Hi,
The size of the DSP host buffer was incorrectly defined as 2ms while
it is 4ms and the ChainDMA PCMs are using 5ms as host facing buffer.
The constraint will be set against the period time rather than the buffer
time to make sure that application will not face with xruns when the
DMA bursts to refill the host buffer.
The minimal period size will be also used by Pipewire in case of SOF
cards to set the headroom to a length which will avoid the cases when
the hw_ptr jumps over the appl_ptr because of a burst.
Iow, it will make Pipewire to keep a safe distance from the hw_ptr.
https://github.com/thesofproject/linux/issues/5284https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/740https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2548
Regards,
Peter
---
Peter Ujfalusi (3):
ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size
ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer
size
ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead
of buffer time
sound/soc/sof/intel/hda-pcm.c | 29 +++++++++++++++++++++--------
sound/soc/sof/ipc4-topology.c | 9 +++++++--
sound/soc/sof/ipc4-topology.h | 7 +++++--
3 files changed, 33 insertions(+), 12 deletions(-)
--
2.51.0
Loading a large (~2.1G) files with kexec crashes the host with when
running:
# kexec --load kernel --initrd initrd_with_2G_or_more
UBSAN: signed-integer-overflow in ./include/crypto/sha256_base.h:64:19
34152083 * 64 cannot be represented in type 'int'
...
BUG: unable to handle page fault for address: ff9fffff83b624c0
sha256_update (lib/crypto/sha256.c:137)
crypto_sha256_update (crypto/sha256_generic.c:40)
kexec_calculate_store_digests (kernel/kexec_file.c:769)
__se_sys_kexec_file_load (kernel/kexec_file.c:397 kernel/kexec_file.c:332)
...
(Line numbers based on commit da274362a7bd9 ("Linux 6.12.49")
This started happening after commit f4da7afe07523f
("kexec_file: increase maximum file size to 4G") that landed in v6.0,
which increased the file size for kexec.
This is not happening upstream (v6.16+), given that `block` type was
upgraded from "int" to "size_t" in commit 74a43a2cf5e8 ("crypto:
lib/sha256 - Move partial block handling out")
Upgrade the block type similar to the commit above, avoiding hitting the
overflow.
This patch is only suitable for the stable tree, and before 6.16, which
got commit 74a43a2cf5e8 ("crypto: lib/sha256 - Move partial block
handling out"). This is not required before f4da7afe07523f ("kexec_file:
increase maximum file size to 4G"). In other words, this fix is required
between versions v6.0 and v6.16.
Signed-off-by: Breno Leitao <leitao(a)debian.org>
Fixes: f4da7afe07523f ("kexec_file: increase maximum file size to 4G") # Before v6.16
Reported-by: Michael van der Westhuizen <rmikey(a)meta.com>
Reported-by: Tobias Fleig <tfleig(a)meta.com>
---
Changes in v2:
- s/size_t/unsigned int/ as suggested by Eric
- Tag the commit that introduce the problem as Fixes, making backport easier.
- Link to v1: https://lore.kernel.org/r/20251001-stable_crash-v1-1-3071c0bd795e@debian.org
---
include/crypto/sha256_base.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/crypto/sha256_base.h b/include/crypto/sha256_base.h
index e0418818d63c8..e3e610cfe8d30 100644
--- a/include/crypto/sha256_base.h
+++ b/include/crypto/sha256_base.h
@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx,
sctx->count += len;
if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) {
- int blocks;
+ unsigned int blocks;
if (partial) {
int p = SHA256_BLOCK_SIZE - partial;
---
base-commit: da274362a7bd9ab3a6e46d15945029145ebce672
change-id: 20251001-stable_crash-f2151baf043b
Best regards,
--
Breno Leitao <leitao(a)debian.org>
From: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com>
In the case of static pipelines, freeing the widgets in the pipelines
that were not suspended after freeing the scheduler widgets results in
errors because the secondary cores are powered off when the scheduler
widgets are freed. Fix this by tearing down the leftover pipelines before
powering off the secondary cores.
Cc: stable(a)vger.kernel.org
Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic")
Signed-off-by: Ranjani Sridharan <ranjani.sridharan(a)linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi(a)linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)linux.intel.com>
---
sound/soc/sof/ipc3-topology.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c
index 473d416bc910..f449362a2905 100644
--- a/sound/soc/sof/ipc3-topology.c
+++ b/sound/soc/sof/ipc3-topology.c
@@ -2473,11 +2473,6 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif
if (ret < 0)
return ret;
- /* free all the scheduler widgets now */
- ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
- if (ret < 0)
- return ret;
-
/*
* Tear down all pipelines associated with PCMs that did not get suspended
* and unset the prepare flag so that they can be set up again during resume.
@@ -2493,6 +2488,11 @@ static int sof_ipc3_tear_down_all_pipelines(struct snd_sof_dev *sdev, bool verif
}
}
+ /* free all the scheduler widgets now. This will also power down the secondary cores */
+ ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
+ if (ret < 0)
+ return ret;
+
list_for_each_entry(sroute, &sdev->route_list, list)
sroute->setup = false;
--
2.51.0
This is the start of the stable review cycle for the 6.1.154 release.
There are 61 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 24 Sep 2025 19:23:52 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.154-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.1.154-rc1
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
David Howells <dhowells(a)redhat.com>
crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: q6apm-lpass-dai: close graph on prepare errors
Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org>
ASoC: qcom: q6apm-lpass-dai: close graphs before opening a new one
Hans de Goede <hansg(a)kernel.org>
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
Philipp Zabel <p.zabel(a)pengutronix.de>
net: rfkill: gpio: add DT support
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: connect: catch IO errors on listen side
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: propagate shutdown to subflows when possible
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: dbc: Fix full DbC transfer ring after several reconnects
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: dbc: decouple endpoint allocation from initialization
Johan Hovold <johan(a)kernel.org>
phy: ti: omap-usb2: fix device leak at unbind
Rob Herring <robh(a)kernel.org>
phy: Use device_get_match_data()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: userspace pm: validate deny-join-id0 flag
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: pm: nl: announce deny-join-id0 flag
Stefan Metzmacher <metze(a)samba.org>
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
Herbert Xu <herbert(a)gondor.apana.org.au>
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
David Howells <dhowells(a)redhat.com>
crypto: af_alg: Indent the loop in af_alg_sendmsg()
Qi Xi <xiqi2(a)huawei.com>
drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
Loic Poulain <loic.poulain(a)oss.qualcomm.com>
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
Colin Ian King <colin.i.king(a)gmail.com>
ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ASoC: wm8974: Correct PLL rate rounding
Charles Keepax <ckeepax(a)opensource.cirrus.com>
ASoC: wm8940: Correct typo in control name
Jens Axboe <axboe(a)kernel.dk>
io_uring: include dying ring in task_work "should cancel" state
Jens Axboe <axboe(a)kernel.dk>
io_uring: backport io_should_terminate_tw()
Praful Adiga <praful.adiga(a)gmail.com>
ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
selftests: mptcp: avoid spurious errors on TCP disconnect
Håkon Bugge <haakon.bugge(a)oracle.com>
rds: ib: Increment i_fastreg_wrs before bailing out
Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com>
KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
Thomas Fourier <fourier.thomas(a)gmail.com>
mmc: mvsdio: Fix dma_unmap_sg() nents value
Mohammad Rafi Shaik <mohammad.rafi.shaik(a)oss.qualcomm.com>
ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
Mohammad Rafi Shaik <mohammad.rafi.shaik(a)oss.qualcomm.com>
ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
Qu Wenruo <wqu(a)suse.com>
btrfs: tree-checker: fix the incorrect inode ref size check
Eugene Koira <eugkoira(a)amazon.com>
iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
Tao Cui <cuitao(a)kylinos.cn>
LoongArch: Check the return value when creating kobj
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
H. Nikolaus Schaller <hns(a)goldelico.com>
power: supply: bq27xxx: restrict no-battery detection to bq27000
H. Nikolaus Schaller <hns(a)goldelico.com>
power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
Nathan Chancellor <nathan(a)kernel.org>
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
Stefan Metzmacher <metze(a)samba.org>
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
Duoming Zhou <duoming(a)zju.edu.cn>
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
Duoming Zhou <duoming(a)zju.edu.cn>
cnic: Fix use-after-free bugs in cnic_delete_task
Alexey Nepomnyashih <sdl(a)nppct.ru>
net: liquidio: fix overflow in octeon_init_instr_queue()
Tariq Toukan <tariqt(a)nvidia.com>
Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
Jakub Kicinski <kuba(a)kernel.org>
tls: make sure to abort the stream if headers are bogus
Kuniyuki Iwashima <kuniyu(a)google.com>
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
Hangbin Liu <liuhangbin(a)gmail.com>
bonding: don't set oif to bond dev when getting NS target destination
Maciej Fijalkowski <maciej.fijalkowski(a)intel.com>
i40e: remove redundant memory barrier when cleaning Tx descs
Yeounsu Moon <yyyynoom(a)gmail.com>
net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
mptcp: set remote_deny_join_id0 on SYN recv
Jamie Bainbridge <jamie.bainbridge(a)gmail.com>
qed: Don't collect too many protection override GRC elements
Ioana Ciornei <ioana.ciornei(a)nxp.com>
dpaa2-switch: fix buffer pool seeding for control traffic
Miaoqian Lin <linmq006(a)gmail.com>
um: virtio_uml: Fix use-after-free after put_device in probe
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix invalid extref key setup when replaying dentry
Chen Ridong <chenridong(a)huawei.com>
cgroup: split cgroup_destroy_wq into 3 workqueues
Geert Uytterhoeven <geert+renesas(a)glider.be>
pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
Liao Yuanhong <liaoyuanhong(a)vivo.com>
wifi: mac80211: fix incorrect type for ret
Lachlan Hodges <lachlan.hodges(a)morsemicro.com>
wifi: mac80211: increase scan_ies_len for S1G
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
-------------
Diffstat:
Makefile | 4 +-
arch/loongarch/include/asm/acenv.h | 7 +-
arch/loongarch/kernel/env.c | 2 +
arch/um/drivers/virtio_uml.c | 6 +-
arch/x86/kvm/svm/svm.c | 3 +-
crypto/af_alg.c | 112 ++++++++-------------
drivers/gpu/drm/bridge/analogix/anx7625.c | 6 +-
.../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 +-
drivers/iommu/intel/iommu.c | 7 +-
drivers/mmc/host/mvsdio.c | 2 +-
drivers/net/bonding/bond_main.c | 1 -
drivers/net/ethernet/broadcom/cnic.c | 3 +-
.../net/ethernet/cavium/liquidio/request_manager.c | 2 +-
.../net/ethernet/freescale/dpaa2/dpaa2-switch.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 -
.../net/ethernet/marvell/octeontx2/nic/otx2_ptp.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 -
drivers/net/ethernet/natsemi/ns83820.c | 13 ++-
drivers/net/ethernet/qlogic/qed/qed_debug.c | 7 +-
drivers/pcmcia/omap_cf.c | 8 +-
drivers/phy/broadcom/phy-bcm-ns-usb3.c | 9 +-
drivers/phy/marvell/phy-berlin-usb.c | 7 +-
drivers/phy/ralink/phy-ralink-usb.c | 10 +-
drivers/phy/rockchip/phy-rockchip-pcie.c | 11 +-
drivers/phy/rockchip/phy-rockchip-usb.c | 10 +-
drivers/phy/ti/phy-omap-control.c | 9 +-
drivers/phy/ti/phy-omap-usb2.c | 24 +++--
drivers/phy/ti/phy-ti-pipe3.c | 14 +--
drivers/power/supply/bq27xxx_battery.c | 4 +-
drivers/usb/host/xhci-dbgcap.c | 94 ++++++++++++-----
fs/btrfs/tree-checker.c | 4 +-
fs/btrfs/tree-log.c | 2 +-
fs/nilfs2/sysfs.c | 4 +-
fs/nilfs2/sysfs.h | 8 +-
fs/smb/client/smbdirect.c | 4 +-
fs/smb/server/transport_rdma.c | 26 +++--
include/crypto/if_alg.h | 10 +-
include/uapi/linux/mptcp.h | 6 +-
io_uring/io_uring.c | 13 ++-
io_uring/io_uring.h | 13 +++
io_uring/poll.c | 3 +-
io_uring/timeout.c | 2 +-
kernel/cgroup/cgroup.c | 43 ++++++--
net/ipv4/tcp.c | 5 +
net/mac80211/driver-ops.h | 2 +-
net/mac80211/main.c | 7 +-
net/mptcp/pm_netlink.c | 7 ++
net/mptcp/protocol.c | 15 +++
net/mptcp/subflow.c | 4 +
net/rds/ib_frmr.c | 20 ++--
net/rfkill/rfkill-gpio.c | 22 +++-
net/tls/tls.h | 1 +
net/tls/tls_strp.c | 14 ++-
net/tls/tls_sw.c | 3 +-
sound/firewire/motu/motu-hwdep.c | 2 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/wm8940.c | 2 +-
sound/soc/codecs/wm8974.c | 8 +-
sound/soc/qcom/qdsp6/audioreach.c | 1 +
sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 36 +++++--
sound/soc/sof/intel/hda-stream.c | 2 +-
tools/testing/selftests/net/mptcp/mptcp_connect.c | 11 +-
tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 7 ++
tools/testing/selftests/net/mptcp/userspace_pm.sh | 14 ++-
64 files changed, 440 insertions(+), 272 deletions(-)
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once
probed") permanently enabled access to the enhanced features in
sc16is7xx_probe(), and it is never disabled after that.
Therefore, remove useless re-enable of enhanced features in
sc16is7xx_set_baud().
Fixes: 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
---
drivers/tty/serial/sc16is7xx.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 1a2c4c14f6aac..c7435595dce13 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -588,13 +588,6 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
div /= prescaler;
}
- /* Enable enhanced features */
- sc16is7xx_efr_lock(port);
- sc16is7xx_port_update(port, SC16IS7XX_EFR_REG,
- SC16IS7XX_EFR_ENABLE_BIT,
- SC16IS7XX_EFR_ENABLE_BIT);
- sc16is7xx_efr_unlock(port);
-
/* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
SC16IS7XX_MCR_CLKSEL_BIT,
--
2.39.5