Repository navigation
[Deepin-Kernel-SIG] [linux 6.18-y] [Upstream] Update kernel base to 6.18.59 - #2248
Merged
opsiff merged 189 commits intoNov 5, 2026
Merged
Conversation
commit 3db7d7d upstream. ttm_tt_swapout() returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit b2ed01e ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") moved the bulk_move bookkeeping in ttm_bo_swapout_cb() under "if (!ret)", so the ttm_resource_del_bulk_move_unevictable() / ttm_resource_move_to_lru_tail() pair is now skipped on every successful swapout. The equivalent change for the shrinker in commit 1d59f36 ("drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure") tests "lret > 0", which is what was intended here as well. Before b2ed01e the resource was taken off the bulk_move before the swapout; since then a swapped-out resource stays inside its BO's bulk_move range (and on the manager LRU) although it is unevictable. When it is later freed or the BO leaves the bulk_move (ttm_resource_free(), ttm_bo_set_bulk_move() via amdgpu_vm_bo_del()), ttm_resource_del_bulk_move() skips it because of its !ttm_resource_unevictable() guard, so a range endpoint in pos->first / pos->last is left pointing at freed memory. The next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() on that cursor is a use-after-free, seen as the resv WARN in ttm_lru_bulk_move_add(), "list_del corruption" in ttm_resource_move_to_lru_tail() or a NULL dereference in ttm_resource_manager_next() -- minutes to hours after a hibernation, or at process exit / reboot following one. Samuel Ainsworth's analysis of drm/amd issue 5387 (see Link) identified the dangling cursor; the missing removal at swapout time is the reason it dangles. Testing the condition for success restores the removal. On an AMD Phoenix APU (ASUS UM3406GA, gfx1103) running suspend-then-hibernate on a 7.0.y stable kernel carrying the backport (Ubuntu 7.0.0-31) the bug crashed 5 of 18 hibernation cycles; a function profile of one hibernation showed 336 ttm_tt_swapout() calls and zero ttm_resource_del_bulk_move_unevictable() calls. With this change the removal happens for every swapped-out resource and 12 further cycles were clean. Fixes: b2ed01e ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") Cc: stable@vger.kernel.org # v7.1+ Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5387 Link: https://lore.kernel.org/dri-devel/CAHYiNPa6aVacJoLOje-qZ1GyYx-9p0tN4NuP8D_eSL+UJeevXw@mail.gmail.com/ Signed-off-by: Vadim Nikitushkin <bub4z0r@gmail.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Christian König <christian.koenig@amd.com> Link: https://lore.kernel.org/r/20260909205028.13799-1-bub4z0r@gmail.com [ Squashed with commit fcfe647 ("drm/ttm: apply the swapout bulk_move fix to the intended condition"): upstream 3db7d7d was applied to the "if (ret)" after ttm_resource_try_charge() in ttm_bo_alloc_at_place() instead of the "if (!ret)" after ttm_tt_swapout() in ttm_bo_swapout_cb(), and fcfe647 restored the former and changed the latter. 7.2.y has no ttm_resource_try_charge() (dmem cgroup charging is 7.3 material), so neither commit applies on its own; the net effect of the two is the single hunk below, which is the change the changelog describes. ] Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit b48ebe399b4e72baa323462580fdd83ebda561e1) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 75dc198 ] The recent refactoring of xfi driver changed the assignment of atc->daios[] at atc_get_resources(); now it loops over all enum DAIOTYP entries while it looped formerly only a part of them. The problem is that the last entry, SPDIF1, is a special type that is used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO), and there is no corresponding definition for hw20k2. Due to the lack of the info, it caused a kernel crash on hw20k2, which was already worked around by the commit b045ab3 ("ALSA: ctxfi: Fix missing SPDIFI1 index handling"). This patch addresses the root cause of the regression above properly, simply by skipping the incorrect SPDIF1 type in the parser loop. For making the change clearer, the code is slightly arranged, too. Fixes: a2dbaeb ("ALSA: ctxfi: Refactor resource alloc for sparse mappings") Cc: <stable@vger.kernel.org> Link: https://bugzilla.suse.com/show_bug.cgi?id=1259925 Link: https://patch.msgid.link/20260331081227.216134-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 7fca3600e79e9f8bac1ebc10af9ff20a35d6cccb) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c6cd83c ] Rename the SPDIFI1 enum value to SPDIFI_BAY to better reflect its purpose as the S/PDIF input on the internal drive bay, as opposed to the S/PDIF input via Flexijack or optical (SPDIFIO; not SPDIFI-zero). Signed-off-by: Harin Lee <me@harin.net> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260401090159.2404387-2-me@harin.net Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit fb5e2dd6565a9af5b4d5c3f53717d1a2a59cf1db) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 07b116b ] Skip the unused DAIO type per model (SPDIFIO on CTSB073X, SPDIFI_BAY on all others) and use the correct DAIO type directly as da_desc type. This removes the mismatch and misleading between the actual DAIO resource and the da_desc type like SPDIFI_BAY (formerly SPDIFI1). Update related functions accordingly, and drop the unreachable SPDIFI_BAY case from the hw20k2 daio_device_index(). Signed-off-by: Harin Lee <me@harin.net> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260401090159.2404387-3-me@harin.net Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c7bdc88b27cc6be31be5adc22a9c9b4fcdf64c76) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
REJ deliberately bypasses the T1/N2 backoff to trigger an immediate go-back-N retransmit -- that is the whole point of REJ, fast recovery from a single lost or out-of-order frame. But unlike every other recovery path in this same state machine (T1 timeout, state 4 enquiry/DM, state 1/2 SABM retries), the REJ case in ax25_std_state3_machine() never touches n2count, so it has no bound. If something keeps corrupting or reordering every retransmitted burst -- lossy RF, or packet reordering over a UDP-based transport such as axudp -- each attempt draws an immediate fresh REJ and the link retransmits at wire/CPU speed indefinitely, a "machine-gun" storm that never reaches the N2 give-up already relied on everywhere else in this file. Reported independently twice: Chris Maness (KQ6UP) on a plain AX.25 link with no ROSE involved at all, and observed live on a ROSE/FPAC White Pages link (f6bvp-8<->f6bvp-10, same LAN, so plain network reordering over the Internet is not the trigger there -- likely lossy retransmission of the same PDU) reaching ~5900 pkt/s. Both hit the same code path since ax25_std_in.c is shared regardless of what rides on top of AX.25. Count consecutive REJ-driven fast retransmits the same way a T1 timeout already does in this state, and once N2 of them have failed to get an in-sequence frame through, fall back to the paced state 4 enquiry -- which will genuinely disconnect after N2 further tries if the link stays bad, exactly like every other recovery path already does. A single frame accepted in sequence resets the counter, so an isolated REJ during otherwise healthy traffic never gets close to N2. Deployed on three Raspberry Pi nodes (f6bvp-12, f6bvp-8, f6bvp-10) since 2026-09-13, running live production AX.25/ROSE/NET-ROM traffic since, with no recurrence of the machine-gun storm and no other AX.25 regression observed. Signed-off-by: Bernard Pidoux <bernard.f6bvp@gmail.com> (cherry picked from commit a3aa611e37d4345ebcc98c847dedaf4bcf23c7ee) Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 6b450cf6dd4192888625eb0e2d4c4e78a84fa853) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
rose_transmit_link() queues an outgoing frame on rose_neigh->queue instead of sending it immediately whenever the neighbour isn't "restarted" yet (link not up) -- notably the CLEAR_REQUEST built by rose_write_internal() when a socket is released (e.g. its owning process is killed) while the underlying AX.25 link to that neighbour is still coming up. rose_neigh_put() already tears down both timers and drops the ax25/ digipeat references before freeing the neighbour, but never empties this queue. kfree(rose_neigh) only frees the rose_neigh struct itself (the sk_buff_head embedded in it is just three next/prev/len words), not the skbs still linked into it -- every frame still queued here at that point leaks for good. rose_remove_neigh() (rose_route.c) already purges this same queue, but it is only one of about two dozen call sites that can drop the last reference and trigger the real kfree() in rose_neigh_put() -- every socket releasing its own rose->neighbour reference (af_rose.c, rose_in.c, rose_timer.c) can just as well be the one that does. Doing the purge once, centrally, in rose_neigh_put() itself covers all of them regardless of which call site happens to be last, rather than relying on whichever caller happened to remember it. Matches a leak pattern observed and documented back in May 2026 (mailbbs killed -> rose_release() -> rose_write_internal() -> rose_transmit_link() queues the CLEAR_REQUEST -> skb never freed), never root-caused until now. Deployed and running since 2026-09-13/15 on three independent nodes (f6bvp-12, f6bvp-8, f6bvp-10 -- three different kernel bases, 6.12.94/6.18.46/6.18.34), no regression observed. Signed-off-by: Bernard Pidoux <bernard.f6bvp@gmail.com> (cherry picked from commit e59e4523182e4f58f4f29b5e4bce44c1ef152d70) Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit cd3c05651d04b4e1d76112396a88d7c5a9f3bf02) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 8cb5c17 ] Currently, the source clock lookup prefers 32 MHz whenever that rate is available, regardless of the rate configured by the platform. Before the switch to looking up the clock index, the driver used the 32 MHz timing table only if the current source clock rate was 32 MHz, and the 19.2 MHz table otherwise. On X1E80100 CRD, this results in switching the source clock from 19.2 MHz to 32 MHz, which causes intermittent failures when probing the I2C HID keyboard. These range from corrupted HID descriptors to failed resets and transfer timeouts, which also affect the touchpad on the same bus. Restore the original selection policy: use 32 MHz if already selected, otherwise request 19.2 MHz. Look up the index for the selected rate and keep the check that rejects higher-frequency multiples. This retains the dynamic clock index lookup without preferring 32 MHz on platforms that previously used 19.2 MHz. Report the requested rate if the lookup fails. Fixes: cb97bf3 ("i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL") Assisted-by: LLM Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Tested-by: Hasty Heat <hastyheat@gmail.com> Tested-by: Mitchell Augustin <mitchell.augustin@canonical.com> Reviewed-by: Mitchell Augustin <mitchell.augustin@canonical.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://patch.msgid.link/20260928-b4-i2c-qcom-geni-preserve-source-clock-v1-1-9aded7552a76@oss.qualcomm.com Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 96d2abaa2e3284fb5939485e9e0372c5d40bd70d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Commit fa759cd ("kho: allocate metadata directly from the buddy allocator") switched the allocation of preserved memory bitmaps to get_zeroed_page(), but __kho_abort() still releases them with kfree(). kfree() on a buddy page that is not a large kmalloc allocation hits the WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it, so every aborted finalization leaks all bitmap pages. Free the bitmaps with free_page() instead. This is a stable-only patch. Upstream fixed it as a side effect of commit 99cd2ff ("kho: don't unpreserve memory during abort"), which removes the tracking teardown from __kho_abort() altogether. That change builds on commit 36f8f7e ("kho: add interfaces to unpreserve folios, page ranges, and vmalloc") and commit 70f9133 ("kho: drop notifiers"). In 6.18.y, KHO users still preserve memory from the KEXEC_KHO_FINALIZE notifier and have no interface to unpreserve it, so the teardown on abort is the only way their preservations get dropped. Backporting that commit would make preservations outlive every abort, so keep the teardown and fix only the mismatched free. Fixes: fa759cd ("kho: allocate metadata directly from the buddy allocator") Signed-off-by: Federico Parola <fparola@amazon.de> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 07fa8baa78d6480f36b84efea303059183c0df04) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 2f4a0fb ] The error message printed by tegra_acpi_init_apbmisc() when failing to get APBMISC memory resources is missing a trailing newline. This can cause the message to be merged with the following kernel log line, making the log harder to read. Add the missing newline to keep the error output properly formatted. Fixes: 7b0c505 ("soc/tegra: fuse: Add tegra_acpi_init_apbmisc()") Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 0992d03e55e5a9cfb9c5c97696765f51ddb2eb8f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 2fabd2f ] Commit d0bdd8b ("ARM: dts: ti/omap: dra7: fix redundant clock divider definition") removes the clock divider definition from optfclk_pciephy_div, reasoning that the table is redundant, as it contains the values 1 and 2, while also setting ti,max-div to 2 while ti,min-div is implicitly initialized to 1. What that commit missed was the fact that the values in the table are in reverse order, i.e. first 2, then 1. As is clearly described in the documentation, the ordering is signifficant, the actual values for the register setting are derived from the index. If no table is specified, the driver assumes that the register value is divider - 1 (see also `_get_val` in `drivers/clk/ti/divider.c`). What is in fact redundant is the value of ti,max-div that is derived from the table if none is specified. To satisfy device tree semantic linters, it is removed instead. Fixes: d0bdd8b ("ARM: dts: ti/omap: dra7: fix redundant clock divider definition") Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at> Link: https://patch.msgid.link/20260716113947.92513-1-david.oberhollenzer@sigma-star.at Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit ea9c08c33d57ccb52924f9ca1d325fd1d6899385) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 45d4af4 ] struct power_supply_maintenance_charge_table contains charge_safety_timer_minutes, but its kernel-doc describes safety_timer_minutes. This leaves the real member undescribed and adds a nonexistent member to the generated documentation. Use the member's actual name. Fixes: d72ce7d ("power: supply: ab8500: Standardize maintenance charging") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260909064623.90737-1-kmehltretter@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 7de3a5a49410a3a50f6c06e78fdd1b75c62779e0) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a58cbc8 ] ds2780_get_capacity() returns the raw register value instead of 0 on success. The capacity is already stored in *capacity, so the function should return 0 to indicate success. Fixes: 275ac74 ("w1: add Maxim/Dallas DS2780 Stand-Alone Fuel Gauge IC support") Signed-off-by: Xueqin Luo <luoxueqin@kylinos.cn> Link: https://patch.msgid.link/20260901072954.1953121-1-luoxueqin@kylinos.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c3e5854b2e8b6ef64cccb5f37dac6bd8155bd86b) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 32ea0a3 ] There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no CPU left, the allocated cpumask is ignored and the process is retried again. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns out not to contain any CPU in that particular node, that will become an infinite retry loop. This particular problem was reported by sashiko [1]. This should rarely happen, but we still need to guard against this. Fix this infinite loop problem by also skipping NUMA node that has no housekeeping CPU in the inner while loop of init_vp_index(). Also update the early abort check to check for the absence of online housekeeping CPUs instead of just the emptiness of the cpumask. As the outer for loop will only be reached if the housekeeping cpumask has at least one online CPU, a NUMA node with housekeeping CPUs will eventually be found. Link: https://sashiko.dev/#/message/20260422030903.E1BFCC2BCB0%40smtp.kernel.org [1] Fixes: 6640b5d ("Drivers: hv: vmbus: Don't assign VMbus channel interrupts to isolated CPUs") Signed-off-by: Waiman Long <longman@redhat.com> Reviewed-by: Michael Kelley <mhkelley@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 7141331f2d245efc07175802a6bf76badec871ed) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 7b74c11 ] hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM with no paravisor. In the former case, the output page is allocated, but in the latter case it is not, so the hypervisor stores the output VP index in memory that has not been allocated by the guest. Fix this by using the input page for both input and output. The hypercall has very small input and output, so sharing the same page for both is straightforward. An alternative fix is to allocate the per-cpu output page when running in an SEV-SNP CoCo guest, but this uses significantly more memory, particularly with larger vCPUs counts. Fixes: 86c4827 ("x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap()") Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Tianyu Lan <tiala@microsoft.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 2b561786c9076a892ef8b8f416c9828bc87ed44f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit ec31dc3 ] In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a9 ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-hyperv/20260805205806.B5AC31F000E9@smtp.kernel.org/ Fixes: 74347a9 ("x86/Hyper-V: Unload vmbus channel in hv panic callback") Signed-off-by: Michael Kelley <mhklinux@outlook.com> Signed-off-by: Wei Liu <wei.liu@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit f47ce27af80b87cc684d5c12b65506af498ac7e5) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit dcb5df1 ] The default width of the interrupt target field doesn't match the actual register layout. Fix it. Fixes: 0c4cd2c ("pinctrl: qcom: add the tlmm driver for QCS8300 platforms") Assisted-by: LLM Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Link: https://patch.msgid.link/20260917-topic-tlmm_intr_width_fixes-v1-3-3bc1d056aa6b@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 54e54a690bf13e0f0e0aa9ce25a2d9d8311db2b0) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c6c159f ] GPIO13 supports the PWM3 function at mux select value 4, but the pingroup table leaves that slot empty and gpio13 is not listed in pwm3_groups. Selecting pwm3 on gpio13 is therefore rejected by the pinmux core: ipq5018-tlmm: invalid group "gpio13" for function "pwm3" The GL.iNet GL-X2000 drives its fan from PWM3 on this pin, and the vendor firmware muxes it with select value 4: gpio13 : out low func4 8mA no pull Add pwm3 to the fourth function slot of gpio13 and list gpio13 in pwm3_groups. With this the pin muxes as expected: pin 13 (GPIO_13): device 1941010.pwm function pwm3 group gpio13 Fixes: 725d1c8 ("pinctrl: qcom: Add IPQ5018 pinctrl driver") Signed-off-by: Gilberto Conde <gilbertorconde@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20260921093419.2870168-1-gilbertorconde@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit e76e6284de2ba2c0da9aa21ab4e17a885186a4b2) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 767c644 ] When turbostat notices a topology change, it frees perf file descriptors for each CPU to prepare to re-initialize. Fix an off-by-one error in that per-cpu loop that resulted in a file descriptor leak of the file for the highest numbered CPU in the system. Fixes: 67bab43 ("tools/power turbostat: Group SMI counter with APERF and MPERF") Assisted-by: GitHub Copilot (claude-sonnet-4.6) Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit e2c86984ccc0bb7fec6134183a23ed4b7cdb5483) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 5e940dd ] Fix off-by-one error causing last CPU on CWF to never get a pmt counter allocated. Fixes: 5ce1e9b ("tools/power turbostat: Add CPU%c1e BIC for CWF") Assisted-by: GitHub Copilot (claude-sonnet-4.6) Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit b2af180dbc5f59a528e8584bcb629a346c2234fb) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 11741cc ] It is possible to leak a file descriptor if a diretory open succeeds, but the scan fails. Close the fd on error. Also, on cleanup, check for NULL fd. Assisted-by: Claude: Claude Sonnet 4.6 Fixes: 4265a86 ("tools/power turbostat: Add PMT directory iterator helper") Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit f573d257aad5a1ae2c8a3edbf15b02a0e162678a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 154b96d ] We allocate space for added counters ahead of time, and we arbitrarily chose 24 added counters of each type. If a future code flow hits this limit and continues, and then removes counters, we do a phantom increment and lose track of the number of added counters. Increment the count only if there is no error. Fixes: 388e9c8 ("tools/power turbostat: Make extensible via the --add parameter") Assisted-by: Claude: Claude Sonnet 4.6 Signed-off-by: Len Brown <len.brown@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 06e3e6dc2688f6dabc331a405fb1dcb648834219) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…rsion [ Upstream commit 6bca94e ] Temperature IIO channel data is provided in milli-degrees, while POWER_SUPPLY_PROP_TEMP is expected to be in deci-degrees. Adjust the existing logic to reflect this conversion properly. Fixes: 33088c0 ("power: supply: generic-adc-battery: add temperature support") Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Link: https://patch.msgid.link/20260926142905.206215-2-clamor95@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit dda0df37aabd84b1d230fe67b1b90777cf932e30) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…lback runs [ Upstream commit 5b4bd13 ] Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as external_power_changed() triggered by the TCPM stack. If a power supply is unregistered while the callback is still running, the driver data can already be freed when the callback tries to access it, leading to a use-after-free. This happens e.g. when the hardware bus carrying the power supply device malfunctions (e.g. I2C is hogged down by another malfunctioning device) immediately after the power supply is registered, and thus the core is still processing the callbacks which were queued up when the driver starts the removal, leading in some cases to a kernel crash, e.g.: [ 11.645942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000005 [ 11.646751] Mem abort info: [ 11.647006] ESR = 0x0000000096000004 [ 11.647338] EC = 0x25: DABT (current EL), IL = 32 bits [ 11.647806] SET = 0, FnV = 0 [ 11.648077] EA = 0, S1PTW = 0 [ 11.648356] FSC = 0x04: level 0 translation fault [ 11.648785] Data abort info: [ 11.649041] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 11.649524] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 11.649981] GCS = 0, Overlay = 0, DirtyBit = 0 [ 11.650390] [0000000000000005] user address but active_mm is swapper [ 11.650955] Internal error: Oops: 0000000096000004 [#1] SMP [ 11.651460] Modules linked in: [ 11.651742] CPU: 1 UID: 0 PID: 144 Comm: kworker/1:2 Not tainted 7.2.0-rc6-g62a9297af2cd #1 PREEMPT [ 11.652553] Hardware name: Flipper One rev. F0B1C2 (DT) [ 11.653024] Workqueue: events power_supply_changed_work [ 11.653511] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 11.654135] pc : __power_supply_is_supplied_by+0x18/0x100 [ 11.654624] lr : __power_supply_am_i_supplied+0x40/0xb8 [ 11.655098] sp : ffff80008192bb30 [ 11.655399] x29: ffff80008192bb30 x28: 0000000000000000 x27: 0000000000000000 [ 11.656049] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 11.656695] x23: ffff0000c19f4200 x22: ffffdb2232ba4ea8 x21: ffff80008192bc28 [ 11.657344] x20: ffff0000c1eef000 x19: ffff80008192bc18 x18: 00000000a0886e62 [ 11.657991] x17: 000000040044ffff x16: 04500072b5503510 x15: 0000000000000000 [ 11.658639] x14: 0000000000000000 x13: 0000000000000220 x12: 0000000000000000 [ 11.659286] x11: 0000000000000000 x10: ffff0000c1fdb2b0 x9 : ffffdb2232ba5590 [ 11.659934] x8 : 00000000e5b906e6 x7 : ffff0000c2502778 x6 : ffffdb22339793d0 [ 11.660581] x5 : ffff80008192bc18 x4 : ffff0000c19cbca0 x3 : 0000000000000000 [ 11.661228] x2 : ffff0000c1fdaf40 x1 : ffffffffffffffed x0 : ffff0000c1eef000 [ 11.661878] Call trace: [ 11.662103] __power_supply_is_supplied_by+0x18/0x100 (P) [ 11.662596] __power_supply_am_i_supplied+0x40/0xb8 [ 11.663040] psy_for_each_psy_cb+0x20/0x40 [ 11.663416] class_for_each_device+0x110/0x150 [ 11.663825] power_supply_am_i_supplied+0x68/0x100 [ 11.664262] bq257xx_external_power_changed+0x58/0x140 [ 11.664733] __power_supply_changed_work+0x60/0x80 [ 11.665170] psy_for_each_psy_cb+0x20/0x40 [ 11.665545] class_for_each_device+0x110/0x150 [ 11.665953] power_supply_changed_work+0x98/0x1b8 [ 11.666382] process_one_work+0x164/0x4c0 [ 11.666758] worker_thread+0x19c/0x320 [ 11.667104] kthread+0x138/0x150 [ 11.667408] ret_from_fork+0x10/0x20 [ 11.667744] Code: d503233f a9bd7bfd 910003fd a90153f3 (f9400c34) [ 11.668294] ---[ end trace 0000000000000000 ]--- Add a read-write semaphore between external_power_changed() and power_supply_unregister() to prevent the latter from returning (and thus the driver from freeing its data) while the callback is still running. Fixes: bc15405 ("power_supply: Add API for safe access of power supply function attrs") Signed-off-by: Alexey Charkov <alchark@flipper.net> Link: https://patch.msgid.link/20260910-bq257xx-init-v3-1-4e219a1a04a5@flipper.net Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 2ac0256a28e15c4888fa394d1fe66cf7b1d58090) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 709ba1c ] The pingroup table has gcc_plltest at function 5 of gpio12 and does not offer pwm2 on that pin, so the pinmux core rejects a request for pwm2 on gpio12 as an invalid group. On the hardware, function 5 of gpio12 carries the PWM2 output: the Xiaomi AX3000T v2 drives its blue status LED from PWM2 on gpio12. The vendor kernel shipped on that router (Linux 4.4, stock firmware 2.0.28) has pwm2 in this slot. Its pingroup table, as read from the firmware image, lists these functions for gpio12: gpio, blsp0_spi, blsp0_i2c, blsp1_uart0, _, pwm2, qdss_tracedata_a, _, _, _ and has pwm3 at function 4 of gpio13, matching commit c6c159f ("pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13"). Measured on the board: with gpio12 set to each of the 16 function values in turn, and PWM2 held at 0% and then at 100% duty, the pad level read back from GPIO_IN follows PWM2 only at function 5. There it does not follow PWM channels 0, 1 or 3, and the LED switches with PWM2. Functions 4 and 7, which the table leaves empty, do not carry PWM2. Put pwm2 in function 5 of gpio12 and list gpio12 in pwm2_groups. Drop gpio12 from gcc_plltest_groups: none of its functions is gcc_plltest any more, and selecting it would trigger the WARN_ON() in msm_pinmux_set_mux(). Fixes: 725d1c8 ("pinctrl: qcom: Add IPQ5018 pinctrl driver") Assisted-by: LLM Signed-off-by: Adriel Santos <adriel@adriel.eu> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20261002160958.908424-1-adriel@adriel.eu Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 9d0508bcf674348f062887e8360f4f518052109a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c5895ea ] init_pins_table() adds to npins in the driver's static descriptor, so after a probe deferral the count doubles and the next probe fails with "pin 0 already registered". Reset it first. Signed-off-by: Pablo Mazzini <pmazzini@gmail.com> Fixes: f5e2cd3 ("pinctrl: sunxi: allow reading mux values from DT") Reviewed-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 47b725c17dcb249fb7435fccdb5412f4930dbd1d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 3f57b34 ] Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe. vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the infoframe, however, if the video hasn't been enabled, vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes, causing the following splat: [ 201.570266] ------------[ cut here ]------------ [ 201.570293] Packet RAM has to be on to store the packet. [ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606 [...] [ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 201.758499] Call trace: [ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P) [ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4] [ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper] [ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper] [ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4] [ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper] [ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec] [ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core] [ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core] [ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core] [ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm] [ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm] [ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm] [ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm] [ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm] [ 201.846802] __arm64_sys_ioctl+0x88/0xd8 [ 201.850769] invoke_syscall+0x48/0xf4 [ 201.854470] el0_svc_common+0x80/0xd8 [ 201.858171] do_el0_svc+0x1c/0x28 [ 201.861520] el0_svc+0x3c/0xb0 [ 201.864605] el0t_64_sync_handler+0x68/0xdc [ 201.868834] el0t_64_sync+0x198/0x19c [ 201.872536] ---[ end trace 0000000000000000 ]--- Considering that Packet RAM enable is essentially a power management configuration, move its enabling/disabling to the Runtime PM hooks. Note that post_crtc_disable() still stops all infoframes, but keeps Packet RAM enabled, leaving it to be disabled by runtime suspend. Link: raspberrypi/linux#7069 Fixes: b47a72f ("drm/vc4: hdmi: Switch to HDMI connector") Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com> Acked-by: Maxime Ripard <mripard@kernel.org> Link: https://patch.msgid.link/20261002-vc4-hdmi-packet-ram-fix-v1-1-3d73148096c9@igalia.com Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 6b03e354526f6bad60ed3a7f08fec8b7d29d2f27) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit fcbc48d ] The GPIO callbacks take a mutex and issue USB transfers, so this GPIO chip must not be used in atomic context. Change the can_sleep switch in struct gpio_chip to true. Fixes: 611a995 ("gpio: Add Nuvoton NCT6694 GPIO support") Signed-off-by: Ming Yu <a0282524688@gmail.com> Link: https://patch.msgid.link/20261007092102.3768818-2-a0282524688@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit fb5fb74fb4fff8de3a7020117b4f947a16358b0c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 4f6ac74 ] Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect() should reflect what happened up to the point the connection was established or failed. Events that occur afterwards must not affect it. E.g. even if OP_RW has already set sk_err, connect() should still return 0, not ENOBUFS because of it. Adapt the inaccurate comment above signal_pending(). Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=, prev=, next=. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 This fix is supplementary to commit 002541e ("vsock: Ignore signal/timeout on connect() if already established"). Details under Link. Fixes: d021c34 ("VSOCK: Introduce VM Sockets") Reported-by: Hyunwoo Kim <imv4bel@gmail.com> Link: https://lore.kernel.org/netdev/anzT1fREOSyHT99k@v4bel/ Signed-off-by: Michal Luczaj <mhal@rbox.co> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20261005-vsock-connect-reset-closing-v4-1-15d41cfda3ed@rbox.co Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c2c5359ef2c33684fa3f3652fd761a483db8d1e7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…failure [ Upstream commit 98d446b ] rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr_handler() destroy the id the event was delivered on. That id is ic->i_cm_id, and nothing clears the pointer: the connection sits in RDS_CONN_CONNECTING with a freed id until its shutdown calls rdma_disconnect() and rdma_destroy_id() on it. The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect() forces a zero return while ic->i_cm_id == cm_id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one. Fixes: 55b7ed0 ("RDS: Common RDMA transport code") Assisted-by: LLM Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20261003163408.250568-3-achender@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit a7c7d0ff876377fea7ae876a28d6df8d9349df57) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit f6be9f5 ] Commit cfca163 ("ASoC: Intel: avs: Unprepare a stream when XRUN occurs") resets the HDA stream when ->prepare() is called in the XRUN state. User space does not always recover that way. PipeWire's ALSA backend recovers from an underrun with snd_pcm_drop(), snd_pcm_prepare() and a new start, so ->prepare() runs in the SETUP state, hdac_stream->prepared is still set and the reset is skipped. Every recovery attempt then fails the same way: spa.alsa: hw:avsmax98927,1p: snd_pcm_avail after recover: Broken pipe On a Google Pixelbook (Kaby Lake, max98927 speakers) this happens after an occasional underrun during normal playback and silences the speakers for one to four minutes, until the PCM is closed. It can be provoked by stopping PipeWire with SIGSTOP for 0.5 s during playback: in one run that single underrun led to 1297 failed recoveries over two minutes, until the sink was suspended. A plain alsa-lib program that recovers with snd_pcm_drop() and snd_pcm_prepare() hits the same loop, while snd_pcm_prepare() straight from XRUN recovers at once. Skip the reset only when the stream is already PREPARED, the repeated ->prepare() case the check exists for, and reset it otherwise. With this change both kinds of recovery succeed with a single restart. Fixes: cfca163 ("ASoC: Intel: avs: Unprepare a stream when XRUN occurs") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Sergey Tiraspolsky <stiraspo@gmail.com> Acked-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://patch.msgid.link/20261010103753.16969-1-stiraspo@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit d3239b8f4fc46dec5175049cf2ddea43fab23212) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…k on its CPU's local DSQ [ Upstream commit 7a9df76 ] With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of being kept running. Exiting tasks without SCX_OPS_ENQ_EXITING, migration disabled tasks without SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue() and go straight to the local DSQ. This happens in put_prev_task_scx() after the pick has settled on idle, so nothing reschedules the CPU, which idles with the task queued until an unrelated wakeup lands on it or the watchdog fires. scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for over 40 seconds. A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST enqueue left the task on this CPU's local DSQ, set need_resched on the task being switched in, as proxy_resched_idle() does. resched_curr() would flag the task being put instead, and __schedule() clears that right after the pick. Fixes: f0e1a06 ("sched_ext: Implement BPF extensible scheduler class") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Xiangyu Bu <xbu@meta.com> Link: sched-ext/scx#3870 Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Dan Schatzberg <schatzberg.dan@gmail.com> [ sashal: adjusted context for do_enqueue_task() in the existing sched_ext file layout. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8d891c218016b6145993e082e7f732cb69dd0e29) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 5906d0e ] FSCTL_DUPLICATE_EXTENTS_TO_FILE changes the target file extents on the server, but the client does not refresh the target AllocationSize/i_blocks. Callers can observe or use the wrong st_blocks value immediately after the clone, before a later attribute revalidation corrects it. For example, create a reflinked file with a leading hole: xfs_io -f -c "pwrite -S 0x61 0 64k" src touch dst chmod 600 dst xfs_io -c "reflink src 0 1m 64k" dst mkswap dst swapon dst The file still has a hole after mkswap: /mnt/scratch/dst: [0..7]: allocated [8..2047]: hole [2048..2175]: allocated The server also reports only the allocated ranges: server dst size=1114112 blocks=144 but the client reported EOF-derived blocks: client dst size=1114112 blocks=2176 and swapon succeeded: swapon_result=success /mnt/scratch/dst 1.1M 0B -1 So EOF-derived i_blocks can let a sparse reflinked file pass the CIFS swapfile hole check. Fix this by querying FILE_ALL_INFORMATION on the target handle after a successful duplicate extents request. Update i_blocks from AllocationSize and keep the refreshed target inode attributes valid so a following stat does not immediately revalidate again. If the query fails, mark the cached inode attributes stale so a later getattr can refresh them. This also fixes the xfstests generic/370 regression introduced by the i_blocks accounting change, as tested on a Samba "vfs objects = btrfs" share. Fixes: 99cd0a6 ("smb/client: do not account EOF extension as allocation") Signed-off-by: Huiwen He <hehuiwen@kylinos.cn> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Steve French <stfrench@microsoft.com> Stable-dep-of: 53676a5 ("cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 242c7b3a71ddf25bbb65c5231becaa57333af464) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 53676a5 ] smb2_duplicate_extents() has no handling for FSCTL_DUPLICATE_EXTENTS_TO_FILE failure: when the FSCTL fails, local inode metadata may be stale from the pre-extension or from concurrent remote writes, but is never refreshed. Force revalidation on FSCTL failure and use i_size_read() for the pre-extension check. Fixes: cfc63fc ("smb3: fix cached file size problems in duplicate extents (reflink)") Cc: stable@vger.kernel.org Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit de477667b890b1feb614391c6c50d51a9c0ac9c8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 0d67793 ] Move io_match_task_safe() and helpers into cancel.c, where it belongs. Signed-off-by: Jens Axboe <axboe@kernel.dk> Stable-dep-of: fddcf4c ("io_uring/cancel: don't spin on local work the task can't run") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 755e88e78beaf2229692152c9cc11a4223e94690) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 01e019b ] Yet another function that should be in cancel.c, move it over. Signed-off-by: Jens Axboe <axboe@kernel.dk> Stable-dep-of: fddcf4c ("io_uring/cancel: don't spin on local work the task can't run") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 76cb14d6f143302321e9264ffeaa8f7df8862e08) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit ffce324 ] There's a bunch of code strictly dealing with cancelations, and that code really belongs in cancel.c rather than in the core io_uring.c file. Move the code there. Mostly mechanical, only real oddity here is that struct io_defer_entry now needs to be visible across both io_uring.c and cancel.c. Signed-off-by: Jens Axboe <axboe@kernel.dk> Stable-dep-of: fddcf4c ("io_uring/cancel: don't spin on local work the task can't run") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7123c79206e4932cb7bad0e35e716a82f403f6ea) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit fddcf4c ] io_uring_cancel_generic() refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next io_uring_try_cancel_requests() pass will run the work. This does not hold for a ring that was still IORING_SETUP_R_DISABLED when the task got its tctx node from io_uring_create() or io_ringfd_register(). The submitter is set later by IORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the submitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To the exiting task the work stays pending forever, the loop never reaches schedule(), and the task trips the WARN_ON_ONCE() once and then spins in do_exit(). An unprivileged user can set this up at will by creating a disabled ring, having a child enable it and stop, posting to the ring with IORING_OP_MSG_RING and exiting with a request in flight that only the child can complete. The exiting thread burns a CPU until the child runs or dies, and with panic_on_warn set the WARN panics the kernel. Fix by skipping the sleep only when io_allowed_defer_tw_run() allows the task to run the work. This is reasonable since work it cannot run cannot complete any of its requests either, so nothing is lost by sleeping. Drop the WARN_ON_ONCE() since handing a disabled ring to another thread is a supported scenario, not a bug state. Fixes: 360cd42 ("io_uring: optimise io_req_local_work_add") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@linux.microsoft.com> Link: https://patch.msgid.link/20261008191602.45101-1-cenzhang@linux.microsoft.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 94d13387b96e50a4288f7bbdfe401189246a11a1) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 3180ee7 ] Add is_percpu_pool() and test the pool directly for per cpu. Convert the other open-coded pool->cpu checks -- in put_unbound_pool(), pool_allowed_cpus() and the workqueue watchdog -- to the same helper. No functional change. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Tejun Heo <tj@kernel.org> Use a single-evaluation macro for the pool predicate. Keep the existing watchdog timestamp and reporting behavior, converting only its pool-type test; the newer stall-duration accounting is absent. Stable-dep-of: cf9c8aa ("workqueue: Fix unbound pool lifetime for pending pwqs") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 299912bbc6455117b5ab252ac53cceb1866d7d9c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit cf9c8aa ] KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318 CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450 Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610 Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790 Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock. Remove the pwq from pending_pwqs before putting the pool. Fixes: 5797b1c ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues") Cc: stable@vger.kernel.org Signed-off-by: Yao Kai <yaokai34@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f320b85c90fe5fc9d4d06badd450518323a94a7f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a6ae12a ] Associate reply packets with the sending socket. When vsock must reply with an RST packet and there exists a sending socket (e.g., for loopback), setting the skb owner to the socket correctly handles reference counting between the skb and sk (i.e., the sk stays alive until the skb is freed). This allows the net namespace to be used for socket lookups for the duration of the reply skb's lifetime, preventing race conditions between the namespace lifecycle and vsock socket search using the namespace pointer. Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260121-vsock-vmtest-v16-2-2859a7512097@meta.com Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Stable-dep-of: dee44f4 ("vsock/virtio: validate packet source for connected sockets") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 569c34a35fbc9552772aa496bc9b7f36fa4f1d7f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit dee44f4 ] virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path. Fixes: 06a8fc7 ("VSOCK: Introduce virtio_vsock_common.ko") Closes: https://lore.kernel.org/netdev/20260813121236.2328599-1-4ncienth@gmail.com/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> Link: https://patch.msgid.link/20260826003929.966160-2-4ncienth@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ sashal: Adjusted context for existing vsock APIs without network-namespace support. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6cd829de69efd9ed3a53aa2421004a0396eb2bd7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 4c3499f ] Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket. Commit 6457378 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()") and commit 67d6d68 ("ipv4: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe. Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device. Note that this does not allow attackers to create FNHEs that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMP error that quotes an ICMP Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ipv4_sk_update_pmtu() / ipv4_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the FNHE cache of the nexthop resolved by the no socket helpers and another in the FNHE cache of the nexthop used by the socket. Fixes: 4895c77 ("ipv4: Add FIB nexthop exceptions.") Cc: stable@vger.kernel.org Reported-by: Amit Klein <aksecurity@gmail.com> Reported-by: Noam Caspi <noam.caspi@mail.huji.ac.il> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260828192344.2596928-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ sashal: inlined udp_err_update_exception() logic into the existing udp_err() wrapper to accommodate the separate __udp4_lib_err() handler. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ecd7ead4bf05e221e90f18a29aec570a50fd1592) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit ad9a7da ] vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer. Fixes: d021c34 ("VSOCK: Introduce VM Sockets") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella <sgarzare@redhat.com> Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> Reviewed-by: Vishnu Dasa <vishnu.dasa@broadcom.com> Link: https://patch.msgid.link/20260826003929.966160-3-4ncienth@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [ sashal: Replaced two calls to the unavailable vsock_check_source() helper with equivalent inline conditions. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c027f8b429dbb2157fc1b503df196e272d947c89) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a8603b5 ] cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache(). Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to: - buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), - read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), - writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock). Fixes: 110fee6 ("smb: client: fix missing timestamp updates with O_TRUNC") Signed-off-by: Paulo Alcantara <pc@manguebit.org> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org [ sashal: Replaced netfs_wb_begin()/netfs_wb_end() with direct wb_lock mutex operations. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 4d143608a0445443a85c9b29f4c9f8e63d5dbfc9) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 9e314a3 upstream. The commit 5384467 ("iavf: kill 'legacy-rx' for good") removed the legacy Rx path in the iavf driver. This change applies the same rationale to the ice driver. The legacy Rx path relied on manual skb allocation and header copying, which has become increasingly inefficient and difficult to maintain. With the stabilization of build_skb() and the growing adoption of features like XDP, page_pool, and multi-buffer support, the legacy approach is no longer viable. Key drawbacks of the legacy path included: - Higher memory pressure due to direct page allocations and splitting; - Redundant memcpy() operations for packet headers; - CPU overhead from eth_get_headlen() and Flow Dissector usage; - Compatibility issues with XDP, which imposes strict headroom and tailroom requirements. The ice driver, like iavf, does not benefit from the minimal headroom savings that legacy Rx once offered, as it already splits pages into fixed halves. Removing this path simplifies the Rx logic, eliminates unnecessary branches in the hotpath, and prepares the driver for upcoming enhancements. In addition to removing the legacy Rx path, this change also eliminates the custom construct_skb() functions from both the standard and zero-copy (ZC) Rx paths. These are replaced with the build_skb() and standardized xdp_build_skb_from_zc() helpers, aligning the driver with the modern XDP infrastructure and reducing code duplication. This cleanup also reduces code complexity and improves maintainability as we move toward a more unified and modern Rx model across drivers. Co-developed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit c8bd04221f6a82780104f4c9fa820a0179b1c3ad) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 3a4f419 upstream. As part of the transition toward Page Pool integration, remove the legacy page splitting and recycling logic from the ice driver. This mirrors the approach taken in commit 920d86f ("iavf: drop page splitting and recycling"). The previous model attempted to reuse partially consumed pages by splitting them and tracking their usage across descriptors. While this was once a memory optimization, it introduced significant complexity and overhead in the Rx path, including: - Manual refcount management and page reuse heuristics; - Per-descriptor buffer shuffling, which could involve moving dozens of `ice_rx_buf` structures per NAPI cycle; - Increased branching and cache pressure in the hotpath. This change simplifies the Rx logic by always allocating fresh pages and letting the networking stack handle their lifecycle. Although this may temporarily reduce performance (up to ~98% in some XDP cases), it greatly improves maintainability and paves the way for Page Pool, which will restore and exceed previous performance levels. The `ice_rx_buf` array is retained for now to minimize diffstat and ease future replacement with a shared buffer abstraction. Co-developed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 0026267561bc64290390cb2753f28b2fd6bf5f12) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 93f53db upstream. This patch completes the transition of the ice driver to use the Page Pool and libeth APIs, following the same direction as commit 5fa4caf ("iavf: switch to Page Pool"). With the legacy page splitting and recycling logic already removed, the driver is now in a clean state to adopt the modern memory model. The Page Pool integration simplifies buffer management by offloading DMA mapping and recycling to the core infrastructure. This eliminates the need for driver-specific handling of headroom, buffer sizing, and page order. The libeth helper is used for CPU-side processing, while DMA-for-device is handled by the Page Pool core. Additionally, this patch extends the conversion to cover XDP support. The driver now uses libeth_xdp helpers for Rx buffer processing, and optimizes XDP_TX by skipping per-frame DMA mapping. Instead, all buffers are mapped as bi-directional up front, leveraging Page Pool's lifecycle management. This significantly reduces overhead in virtualized environments. Performance observations: - In typical scenarios (netperf, XDP_PASS, XDP_DROP), performance remains on par with the previous implementation. - In XDP_TX mode: * With IOMMU enabled, performance improves dramatically - over 5x increase - due to reduced DMA mapping overhead and better memory reuse. * With IOMMU disabled, performance remains comparable to the previous implementation, with no significant changes observed. - In XDP_DROP mode: * For small MTUs, (where multiple buffers can be allocated on a single memory page), a performance drop of approximately 20% is observed. According to 'perf top' analysis, the bottleneck is caused by atomic reference counter increments in the Page Pool. * For normal MTUs, (where only one buffer can be allocated within a single memory page), performance remains comparable to baseline levels. This change is also a step toward a more modular and unified XDP implementation across Intel Ethernet drivers, aligning with ongoing efforts to consolidate and streamline feature support. Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Suggested-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Michal Kubiak <michal.kubiak@intel.com> Tested-by: Alexander Nowlin <alexander.nowlin@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit f4a25618c36835d073caef2745e6bf02ad2723ca) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 436fa8e upstream. Since the tagged commit, ice stopped respecting Rx buffer length passed from VFs. At that point, the buffer length was hardcoded in ice, so VFs still worked up to some point (until, for example, a VF wanted an MTU larger than its PF). The next commit 93f53db ("ice: switch to Page Pool"), broke Rx on VFs completely since ice started accounting per-queue buffer lengths again, but now VF queues always had their length zeroed, as ice was already ignoring what iavf was passing to it. Restore the line that initializes the buffer length on VF queues basing on the virtchnl messages. Fixes: 3a4f419 ("ice: drop page splitting and recycling") Reported-by: Jakub Slepecki <jakub.slepecki@intel.com> Reviewed-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Jakub Slepecki <jakub.slepecki@intel.com> Link: https://patch.msgid.link/20251124170735.3077425-1-aleksander.lobakin@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 9f158a9b10e1e960eaf3da992b64e43a3487d238) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit a9c354e upstream. Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1100f1067 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice] Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 <89> 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44 RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000 RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019 R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000 FS: 00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0 PKRU: 55555554 Call Trace: <TASK> ice_vsi_cfg_rxq+0xca/0x460 [ice] ice_vsi_cfg_rxqs+0x54/0x70 [ice] ice_loopback_test+0xa9/0x520 [ice] ice_self_test+0x1b9/0x280 [ice] ethtool_self_test+0xe5/0x200 __dev_ethtool+0x1106/0x1a90 dev_ethtool+0xbe/0x1a0 dev_ioctl+0x258/0x4c0 sock_do_ioctl+0xe3/0x130 __x64_sys_ioctl+0xb9/0x100 do_syscall_64+0x7c/0x700 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] It crashes because we have not initialized libeth for the rx ring. Fix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and letting them have a q_vector. It's just a dummy, because the loopback test does not use interrupts, but it contains a napi struct that can be passed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() -> ice_rxq_pp_create(). Fixes: 93f53db ("ice: switch to Page Pool") Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a4c584ea79d958ea1cadc9ce056f6df58a363342) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 3581f84 upstream. cifs_do_truncate() flushes the pagecache with filemap_write_and_wait() before resetting the file size to zero, but that does not wait for direct/async I/O that was already in flight, which can complete after the truncate and reinstate stale data past the new EOF. Drain outstanding netfs I/O with netfs_wait_for_outstanding_io() before resizing the file. Reported-by: Frank Sorenson <sorenson@redhat.com> Fixes: a8603b5 ("smb: client: fix data corruption with concurrent writes and O_TRUNC") Reviewed-by: David Howells <dhowells@redhat.com> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Matthew Wilcox <willy@infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 9a5d65b06dc338ed2f68f9096e8d630d4669b34c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20261023163714.201276352@linuxfoundation.org Tested-by: Wentao Guan <guanwentao@uniontech.com> Tested-by: Pavel Machek (CIP) <pavel@nabladev.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Barry K. Nathan <barryn@pobox.com> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Tested-by: SJ Park <sj@kernel.org> Tested-by: Ron Economos <re@w6rz.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1253a6aa5d104312bf0992afacc15220ae35bdf9) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
|
Sorry @opsiff, your pull request is larger than the review limit of 150,000 diff characters |
deepin-ci-robot
requested review from
Ink-Paper,
hello666888999 and
winnscode
November 5, 2026 02:18
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
🟡 Changes recommended
Maple initialization introduces an IRQ-unsafe lock-state mismatch, while AX.25 counts acknowledged recoveries as consecutive failures and can prematurely force timer recovery.
2 open issues
What changed in this PR
Updates Deepin’s Linux 6.18-y kernel base from 6.18.58 to 6.18.59, incorporating upstream changes across core kernel facilities, networking, filesystems, drivers, and tools.
Changes:
- Updates synchronization, resource lifetimes, memory accounting, and tracing.
- Adjusts packet validation, IPv6 payload handling, and filesystem operations.
- Updates hardware drivers, build rules, and the conntrack Netlink specification.
This pull request requires changes. Two unresolved findings block approval:
- Critical (3 votes) —
drivers/base/regmap/regcache.c:218: Maple default insertion remains in initialization without the outer regmap lock, creating inconsistent IRQ lock-state usage. Move insertion into a locked Maple populate callback. - Moderate (3 votes) —
net/ax25/ax25_std_in.c:230: Successful acknowledgments do not reset fast-retransmit accounting, so isolated losses accumulate and force timer recovery despite forward progress. Reset the count when acknowledgments advance.
| File | Description |
|---|---|
tools/power/x86/turbostat/turbostat.c |
Adjusts directory cleanup, CPU iteration, and counter limits. |
tools/gpio/Makefile |
Updates source-tree detection for external builds. |
tools/bootconfig/main.c |
Adds an explicit static assertion message. |
sound/soc/stm/stm32_spdifrx.c |
Corrects receiver synchronization-state comparison. |
sound/soc/sof/ipc4-topology.c |
Handles fewer channels than aggregated ALH devices. |
sound/soc/intel/avs/pcm.c |
Resets stream preparation outside the prepared state. |
sound/soc/codecs/wm8978.c |
Corrects oversampling control bit positions. |
sound/soc/codecs/pcm3168a.c |
Corrects zero-flag polarity control selection. |
sound/soc/codecs/nau8822.c |
Corrects oversampling control bit positions. |
sound/soc/codecs/max98371.c |
Corrects the minimum-volume field offset. |
sound/soc/codecs/cs42l56.c |
Corrects limiter cushion register selection. |
sound/soc/codecs/cs42l52.c |
Corrects the noise-gate type field position. |
sound/soc/amd/yc/pci-acp6x.c |
Separates runtime resume and disables unexpected MSI after system resume. |
sound/pci/ctxfi/ctdaio.h |
Renames the drive-bay S/PDIF input identifier. |
sound/pci/ctxfi/ctdaio.c |
Updates model-specific S/PDIF resource mappings. |
sound/pci/ctxfi/ctatc.c |
Selects and allocates model-specific S/PDIF inputs. |
samples/pidfd/Makefile |
Corrects the userspace-program build variable. |
net/vmw_vsock/vmci_transport.c |
Validates packet transport and peer identity under locking. |
net/vmw_vsock/virtio_transport_common.c |
Validates sources and retains reset-reply socket ownership. |
net/vmw_vsock/af_vsock.c |
Adds source validation and adjusts connection completion. |
net/tipc/node.c |
Protects link-reset tracing with the node lock. |
net/sctp/socket.c |
Revalidates stream state after blocking operations. |
net/sctp/inqueue.c |
Rejects undersized SCTP chunks. |
net/sched/sch_cake.c |
Uses the IPv6 payload-length helper in ACK filtering. |
net/sched/cls_flower.c |
Validates nested encapsulation mask attributes. |
net/sched/act_api.c |
Serializes action reference and binding-count updates. |
net/rds/rdma_transport.c |
Rejects unsupported devices and preserves CM ID ownership on failure. |
net/netlink/af_netlink.c |
Uses namespace cookies and initializes packet header offsets. |
net/netfilter/nft_byteorder.c |
Restricts conversions to single values and updates register access. |
net/netfilter/nf_log_syslog.c |
Accounts for large IPv6 payloads in logging. |
net/netfilter/nf_conntrack_ovs.c |
Preserves large IPv6 payload lengths during trimming. |
net/netfilter/ipvs/ip_vs_xmit.c |
Accounts for large IPv6 payloads in tunneling. |
net/mac802154/scan.c |
Synchronizes association results and rejects duplicate responses. |
net/mac802154/main.c |
Initializes association synchronization. |
net/mac802154/ieee802154_i.h |
Adds protected association state. |
net/iucv/af_iucv.c |
Atomically claims receive credits and moves control transmission outside locking. |
net/ipv6/output_core.c |
Centralizes IPv6 payload-length assignment. |
net/ipv6/ip6_offload.c |
Centralizes GRO payload-length assignment. |
net/ipv6/ip6_input.c |
Uses GSO-aware payload lengths during receive validation. |
net/ipv6/calipso.c |
Recalculates payload length after option insertion. |
net/ipv4/udp.c |
Processes ICMP PMTU updates and redirects. |
net/ipv4/tcp.c |
Protects congestion-control queries with RCU. |
net/ipv4/tcp_output.c |
Publishes congestion-control changes with WRITE_ONCE. |
net/ipv4/tcp_minisocks.c |
Publishes child congestion-control selection with WRITE_ONCE. |
net/ipv4/tcp_dctcp.c |
Annotates concurrent congestion-control accesses. |
net/ipv4/tcp_cong.c |
Annotates congestion-control pointer updates. |
net/ipv4/fib_semantics.c |
Handles nexthop rebalancing with zero total weight. |
net/core/sock.c |
Clears inherited PSP association ownership during cloning. |
net/core/page_pool.c |
Aligns allocated fragments for shared skb metadata. |
net/bridge/netfilter/nf_conntrack_bridge.c |
Uses large-payload-aware IPv6 validation and trimming lengths. |
net/bridge/br_netfilter_ipv6.c |
Validates large IPv6 payload lengths. |
net/bridge/br_multicast.c |
Preserves teardown traversal across indirectly deleted groups. |
net/ax25/ax25_std_in.c |
Adds REJ-driven retransmission accounting; reset behavior requires correction. |
Makefile |
Bumps the kernel sublevel to 59. |
lib/crypto/poly1305.c |
Explicitly erases finalized authentication state. |
lib/crypto/arm64/poly1305-armv8.pl |
Preserves carry into the upper accumulator limb. |
kernel/workqueue.c |
Adjusts pool cleanup, lock annotations, and softirq handling. |
kernel/watch_queue.c |
Publishes notification storage with release/acquire ordering. |
kernel/trace/trace.c |
Adjusts reference cleanup, snapshot errors, and initialization guards. |
kernel/trace/trace_probe.c |
Returns an error for unsupported BTF argument expansion. |
kernel/trace/trace_events_hist.c |
Corrects histogram timestamps, stacktrace typing, and alias handling. |
kernel/trace/trace_events_filter.c |
Tightens parser stack and predicate bounds. |
kernel/trace/ring_buffer.c |
Adjusts metadata validation, indexing, and reader advancement. |
kernel/sched/ext.c |
Requests rescheduling for locally requeued final tasks. |
kernel/sched/ext_internal.h |
Clarifies final-task enqueue behavior. |
kernel/sched/ext_idle.c |
Validates idle-CPU selection for restricted tasks. |
kernel/printk/printk.c |
Delays printk thread readiness initialization. |
kernel/pid_namespace.c |
Makes namespace teardown waits freezer-aware. |
kernel/kexec_handover.c |
Uses the matching page deallocation API. |
kernel/futex/core.c |
Uses unique MM identities for shared anonymous futex keys. |
kernel/exit.c |
Makes child-exit waits freezer-aware. |
kernel/events/core.c |
Updates cgroup timing, perf memory accounting, and PMU migration. |
kernel/cgroup/cgroup.c |
Captures kill sequences from the correct fork destination. |
io_uring/sqpoll.c |
Includes cancellation declarations. |
io_uring/io_uring.h |
Updates shared structures and internal declarations. |
io_uring/cancel.h |
Consolidates cancellation-related declarations. |
include/net/rose.h |
Purges queued frames before freeing neighbors. |
include/net/netfilter/nf_tables_ipv6.h |
Uses large-payload-aware IPv6 validation. |
include/net/ipv6.h |
Removes the relocated payload-length constant. |
include/net/af_vsock.h |
Declares packet-source validation. |
include/linux/unicode.h |
Adds deferred-reclamation state to Unicode maps. |
include/linux/sched/user.h |
Separates perf buffer accounting from pinned-memory accounting. |
include/linux/power_supply.h |
Adds callback teardown synchronization and corrects field documentation. |
include/linux/mm_types.h |
Adds unique futex identity storage to memory contexts. |
include/linux/maple_tree.h |
Adds IRQ-preserving state-lock helpers. |
include/linux/ipv6.h |
Adds large-payload-aware length helpers. |
include/linux/futex.h |
Updates shared-key identities and MM initialization declarations. |
include/linux/fsnotify_backend.h |
Adds connector destruction state. |
include/linux/cgroup-defs.h |
Documents kill-sequence locking requirements. |
include/linux/bsg-lib.h |
Adds configurable reply-buffer sizing to queue setup. |
include/drm/drm_exec.h |
Clarifies locked-object iteration and reformats macros. |
fs/xfs/xfs_iops.c |
Uses namespace-aware capability checks. |
fs/xfs/xfs_iomap.c |
Preserves combined write-mapping flags. |
fs/xfs/xfs_ioctl.c |
Uses namespace-aware capability checks. |
fs/xfs/xfs_fsmap.c |
Uses namespace-aware administrative capability checks. |
fs/xfs/xfs_aops.c |
Preserves combined write-mapping flags. |
fs/xfs/libxfs/xfs_sb.c |
Reacquires superblock buffers before synchronous writes. |
fs/xfs/libxfs/xfs_rtgroup.h |
Provides a typed realtime-superblock logging stub. |
fs/unicode/utf8-core.c |
Defers Unicode map and table-reference release through RCU. |
fs/tracefs/event_inode.c |
Waits for SRCU and RCU readers before reclamation. |
fs/smb/server/smb2pdu.c |
Initializes filesystem information response fields. |
fs/smb/client/smb2ops.c |
Refreshes target inode attributes after extent cloning. |
fs/smb/client/file.c |
Serializes truncation against cached and outstanding I/O. |
fs/smb/client/connect.c |
Preserves Kerberos usernames in constructed contexts. |
fs/smb/client/cifssmb.c |
Bounds POSIX ACL serialization by buffer capacity. |
fs/smb/client/cifsfs.c |
Coordinates clone attribute invalidation with refreshed metadata. |
fs/pipe.c |
Limits asynchronous-notification rollback to newly added readers. |
fs/ocfs2/dlm/dlmrecovery.c |
Exposes the recovery-state lock internally. |
fs/ocfs2/dlm/dlmdebug.c |
Protects recovery-state traversal with its designated lock. |
fs/ocfs2/dlm/dlmcommon.h |
Declares the shared recovery-state lock. |
fs/ntfs3/super.c |
Defers superblock reclamation and preserves mount-option ownership. |
fs/ntfs3/ntfs_fs.h |
Adds RCU reclamation state to superblock information. |
fs/notify/mark.c |
Blocks new marks while destroying connectors. |
fs/namei.c |
Uses the negative-dentry predicate during open lookup. |
fs/ext4/super.c |
Defers superblock and statistics reclamation. |
fs/ext4/extents_status.h |
Declares separate statistics destruction. |
fs/ext4/extents_status.c |
Separates shrinker removal from statistics cleanup. |
fs/ext4/ext4.h |
Adds superblock RCU reclamation state. |
fs/autofs/waitq.c |
Scopes daemon-failure handling to the relevant pipe. |
fs/afs/super.c |
Defers superblock information reclamation. |
fs/afs/internal.h |
Adds superblock RCU reclamation state. |
drivers/ufs/core/ufs_bsg.c |
Allocates replies large enough for RPMB operations. |
drivers/target/iscsi/iscsi_target_configfs.c |
Holds the discovery TPG while updating authentication. |
drivers/spi/spi-tegra114.c |
Reasserts GPIO chip select between transfers. |
drivers/soc/tegra/fuse/tegra-apbmisc.c |
Adds a newline to the resource error message. |
drivers/scsi/xen-scsifront.c |
Rejects responses referencing absent shadow requests. |
drivers/scsi/st.c |
Corrects partition-position tracking and removal ordering. |
drivers/scsi/scsi_transport_sas.c |
Supplies SAS BSG reply-buffer sizes. |
drivers/scsi/scsi_transport_iscsi.c |
Supplies the iSCSI BSG reply-buffer size. |
drivers/scsi/scsi_transport_fc.c |
Supplies Fibre Channel BSG reply-buffer sizes. |
drivers/scsi/mpi3mr/mpi3mr_app.c |
Supplies the controller BSG reply-buffer size. |
drivers/scsi/libsas/sas_expander.c |
Adjusts runtime-PM handling around SMP operations. |
drivers/scsi/libiscsi.c |
Validates task identifiers and rejects inappropriate task states. |
drivers/s390/net/ctcm_mpc.c |
Updates XID validation-state handling. |
drivers/power/supply/power_supply_core.c |
Synchronizes external-power callbacks with unregister. |
drivers/power/supply/generic-adc-battery.c |
Corrects temperature conversion and error handling. |
drivers/power/supply/ds2780_battery.c |
Returns success independently of capacity values. |
drivers/pinctrl/sunxi/pinctrl-sunxi-dt.c |
Resets pin counts before table construction. |
drivers/pinctrl/qcom/pinctrl-qcs8300.c |
Specifies interrupt-target field width. |
drivers/pinctrl/qcom/pinctrl-ipq5018.c |
Corrects PWM and test-clock pin mappings. |
drivers/pinctrl/pinctrl-amd.c |
Preserves firmware-managed S4 wake sources. |
drivers/pci/pci.c |
Refines post-reset readiness checks, including virtual functions. |
drivers/net/wireless/intersil/p54/fwio.c |
Validates firmware record sizes and receive ranges. |
drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c |
Corrects meter offsets and reformat-pool selection. |
drivers/net/ethernet/intel/Kconfig |
Selects the libeth XDP dependency for ICE. |
drivers/net/ethernet/intel/ice/virt/queues.c |
Stores maximum frame size on the VSI. |
drivers/net/ethernet/intel/ice/ice.h |
Adds VSI frame-size state and removes legacy-RX configuration. |
drivers/net/ethernet/intel/ice/ice_xsk.h |
Updates receive-buffer reallocation declarations. |
drivers/net/ethernet/intel/ice/ice_txrx_lib.h |
Removes the obsolete XDP metadata helper. |
drivers/net/ethernet/intel/ice/ice_main.c |
Integrates libeth namespaces and removes legacy receive handling. |
drivers/net/ethernet/intel/ice/ice_lib.c |
Allocates loopback queue vectors and updates ring setup. |
drivers/net/ethernet/intel/ice/ice_ethtool.c |
Adapts diagnostics and ring resizing to libeth receive buffers. |
drivers/net/ethernet/broadcom/genet/bcmgenet.c |
Unshares transmitted socket buffers before modifying control state. |
drivers/md/dm-integrity.c |
Corrects discard workspace sizing and requires stable writes. |
drivers/md/dm-ebs-target.c |
Removes an invalid device-offset restriction. |
drivers/md/dm-crypt.c |
Reads completion status after pending operations finish. |
drivers/md/dm-cache-target.c |
Reworks background-work locking and demotion accounting. |
drivers/i2c/busses/i2c-viai2c-wmt.c |
Manages clock references through device resources. |
drivers/i2c/busses/i2c-qcom-geni.c |
Adjusts source-clock selection and exact-rate validation. |
drivers/i2c/busses/i2c-qcom-cci.c |
Combines simultaneous controller reset requests. |
drivers/hv/vmbus_drv.c |
Preserves connection state until disconnect processing. |
drivers/hv/connection.c |
Leaves connection-state transitions to disconnect handling. |
drivers/hv/channel_mgmt.c |
Restricts channel placement to eligible housekeeping nodes. |
drivers/gpu/drm/xe/xe_vm.h |
Declares submission LRU maintenance. |
drivers/gpu/drm/xe/xe_vm.c |
Updates private and external buffer-object LRUs. |
drivers/gpu/drm/xe/xe_oa.c |
Zeroes userspace-mappable observation buffers. |
drivers/gpu/drm/xe/xe_exec.c |
Applies shared LRU maintenance during submission. |
drivers/gpu/drm/xe/xe_bo.c |
Handles eviction requests without an allocated resource. |
drivers/gpu/drm/vc4/vc4_hdmi.c |
Ties packet-RAM enablement to runtime power management. |
drivers/gpu/drm/ttm/ttm_bo.c |
Recognizes successful swapout return values. |
drivers/gpu/drm/panthor/panthor_hw.c |
Corrects the Immortalis core-count boundary. |
drivers/gpu/drm/i915/display/intel_dmc.c |
Validates firmware sizes, counts, and load addresses. |
drivers/gpu/drm/i915/display/intel_dmc_regs.h |
Defines valid DMC program-address ranges. |
drivers/gpu/drm/i915/display/intel_cx0_phy.c |
Corrects Arrow Lake host-bridge detection and reference handling. |
drivers/gpu/drm/drm_exec.c |
Corrects prelocked-object ownership and cleanup. |
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c |
Adds zero-RPM fan stop-temperature controls. |
drivers/gpu/drm/amd/amdgpu/vce_v3_0.c |
Corrects VM ring alignment requirements. |
drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c |
Adds hang-workaround packets and updates frame sizing. |
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c |
Preserves shared eviction fences and reports byte alignment. |
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c |
Simplifies register-data copying and access cleanup. |
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c |
Releases user-page tracking on submission failures. |
drivers/gpio/gpiolib.c |
Frees temporary bitmaps before returning write errors. |
drivers/gpio/gpio-nct6694.c |
Marks GPIO operations as potentially sleeping. |
drivers/gpio/gpio-mxc.c |
Uses atomic bit operations and reorders IRQ/GPIO registration. |
drivers/base/regmap/regcache.c |
Separates initialization and locked population; Maple integration requires correction. |
drivers/base/regmap/regcache-maple.c |
Preserves IRQ state during Maple cache teardown. |
drivers/base/regmap/internal.h |
Adds the cache population callback interface. |
drivers/accel/rocket/rocket_drv.c |
Resets failed initialization and adjusts core lookup bounds. |
drivers/accel/rocket/rocket_device.h |
Tracks allocated core capacity. |
drivers/accel/rocket/rocket_device.c |
Initializes allocated core capacity. |
Documentation/netlink/specs/conntrack.yaml |
Corrects conntrack filter attributes and dump request fields. |
block/bsg-lib.c |
Allocates transport-specific reply-buffer sizes. |
arch/x86/kvm/vmx/nested.c |
Cleans up nested MMU context after failed entry. |
arch/x86/kvm/svm/svm.c |
Initializes virtual VMLOAD/VMSAVE enablement consistently. |
arch/x86/kvm/mmu/paging_tmpl.h |
Preserves shadow-stack fault information. |
arch/x86/kvm/mmu/mmu.c |
Avoids zapping referenced nested MMU roots. |
arch/x86/kvm/mmu.h |
Sanitizes permission-table fault-code indexing. |
arch/x86/kernel/kvm.c |
Preserves asynchronous page-fault reasons across nested NMI faults. |
arch/x86/hyperv/hv_init.c |
Aligns hypercall output within the input page. |
arch/s390/pci/pci_sysfs.c |
Validates error-report payload length. |
arch/nios2/include/asm/checksum.h |
Adds an explicit checksum arithmetic type conversion. |
arch/arm/boot/dts/ti/omap/dra7xx-clocks.dtsi |
Corrects PCIe clock divider encoding. |
Review effort: Balanced
| dev_dbg(map->dev, "Initializing %s cache\n", | ||
| map->cache_ops->name); | ||
| map->lock(map->lock_arg); | ||
| ret = map->cache_ops->init(map); |
| ax25->state = AX25_STATE_4; | ||
| break; | ||
| } | ||
| ax25->n2count++; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update kernel base to 6.18.59.