March 2025 - Linux-stable-mirror

[PATCH net 13/13] net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family

by Marek Behún

Implement the workaround for erratum 3.3 RGMII timing may be out of spec when transmit delay is enabled for the 6320 family, which says: When transmit delay is enabled via Port register 1 bit 14 = 1, duty cycle may be out of spec. Under very rare conditions this may cause the attached device receive CRC errors. Signed-off-by: Marek Behún <kabel(a)kernel.org> Cc: <stable(a)vger.kernel.org> # 5.4.x --- drivers/net/dsa/mv88e6xxx/chip.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 898aff46693b..6e7c9bbd9787 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -3674,6 +3674,21 @@ static int mv88e6xxx_stats_setup(struct mv88e6xxx_chip *chip) return mv88e6xxx_g1_stats_clear(chip); } +static int mv88e6320_setup_errata(struct mv88e6xxx_chip *chip) +{ + u16 dummy; + int err; + + /* Workaround for erratum + * 3.3 RGMII timing may be out of spec when transmit delay is enabled + */ + err = mv88e6xxx_port_hidden_write(chip, 0, 0xf, 0x7, 0xe000); + if (err) + return err; + + return mv88e6xxx_port_hidden_read(chip, 0, 0xf, 0x7, &dummy); +} + /* Check if the errata has already been applied. */ static bool mv88e6390_setup_errata_applied(struct mv88e6xxx_chip *chip) { @@ -5125,6 +5140,7 @@ static const struct mv88e6xxx_ops mv88e6290_ops = { static const struct mv88e6xxx_ops mv88e6320_ops = { /* MV88E6XXX_FAMILY_6320 */ + .setup_errata = mv88e6320_setup_errata, .ieee_pri_map = mv88e6085_g1_ieee_pri_map, .ip_pri_map = mv88e6085_g1_ip_pri_map, .irl_init_all = mv88e6352_g2_irl_init_all, @@ -5180,6 +5196,7 @@ static const struct mv88e6xxx_ops mv88e6320_ops = { static const struct mv88e6xxx_ops mv88e6321_ops = { /* MV88E6XXX_FAMILY_6320 */ + .setup_errata = mv88e6320_setup_errata, .ieee_pri_map = mv88e6085_g1_ieee_pri_map, .ip_pri_map = mv88e6085_g1_ip_pri_map, .irl_init_all = mv88e6352_g2_irl_init_all, -- 2.48.1

6 months

1
0
0 0

[PATCH net 12/13] net: dsa: mv88e6xxx: fix internal PHYs for 6320 family

by Marek Behún

Fix internal PHYs definition for the 6320 family, which has only 2 internal PHYs (on ports 3 and 4). Fixes: bc3931557d1d ("net: dsa: mv88e6xxx: Add number of internal PHYs") Signed-off-by: Marek Behún <kabel(a)kernel.org> Cc: <stable(a)vger.kernel.org> # 6.6.x --- drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 3849b8d55fa9..898aff46693b 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -6240,7 +6240,8 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .num_databases = 4096, .num_macs = 8192, .num_ports = 7, - .num_internal_phys = 5, + .num_internal_phys = 2, + .internal_phys_offset = 3, .num_gpio = 15, .max_vid = 4095, .max_sid = 63, @@ -6267,7 +6268,8 @@ static const struct mv88e6xxx_info mv88e6xxx_table[] = { .num_databases = 4096, .num_macs = 8192, .num_ports = 7, - .num_internal_phys = 5, + .num_internal_phys = 2, + .internal_phys_offset = 3, .num_gpio = 15, .max_vid = 4095, .max_sid = 63, -- 2.48.1

6 months

1
0
0 0

[PATCH v4 0/3] leds: rgb: leds-qcom-lpg: PWM fixes

by Abel Vesa

The PWM allow configuring the PWM resolution from 8 bits PWM values up to 15 bits values, for the Hi-Res PWMs, and then either 6-bit or 9-bit for the normal PWMs. The current implementation loops through all possible resolutions (PWM sizes), for the PWM subtype, on top of the already existing process of determining the prediv, exponent and refclk. The first and second issues are related to capping the computed PWM value. The third issue is that it uses the wrong maximum possible PWM value for determining the best matched period. Fix all of them. Signed-off-by: Abel Vesa <abel.vesa(a)linaro.org> --- Changes in v4: - Rebased on next-20250305 - Re-worded the commit messages for the first two patches to include an example that should better explain what the issue that is being fixed is. As per Uwe's request. - Link to v3: https://lore.kernel.org/r/20250303-leds-qcom-lpg-fix-max-pwm-on-hi-res-v3-0… Changes in v3: - Added a new patch that fixes the normal PWMs, since they now support 6-bit resolution as well. Added it as first patch. - Re-worded the second patch. Included Bjorn's suggestion and R-b tag. - Link to v2: https://lore.kernel.org/r/20250226-leds-qcom-lpg-fix-max-pwm-on-hi-res-v2-0… Changes in v2: - Re-worded the commit to drop the details that are not important w.r.t. what the patch is fixing. - Added another patch which fixes the resolution used for determining best matched period and PWM config. - Link to v1: https://lore.kernel.org/r/20250220-leds-qcom-lpg-fix-max-pwm-on-hi-res-v1-1… --- Abel Vesa (3): leds: rgb: leds-qcom-lpg: Fix pwm resolution max for normal PWMs leds: rgb: leds-qcom-lpg: Fix pwm resolution max for Hi-Res PWMs leds: rgb: leds-qcom-lpg: Fix calculation of best period Hi-Res PWMs drivers/leds/rgb/leds-qcom-lpg.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- base-commit: 7ec162622e66a4ff886f8f28712ea1b13069e1aa change-id: 20250220-leds-qcom-lpg-fix-max-pwm-on-hi-res-067e8782a79b Best regards, -- Abel Vesa <abel.vesa(a)linaro.org>

6 months

2
3
0 0

FAILED: patch "[PATCH] virt: sev-guest: Move SNP Guest Request data pages handling" failed to apply to 6.13-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 6.13-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.13.y git checkout FETCH_HEAD git cherry-pick -x 3e385c0d6ce88ac9916dcf84267bd5855d830748 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2025030957-magnetism-lustily-55d9@gregkh' --subject-prefix 'PATCH 6.13.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ From 3e385c0d6ce88ac9916dcf84267bd5855d830748 Mon Sep 17 00:00:00 2001 From: Alexey Kardashevskiy <aik(a)amd.com> Date: Fri, 7 Mar 2025 12:37:00 +1100 Subject: [PATCH] virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex Compared to the SNP Guest Request, the "Extended" version adds data pages for receiving certificates. If not enough pages provided, the HV can report to the VM how much is needed so the VM can reallocate and repeat. Commit ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mutex") moved handling of the allocated/desired pages number out of scope of said mutex and create a possibility for a race (multiple instances trying to trigger Extended request in a VM) as there is just one instance of snp_msg_desc per /dev/sev-guest and no locking other than snp_cmd_mutex. Fix the issue by moving the data blob/size and the GHCB input struct (snp_req_data) into snp_guest_req which is allocated on stack now and accessed by the GHCB caller under that mutex. Stop allocating SEV_FW_BLOB_MAX_SIZE in snp_msg_alloc() as only one of four callers needs it. Free the received blob in get_ext_report() right after it is copied to the userspace. Possible future users of snp_send_guest_request() are likely to have different ideas about the buffer size anyways. Fixes: ae596615d93d ("virt: sev-guest: Reduce the scope of SNP command mutex") Signed-off-by: Alexey Kardashevskiy <aik(a)amd.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Nikunj A Dadhania <nikunj(a)amd.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250307013700.437505-3-aik@amd.com diff --git a/arch/x86/coco/sev/core.c b/arch/x86/coco/sev/core.c index 82492efc5d94..96c7bc698e6b 100644 --- a/arch/x86/coco/sev/core.c +++ b/arch/x86/coco/sev/core.c @@ -2853,19 +2853,8 @@ struct snp_msg_desc *snp_msg_alloc(void) if (!mdesc->response) goto e_free_request; - mdesc->certs_data = alloc_shared_pages(SEV_FW_BLOB_MAX_SIZE); - if (!mdesc->certs_data) - goto e_free_response; - - /* initial the input address for guest request */ - mdesc->input.req_gpa = __pa(mdesc->request); - mdesc->input.resp_gpa = __pa(mdesc->response); - mdesc->input.data_gpa = __pa(mdesc->certs_data); - return mdesc; -e_free_response: - free_shared_pages(mdesc->response, sizeof(struct snp_guest_msg)); e_free_request: free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); e_unmap: @@ -2885,7 +2874,6 @@ void snp_msg_free(struct snp_msg_desc *mdesc) kfree(mdesc->ctx); free_shared_pages(mdesc->response, sizeof(struct snp_guest_msg)); free_shared_pages(mdesc->request, sizeof(struct snp_guest_msg)); - free_shared_pages(mdesc->certs_data, SEV_FW_BLOB_MAX_SIZE); iounmap((__force void __iomem *)mdesc->secrets); memset(mdesc, 0, sizeof(*mdesc)); @@ -3054,7 +3042,7 @@ static int __handle_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_r * sequence number must be incremented or the VMPCK must be deleted to * prevent reuse of the IV. */ - rc = snp_issue_guest_request(req, &mdesc->input, rio); + rc = snp_issue_guest_request(req, &req->input, rio); switch (rc) { case -ENOSPC: /* @@ -3064,7 +3052,7 @@ static int __handle_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_r * order to increment the sequence number and thus avoid * IV reuse. */ - override_npages = mdesc->input.data_npages; + override_npages = req->input.data_npages; req->exit_code = SVM_VMGEXIT_GUEST_REQUEST; /* @@ -3120,7 +3108,7 @@ static int __handle_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_r } if (override_npages) - mdesc->input.data_npages = override_npages; + req->input.data_npages = override_npages; return rc; } @@ -3158,6 +3146,11 @@ int snp_send_guest_request(struct snp_msg_desc *mdesc, struct snp_guest_req *req */ memcpy(mdesc->request, &mdesc->secret_request, sizeof(mdesc->secret_request)); + /* Initialize the input address for guest request */ + req->input.req_gpa = __pa(mdesc->request); + req->input.resp_gpa = __pa(mdesc->response); + req->input.data_gpa = req->certs_data ? __pa(req->certs_data) : 0; + rc = __handle_guest_request(mdesc, req, rio); if (rc) { if (rc == -EIO && diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h index 1581246491b5..ba7999f66abe 100644 --- a/arch/x86/include/asm/sev.h +++ b/arch/x86/include/asm/sev.h @@ -203,6 +203,9 @@ struct snp_guest_req { unsigned int vmpck_id; u8 msg_version; u8 msg_type; + + struct snp_req_data input; + void *certs_data; }; /* @@ -263,9 +266,6 @@ struct snp_msg_desc { struct snp_guest_msg secret_request, secret_response; struct snp_secrets_page *secrets; - struct snp_req_data input; - - void *certs_data; struct aesgcm_ctx *ctx; diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c index 23ac177472be..70fbc9a3e703 100644 --- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -176,6 +176,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques struct snp_guest_req req = {}; int ret, npages = 0, resp_len; sockptr_t certs_address; + struct page *page; if (sockptr_is_null(io->req_data) || sockptr_is_null(io->resp_data)) return -EINVAL; @@ -209,8 +210,20 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques * the host. If host does not supply any certs in it, then copy * zeros to indicate that certificate data was not provided. */ - memset(mdesc->certs_data, 0, report_req->certs_len); npages = report_req->certs_len >> PAGE_SHIFT; + page = alloc_pages(GFP_KERNEL_ACCOUNT | __GFP_ZERO, + get_order(report_req->certs_len)); + if (!page) + return -ENOMEM; + + req.certs_data = page_address(page); + ret = set_memory_decrypted((unsigned long)req.certs_data, npages); + if (ret) { + pr_err("failed to mark page shared, ret=%d\n", ret); + __free_pages(page, get_order(report_req->certs_len)); + return -EFAULT; + } + cmd: /* * The intermediate response buffer is used while decrypting the @@ -219,10 +232,12 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques */ resp_len = sizeof(report_resp->data) + mdesc->ctx->authsize; report_resp = kzalloc(resp_len, GFP_KERNEL_ACCOUNT); - if (!report_resp) - return -ENOMEM; + if (!report_resp) { + ret = -ENOMEM; + goto e_free_data; + } - mdesc->input.data_npages = npages; + req.input.data_npages = npages; req.msg_version = arg->msg_version; req.msg_type = SNP_MSG_REPORT_REQ; @@ -237,7 +252,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques /* If certs length is invalid then copy the returned length */ if (arg->vmm_error == SNP_GUEST_VMM_ERR_INVALID_LEN) { - report_req->certs_len = mdesc->input.data_npages << PAGE_SHIFT; + report_req->certs_len = req.input.data_npages << PAGE_SHIFT; if (copy_to_sockptr(io->req_data, report_req, sizeof(*report_req))) ret = -EFAULT; @@ -246,7 +261,7 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques if (ret) goto e_free; - if (npages && copy_to_sockptr(certs_address, mdesc->certs_data, report_req->certs_len)) { + if (npages && copy_to_sockptr(certs_address, req.certs_data, report_req->certs_len)) { ret = -EFAULT; goto e_free; } @@ -256,6 +271,13 @@ static int get_ext_report(struct snp_guest_dev *snp_dev, struct snp_guest_reques e_free: kfree(report_resp); +e_free_data: + if (npages) { + if (set_memory_encrypted((unsigned long)req.certs_data, npages)) + WARN_ONCE(ret, "failed to restore encryption mask (leak it)\n"); + else + __free_pages(page, get_order(report_req->certs_len)); + } return ret; }

6 months

5
10
0 0

[PATCH 5.10.y] KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel

by Abdelkareem Abdelsaamad

From: Sean Christopherson <seanjc(a)google.com> commit a8de7f100bb5989d9c3627d3a223ee1c863f3b69 upstream. Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID. Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC: dump_stack+0xbe/0xfd __kasan_report.cold+0x34/0x84 kasan_report+0x3a/0x50 __apic_accept_irq+0x3a/0x5c0 kvm_hv_send_ipi.isra.0+0x34e/0x820 kvm_hv_hypercall+0x8d9/0x9d0 kvm_emulate_hypercall+0x506/0x7e0 __vmx_handle_exit+0x283/0xb60 vmx_handle_exit+0x1d/0xd0 vcpu_enter_guest+0x16b0/0x24c0 vcpu_run+0xc0/0x550 kvm_arch_vcpu_ioctl_run+0x170/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscal1_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC. Reported-by: Dongjie Zou <zoudongjie(a)huawei.com> Fixes: 214ff83d4473 ("KVM: x86: hyperv: implement PV IPI send hypercalls") Fixes: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") Cc: stable(a)vger.kernel.org Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://lore.kernel.org/r/20250118003454.2619573-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Conflict due to 72167a9d7da2 ("KVM: x86: hyper-v: Stop shadowing global 'current_vcpu' variable") not in the tree] Signed-off-by: Abdelkareem Abdelsaamad <kareemem(a)amazon.com> --- arch/x86/kvm/hyperv.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c index 20eb8f55e1f1..e097faf12c82 100644 --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -1618,6 +1618,9 @@ static u64 kvm_hv_send_ipi(struct kvm_vcpu *current_vcpu, u64 ingpa, u64 outgpa, u32 vector; bool all_cpus; + if (!lapic_in_kernel(current_vcpu)) + return HV_STATUS_INVALID_HYPERCALL_INPUT; + if (!ex) { if (!fast) { if (unlikely(kvm_read_guest(kvm, ingpa, &send_ipi, @@ -2060,7 +2063,8 @@ int kvm_vcpu_ioctl_get_hv_cpuid(struct kvm_vcpu *vcpu, struct kvm_cpuid2 *cpuid, ent->eax |= HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED; ent->eax |= HV_X64_APIC_ACCESS_RECOMMENDED; ent->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED; - ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; + if (!vcpu || lapic_in_kernel(vcpu)) + ent->eax |= HV_X64_CLUSTER_IPI_RECOMMENDED; ent->eax |= HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED; if (evmcs_ver) ent->eax |= HV_X64_ENLIGHTENED_VMCS_RECOMMENDED; -- 2.47.1

6 months

2
1
0 0

[PATCH 5.10.y] x86/kexec: fix memory leak of elf header buffer

by Abdelkareem Abdelsaamad

From: Baoquan He <bhe(a)redhat.com> commit b3e34a47f98974d0844444c5121aaff123004e57 upstream. This is reported by kmemleak detector: unreferenced object 0xffffc900002a9000 (size 4096): comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 ..>............. backtrace: [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170 [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160 [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0 [<0000000019afff23>] crash_load_segments+0x260/0x470 [<0000000019ebe95c>] bzImage64_load+0x814/0xad0 [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0 [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0 [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530 [<0000000087c19992>] do_syscall_64+0x3b/0x90 [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there. And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place. Three different people have reported three bugs about the memory leak on x86_64 inside Redhat. Link: https://lkml.kernel.org/r/20220223113225.63106-2-bhe@redhat.com Signed-off-by: Baoquan He <bhe(a)redhat.com> Acked-by: Dave Young <dyoung(a)redhat.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Conflict due to 179350f00e06 ("x86: Use ELF fields defined in 'struct kimage'") not in the tree] Signed-off-by: Abdelkareem Abdelsaamad <kareemem(a)amazon.com> --- arch/x86/kernel/machine_kexec_64.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c index a29a44a98e5b..19f6aafd595a 100644 --- a/arch/x86/kernel/machine_kexec_64.c +++ b/arch/x86/kernel/machine_kexec_64.c @@ -402,9 +402,6 @@ void machine_kexec(struct kimage *image) #ifdef CONFIG_KEXEC_FILE void *arch_kexec_kernel_image_load(struct kimage *image) { - vfree(image->arch.elf_headers); - image->arch.elf_headers = NULL; - if (!image->fops || !image->fops->load) return ERR_PTR(-ENOEXEC); @@ -540,6 +537,15 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, (int)ELF64_R_TYPE(rel[i].r_info), value); return -ENOEXEC; } + +int arch_kimage_file_post_load_cleanup(struct kimage *image) +{ + vfree(image->arch.elf_headers); + image->arch.elf_headers = NULL; + image->arch.elf_headers_sz = 0; + + return kexec_image_post_load_cleanup_default(image); +} #endif /* CONFIG_KEXEC_FILE */ static int -- 2.47.1

6 months

2
1
0 0

[PATCH 6.1.y] fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super

by Miguel García

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> commit 91a4b1ee78cb100b19b70f077c247f211110348f upstream. This patch is a backport and fixes an UBSAN warning about shift-out-of-bounds in ntfs_fill_super() function of the NTFS3 driver. The original code incorrectly calculated MFT record size, causing undefined behavior when performing bit shifts with values that exceed type limits. The fix has been verified by executing the syzkaller reproducer test case. After applying this patch, the system successfully handles the test case without kernel panic or UBSAN warnings. Bug: https://syzkaller.appspot.com/bug?extid=010986becd65dbf9464b Reported-by: syzbot+010986becd65dbf9464b(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Miguel Garcia Roman <miguelgarciaroman8(a)gmail.com> (cherry picked from commit 91a4b1ee78cb100b19b70f077c247f211110348f) --- fs/ntfs3/ntfs_fs.h | 2 ++ fs/ntfs3/super.c | 68 +++++++++++++++++++++++++++++++--------------- 2 files changed, 48 insertions(+), 22 deletions(-) diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index 26dbe1b46fdd..cbbf1ccc38e3 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -42,9 +42,11 @@ enum utf16_endian; #define MINUS_ONE_T ((size_t)(-1)) /* Biggest MFT / smallest cluster */ #define MAXIMUM_BYTES_PER_MFT 4096 +#define MAXIMUM_SHIFT_BYTES_PER_MFT 12 #define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512) #define MAXIMUM_BYTES_PER_INDEX 4096 +#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12 #define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512) /* NTFS specific error code when fixup failed. */ diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index eee54214f4a3..a9063771afcc 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -680,7 +680,7 @@ static u32 true_sectors_per_clst(const struct NTFS_BOOT *boot) * ntfs_init_from_boot - Init internal info from on-disk boot sector. */ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, - u64 dev_size) + u64 dev_size) { struct ntfs_sb_info *sbi = sb->s_fs_info; int err; @@ -705,12 +705,12 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, /* 0x55AA is not mandaroty. Thanks Maxim Suhanov*/ /*if (0x55 != boot->boot_magic[0] || 0xAA != boot->boot_magic[1]) - * goto out; + * goto out; */ boot_sector_size = (u32)boot->bytes_per_sector[1] << 8; if (boot->bytes_per_sector[0] || boot_sector_size < SECTOR_SIZE || - !is_power_of_2(boot_sector_size)) { + !is_power_of_2(boot_sector_size)) { goto out; } @@ -733,15 +733,49 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, /* Check MFT record size. */ if ((boot->record_size < 0 && - SECTOR_SIZE > (2U << (-boot->record_size))) || - (boot->record_size >= 0 && !is_power_of_2(boot->record_size))) { + SECTOR_SIZE > (2U << (-boot->record_size))) || + (boot->record_size >= 0 && !is_power_of_2(boot->record_size))) { + goto out; + } + + /* Calculate cluster size */ + sbi->cluster_size = boot_sector_size * sct_per_clst; + sbi->cluster_bits = blksize_bits(sbi->cluster_size); + + if (boot->record_size >= 0) { + record_size = (u32)boot->record_size << sbi->cluster_bits; + } else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) { + record_size = 1u << (-boot->record_size); + } else { + ntfs_err(sb, "%s: invalid record size %d.", "NTFS", + boot->record_size); + goto out; + } + + sbi->record_size = record_size; + sbi->record_bits = blksize_bits(record_size); + sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes + + if (record_size > MAXIMUM_BYTES_PER_MFT) { + ntfs_err(sb, "Unsupported bytes per MFT record %u.", + record_size); + goto out; + } + + if (boot->index_size >= 0) { + sbi->index_size = (u32)boot->index_size << sbi->cluster_bits; + } else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) { + sbi->index_size = 1u << (-boot->index_size); + } else { + ntfs_err(sb, "%s: invalid index size %d.", "NTFS", + boot->index_size); goto out; } /* Check index record size. */ if ((boot->index_size < 0 && - SECTOR_SIZE > (2U << (-boot->index_size))) || - (boot->index_size >= 0 && !is_power_of_2(boot->index_size))) { + SECTOR_SIZE > (2U << (-boot->index_size))) || + (boot->index_size >= 0 && !is_power_of_2(boot->index_size))) { goto out; } @@ -762,9 +796,6 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, dev_size += sector_size - 1; } - sbi->cluster_size = boot_sector_size * sct_per_clst; - sbi->cluster_bits = blksize_bits(sbi->cluster_size); - sbi->mft.lbo = mlcn << sbi->cluster_bits; sbi->mft.lbo2 = mlcn2 << sbi->cluster_bits; @@ -785,9 +816,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, sbi->cluster_mask = sbi->cluster_size - 1; sbi->cluster_mask_inv = ~(u64)sbi->cluster_mask; sbi->record_size = record_size = boot->record_size < 0 - ? 1 << (-boot->record_size) - : (u32)boot->record_size - << sbi->cluster_bits; + ? 1 << (-boot->record_size) + : (u32)boot->record_size + << sbi->cluster_bits; if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE) goto out; @@ -801,8 +832,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, ALIGN(sizeof(enum ATTR_TYPE), 8); sbi->index_size = boot->index_size < 0 - ? 1u << (-boot->index_size) - : (u32)boot->index_size << sbi->cluster_bits; + ? 1u << (-boot->index_size) + : (u32)boot->index_size << sbi->cluster_bits; sbi->volume.ser_num = le64_to_cpu(boot->serial_num); @@ -871,13 +902,6 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, sb->s_maxbytes = 0xFFFFFFFFull << sbi->cluster_bits; #endif - /* - * Compute the MFT zone at two steps. - * It would be nice if we are able to allocate 1/8 of - * total clusters for MFT but not more then 512 MB. - */ - sbi->zone_max = min_t(CLST, 0x20000000 >> sbi->cluster_bits, clusters >> 3); - err = 0; out: -- 2.34.1

6 months

2
1
0 0

[PATCH 6.6.y] bpf: Use raw_spinlock_t in ringbuf

by jianqi.ren.cn＠windriver.com

From: Wander Lairson Costa <wander.lairson(a)gmail.com> [ Upstream commit 8b62645b09f870d70c7910e7550289d444239a46 ] The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Signed-off-by: Jianqi Ren <jianqi.ren.cn(a)windriver.com> Signed-off-by: He Zhe <zhe.he(a)windriver.com> --- Verified the build test --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 528f4d634226..6aff5ee483b6 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -29,7 +29,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* For user-space producer ring buffers, an atomic_t busy bit is used * to synchronize access to the ring buffers in the kernel, rather than * the spinlock that is used for kernel-producer ring buffers. This is @@ -173,7 +173,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return NULL; - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); atomic_set(&rb->busy, 0); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -417,10 +417,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -446,7 +446,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -458,7 +458,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.25.1

6 months

2
1
0 0

[PATCH net] net: mana: cleanup mana struct after debugfs_remove()

by Shradha Gupta

When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(), mana_gd_suspend() and mana_gd_resume() are called. If during this mana_gd_resume(), a failure occurs with HWC creation, mana_port_debugfs pointer does not get reinitialized and ends up pointing to older, cleaned-up dentry. Further in the hibernation path, as part of power_down(), mana_gd_shutdown() is triggered. This call, unaware of the failures in resume, tries to cleanup the already cleaned up mana_port_debugfs value and hits the following bug: [ 191.359296] mana 7870:00:00.0: Shutdown was called [ 191.359918] BUG: kernel NULL pointer dereference, address: 0000000000000098 [ 191.360584] #PF: supervisor write access in kernel mode [ 191.361125] #PF: error_code(0x0002) - not-present page [ 191.361727] PGD 1080ea067 P4D 0 [ 191.362172] Oops: Oops: 0002 [#1] SMP NOPTI [ 191.362606] CPU: 11 UID: 0 PID: 1674 Comm: bash Not tainted 6.14.0-rc5+ #2 [ 191.363292] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 191.364124] RIP: 0010:down_write+0x19/0x50 [ 191.364537] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 de cd ff ff 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 16 65 48 8b 05 88 24 4c 6a 48 89 43 08 48 8b 5d [ 191.365867] RSP: 0000:ff45fbe0c1c037b8 EFLAGS: 00010246 [ 191.366350] RAX: 0000000000000000 RBX: 0000000000000098 RCX: ffffff8100000000 [ 191.366951] RDX: 0000000000000001 RSI: 0000000000000064 RDI: 0000000000000098 [ 191.367600] RBP: ff45fbe0c1c037c0 R08: 0000000000000000 R09: 0000000000000001 [ 191.368225] R10: ff45fbe0d2b01000 R11: 0000000000000008 R12: 0000000000000000 [ 191.368874] R13: 000000000000000b R14: ff43dc27509d67c0 R15: 0000000000000020 [ 191.369549] FS: 00007dbc5001e740(0000) GS:ff43dc663f380000(0000) knlGS:0000000000000000 [ 191.370213] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 191.370830] CR2: 0000000000000098 CR3: 0000000168e8e002 CR4: 0000000000b73ef0 [ 191.371557] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 191.372192] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 191.372906] Call Trace: [ 191.373262] <TASK> [ 191.373621] ? show_regs+0x64/0x70 [ 191.374040] ? __die+0x24/0x70 [ 191.374468] ? page_fault_oops+0x290/0x5b0 [ 191.374875] ? do_user_addr_fault+0x448/0x800 [ 191.375357] ? exc_page_fault+0x7a/0x160 [ 191.375971] ? asm_exc_page_fault+0x27/0x30 [ 191.376416] ? down_write+0x19/0x50 [ 191.376832] ? down_write+0x12/0x50 [ 191.377232] simple_recursive_removal+0x4a/0x2a0 [ 191.377679] ? __pfx_remove_one+0x10/0x10 [ 191.378088] debugfs_remove+0x44/0x70 [ 191.378530] mana_detach+0x17c/0x4f0 [ 191.378950] ? __flush_work+0x1e2/0x3b0 [ 191.379362] ? __cond_resched+0x1a/0x50 [ 191.379787] mana_remove+0xf2/0x1a0 [ 191.380193] mana_gd_shutdown+0x3b/0x70 [ 191.380642] pci_device_shutdown+0x3a/0x80 [ 191.381063] device_shutdown+0x13e/0x230 [ 191.381480] kernel_power_off+0x35/0x80 [ 191.381890] hibernate+0x3c6/0x470 [ 191.382312] state_store+0xcb/0xd0 [ 191.382734] kobj_attr_store+0x12/0x30 [ 191.383211] sysfs_kf_write+0x3e/0x50 [ 191.383640] kernfs_fop_write_iter+0x140/0x1d0 [ 191.384106] vfs_write+0x271/0x440 [ 191.384521] ksys_write+0x72/0xf0 [ 191.384924] __x64_sys_write+0x19/0x20 [ 191.385313] x64_sys_call+0x2b0/0x20b0 [ 191.385736] do_syscall_64+0x79/0x150 [ 191.386146] ? __mod_memcg_lruvec_state+0xe7/0x240 [ 191.386676] ? __lruvec_stat_mod_folio+0x79/0xb0 [ 191.387124] ? __pfx_lru_add+0x10/0x10 [ 191.387515] ? queued_spin_unlock+0x9/0x10 [ 191.387937] ? do_anonymous_page+0x33c/0xa00 [ 191.388374] ? __handle_mm_fault+0xcf3/0x1210 [ 191.388805] ? __count_memcg_events+0xbe/0x180 [ 191.389235] ? handle_mm_fault+0xae/0x300 [ 191.389588] ? do_user_addr_fault+0x559/0x800 [ 191.390027] ? irqentry_exit_to_user_mode+0x43/0x230 [ 191.390525] ? irqentry_exit+0x1d/0x30 [ 191.390879] ? exc_page_fault+0x86/0x160 [ 191.391235] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 191.391745] RIP: 0033:0x7dbc4ff1c574 [ 191.392111] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 [ 191.393412] RSP: 002b:00007ffd95a23ab8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 191.393990] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007dbc4ff1c574 [ 191.394594] RDX: 0000000000000005 RSI: 00005a6eeadb0ce0 RDI: 0000000000000001 [ 191.395215] RBP: 00007ffd95a23ae0 R08: 00007dbc50003b20 R09: 0000000000000000 [ 191.395805] R10: 0000000000000001 R11: 0000000000000202 R12: 0000000000000005 [ 191.396404] R13: 00005a6eeadb0ce0 R14: 00007dbc500045c0 R15: 00007dbc50001ee0 [ 191.396987] </TASK> To fix this, we explicitly set such mana debugfs variables to NULL after debugfs_remove() is called. Fixes: 6607c17c6c5e ("net: mana: Enable debugfs files for MANA device") Cc: stable(a)vger.kernel.org Signed-off-by: Shradha Gupta <shradhagupta(a)linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz(a)microsoft.com> --- drivers/net/ethernet/microsoft/mana/gdma_main.c | 11 ++++++++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 10 ++++++---- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c index c15a5ef4674e..f1966788c98e 100644 --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c @@ -1579,6 +1579,7 @@ static int mana_gd_probe(struct pci_dev *pdev, const struct pci_device_id *ent) * adapter-MTU file and apc->mana_pci_debugfs folder. */ debugfs_remove_recursive(gc->mana_pci_debugfs); + gc->mana_pci_debugfs = NULL; pci_iounmap(pdev, bar0_va); free_gc: pci_set_drvdata(pdev, NULL); @@ -1601,6 +1602,8 @@ static void mana_gd_remove(struct pci_dev *pdev) debugfs_remove_recursive(gc->mana_pci_debugfs); + gc->mana_pci_debugfs = NULL; + pci_iounmap(pdev, gc->bar0_va); vfree(gc); @@ -1656,6 +1659,8 @@ static void mana_gd_shutdown(struct pci_dev *pdev) debugfs_remove_recursive(gc->mana_pci_debugfs); + gc->mana_pci_debugfs = NULL; + pci_disable_device(pdev); } @@ -1682,8 +1687,10 @@ static int __init mana_driver_init(void) mana_debugfs_root = debugfs_create_dir("mana", NULL); err = pci_register_driver(&mana_driver); - if (err) + if (err) { debugfs_remove(mana_debugfs_root); + mana_debugfs_root = NULL; + } return err; } @@ -1693,6 +1700,8 @@ static void __exit mana_driver_exit(void) pci_unregister_driver(&mana_driver); debugfs_remove(mana_debugfs_root); + + mana_debugfs_root = NULL; } module_init(mana_driver_init); diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 2d826077d38c..9a8171f099b6 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -748,12 +748,11 @@ static const struct net_device_ops mana_devops = { static void mana_cleanup_port_context(struct mana_port_context *apc) { /* - * at this point all dir/files under the vport directory - * are already cleaned up. - * We are sure the apc->mana_port_debugfs remove will not - * cause any freed memory access issues + * make sure subsequent cleanup attempts don't end up removing already + * cleaned dentry pointer */ debugfs_remove(apc->mana_port_debugfs); + apc->mana_port_debugfs = NULL; kfree(apc->rxqs); apc->rxqs = NULL; } @@ -1264,6 +1263,7 @@ static void mana_destroy_eq(struct mana_context *ac) return; debugfs_remove_recursive(ac->mana_eqs_debugfs); + ac->mana_eqs_debugfs = NULL; for (i = 0; i < gc->max_num_queues; i++) { eq = ac->eqs[i].eq; @@ -1926,6 +1926,7 @@ static void mana_destroy_txq(struct mana_port_context *apc) for (i = 0; i < apc->num_queues; i++) { debugfs_remove_recursive(apc->tx_qp[i].mana_tx_debugfs); + apc->tx_qp[i].mana_tx_debugfs = NULL; napi = &apc->tx_qp[i].tx_cq.napi; if (apc->tx_qp[i].txq.napi_initialized) { @@ -2113,6 +2114,7 @@ static void mana_destroy_rxq(struct mana_port_context *apc, return; debugfs_remove_recursive(rxq->mana_rx_debugfs); + rxq->mana_rx_debugfs = NULL; napi = &rxq->rx_cq.napi; -- 2.34.1

6 months

3
2
0 0

Linux 6.13.7

by Greg Kroah-Hartman

I'm announcing the release of the 6.13.7 kernel. All users of the 6.13 kernel series must upgrade. The updated 6.13.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.13.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/sysctl/kernel.rst | 11 Documentation/devicetree/bindings/iio/adc/adi,ad7606.yaml | 1 Makefile | 7 arch/arm/mm/fault-armv.c | 37 +- arch/arm64/include/asm/hugetlb.h | 4 arch/arm64/mm/hugetlbpage.c | 61 +--- arch/loongarch/include/asm/bug.h | 13 arch/loongarch/include/asm/hugetlb.h | 6 arch/loongarch/kernel/machine_kexec.c | 4 arch/loongarch/kernel/setup.c | 3 arch/loongarch/kernel/smp.c | 47 +++ arch/loongarch/kvm/exit.c | 6 arch/loongarch/kvm/main.c | 7 arch/loongarch/kvm/vcpu.c | 2 arch/loongarch/kvm/vm.c | 6 arch/loongarch/mm/mmap.c | 6 arch/mips/include/asm/hugetlb.h | 6 arch/parisc/include/asm/hugetlb.h | 2 arch/parisc/mm/hugetlbpage.c | 2 arch/powerpc/include/asm/hugetlb.h | 6 arch/riscv/include/asm/hugetlb.h | 3 arch/riscv/mm/hugetlbpage.c | 2 arch/s390/include/asm/hugetlb.h | 18 - arch/s390/kernel/traps.c | 6 arch/s390/mm/hugetlbpage.c | 4 arch/sparc/include/asm/hugetlb.h | 2 arch/sparc/mm/hugetlbpage.c | 2 arch/x86/boot/compressed/pgtable_64.c | 2 arch/x86/include/asm/kvm_host.h | 1 arch/x86/kernel/amd_nb.c | 9 arch/x86/kernel/cpu/cacheinfo.c | 2 arch/x86/kernel/cpu/intel.c | 52 ++- arch/x86/kernel/cpu/microcode/amd.c | 6 arch/x86/kernel/cpu/sgx/ioctl.c | 7 arch/x86/kvm/cpuid.c | 2 arch/x86/kvm/svm/sev.c | 13 arch/x86/kvm/svm/svm.c | 49 +++ arch/x86/kvm/svm/svm.h | 2 arch/x86/kvm/svm/vmenter.S | 10 arch/x86/kvm/vmx/vmx.c | 8 arch/x86/kvm/vmx/vmx.h | 2 arch/x86/kvm/x86.c | 2 block/partitions/efi.c | 2 drivers/base/core.c | 1 drivers/block/ublk_drv.c | 7 drivers/bluetooth/btusb.c | 1 drivers/bus/mhi/host/pci_generic.c | 5 drivers/cdx/cdx.c | 6 drivers/char/misc.c | 2 drivers/gpio/gpio-aggregator.c | 20 + drivers/gpio/gpio-rcar.c | 31 +- drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 4 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 12 drivers/gpu/drm/imagination/pvr_fw_meta.c | 6 drivers/gpu/drm/imagination/pvr_fw_trace.c | 4 drivers/gpu/drm/imagination/pvr_queue.c | 18 - drivers/gpu/drm/imagination/pvr_queue.h | 4 drivers/gpu/drm/imagination/pvr_vm.c | 134 +++++++-- drivers/gpu/drm/imagination/pvr_vm.h | 3 drivers/gpu/drm/nouveau/Kconfig | 1 drivers/gpu/drm/radeon/r300.c | 3 drivers/gpu/drm/radeon/radeon_asic.h | 1 drivers/gpu/drm/radeon/rs400.c | 18 + drivers/gpu/drm/scheduler/gpu_scheduler_trace.h | 4 drivers/gpu/drm/tiny/bochs.c | 5 drivers/gpu/drm/xe/display/xe_plane_initial.c | 10 drivers/gpu/drm/xe/xe_gt.c | 4 drivers/gpu/drm/xe/xe_hmm.c | 188 +++++++++---- drivers/gpu/drm/xe/xe_hmm.h | 7 drivers/gpu/drm/xe/xe_pt.c | 96 +++--- drivers/gpu/drm/xe/xe_pt_walk.c | 3 drivers/gpu/drm/xe/xe_pt_walk.h | 4 drivers/gpu/drm/xe/xe_vm.c | 100 ++++--- drivers/gpu/drm/xe/xe_vm.h | 10 drivers/gpu/drm/xe/xe_vm_types.h | 8 drivers/hid/hid-appleir.c | 2 drivers/hid/hid-corsair-void.c | 83 +++-- drivers/hid/hid-google-hammer.c | 2 drivers/hid/hid-steam.c | 2 drivers/hid/intel-ish-hid/ishtp-hid-client.c | 2 drivers/hid/intel-ish-hid/ishtp-hid.c | 4 drivers/hwmon/ad7314.c | 10 drivers/hwmon/ntc_thermistor.c | 66 ++-- drivers/hwmon/peci/dimmtemp.c | 10 drivers/hwmon/pmbus/pmbus.c | 2 drivers/hwmon/xgene-hwmon.c | 2 drivers/hwtracing/intel_th/pci.c | 15 + drivers/iio/adc/ad7192.c | 2 drivers/iio/adc/ad7606.c | 2 drivers/iio/adc/at91-sama5d2_adc.c | 68 ++-- drivers/iio/dac/ad3552r.c | 6 drivers/iio/filter/admv8818.c | 14 drivers/iio/light/apds9306.c | 4 drivers/iio/light/hid-sensor-prox.c | 7 drivers/misc/cardreader/rtsx_usb.c | 15 - drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 drivers/misc/mei/hw-me-regs.h | 2 drivers/misc/mei/pci-me.c | 2 drivers/misc/mei/vsc-tp.c | 2 drivers/net/caif/caif_virtio.c | 2 drivers/net/dsa/mt7530.c | 8 drivers/net/ethernet/emulex/benet/be.h | 2 drivers/net/ethernet/emulex/benet/be_cmds.c | 197 ++++++-------- drivers/net/ethernet/emulex/benet/be_main.c | 2 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 6 drivers/net/ipa/data/ipa_data-v4.7.c | 18 - drivers/net/mctp/mctp-i3c.c | 3 drivers/net/phy/phy.c | 43 +++ drivers/net/phy/phy_device.c | 2 drivers/net/ppp/ppp_generic.c | 28 + drivers/net/wireless/intel/iwlwifi/fw/dump.c | 3 drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 77 +++-- drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 7 drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 5 drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 6 drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 23 - drivers/nvme/host/ioctl.c | 12 drivers/nvme/host/tcp.c | 81 +++++ drivers/nvme/target/nvmet.h | 1 drivers/nvme/target/tcp.c | 15 - drivers/of/of_reserved_mem.c | 4 drivers/platform/x86/thinkpad_acpi.c | 1 drivers/rapidio/devices/rio_mport_cdev.c | 3 drivers/rapidio/rio-scan.c | 5 drivers/slimbus/messaging.c | 5 drivers/usb/atm/cxacru.c | 13 drivers/usb/core/hub.c | 33 ++ drivers/usb/core/quirks.c | 4 drivers/usb/dwc3/core.c | 85 +++--- drivers/usb/dwc3/core.h | 2 drivers/usb/dwc3/drd.c | 4 drivers/usb/dwc3/gadget.c | 10 drivers/usb/gadget/composite.c | 17 - drivers/usb/gadget/function/u_ether.c | 4 drivers/usb/host/xhci-hub.c | 8 drivers/usb/host/xhci-mem.c | 3 drivers/usb/host/xhci-pci.c | 10 drivers/usb/host/xhci.c | 6 drivers/usb/host/xhci.h | 2 drivers/usb/renesas_usbhs/common.c | 6 drivers/usb/renesas_usbhs/mod_gadget.c | 2 drivers/usb/typec/tcpm/tcpci_rt1711h.c | 11 drivers/usb/typec/ucsi/ucsi.c | 25 - drivers/usb/typec/ucsi/ucsi.h | 2 drivers/usb/typec/ucsi/ucsi_acpi.c | 21 - drivers/usb/typec/ucsi/ucsi_ccg.c | 1 drivers/usb/typec/ucsi/ucsi_glink.c | 1 drivers/usb/typec/ucsi/ucsi_stm32g0.c | 1 drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 1 drivers/virt/acrn/hsm.c | 6 drivers/virt/coco/sev-guest/sev-guest.c | 24 + fs/btrfs/inode.c | 9 fs/btrfs/volumes.c | 1 fs/coredump.c | 15 - fs/exfat/balloc.c | 10 fs/exfat/exfat_fs.h | 2 fs/exfat/fatent.c | 11 fs/exfat/file.c | 2 fs/exfat/namei.c | 2 fs/nfs/file.c | 3 fs/smb/client/cifsglob.h | 6 fs/smb/client/inode.c | 2 fs/smb/client/reparse.h | 28 + fs/smb/client/smb1ops.c | 4 fs/smb/client/smb2inode.c | 4 fs/smb/client/smb2ops.c | 3 fs/smb/server/smb2pdu.c | 8 fs/smb/server/smbacl.c | 16 + fs/smb/server/transport_ipc.c | 1 include/asm-generic/hugetlb.h | 2 include/linux/compaction.h | 5 include/linux/cred.h | 9 include/linux/ethtool.h | 23 + include/linux/hugetlb.h | 4 include/linux/nvme-tcp.h | 2 include/linux/phy.h | 36 ++ include/linux/phylib_stubs.h | 42 ++ include/linux/sched.h | 2 kernel/events/core.c | 4 kernel/sched/fair.c | 6 kernel/trace/trace_fprobe.c | 15 + kernel/trace/trace_probe.h | 2 mm/compaction.c | 3 mm/hugetlb.c | 4 mm/internal.h | 5 mm/kmsan/hooks.c | 1 mm/memory-failure.c | 63 ++-- mm/memory.c | 21 - mm/memory_hotplug.c | 26 - mm/page_alloc.c | 4 mm/userfaultfd.c | 17 + mm/vma.c | 12 mm/vmalloc.c | 4 net/8021q/vlan.c | 3 net/bluetooth/mgmt.c | 5 net/ethtool/cabletest.c | 8 net/ethtool/linkstate.c | 26 + net/ethtool/netlink.c | 6 net/ethtool/netlink.h | 5 net/ethtool/phy.c | 2 net/ethtool/plca.c | 6 net/ethtool/pse-pd.c | 4 net/ethtool/stats.c | 18 + net/ethtool/strset.c | 2 net/ipv4/tcp_offload.c | 11 net/ipv4/udp_offload.c | 8 net/ipv6/ila/ila_lwt.c | 4 net/llc/llc_s_ac.c | 49 +-- net/mac80211/ieee80211_i.h | 2 net/mac80211/mlme.c | 1 net/mac80211/parse.c | 164 ++++++++--- net/mptcp/pm_netlink.c | 18 + net/wireless/nl80211.c | 5 net/wireless/reg.c | 3 rust/kernel/block/mq/gen_disk.rs | 6 sound/core/seq/seq_clientmgr.c | 46 ++- sound/pci/hda/Kconfig | 1 sound/pci/hda/hda_intel.c | 2 sound/pci/hda/patch_realtek.c | 107 ++++++- sound/usb/usx2y/usbusx2y.c | 11 sound/usb/usx2y/usbusx2y.h | 26 + sound/usb/usx2y/usbusx2yaudio.c | 27 - tools/testing/selftests/damon/damon_nr_regions.py | 2 tools/testing/selftests/damon/damos_quota.py | 9 tools/testing/selftests/damon/damos_quota_goal.py | 3 tools/testing/selftests/mm/hugepage-mremap.c | 2 tools/testing/selftests/mm/ksm_functional_tests.c | 8 tools/testing/selftests/mm/memfd_secret.c | 14 tools/testing/selftests/mm/mkdirty.c | 8 tools/testing/selftests/mm/mlock2.h | 1 tools/testing/selftests/mm/protection_keys.c | 2 tools/testing/selftests/mm/uffd-common.c | 4 tools/testing/selftests/mm/uffd-stress.c | 15 - tools/testing/selftests/mm/uffd-unit-tests.c | 14 usr/include/Makefile | 2 239 files changed, 2390 insertions(+), 1068 deletions(-) Ahmed S. Darwish (3): x86/cacheinfo: Validate CPUID leaf 0x2 EDX output x86/cpu: Validate CPUID leaf 0x2 EDX output x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 Alessio Belle (1): drm/imagination: Fix timestamps in firmware traces Alexander Shishkin (2): intel_th: pci: Add Panther Lake-H support intel_th: pci: Add Panther Lake-P/U support Alexander Usyskin (1): mei: me: add panther lake P DID Andrei Kuchynski (1): usb: typec: ucsi: Fix NULL pointer access Andrew Cooper (1): x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Andrew Martin (1): drm/amdkfd: Fix NULL Pointer Dereference in KFD queue Andy Shevchenko (1): eeprom: digsy_mtc: Make GPIO lookup table match the device Angelo Dureghello (3): iio: dac: ad3552r: clear reset status flag dt-bindings: iio: dac: adi-axi-adc: fix ad7606 pwm-names iio: adc: ad7606: fix wrong scale available AngeloGioacchino Del Regno (1): usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality Antheas Kapenekakis (1): ALSA: hda/realtek: Remove (revert) duplicate Ally X config Antoine Tenart (1): net: gso: fix ownership in __udp_gso_segment Ard Biesheuvel (1): x86/boot: Sanitize boot params before parsing command line Arnd Bergmann (2): kbuild: hdrcheck: fix cross build with clang ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage Badhri Jagan Sridharan (1): usb: dwc3: gadget: Prevent irq storm when TH re-executes Benjamin Berg (1): wifi: iwlwifi: mvm: log error for failures after D3 Bibo Mao (5): LoongArch: Set hugetlb mmap base address aligned with pmd size LoongArch: Set max_pfn with the PFN of the last page LoongArch: KVM: Add interrupt checking for AVEC LoongArch: KVM: Reload guest CSR registers after sleep LoongArch: KVM: Fix GPA size issue about VM Borislav Petkov (AMD) (1): x86/microcode/AMD: Add some forgotten models to the SHA check Brendan King (3): drm/imagination: avoid deadlock on fence release drm/imagination: Hold drm_gem_gpuva lock for unmap drm/imagination: only init job done fences once Brian Geffon (1): mm: fix finish_fault() handling for large folios Christian A. Ehrhardt (1): acpi: typec: ucsi: Introduce a ->poll_cci method Christian Brauner (1): cred: return old creds from revert_creds_light() Christian Heusel (1): Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" Claudiu Beznea (3): usb: renesas_usbhs: Call clk_put() usb: renesas_usbhs: Use devm_usb_get_phy() usb: renesas_usbhs: Flush the notify_hotplug_work Dan Carpenter (1): nvme-tcp: fix signedness bug in nvme_tcp_init_connection() Daniil Dulov (1): HID: appleir: Fix potential NULL dereference at raw event handle Dave Airlie (1): drm/nouveau: select FW caching Emmanuel Grumbach (2): wifi: iwlwifi: mvm: don't dump the firmware state upon RFKILL while suspend wifi: iwlwifi: mvm: don't try to talk to a dead firmware Eric Dumazet (1): llc: do not use skb_get() before dev_queue_xmit() Eric Sandeen (1): exfat: short-circuit zero-byte writes in exfat_file_write_iter Erik Schumacher (1): hwmon: (ad7314) Validate leading zero bits and return error Fabrizio Castro (1): gpio: rcar: Fix missing of_node_put() call Fedor Pchelkin (1): usb: typec: ucsi: increase timeout for PPM reset operations Gabriel Krisman Bertazi (1): Revert "mm/page_alloc.c: don't show protection in zone's ->lowmem_reserve[] for empty zone" Greg Kroah-Hartman (1): Linux 6.13.7 Hans de Goede (1): mei: vsc: Use "wakeuphostint" when getting the host wakeup GPIO Hao Zhang (1): mm/page_alloc: fix uninitialized variable Haoxiang Li (5): btrfs: fix a leaked chunk map issue in read_one_chunk() Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() rapidio: add check for rio_add_net() in rio_scan_alloc_net() rapidio: fix an API misues when rio_add_net() fails Haoyu Li (1): drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl Heiko Carstens (1): s390/traps: Fix test_monitor_call() inline assembly Herbert Xu (1): cred: Fix RCU warnings in override/revert_creds Hoku Ishibe (1): ALSA: hda: intel: Add Dell ALC3271 to power_save denylist Huacai Chen (1): LoongArch: Use polling play_dead() when resuming from hibernation Ilan Peer (4): wifi: iwlwifi: Free pages allocated when failing to build A-MSDU wifi: iwlwifi: Fix A-MSDU TSO preparation wifi: mac80211: Support parsing EPCS ML element wifi: iwlwifi: pcie: Fix TSO preparation Jakub Kicinski (1): net: ethtool: plumb PHY stats to PHY drivers Jarkko Sakkinen (1): x86/sgx: Fix size overflows in sgx_encl_create() Jason Xing (1): net-timestamp: support TCP GSO case for a few missing flags Javier Carrasco (1): iio: light: apds9306: fix max_scale_nano values Jiayuan Chen (1): ppp: Fix KMSAN uninit-value warning with bpf Johannes Berg (4): wifi: iwlwifi: mvm: clean up ROC on failure wifi: iwlwifi: limit printed string from FW file wifi: mac80211: fix MLE non-inheritance parsing wifi: mac80211: fix vendor-specific inheritance John Hubbard (1): Revert "selftests/mm: remove local __NR_* definitions" Justin Iurman (2): net: ipv6: fix dst ref loop in ila lwtunnel net: ipv6: fix missing dst ref drop in ila lwtunnel Kailang Yang (2): ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform ALSA: hda/realtek: update ALC222 depop optimize Kees Cook (1): coredump: Only sort VMAs when core_sort_vma sysctl is set Keith Busch (1): nvme-ioctl: fix leaked requests on mapping error Kenneth Feng (1): drm/amd/pm: always allow ih interrupt from fw Koichiro Den (1): gpio: aggregator: protect driver attr handlers against module unload Krister Johansen (1): mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr Lorenzo Bianconi (1): net: dsa: mt7530: Fix traffic flooding for MMIO devices Lorenzo Stoakes (1): mm: abort vma_modify() on merge out of memory failure Luca Ceresoli (1): drivers: core: fix device leak in __fw_devlink_relax_cycles() Luca Weiss (3): net: ipa: Fix v4.7 resource group names net: ipa: Fix QSB data for v4.7 net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7 Ma Ke (1): drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params Ma Wupeng (3): mm: memory-failure: update ttu flag inside unmap_poisoned_folio hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio mm: memory-hotplug: check folio ref count first in do_migrate_range Maarten Lankhorst (1): drm/xe: Remove double pageflip Manivannan Sadhasivam (1): bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock Marc Zyngier (1): xhci: Restrict USB4 tunnel detection for USB3 devices to Intel hosts Marek Szyprowski (1): usb: gadget: Fix setting self-powered state on suspend Markus Burri (1): iio: adc: ad7192: fix channel select Masami Hiramatsu (Google) (3): tracing: tprobe-events: Fix a memory leak when tprobe with $retval tracing: tprobe-events: Reject invalid tracepoint name tracing: probe-events: Remove unused MAX_ARG_BUF_LEN macro Matt Johnston (1): mctp i3c: handle NULL header address Matthew Auld (1): drm/xe/userptr: properly setup pfn_flags_mask Matthew Brost (1): drm/xe: Add staging tree for VM binds Maud Spierings (1): hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table Maurizio Lombardi (4): nvmet: remove old function prototype nvme-tcp: add basic support for the C2HTermReq PDU nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme-tcp: Fix a C2HTermReq error message Maxime Chevallier (1): net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device Meir Elisha (1): nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch Miao Li (1): usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader Michal Pecio (2): usb: xhci: Fix host controllers "dying" after suspend and resume usb: xhci: Enable the TRB overfetch quirk on VIA VL805 Mike Snitzer (1): NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Mingcong Bai (1): platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e Miri Korenblit (1): wifi: iwlwifi: fw: avoid using an uninitialized variable Murad Masimov (1): ALSA: usx2y: validate nrpacks module parameter on probe Namjae Jeon (5): ksmbd: fix type confusion via race condition when using ipc_msg_send_request ksmbd: fix out-of-bounds in parse_sec_desc() ksmbd: fix use-after-free in smb2_lock ksmbd: fix bug on trap in smb2_lock exfat: fix soft lockup in exfat_clear_bitmap Naohiro Aota (1): btrfs: zoned: fix extent range end unlock in cow_file_range() Nayab Sayed (1): iio: adc: at91-sama5d2_adc: fix sama7g5 realbits value Nikita Zhandarovich (2): wifi: cfg80211: regulatory: improve invalid hints checking usb: atm: cxacru: fix a flaw in existing endpoint checks Niklas Söderlund (1): gpio: rcar: Use raw_spinlock to protect register access Nikolay Aleksandrov (1): be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink Nikunj A Dadhania (1): virt: sev-guest: Allocate request data dynamically Oleksij Rempel (1): ethtool: linkstate: migrate linkstate functions to support multi-PHY setups Olivier Gayot (1): block: fix conversion of GPT partition name to 7-bit Oscar Maes (1): vlan: enforce underlying device type Pali Rohár (1): cifs: Remove symlink member from cifs_open_info_data union Paul Fertser (1): hwmon: (peci/dimmtemp) Do not provide fake thresholds data Pawel Chmielewski (1): intel_th: pci: Add Arrow Lake support Pawel Laszczak (1): usb: hub: lack of clearing xHC resources Peiyang Wang (1): net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error Peter Zijlstra (2): loongarch: Use ASM_REACHABLE perf/core: Fix pmus_lock vs. pmus_srcu ordering Philipp Stanner (2): stmmac: loongson: Pass correct arg to PCI function drm/sched: Fix preprocessor guard Prashanth K (3): usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails usb: gadget: Set self-powered based on MaxPower and bmAttributes usb: gadget: Check bmAttributes only if configuration is valid Qi Zheng (1): arm: pgtable: fix NULL pointer dereference issue Qiu-ji Chen (1): cdx: Fix possible UAF error in driver_override_show() Ricardo Ribalda (1): iio: hid-sensor-prox: Split difference from multiple channels Richard Thier (1): drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M Rob Herring (Arm) (1): Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" Ryan Roberts (3): mm: don't skip arch_sync_kernel_mappings() in error paths mm: hugetlb: Add huge page size param to huge_ptep_get_and_clear() arm64: hugetlb: Fix huge_ptep_get_and_clear() for non-present ptes Salah Triki (1): bluetooth: btusb: Initialize .owner field of force_poll_sync_fops Sam Winchenbach (1): iio: filter: admv8818: Force initialization of SDO Sean Christopherson (7): KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow KVM: SVM: Save host DR masks on CPUs with DebugSwap KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value KVM: SVM: Suppress DEBUGCTL.BTF on AMD KVM: x86: Snapshot the host's DEBUGCTL in common x86 KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization is disabled KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs Sebastian Andrzej Siewior (1): dma: kmsan: export kmsan_handle_dma() for modules SeongJae Park (4): selftests/damon/damos_quota_goal: handle minimum quota that cannot be further reduced selftests/damon/damos_quota: make real expectation of quota exceeds selftests/damon/damon_nr_regions: set ops update for merge results check to 100ms selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries Steve French (1): smb311: failure to open files of length 1040 when mounting with SMB3.1.1 POSIX extensions Stuart Hayhurst (1): HID: corsair-void: Update power supply values with a unified work handler Suren Baghdasaryan (1): userfaultfd: do not block on locking a large folio with raised refcount Takashi Iwai (2): ALSA: seq: Avoid module auto-load handling at event delivery drm/bochs: Fix DPMS regression Thadeu Lima de Souza Cascardo (1): char: misc: deallocate static minor in error path Thinh Nguyen (1): usb: dwc3: Set SUSPENDENABLE soon after phy init Thomas Hellström (6): drm/xe/hmm: Style- and include fixes drm/xe/hmm: Don't dereference struct page pointers without notifier lock drm/xe/vm: Fix a misplaced #endif drm/xe/vm: Validate userptr during gpu vma prefetching drm/xe: Fix fault mode invalidation with unbind drm/xe/userptr: Unmap userptrs in the mmu notifier Thomas Weißschuh (1): kbuild: userprogs: use correct lld when linking through clang Tiezhu Yang (1): LoongArch: Convert unreachable() to BUG() Titus Rwantare (1): hwmon: (pmbus) Initialise page count in pmbus_identify() Tvrtko Ursulin (1): drm/xe: Fix GT "for each engine" workarounds Uday Shankar (1): ublk: set_params: properly check if parameters can be applied Vicki Pfau (1): HID: hid-steam: Fix use-after-free when detaching device Visweswara Tanuku (1): slimbus: messaging: Free transaction ID in delayed interrupt scenario Vitaliy Shevtsov (2): wifi: nl80211: reject cooked mode if it is set along with other flags caif_virtio: fix wrong pointer check in cfv_probe() Xiaoyao Li (1): KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't supported by KVM Xinghuo Chen (1): hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() Yu-Chun Lin (1): HID: google: fix unused variable warning under !CONFIG_ACPI Yuezhang Mo (1): exfat: fix just enough dentries but allocate a new cluster to dir Yutaro Ohno (1): rust: block: fix formatting in GenDisk doc Zecheng Li (1): sched/fair: Fix potential memory corruption in child_cfs_rq_on_list Zhang Lixu (2): HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

6 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2025