August 2025 - Linux-stable-mirror

[PATCH v3] usb:xhci:Fix slot_id resource race conflict

by Weitao Wang

In such a scenario, device-A with slot_id equal to 1 is disconnecting while device-B is enumerating, device-B will fail to enumerate in the follow sequence. 1.[device-A] send disable slot command 2.[device-B] send enable slot command 3.[device-A] disable slot command completed and wakeup waiting thread 4.[device-B] enable slot command completed with slot_id equal to 1 and wakeup waiting thread 5.[device-B] driver check this slot_id was used by someone(device-A) in xhci_alloc_virt_device, this device fails to enumerate as this conflict 6.[device-A] xhci->devs[slot_id] set to NULL in xhci_free_virt_device To fix driver's slot_id resources conflict, clear xhci->devs[slot_id] and xhci->dcbba->dev_context_ptrs[slot_id] pointers in the interrupt context when disable slot command completes successfully. Simultaneously, adjust function xhci_free_virt_device to accurately handle device release. Cc: stable(a)vger.kernel.org Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend") Signed-off-by: Weitao Wang <WeitaoWang-oc(a)zhaoxin.com> --- v2->v3 - When disable slot command completes successfully, only clear some strategic pointers instead of calling xhci_free_virt_device in the interrupt context. drivers/usb/host/xhci-hub.c | 3 +-- drivers/usb/host/xhci-mem.c | 20 +++++++++----------- drivers/usb/host/xhci-ring.c | 9 +++++++-- drivers/usb/host/xhci.c | 21 ++++++++++++++------- drivers/usb/host/xhci.h | 3 ++- 5 files changed, 33 insertions(+), 23 deletions(-) diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c index 92bb84f8132a..b3a59ce1b3f4 100644 --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -704,8 +704,7 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci, if (!xhci->devs[i]) continue; - retval = xhci_disable_slot(xhci, i); - xhci_free_virt_device(xhci, i); + retval = xhci_disable_and_free_slot(xhci, i); if (retval) xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", i, retval); diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 6680afa4f596..962b0c20b883 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -865,21 +865,18 @@ int xhci_alloc_tt_info(struct xhci_hcd *xhci, * will be manipulated by the configure endpoint, allocate device, or update * hub functions while this function is removing the TT entries from the list. */ -void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) +void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, + int slot_id) { - struct xhci_virt_device *dev; int i; int old_active_eps = 0; /* Slot ID 0 is reserved */ - if (slot_id == 0 || !xhci->devs[slot_id]) + if (slot_id == 0 || !dev) return; - dev = xhci->devs[slot_id]; - - xhci->dcbaa->dev_context_ptrs[slot_id] = 0; - if (!dev) - return; + if (xhci->dcbaa->dev_context_ptrs[slot_id] == cpu_to_le64(dev->out_ctx->dma)) + xhci->dcbaa->dev_context_ptrs[slot_id] = 0; trace_xhci_free_virt_device(dev); @@ -920,8 +917,9 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) dev->udev->slot_id = 0; if (dev->rhub_port && dev->rhub_port->slot_id == slot_id) dev->rhub_port->slot_id = 0; - kfree(xhci->devs[slot_id]); - xhci->devs[slot_id] = NULL; + if (xhci->devs[slot_id] == dev) + xhci->devs[slot_id] = NULL; + kfree(dev); } /* @@ -962,7 +960,7 @@ static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_i out: /* we are now at a leaf device */ xhci_debugfs_remove_slot(xhci, slot_id); - xhci_free_virt_device(xhci, slot_id); + xhci_free_virt_device(xhci, vdev, slot_id); } int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 94c9c9271658..7a440ec52ff6 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -1589,7 +1589,8 @@ static void xhci_handle_cmd_enable_slot(int slot_id, struct xhci_command *comman command->slot_id = 0; } -static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id) +static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id, + u32 cmd_comp_code) { struct xhci_virt_device *virt_dev; struct xhci_slot_ctx *slot_ctx; @@ -1604,6 +1605,10 @@ static void xhci_handle_cmd_disable_slot(struct xhci_hcd *xhci, int slot_id) if (xhci->quirks & XHCI_EP_LIMIT_QUIRK) /* Delete default control endpoint resources */ xhci_free_device_endpoint_resources(xhci, virt_dev, true); + if (cmd_comp_code == COMP_SUCCESS) { + xhci->dcbaa->dev_context_ptrs[slot_id] = 0; + xhci->devs[slot_id] = NULL; + } } static void xhci_handle_cmd_config_ep(struct xhci_hcd *xhci, int slot_id) @@ -1853,7 +1858,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci, xhci_handle_cmd_enable_slot(slot_id, cmd, cmd_comp_code); break; case TRB_DISABLE_SLOT: - xhci_handle_cmd_disable_slot(xhci, slot_id); + xhci_handle_cmd_disable_slot(xhci, slot_id, cmd_comp_code); break; case TRB_CONFIG_EP: if (!cmd->completion) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 8a819e853288..b1419e3ec7f9 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3930,8 +3930,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd, * Obtaining a new device slot to inform the xHCI host that * the USB device has been reset. */ - ret = xhci_disable_slot(xhci, udev->slot_id); - xhci_free_virt_device(xhci, udev->slot_id); + ret = xhci_disable_and_free_slot(xhci, udev->slot_id); if (!ret) { ret = xhci_alloc_dev(hcd, udev); if (ret == 1) @@ -4088,7 +4087,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) xhci_disable_slot(xhci, udev->slot_id); spin_lock_irqsave(&xhci->lock, flags); - xhci_free_virt_device(xhci, udev->slot_id); + xhci_free_virt_device(xhci, virt_dev, udev->slot_id); spin_unlock_irqrestore(&xhci->lock, flags); } @@ -4137,6 +4136,16 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) return 0; } +int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id) +{ + struct xhci_virt_device *vdev = xhci->devs[slot_id]; + int ret; + + ret = xhci_disable_slot(xhci, slot_id); + xhci_free_virt_device(xhci, vdev, slot_id); + return ret; +} + /* * Checks if we have enough host controller resources for the default control * endpoint. @@ -4243,8 +4252,7 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) return 1; disable_slot: - xhci_disable_slot(xhci, udev->slot_id); - xhci_free_virt_device(xhci, udev->slot_id); + xhci_disable_and_free_slot(xhci, udev->slot_id); return 0; } @@ -4380,8 +4388,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev, dev_warn(&udev->dev, "Device not responding to setup %s.\n", act); mutex_unlock(&xhci->mutex); - ret = xhci_disable_slot(xhci, udev->slot_id); - xhci_free_virt_device(xhci, udev->slot_id); + ret = xhci_disable_and_free_slot(xhci, udev->slot_id); if (!ret) { if (xhci_alloc_dev(hcd, udev) == 1) xhci_setup_addressable_virt_dev(xhci, udev); diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index a20f4e7cd43a..85d5b964bf1e 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1791,7 +1791,7 @@ void xhci_dbg_trace(struct xhci_hcd *xhci, void (*trace)(struct va_format *), /* xHCI memory management */ void xhci_mem_cleanup(struct xhci_hcd *xhci); int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags); -void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id); +void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, int slot_id); int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, struct usb_device *udev, gfp_t flags); int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev); void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci, @@ -1888,6 +1888,7 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev); int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev, struct usb_tt *tt, gfp_t mem_flags); int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); +int xhci_disable_and_free_slot(struct xhci_hcd *xhci, u32 slot_id); int xhci_ext_cap_init(struct xhci_hcd *xhci); int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); -- 2.32.0

2 months

3
2
0 0

[GIT PULL] virtio, vhost: features, fixes

by Michael S. Tsirkin

The following changes since commit 347e9f5043c89695b01e66b3ed111755afcf1911: Linux 6.16-rc6 (2025-07-13 14:25:58 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus for you to fetch changes up to c7991b44d7b44f9270dec63acd0b2965d29aab43: vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers (2025-07-17 08:33:09 -0400) ---------------------------------------------------------------- virtio, vhost: features, fixes vhost can now support legacy threading if enabled in Kconfig vsock memory allocation strategies for large buffers have been improved, reducing pressure on kmalloc vhost now supports the in-order feature guest bits missed the merge window fixes, cleanups all over the place Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> ---------------------------------------------------------------- Alexandre Courbot (1): media: add virtio-media driver Alok Tiwari (4): virtio: Fix typo in register_virtio_device() doc comment vhost-scsi: Fix typos and formatting in comments and logs vhost: Fix typos vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit Anders Roxell (1): vdpa: Fix IDR memory leak in VDUSE module exit Cindy Lu (1): vhost: Reintroduce kthread API and add mode selection Dr. David Alan Gilbert (2): vhost: vringh: Remove unused iotlb functions vhost: vringh: Remove unused functions Dragos Tatulea (2): vdpa/mlx5: Fix needs_teardown flag calculation vdpa/mlx5: Fix release of uninitialized resources on error path Gerd Hoffmann (1): drm/virtio: implement virtio_gpu_shutdown Jason Wang (3): vhost: fail early when __vhost_add_used() fails vhost: basic in order support vhost_net: basic in_order support Michael S. Tsirkin (6): virtio: document ENOSPC pci: report surprise removal event virtio: fix comments, readability virtio: pack config changed flags virtio: allow transports to suppress config change virtio: support device disconnect Mike Christie (1): vhost-scsi: Fix log flooding with target does not exist errors Pei Xiao (1): vhost: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...)) Viresh Kumar (2): virtio-mmio: Remove virtqueue list from mmio device virtio-vdpa: Remove virtqueue list WangYuli (1): virtio: virtio_dma_buf: fix missing parameter documentation Will Deacon (9): vhost/vsock: Avoid allocating arbitrarily-sized SKBs vsock/virtio: Validate length in packet header before skb_put() vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page vsock/virtio: Rename virtio_vsock_alloc_skb() vsock/virtio: Move SKB allocation lower-bound check to callers vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers vsock/virtio: Rename virtio_vsock_skb_rx_put() vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers MAINTAINERS | 6 + drivers/gpu/drm/virtio/virtgpu_drv.c | 8 +- drivers/media/Kconfig | 13 + drivers/media/Makefile | 2 + drivers/media/virtio/Makefile | 9 + drivers/media/virtio/protocol.h | 288 ++++++ drivers/media/virtio/scatterlist_builder.c | 563 ++++++++++++ drivers/media/virtio/scatterlist_builder.h | 111 +++ drivers/media/virtio/session.h | 109 +++ drivers/media/virtio/virtio_media.h | 93 ++ drivers/media/virtio/virtio_media_driver.c | 959 ++++++++++++++++++++ drivers/media/virtio/virtio_media_ioctls.c | 1297 ++++++++++++++++++++++++++++ drivers/pci/pci.h | 6 + drivers/vdpa/mlx5/core/mr.c | 3 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 12 +- drivers/vdpa/vdpa_user/vduse_dev.c | 1 + drivers/vhost/Kconfig | 18 + drivers/vhost/net.c | 88 +- drivers/vhost/scsi.c | 24 +- drivers/vhost/vhost.c | 377 +++++++- drivers/vhost/vhost.h | 30 +- drivers/vhost/vringh.c | 118 --- drivers/vhost/vsock.c | 15 +- drivers/virtio/virtio.c | 25 +- drivers/virtio/virtio_dma_buf.c | 2 + drivers/virtio/virtio_mmio.c | 52 +- drivers/virtio/virtio_pci_common.c | 45 + drivers/virtio/virtio_pci_common.h | 3 + drivers/virtio/virtio_pci_legacy.c | 2 + drivers/virtio/virtio_pci_modern.c | 2 + drivers/virtio/virtio_ring.c | 4 + drivers/virtio/virtio_vdpa.c | 44 +- include/linux/pci.h | 45 + include/linux/virtio.h | 13 +- include/linux/virtio_config.h | 32 + include/linux/virtio_vsock.h | 46 +- include/linux/vringh.h | 12 - include/uapi/linux/vhost.h | 29 + include/uapi/linux/virtio_ids.h | 1 + kernel/vhost_task.c | 2 +- net/vmw_vsock/virtio_transport.c | 20 +- net/vmw_vsock/virtio_transport_common.c | 3 +- 42 files changed, 4186 insertions(+), 346 deletions(-) create mode 100644 drivers/media/virtio/Makefile create mode 100644 drivers/media/virtio/protocol.h create mode 100644 drivers/media/virtio/scatterlist_builder.c create mode 100644 drivers/media/virtio/scatterlist_builder.h create mode 100644 drivers/media/virtio/session.h create mode 100644 drivers/media/virtio/virtio_media.h create mode 100644 drivers/media/virtio/virtio_media_driver.c create mode 100644 drivers/media/virtio/virtio_media_ioctls.c

2 months

1
2
0 0

Adjustments for pinctrl-amd debounce behavior

by Mario Limonciello

Hi, The issue that I originally fixed with commit 8ff4fb276e23 ("pinctrl: amd: Clear GPIO debounce for suspend") I have found out will be a problem on more platforms due to more designs switching to power button controlled this way. I think it would be a good idea to take it back to stable kernels. Thanks!

2 months

1
1
0 0

[GIT PULL] USB chipidea patches for linux-5.15.y and linux-6.1.y

by Xu Yang

Hi Greg, The below two patches are needed on linux-5.15.y and linux-6.1.y, please help to add them to the stable tree. b7a62611fab7 usb: chipidea: add USB PHY event 87ed257acb09 usb: phy: mxs: disconnect line when USB charger is attached They are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git branch usb-testing Thanks, Xu Yang

2 months

4
5
0 0

linux-6.6.y regression on amd-pstate

by Mario Limonciello

+ stable + regressions New subject Great news. Greg, Sasha, Can you please pull in these 3 commits specifically to 6.6.y to fix a regression that was reported by Morgan in 6.6.y: commit 12753d71e8c5 ("ACPI: CPPC: Add helper to get the highest performance value") commit ed429c686b79 ("cpufreq: amd-pstate: Enable amd-pstate preferred core support") commit 3d291fe47fe1 ("cpufreq: amd-pstate: fix the highest frequency issue which limits performance") Further details are below. Thanks! On 9/5/2024 16:09, Jones, Morgan wrote: > Mario, > > Confirmed. Thank you for the help! Slightly different refs on my end: > > Remotes: > > next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git (fetch) > next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git (push) > origin git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (fetch) > origin git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (push) > superm1 https://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux.git/ (fetch) > superm1 https://git.kernel.org/pub/scm/linux/kernel/git/superm1/linux.git/ (push) > torvalds git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git (fetch) > torvalds git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git (push) > > Patches: > > git format-patch 12753d71e8c5^..12753d71e8c5 > git format-patch f3a052391822b772b4e27f2594526cf1eb103cab^..f3a052391822b772b4e27f2594526cf1eb103cab > git format-patch bf202e654bfa57fb8cf9d93d4c6855890b70b9c4^..bf202e654bfa57fb8cf9d93d4c6855890b70b9c4 > > Results: > > Linux redact 6.6.48 #1-NixOS SMP PREEMPT_DYNAMIC Tue Jan 1 00:00:00 UTC 1980 x86_64 GNU/Linux > > analyzing CPU 56: > driver: amd-pstate-epp > CPUs which run at the same hardware frequency: 56 > CPUs which need to have their frequency coordinated by software: 56 > maximum transition latency: Cannot determine or is not supported. > hardware limits: 400 MHz - 3.35 GHz > available cpufreq governors: performance powersave > current policy: frequency should be within 400 MHz and 3.35 GHz. > The governor "performance" may decide which speed to use > within this range. > current CPU frequency: Unable to call hardware > current CPU frequency: 2.09 GHz (asserted by call to kernel) > boost state support: > Supported: yes > Active: yes > AMD PSTATE Highest Performance: 255. Maximum Frequency: 3.35 GHz. > AMD PSTATE Nominal Performance: 152. Nominal Frequency: 2.00 GHz. > AMD PSTATE Lowest Non-linear Performance: 115. Lowest Non-linear Frequency: 1.51 GHz. > AMD PSTATE Lowest Performance: 31. Lowest Frequency: 400 MHz. > > And our builds are back to being fast with `amd_pstate=active amd_prefcore=enable amd_pstate.shared_mem=1`. > > Morgan > > -----Original Message----- > From: Mario Limonciello <mario.limonciello(a)amd.com> > Sent: Thursday, September 5, 2024 8:12 AM > To: Jones, Morgan <Morgan.Jones(a)viasat.com> > Cc: linux-pm(a)vger.kernel.org; linux-kernel(a)vger.kernel.org; David Arcari <darcari(a)redhat.com>; Dhananjay Ugwekar <Dhananjay.Ugwekar(a)amd.com>; rafael(a)kernel.org; viresh.kumar(a)linaro.org; gautham.shenoy(a)amd.com; perry.yuan(a)amd.com; skhan(a)linuxfoundation.org; li.meng(a)amd.com; ray.huang(a)amd.com > Subject: Re: [EXTERNAL] Re: [PATCH v2 2/2] cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems > > Hi Morgan, > > Please apply these 3 commits: > > commit 12753d71e8c5 ("ACPI: CPPC: Add helper to get the highest performance value") commit ed429c686b79 ("cpufreq: amd-pstate: Enable amd-pstate preferred core support") commit 3d291fe47fe1 ("cpufreq: amd-pstate: fix the highest frequency issue which limits performance") > > The first two should help your system, the third will prevent introducing a regression on a different one. > > Assuming that works we should ask @stable to pull all 3 in to fix this regression. > > Thanks, > > On 9/4/2024 08:57, Mario Limonciello wrote: >> Morgan, >> >> I was referring specfiically to the version that landed in Linus' tree: >> https://urldefense.us/v3/__https://git.kernel.org/torvalds/c/8164f7433 >> 264__;!!C5Asm8uRnZQmlRln!aIZEDEbIUKD7OrxN0b0KjoqKYDL2yMkwk4EK7x_oSnyHQ >> 6MEq7yt6JHjd0TD9DgEYEWDcF58OKL8c7G11bT3dSqL8eM$ >> >> But yeah it's effectively the same thing. In any case, it's not the >> solution. >> >> We had some internal discussion and suspect this is due to missing >> prefcore patches in 6.6 as that feature landed in 6.9. We'll try to >> reproduce this on a Rome system and come back with our findings and >> suggestions what to do. >> >> Thanks, >> >

2 months

4
5
0 0

[PATCH 5.15.y] PCI: vmd: Assign VMD IRQ domain before enumeration

by Artur Piechocki

From: Nirmal Patel <nirmal.patel(a)linux.intel.com> [ Upstream commit 886e67100b904cb1b106ed1dfa8a60696aff519a ] During the boot process all the PCI devices are assigned default PCI-MSI IRQ domain including VMD endpoint devices. If interrupt-remapping is enabled by IOMMU, the PCI devices except VMD get new INTEL-IR-MSI IRQ domain. And VMD is supposed to create and assign a separate VMD-MSI IRQ domain for its child devices in order to support MSI-X remapping capabilities. Now when MSI-X remapping in VMD is disabled in order to improve performance, VMD skips VMD-MSI IRQ domain assignment process to its child devices. Thus the devices behind VMD get default PCI-MSI IRQ domain instead of INTEL-IR-MSI IRQ domain when VMD creates root bus and configures child devices. As a result host OS fails to boot and DMAR errors were observed when interrupt remapping was enabled on Intel Icelake CPUs. For instance: DMAR: DRHD: handling fault status reg 2 DMAR: [INTR-REMAP] Request device [0xe2:0x00.0] fault index 0xa00 [fault reason 0x25] Blocked a compatibility format interrupt request To fix this issue, dev_msi_info struct in dev struct maintains correct value of IRQ domain. VMD will use this information to assign proper IRQ domain to its child devices when it doesn't create a separate IRQ domain. Link: https://lore.kernel.org/r/20220511095707.25403-2-nirmal.patel@linux.intel.c… Signed-off-by: Nirmal Patel <nirmal.patel(a)linux.intel.com> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> (cherry picked from commit 886e67100b904cb1b106ed1dfa8a60696aff519a) [ This patch has already been backported to the Ubuntu 5.15 kernel and fixes boot issues on Intel platforms with VMD rev 04, confirmed on version 5.15.189. ] Signed-off-by: Artur Piechocki <artur.piechocki(a)open-e.com> --- drivers/pci/controller/vmd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c index 846590706a38..d0d18e9c6968 100644 --- a/drivers/pci/controller/vmd.c +++ b/drivers/pci/controller/vmd.c @@ -799,6 +799,9 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) vmd_attach_resources(vmd); if (vmd->irq_domain) dev_set_msi_domain(&vmd->bus->dev, vmd->irq_domain); + else + dev_set_msi_domain(&vmd->bus->dev, + dev_get_msi_domain(&vmd->dev->dev)); WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj, "domain"), "Can't create symlink to domain\n"); -- 2.50.1

2 months

1
0
0 0

[PATCH] HID: asus: fix UAF via HID_CLAIMED_INPUT validation

by Qasim Ijaz

After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support") Cc: stable(a)vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> --- drivers/hid/hid-asus.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 4b45e31f0bab..9bce9c84ab20 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1212,8 +1212,14 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) hid_err(hdev, "Asus hw start failed: %d\n", ret); return ret; } - - if (!drvdata->input) { + + /* + * Check that input registration succeeded. Checking that + * HID_CLAIMED_INPUT is set prevents a UAF when all input devices + * were freed during registration due to no usages being mapped, + * leaving drvdata->input pointing to freed memory. + */ + if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) { hid_err(hdev, "Asus input not registered\n"); ret = -ENOMEM; goto err_stop_hw; -- 2.39.5

2 months

1
0
0 0

[PATCH v2 RESEND] HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

by Qasim Ijaz

A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] <TASK> [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...] Fixes: c8000deb6836 ("HID: multitouch: Add support for GT7868Q") Cc: stable(a)vger.kernel.org Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> --- v2: - Simplify fix with a if-size check after discussion with Jiri Slaby - Change explanation of bug to reflect inclusion of a if-size check drivers/hid/hid-multitouch.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index 294516a8f541..22c6314a8843 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1503,6 +1503,14 @@ static const __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, if (hdev->vendor == I2C_VENDOR_ID_GOODIX && (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { + if (*size < 608) { + dev_info( + &hdev->dev, + "GT7868Q fixup: report descriptor is only %u bytes, skipping\n", + *size); + return rdesc; + } + if (rdesc[607] == 0x15) { rdesc[607] = 0x25; dev_info( -- 2.39.5

2 months

1
0
0 0

Linux 6.15.9

by Greg Kroah-Hartman

I'm announcing the release of the 6.15.9 kernel. All users of the 6.15 kernel series must upgrade. The updated 6.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/Kconfig | 2 arch/arm/Makefile | 2 arch/arm64/include/asm/assembler.h | 5 arch/arm64/kernel/entry.S | 6 arch/x86/hyperv/irqdomain.c | 4 arch/x86/include/asm/debugreg.h | 19 - arch/x86/include/asm/kvm_host.h | 2 arch/x86/kernel/cpu/common.c | 2 arch/x86/kernel/kgdb.c | 2 arch/x86/kernel/process_32.c | 2 arch/x86/kernel/process_64.c | 2 arch/x86/kvm/x86.c | 4 drivers/base/regmap/regmap.c | 2 drivers/bus/fsl-mc/fsl-mc-bus.c | 19 - drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.c | 44 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_sdma.h | 8 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 17 + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 drivers/gpu/drm/drm_buddy.c | 43 ++ drivers/gpu/drm/drm_gem_dma_helper.c | 2 drivers/gpu/drm/drm_gem_framebuffer_helper.c | 8 drivers/gpu/drm/drm_gem_shmem_helper.c | 10 drivers/gpu/drm/drm_prime.c | 8 drivers/gpu/drm/i915/display/intel_dp.c | 6 drivers/gpu/drm/scheduler/sched_entity.c | 21 - drivers/gpu/drm/xe/xe_lrc.c | 37 +- drivers/gpu/drm/xe/xe_lrc_types.h | 3 drivers/i2c/busses/i2c-qup.c | 4 drivers/i2c/busses/i2c-tegra.c | 24 - drivers/i2c/busses/i2c-virtio.c | 15 drivers/iio/adc/ad7949.c | 7 drivers/iio/industrialio-core.c | 5 drivers/infiniband/core/cache.c | 4 drivers/interconnect/icc-clk.c | 2 drivers/interconnect/qcom/sc7280.c | 1 drivers/net/can/dev/dev.c | 12 drivers/net/can/dev/netlink.c | 12 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 15 drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 15 drivers/net/ethernet/google/gve/gve_main.c | 67 ++-- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 31 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 36 +- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 9 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 drivers/net/ethernet/intel/e1000e/defines.h | 3 drivers/net/ethernet/intel/e1000e/ich8lan.c | 2 drivers/net/ethernet/intel/e1000e/nvm.c | 6 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 drivers/net/ethernet/intel/ice/ice_ddp.c | 2 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 108 +++--- drivers/net/ethernet/ti/icssg/icssg_config.c | 158 ++++++---- drivers/net/ethernet/ti/icssg/icssg_config.h | 80 ++++- drivers/net/ethernet/ti/icssg/icssg_prueth.c | 20 - drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 drivers/net/ethernet/ti/icssg/icssg_switch_map.h | 3 drivers/net/virtio_net.c | 6 drivers/pci/probe.c | 7 drivers/platform/mellanox/mlxbf-pmc.c | 25 + drivers/platform/x86/Makefile | 3 drivers/platform/x86/asus-nb-wmi.c | 9 drivers/platform/x86/dell/alienware-wmi-wmax.c | 1 drivers/platform/x86/ideapad-laptop.c | 4 drivers/regulator/core.c | 1 drivers/s390/net/ism_drv.c | 3 drivers/spi/spi-cadence-quadspi.c | 5 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 drivers/usb/typec/tcpm/tcpm.c | 64 ++-- drivers/virtio/virtio_ring.c | 8 fs/nilfs2/inode.c | 9 include/drm/drm_buddy.h | 2 include/linux/ism.h | 1 include/linux/sprintf.h | 1 include/net/xfrm.h | 2 kernel/bpf/verifier.c | 7 kernel/resource.c | 5 kernel/time/timekeeping.c | 2 mm/kasan/report.c | 4 mm/ksm.c | 6 mm/memory-failure.c | 4 mm/vmscan.c | 8 mm/zsmalloc.c | 3 net/appletalk/aarp.c | 24 + net/ipv4/xfrm4_input.c | 3 net/ipv6/xfrm6_input.c | 3 net/sched/sch_qfq.c | 7 net/xfrm/xfrm_device.c | 1 net/xfrm/xfrm_interface_core.c | 7 net/xfrm/xfrm_ipcomp.c | 2 net/xfrm/xfrm_state.c | 29 - net/xfrm/xfrm_user.c | 1 sound/pci/hda/hda_tegra.c | 51 ++- sound/pci/hda/patch_hdmi.c | 20 + sound/pci/hda/patch_realtek.c | 4 sound/soc/mediatek/common/mtk-soundcard-driver.c | 4 sound/soc/mediatek/mt8365/mt8365-dai-i2s.c | 3 tools/hv/hv_fcopy_uio_daemon.c | 37 -- tools/testing/selftests/bpf/progs/verifier_precision.c | 53 +++ tools/testing/selftests/drivers/net/lib/py/load.py | 23 + tools/testing/selftests/mm/split_huge_page_test.c | 3 tools/testing/selftests/net/mptcp/Makefile | 3 tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh | 5 tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh | 5 tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh | 5 109 files changed, 996 insertions(+), 450 deletions(-) Abdun Nihaal (1): regmap: fix potential memory leak of regmap_bus Ada Couprie Diaz (1): arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() Akhil R (1): i2c: tegra: Fix reset error handling with ACPI Akinobu Mita (1): resource: fix false warning in __request_region() Alessandro Carminati (1): regulator: core: fix NULL dereference on unbind due to stale coupling data Arunpravin Paneer Selvam (1): drm/amdgpu: Reset the clear flag in buddy during resume Chiara Meiohas (1): net/mlx5: Fix memory leak in cmd_exec() Daniel Dadap (1): ALSA: hda: Add missing NVIDIA HDA codec IDs David Lechner (1): iio: adc: ad7949: use spi_is_bpw_supported() Dawid Rezler (1): ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx Dennis Chen (1): i40e: report VF tx_dropped with tx_errors instead of tx_discards Dmitry Osipenko (1): drm/shmem-helper: Remove obsoleted is_iomem test Douglas Anderson (1): drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() Edip Hazuri (1): ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx Eyal Birger (1): xfrm: interface: fix use-after-free after changing collect_md xfrm interface Fernando Fernandez Mancera (1): xfrm: ipcomp: adjust transport header after decompressing Gabor Juhos (1): interconnect: icc-clk: destroy nodes in case of memory allocation failures Greg Kroah-Hartman (1): Linux 6.15.9 Guoqing Jiang (1): ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv Halil Pasic (1): s390/ism: fix concurrency management in ism_cmd() Haoxiang Li (1): ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Harry Yoo (1): mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n Himanshu Mittal (1): net: ti: icssg-prueth: Fix buffer allocation for ICSSG Jacek Kowalski (2): e1000e: disregard NVM checksum on tgp when valid checksum bit is not set e1000e: ignore uninitialized checksum word on tgp Jamie Bainbridge (1): i40e: When removing VF MAC filters, only check PF-set MAC Jesse Zhang (1): drm/amdgpu: Fix SDMA engine reset with logical instance ID Jesse.zhang(a)amd.com (2): drm/amdgpu: Add the new sdma function pointers for amdgpu_sdma.h drm/amdgpu: Implement SDMA soft reset directly for v5.x Jian Shen (2): net: hns3: fix concurrent setting vlan filter issue net: hns3: fixed vf get max channels bug Jijie Shao (1): net: hns3: default enable tx bounce buffer when smmu enabled Jinjiang Tu (1): mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list Johan Hovold (1): ASoC: mediatek: common: fix device and OF node leak Khairul Anuar Romli (1): spi: cadence-quadspi: fix cleanup of rx_chan on failure paths Kito Xu (veritas501) (1): net: appletalk: Fix use-after-free in AARP proxy probe Kurt Borja (1): platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array Laurent Vivier (2): virtio_net: Enforce minimum TX ring size for reliability virtio_ring: Fix error reporting in virtqueue_resize Leon Romanovsky (1): xfrm: always initialize offload path Lin.Cao (1): drm/sched: Remove optimization that causes hang when killing dependent jobs Ma Ke (3): bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() dpaa2-eth: Fix device reference count leak in MAC endpoint handling dpaa2-switch: Fix device reference count leak in MAC endpoint handling Manivannan Sadhasivam (1): PCI/pwrctrl: Create pwrctrl devices only when CONFIG_PCI_PWRCTRL is enabled Maor Gottlieb (1): RDMA/core: Rate limit GID cache warning messages Marc Kleine-Budde (1): can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Marco Elver (1): kasan: use vmalloc_dump_obj() for vmalloc error reports Mario Limonciello (1): drm/amd/display: Don't allow OLED to go down to fully off Markus Blöchl (1): timekeeping: Zero initialize system_counterval when querying time from phc drivers Markus Burri (1): iio: fix potential out-of-bound write Matthew Brost (1): drm/xe: Make WA BB part of LRC BO Matthieu Baerts (NGI0) (2): selftests: mptcp: connect: also cover alt modes selftests: mptcp: connect: also cover checksum Michael Grzeschik (2): usb: typec: tcpm: allow to use sink in accessory mode usb: typec: tcpm: allow switching to mode accessory to mux properly Mohan Kumar D (1): ALSA: hda/tegra: Add Tegra264 support Nathan Chancellor (3): mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 Nimrod Oren (1): selftests: drv-net: wait for iperf client to stop sending Nuno Das Neves (1): x86/hyperv: Fix usage of cpu_online_mask to get valid cpu Praveen Kaligineedi (1): gve: Fix stuck TX queue for DQ queue format RD Babiera (1): usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach Rahul Chandra (1): platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA Rong Zhang (2): platform/x86: ideapad-laptop: Fix FnLock not remembered among boots platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots Ryusuke Konishi (1): nilfs2: reject invalid file types when reading inodes SHARAN KUMAR M (1): ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop Sabrina Dubroca (2): xfrm: state: initialize state_ptrs earlier in xfrm_state_find xfrm: state: use a consistent pcpu_id in xfrm_state_find Shahar Shitrit (1): net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch Shravan Kumar Ramani (3): platform/mellanox: mlxbf-pmc: Remove newline char from event name input platform/mellanox: mlxbf-pmc: Validate event/enable input platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input Stefan Wahren (1): staging: vchiq_arm: Make vchiq_shutdown never fail Stephen Rothwell (1): sprintf.h requires stdarg.h Thomas Zimmermann (4): Revert "drm/prime: Use dma_buf from GEM object instance" Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance" Revert "drm/gem-dma: Use dma_buf from GEM object instance" Revert "drm/gem-shmem: Use dma_buf from GEM object instance" Tobias Brunner (1): xfrm: Set transport header to fix UDP GRO handling Torsten Hilbrich (1): platform/x86: Fix initialization order for firmware_attributes_class Ville Syrjälä (1): drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x Viresh Kumar (1): i2c: virtio: Avoid hang by using interruptible completion wait Xiang Mei (1): net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class Xilin Wu (1): interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node Xin Li (Intel) (1): x86/traps: Initialize DR7 by writing its architectural reset value Yang Xiwen (1): i2c: qup: jump out of the loop in case of timeout Yasumasa Suenaga (1): tools/hv: fcopy: Fix incorrect file path conversion Yonghong Song (1): selftests/bpf: Add tests with stack ptr register in conditional jmp Yonglong Liu (1): net: hns3: disable interrupt when ptp init failed Zi Yan (1): selftests/mm: fix split_huge_page_test for folio_split() tests

2 months

1
1
0 0

Linux 6.12.41

by Greg Kroah-Hartman

I'm announcing the release of the 6.12.41 kernel. All users of the 6.12 kernel series must upgrade. The updated 6.12.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.12.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ .clippy.toml | 2 Makefile | 2 arch/arm/Kconfig | 2 arch/arm/Makefile | 2 arch/arm64/boot/dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts | 2 arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 4 arch/arm64/include/asm/assembler.h | 5 arch/arm64/kernel/entry.S | 6 arch/powerpc/crypto/Kconfig | 1 arch/x86/hyperv/hv_init.c | 33 arch/x86/hyperv/hv_vtl.c | 44 arch/x86/hyperv/irqdomain.c | 4 arch/x86/hyperv/ivm.c | 22 arch/x86/include/asm/debugreg.h | 19 arch/x86/include/asm/kvm_host.h | 2 arch/x86/include/asm/mshyperv.h | 6 arch/x86/kernel/cpu/amd.c | 2 arch/x86/kernel/cpu/common.c | 2 arch/x86/kernel/kgdb.c | 2 arch/x86/kernel/process_32.c | 2 arch/x86/kernel/process_64.c | 2 arch/x86/kvm/cpuid.h | 1 arch/x86/kvm/emulate.c | 15 arch/x86/kvm/hyperv.c | 3 arch/x86/kvm/kvm_emulate.h | 5 arch/x86/kvm/mmu.h | 1 arch/x86/kvm/mmu/mmu.c | 2 arch/x86/kvm/mtrr.c | 1 arch/x86/kvm/vmx/hyperv.c | 1 arch/x86/kvm/vmx/nested.c | 24 arch/x86/kvm/vmx/pmu_intel.c | 2 arch/x86/kvm/vmx/sgx.c | 5 arch/x86/kvm/vmx/vmx.c | 4 arch/x86/kvm/x86.c | 19 arch/x86/kvm/x86.h | 48 drivers/base/regmap/regmap.c | 2 drivers/bus/fsl-mc/fsl-mc-bus.c | 19 drivers/comedi/drivers/comedi_test.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 17 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 2 drivers/gpu/drm/drm_buddy.c | 43 drivers/gpu/drm/i915/display/intel_dp.c | 6 drivers/gpu/drm/scheduler/sched_entity.c | 21 drivers/gpu/drm/xe/tests/xe_mocs.c | 21 drivers/gpu/drm/xe/xe_devcoredump.c | 14 drivers/gpu/drm/xe/xe_force_wake.h | 16 drivers/gpu/drm/xe/xe_gt.c | 105 -- drivers/hv/vmbus_drv.c | 2 drivers/i2c/busses/i2c-qup.c | 4 drivers/i2c/busses/i2c-tegra.c | 24 drivers/i2c/busses/i2c-virtio.c | 15 drivers/iio/adc/ad7949.c | 7 drivers/iio/light/hid-sensor-prox.c | 8 drivers/infiniband/core/cache.c | 4 drivers/input/keyboard/gpio_keys.c | 4 drivers/interconnect/qcom/sc7280.c | 1 drivers/mtd/nand/raw/qcom_nandc.c | 12 drivers/net/can/dev/dev.c | 12 drivers/net/can/dev/netlink.c | 12 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 15 drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 15 drivers/net/ethernet/google/gve/gve_main.c | 67 - drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 31 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 36 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 9 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 drivers/net/ethernet/intel/e1000e/defines.h | 3 drivers/net/ethernet/intel/e1000e/ich8lan.c | 2 drivers/net/ethernet/intel/e1000e/nvm.c | 6 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 drivers/net/ethernet/intel/ice/ice_ddp.c | 2 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 108 +- drivers/net/ethernet/ti/icssg/icssg_config.c | 158 ++- drivers/net/ethernet/ti/icssg/icssg_config.h | 80 + drivers/net/ethernet/ti/icssg/icssg_prueth.c | 20 drivers/net/ethernet/ti/icssg/icssg_prueth.h | 2 drivers/net/ethernet/ti/icssg/icssg_switch_map.h | 3 drivers/net/virtio_net.c | 6 drivers/net/wireless/mediatek/mt76/mt7925/main.c | 76 - drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 106 +- drivers/net/wireless/mediatek/mt76/mt7925/mcu.h | 2 drivers/net/wireless/mediatek/mt76/mt7925/mt7925.h | 2 drivers/platform/mellanox/mlxbf-pmc.c | 25 drivers/platform/x86/Makefile | 3 drivers/platform/x86/asus-nb-wmi.c | 9 drivers/platform/x86/ideapad-laptop.c | 4 drivers/regulator/core.c | 1 drivers/s390/net/ism_drv.c | 3 drivers/spi/spi-cadence-quadspi.c | 5 drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 drivers/usb/typec/tcpm/tcpm.c | 64 - drivers/virtio/virtio_ring.c | 8 fs/erofs/internal.h | 13 fs/erofs/zdata.c | 2 fs/erofs/zmap.c | 246 +--- fs/ext4/ext4.h | 2 fs/ext4/extents.c | 518 +++------- fs/ext4/inode.c | 140 +- fs/jfs/jfs_imap.c | 13 fs/nilfs2/inode.c | 9 include/drm/drm_buddy.h | 2 include/linux/ism.h | 1 include/linux/sprintf.h | 1 kernel/bpf/verifier.c | 7 kernel/resource.c | 5 kernel/time/timekeeping.c | 2 mm/kasan/report.c | 4 mm/khugepaged.c | 4 mm/ksm.c | 6 mm/memory-failure.c | 4 mm/vmscan.c | 8 mm/zsmalloc.c | 3 net/appletalk/aarp.c | 24 net/ipv4/xfrm4_input.c | 3 net/ipv6/xfrm6_input.c | 3 net/sched/sch_qfq.c | 7 net/xfrm/xfrm_interface_core.c | 7 net/xfrm/xfrm_state.c | 23 sound/pci/hda/hda_tegra.c | 51 sound/pci/hda/patch_hdmi.c | 20 sound/pci/hda/patch_realtek.c | 4 sound/soc/mediatek/mt8365/mt8365-dai-i2s.c | 3 tools/hv/hv_fcopy_uio_daemon.c | 37 tools/testing/selftests/bpf/progs/verifier_precision.c | 53 + tools/testing/selftests/drivers/net/lib/py/load.py | 23 tools/testing/selftests/net/mptcp/Makefile | 3 tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh | 5 tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh | 5 tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh | 5 133 files changed, 1608 insertions(+), 1223 deletions(-) Abdun Nihaal (1): regmap: fix potential memory leak of regmap_bus Ada Couprie Diaz (1): arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() Akhil R (1): i2c: tegra: Fix reset error handling with ACPI Akinobu Mita (1): resource: fix false warning in __request_region() Alessandro Carminati (1): regulator: core: fix NULL dereference on unbind due to stale coupling data Arunpravin Paneer Selvam (1): drm/amdgpu: Reset the clear flag in buddy during resume Chiara Meiohas (1): net/mlx5: Fix memory leak in cmd_exec() Daniel Dadap (1): ALSA: hda: Add missing NVIDIA HDA codec IDs David Lechner (1): iio: adc: ad7949: use spi_is_bpw_supported() Dawid Rezler (1): ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx Dennis Chen (1): i40e: report VF tx_dropped with tx_errors instead of tx_discards Dmitry Antipov (1): jfs: reject on-disk inodes of an unsupported type Douglas Anderson (1): drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() Edip Hazuri (1): ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx Eric Biggers (1): crypto: powerpc/poly1305 - add depends on BROKEN for now Eyal Birger (1): xfrm: interface: fix use-after-free after changing collect_md xfrm interface Fabrice Gasnier (1): Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT Gao Xiang (5): erofs: simplify z_erofs_load_compact_lcluster() erofs: refine z_erofs_get_extent_compressedlen() erofs: simplify tail inline pcluster handling erofs: clean up header parsing for ztailpacking and fragments erofs: fix large fragment handling Greg Kroah-Hartman (1): Linux 6.12.41 Guoqing Jiang (1): ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv Halil Pasic (1): s390/ism: fix concurrency management in ism_cmd() Haoxiang Li (1): ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Harry Yoo (1): mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n Himanshu Mittal (1): net: ti: icssg-prueth: Fix buffer allocation for ICSSG Hongzhen Luo (1): erofs: use Z_EROFS_LCLUSTER_TYPE_MAX to simplify switches Ian Abbott (1): comedi: comedi_test: Fix possible deletion of uninitialized timers Jacek Kowalski (2): e1000e: disregard NVM checksum on tgp when valid checksum bit is not set e1000e: ignore uninitialized checksum word on tgp Jamie Bainbridge (1): i40e: When removing VF MAC filters, only check PF-set MAC Jian Shen (2): net: hns3: fix concurrent setting vlan filter issue net: hns3: fixed vf get max channels bug Jijie Shao (1): net: hns3: default enable tx bounce buffer when smmu enabled Jinjiang Tu (1): mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list Johan Hovold (1): arm64: dts: qcom: x1e78100-t14s: mark l12b and l15b always-on Khairul Anuar Romli (1): spi: cadence-quadspi: fix cleanup of rx_chan on failure paths Kito Xu (veritas501) (1): net: appletalk: Fix use-after-free in AARP proxy probe Laurent Vivier (2): virtio_net: Enforce minimum TX ring size for reliability virtio_ring: Fix error reporting in virtqueue_resize Lin.Cao (1): drm/sched: Remove optimization that causes hang when killing dependent jobs Liu Shixin (1): mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma Ma Ke (3): bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() dpaa2-eth: Fix device reference count leak in MAC endpoint handling dpaa2-switch: Fix device reference count leak in MAC endpoint handling Manuel Andreas (1): KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush Maor Gottlieb (1): RDMA/core: Rate limit GID cache warning messages Marc Kleine-Budde (1): can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Marco Elver (1): kasan: use vmalloc_dump_obj() for vmalloc error reports Markus Blöchl (1): timekeeping: Zero initialize system_counterval when querying time from phc drivers Matthieu Baerts (NGI0) (2): selftests: mptcp: connect: also cover alt modes selftests: mptcp: connect: also cover checksum Maxim Levitsky (4): KVM: x86: drop x86.h include from cpuid.h KVM: x86: Route non-canonical checks in emulator through emulate_ops KVM: x86: Add X86EMUL_F_MSR and X86EMUL_F_DT_LOAD to aid canonical checks KVM: x86: model canonical checks more precisely Md Sadre Alam (1): mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() Michael Grzeschik (2): usb: typec: tcpm: allow to use sink in accessory mode usb: typec: tcpm: allow switching to mode accessory to mux properly Michael Zhivich (1): x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() Miguel Ojeda (1): rust: give Clippy the minimum supported Rust version Ming Yen Hsieh (1): wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure Mohan Kumar D (1): ALSA: hda/tegra: Add Tegra264 support Naman Jain (1): Drivers: hv: Make the sysfs node size for the ring buffer dynamic Nathan Chancellor (3): mm/ksm: fix -Wsometimes-uninitialized from clang-21 in advisor_mode_show() ARM: 9450/1: Fix allowing linker DCE with binutils < 2.36 ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS Nimrod Oren (1): selftests: drv-net: wait for iperf client to stop sending Nuno Das Neves (1): x86/hyperv: Fix usage of cpu_online_mask to get valid cpu Praveen Kaligineedi (1): gve: Fix stuck TX queue for DQ queue format RD Babiera (1): usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach Rahul Chandra (1): platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8406CA Roman Kisel (1): x86/hyperv: Fix APIC ID and VP index confusion in hv_snp_boot_ap() Rong Zhang (2): platform/x86: ideapad-laptop: Fix FnLock not remembered among boots platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots Ryusuke Konishi (1): nilfs2: reject invalid file types when reading inodes SHARAN KUMAR M (1): ALSA: hda/realtek: Fix mute LED mask on HP OMEN 16 laptop Sabrina Dubroca (2): xfrm: state: initialize state_ptrs earlier in xfrm_state_find xfrm: state: use a consistent pcpu_id in xfrm_state_find Sean Christopherson (1): KVM: x86: Free vCPUs before freeing VM state Sean Wang (1): Revert "wifi: mt76: mt7925: Update mt7925_mcu_uni_[tx,rx]_ba for MLO" Shahar Shitrit (1): net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch Shravan Kumar Ramani (3): platform/mellanox: mlxbf-pmc: Remove newline char from event name input platform/mellanox: mlxbf-pmc: Validate event/enable input platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input Stefan Wahren (1): staging: vchiq_arm: Make vchiq_shutdown never fail Stephan Gerhold (1): arm64: dts: qcom: x1-crd: Fix vreg_l2j_1p2 voltage Stephen Rothwell (1): sprintf.h requires stdarg.h Tobias Brunner (1): xfrm: Set transport header to fix UDP GRO handling Tomita Moeko (4): Revert "drm/xe/gt: Update handling of xe_force_wake_get return" Revert "drm/xe/tests/mocs: Update xe_force_wake_get() return handling" Revert "drm/xe/devcoredump: Update handling of xe_force_wake_get return" Revert "drm/xe/forcewake: Add a helper xe_force_wake_ref_has_domain()" Torsten Hilbrich (1): platform/x86: Fix initialization order for firmware_attributes_class Ville Syrjälä (1): drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x Viresh Kumar (1): i2c: virtio: Avoid hang by using interruptible completion wait Xiang Mei (1): net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class Xilin Wu (1): interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node Xin Li (Intel) (1): x86/traps: Initialize DR7 by writing its architectural reset value Yang Xiwen (1): i2c: qup: jump out of the loop in case of timeout Yasumasa Suenaga (1): tools/hv: fcopy: Fix incorrect file path conversion Yonghong Song (1): selftests/bpf: Add tests with stack ptr register in conditional jmp Yonglong Liu (1): net: hns3: disable interrupt when ptp init failed Zhang Lixu (2): iio: hid-sensor-prox: Restore lost scale assignments iio: hid-sensor-prox: Fix incorrect OFFSET calculation Zhang Yi (11): ext4: don't explicit update times in ext4_fallocate() ext4: refactor ext4_punch_hole() ext4: refactor ext4_zero_range() ext4: refactor ext4_collapse_range() ext4: refactor ext4_insert_range() ext4: factor out ext4_do_fallocate() ext4: move out inode_lock into ext4_fallocate() ext4: move out common parts into ext4_fallocate() ext4: fix incorrect punch max_end ext4: correct the error handle in ext4_fallocate() ext4: fix out of bounds punch offset

2 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror August 2025