Repository navigation
Add CYPD6129 Type-C support for Talos lyra - #1278
Open
akakum-qualcomm wants to merge 10000 commits into
Open
akakum-qualcomm wants to merge 10000 commits into
akakum-qualcomm wants to merge 10000 commits into
Conversation
…init [ Upstream commit b31d3f7 ] strcpy() is deprecated and sprintf() does not perform bounds checking either. Although an overflow is unlikely, it's better to proactively avoid it by using the safer strscpy() and scnprintf(), respectively. Additionally, unify memory allocation for 'hname' to simplify and improve aa_policy_init(). Closes: KSPP/linux#88 Reviewed-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: John Johansen <john.johansen@canonical.com> Stable-dep-of: 3daad92 ("apparmor: policy_int make sure list heads are initialized before fail path") Signed-off-by: Sasha Levin <sashal@kernel.org>
… path [ Upstream commit 3daad92 ] If profile create fails before policy_init is complete the list heads are not properly initialized causing profile_free() sanity checks to trigger the following splat. AppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))): WARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541 Modules linked in: CPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509 Code: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b RSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293 RAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580 RDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320 RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122 R13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000 FS: 00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0 Call Trace: <TASK> aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334 aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416 unpack_profile security/apparmor/policy_unpack.c:1153 [inline] aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748 aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183 policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505 profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522 vfs_write+0x296/0xba0 fs/read_write.c:685 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f6939e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9 RDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003 RBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18 Reported-by: syzbot+faed97c4ed43bfe7fee5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=faed97c4ed43bfe7fee5 Fixes: fe6bb31 ("apparmor: split out shared policy_XXX fns to lib") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 14511c9 ] The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but it lets item[1] be equal to it. Both go on to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. The indexing arrived with the MUX consolidation, which relaxed the item[1] check in the same hunk. The value MUX handler it deleted used >= there, and the snd_soc_put_enum_double() in soc-ops.c still does. Only adav80x pairs a value table with two shifts, and its second channel looks accidental, but the control does report two values. Writing three into it reads off the end of adav80x_mux_values. The core catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which defaults off. Fixes: 3727b49 ("ASoC: dapm: Consolidate MUXs and value MUXs") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Link: https://patch.msgid.link/20260825125745.932832-1-sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4f49c3f ] When mkdir succeeds, ceph_mkdir() sets ret to ERR_PTR(0) which is incorrect. It should return NULL instead for success. Fixes: 88d5baf ("Change inode_operations.mkdir to return struct dentry *") Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d2a8d44 ] For O_APPEND writes, ki_pos is set to the current EOF via generic_write_checks() after fetching i_size from the MDS. However, ceph_get_caps() may need to wait for Fwx exclusive caps if the write extends the file (endoff > i_max_size). While waiting for Fwx, the previous Fwx holder (another client) may have already extended the file. When the MDS grants us Fwx, the cap grant message updates the local i_size, but ki_pos remains at the old EOF, causing the append write to land at a stale offset and overwrite data from the other client. Fix by re-reading i_size_read(inode) after ceph_get_caps() returns. At this point we hold Fwx exclusive caps, no other client can modify the file, and i_size reflects the true EOF from the MDS cap grant. No extra MDS round-trip is needed. Only adjust ki_pos when the EOF has actually changed. After adjusting ki_pos forward, the write range [pos, pos+count) may now exceed the i_max_size that was validated by ceph_get_caps() for the old range. Re-check against i_max_size and truncate the write if necessary to stay within the MDS-granted limit. Link: https://tracker.ceph.com/issues/7333 Fixes: 8e4473b ("ceph: do not execute direct write in parallel if O_APPEND is specified") Signed-off-by: Xiubo Li <xiubo.li@clyso.com> Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit f374967 ] When parsing the Ceph messenger v2 protocol banner, the `payload_len` field is decoded from the banner prefix. If a client sends a banner with a `payload_len` of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in `populate_in_iter()`: ------------[ cut here ]------------ !iov_iter_count(&con->v2.in_iter) WARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter net/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070 WARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810 net/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (`server_feat` and `server_req_feat`). Therefore, `payload_len` must be at least 16 bytes. Fix this by adding a check in `process_banner_prefix()` to reject a `payload_len` smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error. Fixes: cd1a677 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+87c7c2d63c44e41c77a3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=87c7c2d63c44e41c77a3 Link: https://syzkaller.appspot.com/ai_job?id=c8ca3d63-717a-4933-89ec-f3d761b8690d Signed-off-by: Aleksandr Nogikh <nogikh@google.com> Reviewed-by: Alex Markuze <amarkuze@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d79fb75 ] ftrace_direct_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference. Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code. Link: https://patch.msgid.link/20260826015034.10755-1-vulab@iscas.ac.cn Fixes: ae0cc3b ("ftrace/samples: Add a sample module that implements modify_ftrace_direct()") Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
…modify [ Upstream commit 6727b76 ] ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference. Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code. Link: https://patch.msgid.link/20260826015050.10772-1-vulab@iscas.ac.cn Fixes: e1067a0 ("ftrace/samples: Add module to test multi direct modify interface") Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 991c2be ] irq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails. The current code checks for -ENXIO and therefore does not detect the failure. Check for a zero return value and convert it to -ENXIO. Fixes: 4922050 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's") Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Reviewed-by: Andre Przywara <andre.przywara@arm.com> Link: https://patch.msgid.link/20260824100901.31675-1-phucduc.bui@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
… failure [ Upstream commit cec261b ] IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run - e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE denies the socket - sk_common_release() only invokes sk_prot->destroy if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it, and smc_destruct() returns early unless sk_state is SMC_CLOSED. As a result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one tcp_sock, so an unprivileged task able to attach a deny-all BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup can grow kernel memory unboundedly. Add a .destroy hook to both protos that releases the clcsock via smc_clcsock_release(). smc_sk_init() hashes the sock into the smc hashinfo before the clcsock is created, and smc_diag dumps walk that hash dereferencing smc->clcsock without taking clcsock_release_lock, while sk_common_release() calls .destroy before .unhash. Unhash the sock before releasing the clcsock, as __smc_release() does, so a concurrent dump cannot observe the release; the second unhash in sk_common_release() is a no-op. Fixes: d25a92c ("net/smc: Introduce IPPROTO_SMC") Reported-by: Abaci <abaci@linux.alibaba.com> Assisted-by: abaci:qwen3.8-max Signed-off-by: Yifei Chu <Chuyf26@linux.alibaba.com> Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Link: https://patch.msgid.link/178753843966.342810.566471390946765094@linux.alibaba.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 63c8856 ] The macros TXGBE_INTR_MISC() and WX_INTR_Q() rely on the standard BIT() macro to generate interrupt masks based on the queue vector index. On 32-bit architectures, BIT() evaluates to a 32-bit `unsigned long`. Since the number of queue vectors can be up to 63 on txgbe devices, performing a left shift of 32 or more results in an integer overflow and undefined behavior. This causes incorrect interrupt masking and unmasking logic for both the queue and miscellaneous interrupts on 32-bit systems. Fix this by replacing BIT() with BIT_ULL() in these macros. This ensures that the bitwise shift is always performed safely on a 64-bit `unsigned long long` type, regardless of the underlying architecture. Fixes: e37546a ("net: wangxun: revert the adjustment of the IRQ vector sequence") Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Link: https://patch.msgid.link/45F5565CE6AC4329+20260824072119.48399-1-jiawenwu@trustnetic.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 9a56a27 ] The stmmac TC filtering rules have recently gained sanity checks to make sure the passed keys and their respective masks are aligned with the HW filtering abilities. The stmmac selftests failed to pass the mask in the match data for L4 filtering tests, and are now failing consistently with -EINVAL : $ ethtool -t eth1 [...] 23. L4 DA TCP Filtering -22 24. L4 SA TCP Filtering -22 25. L4 DA UDP Filtering -22 26. L4 SA UDP Filtering -22 Let's pass the ip_proto mask in the l4 filtering tests match data. Found on imx8mp, which now have passing L4 tests : $ ethtool -t eth1 [...] 23. L4 DA TCP Filtering 0 24. L4 SA TCP Filtering 0 25. L4 DA UDP Filtering 0 26. L4 SA UDP Filtering 0 While at it, initialize the masks and keys to avoid re-using whatever was on the stack. Fixes: 5536d7c ("net: stmmac: fix l3l4 filter rejecting unsupported offload requests") Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260825211748.360935-1-maxime.chevallier@bootlin.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 369ba0d ] While reading the main GT powergating info from debugfs, include both RCS and CCS engine masks. Fixes: 0914c1e ("drm/xe/xe_gt_idle: add debugfs entry for powergating info") Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com> Link: https://patch.msgid.link/20260819073457.1812722-2-balasubramani.vivekanandan@intel.com Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 8899e41) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c27c449 ] The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649. Fixes: 7c6d2ec ("net: be more gentle about silly gso requests coming from user") Signed-off-by: Alice Mikityanska <alice@isovalent.com> Suggested-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260822120117.1163423-2-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
…hain blob [ Upstream commit b1881d3 ] Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the software ruleset differ. Fixes: c9626a2 ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 24bd5c2 ] Add pr_fmt to prefix log messages with the module name for easier debugging in dmesg. Add checkentry functions for IPv4 (ttl_mt_check) and IPv6 (hl_mt6_check) to validate the match mode at rule registration time, rejecting invalid modes with -EINVAL. The evaluation function returns false in case the mode is unknown, so this is a cleanup, not a bug fix. Signed-off-by: Marino Dzalto <marino.dzalto@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Stable-dep-of: 793d9ed ("netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()") Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 793d9ed ] Several xtables extension still use pr_err() or pr_info() without ratelimit. For xt_cgroup, while at this, remove redundant "xt_cgroup:" prefix since pr_fmt is already set on. Fixes: c38c459 ("netfilter: implement xt_cgroup cgroup2 path match") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 74e3b97 ] The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that has no get callback (even a user element can do it), and this may lead to a NULL dereference at the call chain of snd_ctl_led_notify(), as found by syzkaller. For avoiding the Oops, add a sanity check of the kcontrol's info and get callbacks, and just skip the invalid kcontrols before assigning the kctl to the LED layer. Reported-by: syzbot+b7fe2760ea6f1ee44b4d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com Fixes: 22d8de6 ("ALSA: control - add generic LED trigger module as the new control layer") Reviewed-by: Jaroslav Kysela <perex@perex.cz> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260827113951.893291-1-tiwai@suse.de Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8d2237e ] Most MTE tests set a TAP plan and emit results without first printing the TAP version header. Direct execution therefore starts with a plan such as "1..20" instead of "TAP version 13". The problem is particularly visible in the GCR_EL1 context-switch test. It prints its plan before forking 1,024 child processes. When stdout is fully buffered, the plan remains in the stdio buffer. Each child inherits the pending "1..1" line and flushes its copy from exit(), producing repeated plan lines. ksft_print_header() prints the TAP header and enables line buffering. Call it in every MTE test that is missing it. In the GCR_EL1 test, call it before the plan so the plan is flushed before the children are forked. In the remaining tests, call it before setup and prerequisite checks so early failures and whole-test skips also retain the header. Fixes: 29f0808 ("kselftest/arm64: check GCR_EL1 after context switch") Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Mark Brown <broonie@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 1a0dba0 ] The MTE KSM test requires write access to KSM sysfs but does not check that it is running as root. It also unconditionally saves, enables and restores the merge_across_nodes attribute. The kernel only creates this attribute when CONFIG_NUMA=y, so a non-NUMA kernel prints the following message three times even though every KSM subtest passes: # ERR: missing /sys/kernel/mm/ksm/merge_across_nodes Skip the test when it is not running as root. Check that the optional attribute is readable and writable, treating ENOENT as its expected absence on non-NUMA kernels and skipping the test for other access failures. Only save, enable and restore the attribute when it is available. Check MTE availability before the privilege and sysfs checks so systems without MTE retain the existing feature-unavailable skip result. This preserves the existing behavior on NUMA kernels without requiring NUMA or reducing KSM coverage on single-node systems. Fixes: f981d8f ("kselftest/arm64: Verify KSM page merge for MTE pages") Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Mark Brown <broonie@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit bb52892 ] The MTE prctl test emits one result from check_basic_read() followed by one result for each of the seven entries in mte_modes[]. However, the TAP plan only accounts for the array entries, producing: # Planned tests != run tests (7 != 8) Include the basic read check in the plan so that all eight emitted results are declared. Reviewed-by: Mark Brown <broonie@kernel.org> Fixes: 1f488fb ("kselftest/arm64/mte: Add MTE_STORE_ONLY testcases") Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 6fe7e31 ] The driver calls dma_set_coherent_mask() but never dma_set_mask(), leaving the streaming DMA mask at the bus default. On the non-coherent EN7581 platform (Cortex-A53), this causes the NPU mailbox to hang after approximately 41 calls when using streaming DMA mappings. Replace dma_set_coherent_mask() with dma_set_mask_and_coherent() to set both the streaming and coherent DMA masks, matching standard driver practice. Fixes: 6f884eb ("net: airoha: Fix DMA direction for NPU mailbox buffer") Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260814110017.2795022-1-pawlik.dan@gmail.com/ Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260809152813.585797-1-pawlik.dan@gmail.com/ Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20260805070851.2885888-1-pawlik.dan@gmail.com/ Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com> Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://patch.msgid.link/20260820085941.380401-1-pawlik.dan@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit d29b399 ] The MMC counters report MAC statistics. Multiple counters can be enabled when the IP is integrated, however there's no way to know exactly which ones. Un-implemented counters seem to report 0. It was found that on StarFive JH7110 and Amlogic SM1, the counter that's used by the selftest (mmc_tx_framecount_g) isn't implemented, triggering an MMC selftest failure. Both the above SoCs seem to implement mmc_rx_framecount_gb, let's use this counter as well for MMC counter validation. Note that this doesn't guarantee that we won't encounter the same issue again if another IP implements yet another set of counters that don't include that new one. If the game of whack-a-mole with implemented counters becomes too hard to maintain, we may simply consider removing the MMC selftest entirely. Fixes: 091810d ("net: stmmac: Introduce selftests support") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260826140500.616466-2-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
…ltering [ Upstream commit 9698b6d ] The same filter slots are used to store the main MAC address as well as the address for the unicast filter. Let's account for that when deciding whether or not to use promisc when programming the UC list in hardware. Fixes: 47dd7a5 ("net: add support for STMicroelectronics Ethernet controllers.") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260826140500.616466-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
…ring [ Upstream commit 82187f4 ] The same filter slots are used to store the main MAC address as well as the address for the unicast filter. Let's account for that when deciding whether or not to use promisc when programming the UC list in hardware. Fixes: 477286b ("stmmac: add GMAC4 core support") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260826140500.616466-4-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
…ering [ Upstream commit 2739d6f ] The same filter slots are used to store the main MAC address as well as the address for the unicast filter. Let's account for that when deciding whether or not to use promisc when programming the UC list in hardware. Fixes: 0efedbf ("net: stmmac: xgmac: Fix XGMAC selftests") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260826140500.616466-5-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
…tests [ Upstream commit cd8c3b2 ] On dwmac, one of the Unicast filter entries is used to store the local HW addr. This means that we have to use promisc mode for any kind of unicast filtering if we only have one slot in our unicast filter. The number of slots available depends on how the IP is integrated, and we can't autodiscover how many of these slots we have available, so the DT property snps,perfect-filter-entries can be used to specify how many are available. Most IP variants default to 1 if this isn't specified, which is the case for the amlogic variants (in this case, S905X3). The stmmac selftests for UC filtering look if we have enough slots in the filter to store the dev->uc list, but doesn't account for the device's own MAC address. The dev->uc list's size we get with netdev_uc_count() also doesn't account for the HW addr. As the selftest only requires one available slot, in the case of single-slot platforms, that means we erroneously consider we have enough room for the test, when we actually don't, and the filtering test fails. Fixes: 091810d ("net: stmmac: Introduce selftests support") Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260826140500.616466-6-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 23680bf ] Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the alignment of the packet headers. Before the conversion the payload was copied into an skb obtained from napi_alloc_skb(), which reserves NET_SKB_PAD + NET_IP_ALIGN. The conversion moved the headroom into stmmac_rx_offset() but did not carry over NET_IP_ALIGN, so on architectures where NET_IP_ALIGN is 2 the IP header now lands misaligned: 64 (NET_SKB_PAD) + 14 (ethernet) + 20 (IP) = 98 Same for the XDP branch: 256 (XDP_PACKET_HEADROOM) + 14 (ethernet) + 20 (IP) = 290 On ARM32 this is fatal, because ldm and ldrd trap on unaligned addresses even when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set. Any received echo request panics the machine, e.g: Unhandled fault: alignment exception (0x001) at 0x81873062 Internal error: : 1 [#1] SMP ARM Hardware name: Altera SOCFPGA Arria10 PC is at icmp_echo+0x38/0xa8 LR is at icmp_rcv+0x22c/0x370 Call trace: icmp_echo from icmp_rcv+0x22c/0x370 icmp_rcv from ip_protocol_deliver_rcu+0x2c/0x224 ip_protocol_deliver_rcu from ip_local_deliver+0xc8/0x1a0 ip_local_deliver from ip_sublist_rcv_finish+0x3c/0x50 ip_sublist_rcv_finish from ip_list_rcv_finish+0x110/0x118 ip_list_rcv_finish from ip_list_rcv+0xc8/0xdc ip_list_rcv from __netif_receive_skb_list_core+0x170/0x1c0 ... napi_complete_done from stmmac_napi_poll_rx+0xcb0/0x1030 Code: e24dd068 e59020a0 e28dc010 e0822001 (e8920003) Kernel panic - not syncing: Fatal exception in interrupt The faulting instruction is the ldm of *icmp_hdr(skb) in icmp_echo(). Fix by adding NET_IP_ALIGN back to the RX offset, which restores the alignment the stack used to get. Note that commit a955318 ("stmmac: align RX buffers") made a similar change in 2021 and was reverted by commit 12d125b ("stmmac: Revert "stmmac: align RX buffers"") because it caused packet corruption. That patch raised the offset from 0 without adjusting the buffer size accounting, so the DMA engine could arguably write past the end of the RX buffers, though this was never root caused. Commit df542f6 ("net: stmmac: Switch to zero-copy in non-XDP RX path") since derives the page pool allocation from stmmac_rx_offset(), so the extra bytes are accounted for. Fixes: df542f6 ("net: stmmac: Switch to zero-copy in non-XDP RX path") Cc: Daniel Baldin <DBaldin@dspace.de> Signed-off-by: Pascal Kneuper <PKneuper@dspace.de> Link: https://patch.msgid.link/20260824125014.47862-1-PKneuper@dspace.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 8f735d6 ] qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through the overhead, the size-table data (u16), and size_log (up to STAB_SIZE_LOG_MAX). A crafted stab can therefore set qdisc_pkt_len() to ~1 GiB for an ordinary skb. Per-flow deficit schedulers such as DRR and ETS replenish one quantum per loop iteration; with a tiny quantum (1) they spin billions of times under the qdisc lock, producing a soft lockup / RCU stall as illustrated by vega@nebusec.ai. Cap the final qdisc_pkt_len() to QDISC_PKT_LEN_MAX so the size-table amplification cannot drive deficit schedulers into an unbounded loop. A legitimate size table (e.g. qfq's overhead 999999999, which is handled by dropping) is still accepted. Introduce cap QDISC_PKT_LEN_MAX (1 << 20) = 1 MiB which is well above any legitimate single-skb wire length: the largest current skb->len is GSO_MAX_SIZE (524280), and an ATM-style size table (53/48 cell tax) amplifies that to ~578 KB, both comfortably below 1 MiB. At the same time, 1 MiB bounds the deficit refill loop to ~1M iterations per packet with quantum=1, which completes in a few milliseconds well under the demonstrated softlockup threshold (~10^9 iterations). Conditions to recreate the bug: - CONFIG_NET_SCHED=y, CONFIG_NET_SCH_DRR=y (or CONFIG_NET_SCH_ETS=y). - Attach a DRR (or ETS) root qdisc with a crafted TCA_STAB that amplifies qdisc_pkt_len to ~1 GiB (e.g. size_log=15, data=[32768]). - Add a class with a tiny quantum of 1 and send one small packet; the deficit loop spins billions of times under the qdisc lock and trips the softlockup detector (panic with kernel.softlockup_panic=1). - Reachable as root or from an unprivileged user in a fresh user+net namespace (unshare -Urn) with namespace-local CAP_NET_ADMIN. Fixes: 1da177e ("Linux-2.6.12-rc2") Reported-by: vega@nebusec.ai Tested-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20260825081403.133992-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 23c5326 ] Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slip_receive_buf() when racing against tty hangup. tty_ldisc_hangup() calls ld->ops->hangup() while holding only a read lock on tty->ldisc_sem (via tty_ldisc_ref()). Because slip_hangup() simply called slip_close(), it ran concurrently with reader functions such as slip_receive_buf(). slip_close() unregisters and frees the net device and its private struct slip, causing concurrent reader threads in slip_receive_buf() to dereference freed memory. Line discipline close() is already guaranteed to be called under the write lock of tty->ldisc_sem during hangup processing (in tty_ldisc_reinit() or tty_ldisc_kill()). Remove slip_hangup() so teardown is serialized cleanly by slip_close(). Fixes: 5342b77 ("slip: Clean up create and destroy") Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr> Closes: https://lore.kernel.org/netdev/20260825150655.1450271-1-jjy600901@snu.ac.kr/ Cc: Qingfang Deng <qingfang.deng@linux.dev> Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260826105238.3323436-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Add the Offline Processing Engine (OPE) device tree node for the Agatti platform (QCM2290). The node describes the six register regions (cdm, top, qos, pipeline, bus_read, bus_write), clocks, interrupt, interconnects, IOMMU mappings, and OPP table. OPE is a memory-to-memory block with no board-level dependencies, so the node is left enabled for all Agatti boards. Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Upstream-Status: Submitted Link: https://lore.kernel.org/all/20260925-camss-isp-ope-v10-7-2622411034cb@oss.qualcomm.com/
Add the Offline Processing Engine (OPE) device tree node for Shikra. The node describes the six register regions (cdm, top, qos, pipeline, bus_read, bus_write), clocks, interrupt, interconnects, IOMMU mappings, and OPP table. OPE is a memory-to-memory block with no board-level dependencies, so the node is left enabled for all Shikra boards. Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Nihal Kumar Gupta <nihal.gupta@oss.qualcomm.com> Upstream-Status: Submitted Link: https://lore.kernel.org/all/20260925-camss-isp-ope-v10-8-2622411034cb@oss.qualcomm.com/
Add CONFIG_VIDEO_QCOM_CAMSS_OPE=m to enable the Qualcomm Offline Processing Engine (OPE) driver, an image processing block available on Qualcomm Agatti and Shikra based platforms such as the Arduino UNO Q. Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Signed-off-by: Nihal Kumar Gupta <nihal.gupta@oss.qualcomm.com> Upstream-Status: Submitted Link: https://lore.kernel.org/all/20260925-camss-isp-ope-v10-9-2622411034cb@oss.qualcomm.com/
qcom.config: Disable CPUFREQ_DT driver
…qualcomm-linux#1218) LPASS codec macros: switch to explicit clock management in runtime PM
…linux#1217) bus: mhi: host: pci_generic: Add DUN channel configuration
There's nothing special about RGB multi-led instances. Allow any color combinations by simply extending the "if _RGB" checks. Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Bjorn Andersson <andersson@kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20251117-topic-lpg_multi-v1-1-05604374a2dd@oss.qualcomm.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Rakesh Kota <rakesh.kota@oss.qualcomm.com>
pm_clk_suspend()/resume() only call clk_disable()/clk_enable() for the
AHB ("iface") clock, never clk_unprepare(), so prepare_count never
reaches 0. The clock (and its source) stays reported as enabled
through s2idle suspend even though the display stack is fully
suspended:
disp_cc_mdss_ahb_clk [19200000] ->
disp_cc_mdss_ahb_clk_src [19200000] ->
bi_tcxo [19200000] -> xo-board [76800000]
disp_cc_mdss_ahb_clk_src [19200000] ->
bi_tcxo [19200000] -> xo-board [76800000]
Calling clk_prepare_enable()/clk_disable_unprepare() directly from the
PHY's runtime_suspend/runtime_resume is not safe either, since it can
deadlock against the PHY's own PLL clocks taking the global CCF
prepare_lock during clk_prepare()/clk_unprepare().
Fix this by moving clk_prepare()/clk_unprepare() out of the runtime PM
path. clk_enable()/clk_disable() (spinlock only) stay in
runtime_suspend/runtime_resume. clk_prepare()/clk_unprepare() move to
suspend_late/resume_early, avoiding the prepare_lock collision and
actually dropping prepare_count to 0. DPM_FLAG_NO_DIRECT_COMPLETE
ensures these hooks always run on sleep.
Fixes: 0b3ccb7 ("drm/msm/dsi: Fix 14nm DSI PHY PLL Lock issue")
Link: https://lore.kernel.org/all/20261006-dsi-ahb-clk-suspend-fix-v1-1-67da848e1b0a@oss.qualcomm.com/
Signed-off-by: Arpit Saini <arpit.saini@oss.qualcomm.com>
Remove sn65dsi83 from prune.config to enable it Signed-off-by: Anand Tiwari <anand.tiwari@oss.qualcomm.com>
Some domain idle states require system-wide coordination and are not applicable while the platform is up and running. Add a boolean system-state property to describe these states. Link: https://lore.kernel.org/linux-arm-msm/20261005-s2idle_state-v1-1-3c402c66f388@oss.qualcomm.com/ Assisted-by: Codex:GPT-6 Acked-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
Some domain idle states require system-wide coordination and should not be selected during regular CPU idle. However those states remain valid for system-wide suspend like s2idle. Add a per-state system_state boolean and populate it from the system-state property. Make the genpd governor skip these states during CPU idle. Leave the system wide suspend path unchanged so s2idle can select them. Link: https://lore.kernel.org/linux-arm-msm/20261005-s2idle_state-v1-2-3c402c66f388@oss.qualcomm.com/ Assisted-by: Codex:GPT-6 Acked-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
…se state To achieve SoC low power mode like chip rail power collapse (CxPC), the Monaco EVK board with four PMICs requires coordinated power-down of CPUSS and the Safety Island (SAIL) subsystem. This deepest system power collapse state is reserved for system-wide suspend (s2idle). Add the system_suspend domain idle state, mark it with system-state, and reference it from the system power domain. Link: https://lore.kernel.org/linux-arm-msm/20261005-s2idle_state-v1-3-3c402c66f388@oss.qualcomm.com/ Assisted-by: Codex:GPT-6 Acked-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
Add pctrl-idx-mapping/pctrl-map-names to both CCI nodes (cam_cci0, cam_cci1). This is needed by the camx-dlkm CCI to determine the number of CCI master instances per node. Signed-off-by: Nirav Khatri <khatri@qti.qualcomm.com>
leds: rgb: leds-qcom-lpg: Allow LED_COLOR_ID_MULTI
…ux#1246) arm64: dts: qcom: camera: add pctrl-idx-mapping for CCI
…ts (qualcomm-linux#1121) media: iris: Retain firmware confirmed video_format across GOP restarts
The tpdm_dcc device cannot work properly on secure devices because its required clock cannot be enabled due to a hardware issue. Mark the node with status = "fail" to reflect this. Link: https://lore.kernel.org/all/20261008-remove_tpdm_dcc_device-v1-1-48574c6ae6c2@oss.qualcomm.com/ Fixes: eed738c ("arm64: dts: qcom: shikra: Add coresight nodes") Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
prune.config: Enable the TI-SN65DSI83 driver
…linux#1245) Add Support for deepest CPUSS low power mode on Monaco EVK
* refs/heads/8f3741e
Linux 6.18.52
wifi: mt76: fix airoha_npu dependency tracking
staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
pinctrl: airoha: an7583: add missed gpio22 pin group
ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
ACPI: processor: idle: Remove redundant static variable and rename cstate check function
ACPI: processor: idle: Move max_cstate update out of the loop
ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified
cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled
cpufreq/amd-pstate: Add support for raw EPP writes
cpufreq/amd-pstate: Add static asserts for EPP indices
cpufreq/amd-pstate: Fix some whitespace issues
io_uring/waitid: fix KCSAN warning on io_waitid->head
io_uring/waitid: use io_waitid_remove_wq() consistently
net/sched: fq: clamp quantum and initial_quantum in change path
Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array
tcp: reject non zerocopy devmem tx
ipmr: Add __rcu to netns_ipv4.mrt.
ipmr: Call ipmr_fib_lookup() under RCU.
erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
erofs: relax sanity check for tail pclusters due to ztailpacking
block: fix merging data-less bios
blk-mq-dma: always initialize dma state
block: save page offset gaps in cloned bio
integrity: Eliminate weak definition of arch_get_secureboot()
apparmor: fix kernel-doc comments for inview
pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: Fix AIROHA_PINCTRL_CONFS_DRIVE_E2 in an7583_pinctrl_match_data
pinctrl: airoha: an7583: add missed gpio32 pin group
pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7583: fix gpio21 pin group
pinctrl: airoha: an7583: fix phy1_led1 pin function
pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
phy: renesas: rcar-gen3-usb2: add regulator dependency
perf annotate: Fix build with NO_SLANG=1
wifi: nl80211: fix UHR capability validation
wifi: mt76: npu: Add missing rx_token_size initialization
wifi: mt76: restrict NPU/PPE active checks to MMIO devices
s390/kexec: Disable stack protector in s390_reset_system()
selftests: vDSO: getrandom: Fix path to s390 chacha implementation
cpufreq/amd-pstate: Fix setting EPP in performance mode
cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP
cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp
cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name
cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset
cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks
usb: ucsi: huawei_gaokun: move typec_altmode off stack
serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
perf tests kvm: Avoid leaving perf.data.guest file around
tracing: Move d_max_latency out of CONFIG_FSNOTIFY protection
mtd: rawnand: pl353: Fix debug prints
dm-integrity: fix buffer overflow with keyed discard
net/sched: sch_htb: limit htb_classify inner-class filter hops
tcp: fix corruption of urgent data on multi-segment retransmit
usb: atm: usbatm: fix invalid ci_range initialization
net: fec: only stop PTP if it was initialized
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
net: stmmac: selftests: Account for the UC filter list for filtering tests
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
net: stmmac: selftests: Check multiple MMC counters
net: airoha: npu: fix missing streaming DMA mask
selftests/arm64: Fix MTE prctl TAP plan
selftests/arm64: Treat KSM merge_across_nodes as optional
selftests/arm64: Print missing MTE TAP headers
ALSA: control: Don't add invalid kcontrols to LED layer
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
netfilter: xt_HL: add pr_fmt and checkentry validation
netfilter: nf_tables: move hardware offload step after building the chain blob
virtio-net: Ensure that TCP packets don't overflow gso_segs
drm/xe/xe_gt_idle: Add CCS to the powergating info print
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs
net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
net: ethernet: sun4i-emac: Fix IRQ error handling
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
libceph: validate banner payload length
ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
ceph: Fix ERR_PTR(0) in ceph_mkdir()
ASoC: dapm: Fix off-by-one check on the second enum channel
apparmor: policy_int make sure list heads are initialized before fail path
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
crypto: acomp - allocate async request context when cloning
tpm: st33zp24: Validate locality read result
tpm: st33zp24: Return zero on status read failure
net/sched: sch_teql: restore skb->dev on the slave failure path
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
net/sched: fq_pie: clamp default quantum to avoid signed overflow
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
net/sched: fq_codel: clamp default quantum and mtu
net/sched: fq: add overflow bounds to quantum and initial quantum
net: fix a resource leak in copy_net_ns() error handling path
net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
maple_tree: fix argument name in header
maple_tree: catch race in mas_alloc_cyclic()
selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
cifs: fix clearing stats for fastest execution of each smb2 command
octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
net/sched: act_ife: Only operate on Ethernet frames
net/sched: add qstats_cpu_drop_inc() helper
net: enetc: restore RX ring congestion mode after ring reconfiguration
octeontx2-af: Fix TL3/TL2 link config ENA clearing
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
octeontx2-vf: fix workqueue and netdev race in probe/remove
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
xsk: honor XDP_TX_METADATA in zero-copy path
xsk: align TX metadata layout across ABIs
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
Bluetooth: btnxpuart: Validate the FW dump header length
Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
Bluetooth: btmtk: Do not discard the subsystem reset timeout
Bluetooth: btmtk: Do not report success when subsys reset fails
Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support
Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
arm64: process: Fix context switching MTE store-only tag check
arm64: ptdump: Make note_page_flush() range aware
erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
scsi: qla2xxx: Fix an loop timeout test
Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
syscore: Pass context data to callbacks
net_sched: sch_fq: fix pacing delay underflow with pacing offload
net: page_pool: Remove zone/policy GFP flags when allocating XArray entries
net: libwx: fix concurrent bitmap overwrite in PTP setup
net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown
net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state
net: wangxun: schedule hardware stats update in watchdog
net: wangxun: replace busy-wait reset flag with kernel mutex
net: txgbe: support RSC offload
net: txgbe: support RX desc merge mode
ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check
bnxt_en: Fix call to hardware monitoring event handler
rtc: pcf85363: Add error checking to regmap calls in probe()
NFSv4/pnfs: key the data server cache on the NFS version
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
net/smc: free pending qentry in smc_llc_flow_stop() before memset
net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
net: tcp: block mixing readable and unreadable frags
inetpeer: randomize RB-tree node comparison using SipHash
ip6mr: plug drop_reason to ip6mr_cache_report()
ipmr: Free mr_table after RCU grace period.
net: change sock_queue_rcv_skb_reason() to return a drop_reason
ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init().
ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl().
ipmr: Move unregister_netdevice_many() out of ipmr_free_table().
ipmr: Move unregister_netdevice_many() out of mroute_clean_tables().
net: qlcnic: validate unified ROM sections before loading
net: add missing ref_tracker_dir_exit() to net_passive_dec()
ipv6: avoid divide by zero in rt6_multipath_rebalance
netdevsim: update queue NAPI association on queue reset
net: ipa: balance runtime PM reference on remove error
forcedeth: stop the tx_timeout register dump past the requested window
net/mlx5: E-Switch, preserve max tx speed on vport state modification
net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed()
net/mlx5: Skip disabled vports when setting max TX speed
RDMA/mlx5: Implement query_port_speed callback
IB/core: Add query_port_speed verb
IB/core: Add helper to convert port attributes to data rate
net/mlx5: Add support for querying bond speed
net/mlx5: Handle port and vport speed change events in MPESW
net/mlx5: E-Switch, use state lock for vport state changes
net/mlx5: Propagate LAG effective max_tx_speed to vports
net/mlx5: Add max_tx_speed and its CAP bit to IFC
net/mlx5: E-Switch, support eswitch inactive mode
net/mlx5: MPFS, add support for dynamic enable/disable
devlink: Introduce switchdev_inactive eswitch mode
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
net/sched: add get_fill_size callbacks for actions missing them
net: bridge: Reject descending VLAN tunnel ranges
xsk: fix NULL pointer dereference in __xsk_rcv()
xsk: avoid double checking against rx queue being full
irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
irqchip/irq-realtek-rtl: Add mask for interrupt handling
irqchip/irq-realtek-rtl: Add interrupt data structure
irqchip/irq-realtek-rtl: Split out parent setup code
irqchip/irq-realtek-rtl: Add multicore support
irqchip/irq-realtek-rtl: Add/simplify register helpers
smb: server: remove unused DES crypto header
smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
ALSA: mtpav: shut down output timer before card teardown
spi: amlogic-spisg: Make sure clk_init_data is fully initialized
RDMA/ucma: Allow path records to exactly fit the output buffer
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
ALSA: core: Add scoped cleanup helper for card references
irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
irqchip/gic-v5: Fix gicv5_init_common() error paths
irqchip/gic-v5: Check for NULL LPI domain on domain teardown
irqchip/gic-v5: Synchronize CPU interface disable
clk: visconti: Make sure clk_init_data is fully initialized
clk: ti: Make sure clk_init_data is fully initialized
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
lib/interval_tree: fix allocation warning messages
rtc: gamecube: check return value of devm_rtc_register_device()
i2c: ocores: Disable clock on failed resume
irqchip/renesas-rzg2l: Fix loss of interrupt
rtc: zynqmp: Return optional clock lookup errors
cifs: remove dead size-update blocks in cifs_setattr_unix/nounix
smb: client: fix request buffer leak in smb2_new_read_req()
rtc: spacemit: handle regmap_test_bits() error return
rtc: pcf8563: fix clock provider leak on unbind
virtio: rtc: time out alarm requests
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
virtio_pci: fix wrong queue index for admin vq in intx path
vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY
virtio_balloon: quiesce balloon work before device shutdown
virtio_balloon: factor out virtballoon_quiesce()
virtio: add virtio_device_shutdown() helper
vdpa_sim: fix cleanup after worker creation failure
virtio_balloon: disable indirect descriptors
net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
bonding: initialize err for empty target lists
mlxbf-bootctl: fix the build error with FIELD_PREP()
platform/x86/amd/hsmp: Reject negative power cap writes in hwmon
platform/x86: hp-bioscfg: fix password encoding bounds check
vsock: use sock_error() to consume sk_err after a failed connect
vsock: don't check the listener's sk_err in vsock_accept()
vsock: avoid timeout for non-blocking accept() with empty backlog
platform/x86: dell-wmi-sysman: Fix instance ID bounds
net/smc: hash socket only after full initialisation in smc_sk_init()
8139cp: fix Rx and Tx not being disabled in cp_suspend
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
ALSA: hda: Fix connection list comparison in proc output
fuse: check for NULL root inode in fuse_fill_super_submount
soc: qcom: ubwc: Fix missing include
fs/ntfs3: validate ef->size covers the record's name and value
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
cuse: wait for pending RCU callbacks on module exit
net: bridge: vlan: fix inverted default vlan notification
tls: fix RX desync on overlapping skbs
net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
ipvs: fix integer overflow in ftp helper port/address parsing
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled
net: hsr: free learned nodes on device setup failure
pppox: drain queued packets on channel handoff
net: dsa: b53: fix error propagation from b53_fdb_dump()
net: kcm: Hold RCU read lock while running BPF parser
ionic: fix completion descriptor access with 2x desc size
ptp: netc: skip PEROUT disable if channel is not enabled
drm/xe: tests: fix error message in xe_migrate_sanity_test()
hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed
octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
bpf, xdp: move offload check into dev_xdp_install()
clk: ti: mux: resolve parent clocks by DT index, not by name
clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate()
nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3
NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
pnfs/blocklayout: Fix device leaks on parse failure
NFSv4: remove callback IDR entry on client allocation failure
nfs: refactor pNFS functions using clear_and_wake_up_bit
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
smb/server: fix session leak in ksmbd_session_register()
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
ksmbd: disconnect on SMB3 decryption failure
bpf: Reject negative optlen in cgroup getsockopt hook
m68k: nfcon: Do not call console_is_registered() in nfcon_device()
bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks
erofs: fix unused pcluster_pools for higher page sizes
lwt_bpf: Restore reserved headroom after xmit program
erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX
erofs: fix interlaced ztailpacking pclusters
erofs: error out obviously illegal extents in advance
erofs: clean up encoded map flags
smb/server: preserve error status in smb2_handle_negotiate()
smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
ksmbd: free preauth sessions on connection teardown
ksmbd: do not advertise unimplemented CA support
ksmbd: validate ipc response length before dereferencing its fields
smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
ksmbd: Do not skip lock checks for single-byte ranges
hwmon: (emc1403) Drop hysteresis for low limit temperature
hwmon: (emc1403) Rely on subsystem locking
hwmon: (coretemp) Fix core_data leak on CPUs without PTS
apparmor: fix deadlock in complain-mode change_hat
block: mtip32xx: synchronize ioctls with device removal
ublk: reject non-power-of-2 zone sizes in SET_PARAMS
null_blk: serialize configfs attribute updates with device setup
null_blk: serialize configfs attribute stores with the lock
null_blk: reject per-device queue resize for shared tag set
null_blk: free zones array on device power-off
null_blk: free global tag_set on init error path
null_blk: register configfs subsystem after creating default devices
null_blk: use DEFINE_MUTEX for the file-scope mutex
mailbox: riscv-sbi-mpxy: validate RPMI notification lengths
mailbox: pcc: Fix command timeout due to missed interrupt
mailbox: rockchip: disable pclk on probe failure and unbind
mailbox: qcom-cpucp: handle NULL data in send_data callback
mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
perf dso: Replace assert with runtime check in dso__read_symbol()
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
perf dso: Guard against errno==0 when dso__get_filename() returns NULL
sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry
crypto: lskcipher - propagate errors from unaligned crypt
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
selftests/sched_ext: Fix flaky ddsp failure tests on busy systems
bpf: Fix pending_pos walk on 32-bit ring position wrap
ACPI: scan: fix bus ID cleanup on device_add() failures
ring-buffer: Remove trace_buffer::cpus
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap
selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt
HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU
ASoC: SOF: validate topology volume range before allocation
tracing: Have trace_event_update_all() only handle module that is loading
HID: haptic: don't write an uninitialized value to unhandled usages
ALSA: core: Fix use-after-free in snd_card_do_free()
fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
fs/ntfs3: fix integer overflow in MFT cluster validation
bpf, arm64: Fix stack-passed arguments for indirect trampolines
net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
scsi: ufs: core: Set task state before io_schedule_timeout()
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
selftests/bpf: Fix for veristat file/prog filters processing
Squashfs: check block offset is not negative
ocfs2: fix circular locking dependency in ocfs2_init_acl()
ocfs2: validate DIO orphan slot during inode read
ocfs2: validate orphan slot during inode read
bpftool: Fix double close in map dump
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
selftests/cgroup: Preserve CPU hotplug write errors
ALSA: seq: midi: Serialize input teardown with event_input
ALSA: seq: midi: Optimize event_input locking with RCU
clocksource/drivers/armada: Unwind timer clock on init failure
clocksource/drivers/clps711x: Do not unmap clocksource MMIO
s390/debug: Fix deadlock during unregister
xenbus: Unregister reboot notifier on init failure
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
power: supply: bq27xxx: bq27520g4: fix REG_TTES address
power: supply: bd99954: Drop bad register fields
PCI/ASPM: Disable/restore ASPM on every function for multi-function devices
spi: img-spfi: don't disable runtime PM on DMA deferred probe
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
selftests: harness: Mark test fixture objects __maybe_unused
selftests: harness: Restore order of test functions
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
perf build: Remove leftover feature tests for removed cxx and clang support
super: fix dying superblock warning messages
PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore
firewire: core: fix memory leak in error path of build_tree()
firewire: core: validate parent port count before allocating nodes in build_tree()
firewire: core: consolidate port counting in build_tree()
firewire: core: add KUnit tests for failure of tree building
firewire: core: add KUnit tests for successful tree building
firewire: core: add KUnit test skeleton for node tree
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
mtd: ubi: Release device reference on busy detach
ubi: Fix rollback for explicit UBI device numbers
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc
ice: acquire NVM lock around each flash read
ice: refactor to use helpers
ice: clear the default forwarding VSI rule when releasing a VSI
ice: fall back to SBQ when LL PHY timer interface times out
RDMA/cma: Fix WARNING in res_to_rt
RDMA/cxgb4: Free debugfs on registration failure
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
ALSA: seq: Don't leak the extension cell pointer in the bounce payload
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
nfc: digital: Do not dump a NULL response in command completion
nfc: pn533: hold a reference to the request skb during send_frame
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
nfc: nci: fix double completion race in nci_data_exchange_complete
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
nfc: llcp: avoid userspace overflow on invalid optlen
nvme: reject passthrough of driver-managed Set Features
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
nvme-apple: Drop the PRP null check chicken bit
nvme-apple: Require page aligned buffers on the admin queue
nvme: Add a quirk for page aligned admin queue buffers
nvme: expose active quirks in sysfs
nvme: remove virtual boundary for sgl capable devices
block: accumulate memory segment gaps per bio
nvme-apple: Never set the opcode in the NVMMU TCB
nvme-apple: Don't set a DMA direction for commands without a data transfer
nvme-apple: Destroy the admin queue on removal
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
nvme: Add the DHCHAP maximum HD IDs
s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
integrity: Make arch_ima_get_secureboot integrity-wide
arm64: bti: Disable in-kernel BTI with recent versions of Clang
ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
spi: sprd-adi: Fix probe succeeding without registering the controller
phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy
phy: qualcomm: qmp-combo: Add DP offsets and settings for Glymur platforms
phy: qualcomm: qmp-combo: Update QMP PHY with Glymur settings
phy: qualcomm: Update the QMP clamp register for V6
phy: qcom-qmp-combo: Use regulator_bulk_data with init_load_uA for regulator setup
phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator
rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
iommu/amd: Fix incorrect device ID in invalid PASID error message
apparmor: fix unconfined user namespace restriction forced stack
apparmor: change fn_label_build() call to not return NULL
apparmor: split xxx_in_ns into its two separate semantic use cases
powerpc/configs: enable CONFIG_RAS to fix EDAC support
amt: Don't support cross-netns setup.
selftests/sched_ext: Check skeleton open failure in exit test
cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates
cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping
cgroup/cpuset: Rename update_unbound_workqueue_cpumask() to update_isolation_cpumasks()
nvme-pci: release descriptor pools on probe failure
nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
nvmet: fix Reservation Register Replace for unregistered host with IEKEY
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks
hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv
hwmon: (cros_ec) Register the thermal devices after the hwmon ones
hwmon: Support guard() and scoped_guard for subsystem locks
hwmon: (cros_ec) Add support for temperature thresholds
hwmon: (cros_ec) Move temperature channel params to a macro
hwmon: (cros_ec) Split up supported features in the documentation
arm64: Disable KCSAN instrumentation in delay.o
xdrgen: Fix opaque and string encoders for unbounded members
xdrgen: Do not declare union XDR functions in the definitions header
xdrgen: Address some checkpatch whitespace complaints
m68k: Fix backtraces for non-running tasks
hwrng: imx-rngc - Disable clock on registration failure
crypto: qat - remove dead ADF_HEX code
crypto: qat - use 2-arg strscpy where destination size is known
iommu/vt-d: Flush context cache with correct SID when tearing down aliases
iommu/vt-d: Tear down scalable-mode context on probe failure
iommu/vt-d: Clear Present bit before tearing down copied context entry
iommu/vt-d: Fix UCTP context table slot when copying root entries
iommu/dma: Restore locking around msi_page_list
fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
fbdev: kyro: Validate overlay viewport coordinates
fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
perf python: Fix memory leak in pyrf__metrics_cb
perf python: Validate CPU and thread maps in pyrf_evsel__open
perf python: Handle Py_None for thread and cpu maps
perf python: Check counts_values size in set_values
perf test: Fix skiplist leak in cmd_test
perf test: Support dynamic test suites with setup callback and private data
perf synthetic-events: Fix uninitialized pthread_join
perf stat: Fix evsel_list leak in cmd_stat
ARM: dts: helios4: add SATA regulator supplies
ARM: dts: helios4: add vcc-supply to GPIO expander
ARM: dts: helios4: add vcc-supply to EEPROM
arm64: dts: turris-mox: fix usb3 phys
i3c: renesas: Don't register devices when ENTDAA times out
i3c: renesas: Follow a unified pattern for transfer and command initialization
i3c: renesas: Return immediately if there is no transfer
bpf: Fix mmap_lock leak in irq_work path
bpf: Avoid faultable build ID reads under mm locks
bpf: Factor out stack_map build ID helpers
riscv: cpufeature: Clarify ISA spec version for canonical order
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
iio: light: gp2ap002: re-enable irq if runtime suspend fails
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
iio: light: opt4060: Fix pointer type passed to div_u64_rem()
bpf, cgroup: Fix storage null-ptr-deref after replacing prog
Bluetooth: MSFT: validate evt_prefix_len against the response length
Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative
Bluetooth: btmtk: add MT7902 SDIO support
Bluetooth: btmtk: add MT7902 MCU support
mmc: sdio: add MediaTek MT7902 SDIO device ID
Bluetooth: MGMT: free the HCI command when it is cancelled
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
Bluetooth: hci_conn: fix the SCO setup context lifetime
Bluetooth: btintel: Fix diagnostics event detection
Bluetooth: virtio_bt: avoid OOB read of build info string
pinctrl: airoha: fix edge-triggered interrupts handling
pinctrl: airoha: fix IRQ mask/unmask code
pinctrl: airoha: add missed IRQ resource helpers
pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code
pinctrl: airoha: add missed get_direction() function for gpio_chip
pinctrl: airoha: an7583: fix spi group pins
pinctrl: airoha: an7583: fix muxing of non-gpio default pins
pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins
pinctrl: airoha: fix pwm pin function for an7581 and an7583
pinctrl: airoha: convert PWM GPIO to macro
pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order
pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins
pinctrl: airoha: fix mdio bitfield names
pinctrl: airoha: add support for Airoha AN7583 PINs
pinctrl: airoha: convert PHY LED GPIO to macro
btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
btrfs: avoid GFP_ATOMIC allocations in qgroup free paths
btrfs: use aligned range for locking in extent_fiemap()
btrfs: zoned: don't clobber the extent buffer when zeroing it out
btrfs: retry verity reads for not-uptodate Merkle folios
btrfs: always wait for ordered extents to avoid OE races
btrfs: merge setting ret and return ret
btrfs: make btrfs_repair_io_failure() handle bs > ps cases without large folios
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
scsi: sd: Fix sd_done() sense handling condition
perf trace-event: Fix integer truncation in do_read() and skip()
Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
Bluetooth: btusb: Record matched usb_device_id into btusb_data
Bluetooth: btusb: refactor endpoint lookup
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
sched/fair: Check CPU capacity before comparing group types during load balance
sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY
perf/x86/intel/pt: Fix stop/start with no update
perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED
perf/x86/intel/pt: Factor out pt_config_enable()
ACPI: video: Release PCI device reference after lookup
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
bpf, arm64: Fix exception table metadata for arena load-acquire
bpf, x86: Fix exception table metadata for arena load-acquire
bpf, riscv: Add and use bpf_atomic_is_load_acq() helper
bpf: Reject load-acquire from pointers requiring fault protection
perf: arm_pmuv3: Zero initialize hw_id branch stack field
coresight: Refactor etm4_config_timestamp_event()
coresight: etm4x: fix leaked trace id
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
coresight: Change syncfreq to be a u8
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
md/raid1: don't set array_frozen in raid1_takeover()
md/md-llbitmap: stop daemon timer rearm on destroy
md/md-llbitmap: prevent create failure bitmap UAF
md: avoid stale clone I/O accounting timestamps
md: wait for behind writes before destroying bitmap
md/raid5: round bitmap stripes with sector division
phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets
phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
hugetlbfs: release subpool on fill_super failure
pinctrl: rockchip: Reset the pin count when recalculating SoC data
firmware_loader: do not queue completed sysfs fallback requests
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
drm/amdgpu/gfx6: Use PFP on the compute queues too
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
perf trace-event: Fix buffer overflow in read_string()
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
phy: sunplus: fix error handling in sp_uphy_init()
phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
ext4: fix spurious message about orphan cleanup on RO fs
drm/amdgpu/gfx6: Fixup emit_cntxcntl()
leds: gpio: Clear error pointers for skipped LEDs
mfd: macsmc: Fix key count endianness annotation
mfd: iqs62x: Reject zero-length firmware records
mfd: rave-sp: validate received frame payload lengths
arm64: hibernate: Restore DAIF state on error
arm64: hibernate: mask DAIF before restoring hibernated kernel
wifi: mac80211: skip default WMM setup for AP_VLAN links
RDMA/erdma: restrict the driver to little-endian systems
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
module/dups: Inform duplicate requests about the result directly
module: use strscpy() to copy module names in stats and dup tracking
module: replace use of system_wq with system_dfl_wq
RDMA/siw: Fix use-after-free in siw_accept()
IB/isert: post the full-feature receive buffers after session registration
IB/isert: delay the final Login Response until the session is registered
cpufreq: imx6q: fix out-of-bounds write when probed more than once
cpufreq: imx6q: fix devres accumulation across driver rebind
rust: cpufreq: Fix temporary write in Registration::bios_limit_callback
rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
drm/sun4i: dw-hdmi: Drop TCON TOP port reference
drm/sun4i: tcon: Drop remote endpoint reference
drm/sun4i: crtc: Propagate layer initialization error
drm/sun4i: hdmi: Don't leak sync polarity bits into packet control
drm/sun4i: tcon: Drop TCON TOP device reference
drm/sun4i: tcon: Set output mux for DSI and LVDS
drm/sun4i: vi scaler: Fix coefficient selection
clk: rockchip: rk3576: fix source muxes for SPI0..SPI4
ocfs2: synchronize heartbeat callbacks with o2net teardown
perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly
perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info()
perf libbfd: Validate BPF prog info arrays before pointer cast
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
RDMA/erdma: Hold QP references for AE and CM processing
RDMA/erdma: Hold CQ references when processing EQ events
kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile
modpost: prevent leak when early return no suffix .o in read_symbols()
scripts/tags.sh: Prevent binary files appearing in cscope.files
intel_idle: Avoid using deep idle states during initialization
intel_idle: Add cmdline option to adjust C-states table
intel_idle: Initialize sysfs after cpuidle driver initialization
bpf: Check load-acquire src ptr type before the load
arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
selftests/mm: fix ternary operator precedence in ksm_tests
selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
selftests/mm: ksm_tests: use kselftest framework
bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
remoteproc: Move resource table data structure to its own header
arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC
drm/omap: dsi: Do not copy isr table
riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller
fat: release buffer head after rebuilding parent
rapidio: clear mport->net when rio_add_net() fails
pps-gpio: remove dead capture_clear code
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
pps: don't try to wait for negative timeouts in PPS_FETCH
lib/string: fix memchr_inv() for large ranges
ocfs2/cluster: keep heartbeat local node stable
ublk: check for ublk_unmap_io() returning 0
ublk: check import_ubuf() return value
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
block/blk-iocost: collect per-cpu latency stats over possible CPUs
block/blk-stat: drain per-cpu callback stats over possible CPUs
blk-cgroup: skip dying blkg in blkcg_activate_policy()
blk-cgroup: fix race between policy activation and blkg destruction
phonet: pep: do not write beyond optlen in getsockopt
net: stmmac: Skip PHY attach if custom PCS is in use
iio: light: tsl2583: return zero in write_raw() on success
iio: light: isl29028: return zero in write_raw() on success
iio: light: tsl2772: fix ALS calibscale readback
perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
perf auxtrace: Fix queue grow overflow and old array leak
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
HID: lg4ff: validate report length before fixed offsets
HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
HID: steam: Reject short reads
HID: steam: Improve logging and other cleanup
HID: steam: Add support for sensor events on the Steam Controller (2015)
HID: steam: Rename some constants that got renamed upstream
HID: steam: Refactor and clean up report parsing
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
HID: synchronize input before cleaning up a failed probe
HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
misc: pci_endpoint_test: Check SUCCESS bit for doorbell status
dm-integrity: replace forgeable discard filler with a keyed sector marker
tty: clear cdev pointer after cdev_add() failure
serial: amba-pl011: keep console clock enabled for atomic writes
serial: amba-pl011: unprepare console clock on unregister
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
soc: fsl: qe: implement get_direction()
soc: fsl: qe: properly scan GPIO nodes at startup
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
pinctrl: spacemit: validate pins in pinconf callbacks
pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE
firmware: coreboot: Validate table bounds
firmware: google: Add bounds checks in coreboot_table_populate()
wifi: cfg80211: stop PMSR before P2P and NAN teardown
wifi: cfg80211: Add an API to configure local NAN schedule
wifi: nl80211: split out UHR operation information
wifi: nl80211: refactor nl80211_parse_chandef
wifi: cfg80211: add support to handle incumbent signal detected event from mac80211/driver
wifi: cfg80211: add initial UHR support
wifi: ieee80211: add some initial UHR definitions
wifi: nl80211: Add support for EPP peer indication
wifi: cfg80211: include S1G_NO_PRIMARY flag when sending channel
wifi: mac80211: disconnect on CSA to channel 0
wifi: mac80211: skip unused probe response countdown offsets
wifi: zd1211rw: reject secondary interfaces to prevent conflicts
wifi: mac80211: send TWT teardown to peer after setup TX failure
perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
iommu/arm-smmu-v3: Convert to use atomic poll timeout
kselftest/arm64: Don't write to P0 in irritator on SME only systems
kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets
arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets
arm64: smp: Fix IPI teardown for GICv5 flow
wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
wifi: mt76: reject out-of-range link ids in mt76_vif_link()
wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band
wifi: mt76: fix queue assignment for disassoc packets
wifi: mt76: mt7915: report RX chain signal for all RX paths
wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed
wifi: mt76: mt7996: fix reg addr remap when addr is 0
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
wifi: mt76: mt7915: fix double hif2 init on the non-WED path
wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
wifi: mt76: mt7996: skip key upload when adding an offchannel link
wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
bpf, x86: Fix trampoline stack size for 128-bit arguments
perf machine: Check snprintf truncation for guest kallsyms path
perf machine: Free scandir entries in guest kernel map creation
perf machine: Reset errno before strtol in guest kernel map creation
perf machine: Don't abort guest map creation on first inaccessible dir
perf machine: Check snprintf truncation in machines__findnew()
perf machine: Guard against NULL strlist in machines__findnew()
perf machine: Fix NULL parent dereference in fork event processing
perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()
regulator: core: use system_freezable_wq for init complete work
ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach
ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors
ASoC: tas2783: Use new SoundWire enumeration helper
soundwire: Add a helper function to wait for device initialisation
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
drm/msm/dp: Drop dev_pm_opp_set_rate(0)
drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
perf: arm_spe: Make wakeup range check overflow safe
drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active
drm/msm/dp: reject YUV420-only modes without VSC SDP support
drm/msm: don't tear down KMS twice when KMS init fails
ACPI: processor: Unregister cpufreq notifier on init failure
ACPI: processor: idle: Optimize ACPI idle driver registration
wifi: mt76: only consume the WO drop bit on WED v2 devices
wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
wifi: mt76: mt7915: unwind state on add_interface failure
wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
wifi: mt76: check txfree done event on the WED hw path
wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
wifi: mt76: fix RXDMAD_C buffer recycling race
wifi: mt76: fix uninitialised RXDMAD_C descriptor info
wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
wifi: mt76: mt7915: write RX header translation bit to the correct register
wifi: mt76: mt7996: don't report a zero TX bitrate
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
wifi: mt76: assign link_id when sending probe request during scan
wifi: mt76: fix non-AQL packet accounting for MLO stations
wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart
wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch
wifi: mt76: mt7996: support fixed rate for link station
wifi: mt76: fix RX data queuing of RRO 3.0
wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
wifi: mt76: mt7925: update clc before setting sar power table
wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
wifi: mt76: always enable RRO queues for non-MT7992 chipset
wifi: mt76: Introduce the NPU generic layer
wifi: mt76: Move Q_READ/Q_WRITE definitions in dma.h
wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
fanotify: report full event length for FIONREAD
misc: sgi-gru: remove interrupt-context page-table walks
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
powerpc/44x: Set GPIO chip parent
powerpc: implement get_direction() in cpm2
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
md/raid1: create serial pool adding rdev to array with serialize_policy=1
fs: annotate inode timestamp accessors
i3c: master: adi: add OF module alias for autoloading
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
swiotlb: Preserve allocation virtual address for dynamic pools
iommu/dma: Check atomic pool allocation result directly
md: scope memalloc_noio to allocation critical sections
md: skip redundant raid_disks update when value is unchanged
md: remove unused mddev argument from export_rdev
md/bitmap: resume array on backlog_store() error path
clk: qcom: Return expected ENOMEM error on dynamic allocation failure
clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
bpf: Fix potential UAF when reading bpf link info
bpf: Fix potential UAF in bpf_netns_link_update_prog
power: supply: sc2731_charger: cancel work on remove
power: supply: isp1704_charger: cancel work on remove
arm64: dts: qcom: qcs6490-rb3gen2: Fix the PCIe iommu-map entries
arm64: dts: qcom: lemans: Fix the PCIe iommu-map entries
arm64: dts: qcom: lemans: Move PCIe devices into soc node
arm64: dts: qcom: sa8775p: Add reg and clocks for QoS configuration
arm64: dts: qcom: lemans: add QCrypto node
arm64: dts: qcom: lemans: add refgen regulator and use it for DSI
arm64: dts: qcom: lemans: move USB PHYs to a proper place
arm64: dts: qcom: talos: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8750: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8650: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
arm64: dts: qcom: sar2130p: Fix the PCIe iommu-map entries
arm64: dts: qcom: kodiak: Fix the PCIe iommu-map entries
arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
block: fix dio leak on metadata mapping error
block: add a bio_endio_status helper
block: don't set BIO_QUIET for BLK_STS_AGAIN
blk-crypto: use on-stack skcipher requests for fallback en/decryption
blk-crypto: optimize bio splitting in blk_crypto_fallback_encrypt_bio
blk-crypto: submit the encrypted bio in blk_crypto_fallback_bio_prep
firmware: qcom: scm: Fix tzmem state on probe retry
firmware: qcom: scm: Fix reserved memory cleanup on probe failure
firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
firmware: qcom: scm: instrument SMC call path with tracepoints
firmware: qcom: scm: add trace events for the SMC call interface
firmware: qcom_scm: Support multiple waitq contexts
firmware: qcom_scm: Add API to get waitqueue IRQ info
arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes
arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override
arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
md/raid10: consistently fail atomic writes that require splitting
wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration"
selftests/zram: fix kernel_gte() for POSIX sh
md: recheck spare changes before starting sync
tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
fanotify: stop permission watchdog when timeout is zero
md/raid5: protect lockless recovery_offset accesses during reshape
md/raid5-ppl: fix use-after-free in ppl_do_flush()
md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
bus: mhi: host: Fix controller cleanup on EDL sysfs failure
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
platform/chrome: cros_ec_debugfs: Unregister panic notifier
platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
media: qcom: iris: handle runtime PM resume failure in core deinit
media: qcom: iris: Fix bitmask test in iris_allow_cmd()
drm/msm: remove objects from evit list after pinning them
PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
PCI: starfive: Fix Runtime PM handling and teardown ordering
wifi: ath12k: validate TLV length in process_tpc_stats()
wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
spi: davinci: switch to managed controller allocation
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
IB/isert: reject login PDUs declaring more data than was received
IB/isert: reject PDUs declaring more data than was received
media: staging/ipu7: fix async notifier leak on init error
RDMA/cxgb4: free STAG index when TPT entry write fails
RDMA/mlx5: Send cong param changes to the resolved port mdev
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
nilfs2: prevent out-of-bounds read in super root block parsing
nilfs2: fix infinite loop in nilfs_clean_segments()
clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
clk/x86: pmc_atom: add kasprintf return value check
clk: palmas: Manage external-control prepare with devm
clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
clk: mediatek: Refactor pllfh registration to pass device
clk: mediatek: Pass device to clk_hw_register for PLLs
clk: mediatek: Refactor pll registration to pass device
clk: tegra: tegra124-emc: put EMC node on register failure
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
wifi: mac80211: fix per-STA profile length in cross-link CSA parsing
RDMA/efa: Fix PBL chunk length computation
RDMA/rxe: Fix UAF in ODP init error-handling path
iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
fs/ntfs3: reject restart table growth beyond U16_MAX entries
staging: rtl8723bs: use kfree_sensitive() for key material
firmware: qcom_scm: Introduce PAS context allocator helper function
remoteproc: Prevent crash handling to race with rproc_del()
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
remoteproc: Allow shutdown of crashed processors
remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf
cpufreq/amd-pstate: Add comment explaining nominal_perf usage for performance policy
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
spi: oc-tiny: switch to managed controller allocation
clk: mediatek: mt6735: Unregister PLLs on probe failure
isofs: release zisofs block pointer buffer head
powercap: intel_rapl_tpmi: Handle PMU registration failure during probe
thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp
thermal/drivers/airoha: Fix copy paste error for sen internal
thermal/drivers/airoha: Fix copy paste error on clamp_t low temp
RDMA/mlx5: Fix integer overflow of user QP buffer size
crypto: keembay - publish OF module alias for OCS AES/SM4
crypto: keembay - Initialize completion before requesting IRQ
scsi: ufs: debugfs: Reserve space for a string terminator
power: supply: sbs-battery: Use a per-device serial number buffer
arm64: RSI: fix field-spanning write warning in attestation token init
tools/build: Allow versioning of all LLVM tools defined in Makefile.include
pinctrl: mediatek: free EINT resources on unbind
cxl/region: Fix use-after-free in find_pos_and_ways() error path
selftests/bpf: Fix memory leak on subtest_states reallocation
selftests/bpf: Fix incorrect error checking for pthread_create
ARM: lpc32xx: only run SoC init on LPC32xx hardware
bpf: Fix CFI mismatch in task work callback
arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
arm64: dts: rockchip: Add missing hclk for RK3588 eDP1
arm64: dts: rockchip: Add missing hclk for RK3588 eDP0
drm/panthor: return PTR_ERR() from devm_drm_dev_alloc()
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
drm/tve200: add OF module alias for autoloading
perf cap: Remove used_root parameter and simplify capability checks
leds: pca9532: Fix phantom device registration on missing hardware
PM: hibernate: Fix memory leak in snapshot_write_next() error path
RDMA/erdma: complete object teardown when the destroy command fails
xfrm: Fix skb double-free in xfrm_dev_direct_output()
perf cs-etm: Avoid truncating AUX buffer sizes to int
perf cs-etm: Flush thread stacks after decoder reset
riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups
riscv: dts: spacemit: Add OrangePi R2S board device tree
riscv: dts: spacemit: add MusePi Pro board device tree
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems
cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization
cpufreq/amd-pstate: Add support for platform profile class
cpufreq/amd-pstate: Add dynamic energy performance preference
amd-pstate: Make certain freq_attrs conditionally visible
cpufreq/amd-pstate: Use sysfs_match_string() for epp
cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active
ARM: dts: allwinner: a10: Fix PMU interrupt
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
ext4: fix buffer_head leak in ext4_init_orphan_info
RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region
wifi: ath12k: refactor QMI memory assignment
wifi: ath12k: switch to name-based reserved memory lookup
wifi: ath6kl: avoid buffer overreads in WMI event handlers
ext4: validate readdir offset before accessing dirent
ext4: use fsdata to track inline data write state and fix race
ext4: drain in-flight DIO before buffered write fallback
ext4: clear stale xarray tags on folios skipped during writeback
thermal: intel: int3400: clean up ODVP on probe failures
iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
iommu/qcom: Remove sysfs device on probe failure path
iommu/amd: Fix undefined behavior in devid_write debugfs function
firmware: arm_scmi: Fix requested device removal race
RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
RDMA/core: Fix potential use after free in uverbs_free_dmah()
RDMA/core: Fix potential use after free in ib_free_cq()
RDMA/core: Fix potential use after free in counter_release()
RDMA/core: Fix potential use after free in ib_destroy_srq_user()
RDMA/core: Fix potential use after free in ib_destroy_cq_user()
RDMA/core: Fix use after free in ib_query_qp()
RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
RDMA/nldev: Fix locking when accessing mr->pd
RDMA/restrack: Fix typos in the comments
RDMA/mana_ib: drain QP references after partial table insertion
RDMA/erdma: Fix CEQ tasklet use-after-free on removal
PCI: j721e: Fix incorrect max_lanes for J7200
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
bpf: Mark bpf_refcount field as unique
bpf: Preserve unique-field state across nested structs
bpf: Fix offset warn check for bpf_res_spin_lock
virt: arm-cca-guest: use migrate_disable() for attestation token requests
ACPI: battery: Adjust charging status validation check
bpf, riscv: Fix extable handling for arena load_acquire
riscv, bpf: Fix kernel stack corruption in tailcall with CFI
riscv, bpf: Fix memory leak in bpf_jit_free
libbpf: Search /lib64 and /lib in resolve_full_path()
bpf: Zero queue and stack outputs on lock failure
platform/x86: acer-wmi: reject missing gaming WMI results
ext4: skip extra isize expansion during mount to prevent deadlock
ext4: fix out-of-bounds read in ext4_read_inline_dir()
ext4: fix circular lock dependency in ext4_ext_migrate
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
ACPI: processor: validate MADT IOAPIC entry bounds
ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
RDMA/nldev: validate dynamic counter attribute length
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
selftests/bpf: Silence array bounds warning in global_map_resize
selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256
x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0
kcsan: avoid unintended access checking in NMIs
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe
ASoC: meson: Keep link pointers valid on realloc failure
dmaengine: dw-edma: Clear stale requests on termination
dmaengine: dw-edma: Serialize channel state checks
dmaengine: dw-edma: Serialize abort state updates
dmaengine: dw-edma: Terminate all descriptors without callbacks
bpf: Reject arena frees below the arena base
drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg
driver core: soc: Unregister bus on early device registration failure
software node: Fix software_node_get_reference_args() with index -1
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
mtd: mtdswap: Avoid freeing registered blktrans device twice
mtd: intel-dg: Fix runtime PM error path in probe
mtd: intel-dg: wake card on operations
vfio/pci: clear vdev->msi_perm after freeing it on init failure
char: xilinx_hwicap: unregister class on init errors
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
ppdev: prevent overflow when setting port timeout
cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
misc: lan966x_pci: depopulate children on populate failure
misc: ad525x_dpot: use driver core groups for sysfs files
misc: rtsx: add missing write register handling
misc: bcm-vk: Use acquire/release for msgq_inited
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
uio: Fix stale info pointer in failed registration path
gpib: Move stuck SRQ update under lock
staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
staging: rtl8723bs: remove multiple blank lines in core/
staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
staging: rtl8723bs: expand multiple assignment into separate statements
staging: rtl8723bs: fix operator and type cast spacing
staging: rtl8723bs: use standard offsetof in cfg80211 operations
staging: rtl8723bs: Fix operator spacing in rtw_security.c
UDF symlink pathComponent header OOB read
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
usb: gadget: f_uac1_legacy: remove broken string configfs attrib…
…_config_sid_1_9_0()
qcom_pcie_config_sid_1_9_0() reads the "iommu-map" property as an array
of fixed four-word {rid-base, phandle, sid, rid-len} entries to program
the BDF to SID translation table. But that layout only holds for an
IOMMU with '#iommu-cells = <1>'. The PCIe SMMUs on these SoCs use
'#iommu-cells = <2>' (SID and mask), so per the pci-iommu binding each
entry is really five cells long.
This used to work only because the DTs were themselves broken. They
described iommu-map with four-cell entries that omitted the SID mask,
which of_map_id() tolerated via its of_check_bad_map() fallback, and the
four-word parsing coincidentally matched that malformed shape.
Since commit ccb2fd7 ("of: Respect #{iommu,msi}-cells in maps") the
OF core parses such maps correctly, so the device trees were converted
to proper five-cell entries, e.g. commit c41749e ("arm64: dts:
qcom: sm8250: Fix the PCIe iommu-map entries"). With five-cell entries
the fixed four-word stride slips by one cell for each entry after the
first, so qcom_pcie_config_sid_1_9_0() reads the endpoint mapping's RID
from the preceding entry's length cell and its SID from the phandle cell.
As the RID is the hash key, the endpoint's real RID is never programmed
into the BDF to SID table. Its DMA then hashes to an unprogrammed slot,
gets tagged with SID 0 and the SMMU faults like below on QCS8300:
arm-smmu 15200000.iommu: Unhandled context fault: fsr=0x402, iova=0xffa00000, cbfrsynra=0x0, cb=1
To fix this, walk the map with a stride of 3 + '#iommu-cells' of the
referenced IOMMU and take the SID from the first specifier cell, which is
all the BDF to SID table needs. Validate the layout instead of trusting
the array size. Also, preserve the legacy behavior of the old DTs by
detecting the same pattern that of_check_bad_map() recognizes and
falling back to a stride of four.
Fixes: 4c93988 ("PCI: qcom: Add support for configuring BDF to SID mapping for SM8250")
Reported-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260907143349.317495-1-mani@kernel.org
Signed-off-by: Ziyue Zhang <ziyue.zhang@oss.qualcomm.com>
…nux#1254) arm64: dts: qcom: shikra: Mark tpdm_dcc device as failed
…inux#1240) drm/msm/dsi: fix AHB clock staying enabled across suspend
…latory update on bring-up (qualcomm-linux#1119) [PATCH ath-next 0/4] wifi: ath12k: fix timeout while waiting for regulatory update on bring-up
Enable OPE driver support for Agatti and Shikra
Menu governor gets default enabled if Teo governor is not compiled in. Menu still stays as default governor when both are compiled in due to menu having higher rating than teo. Keeping Teo available helps in evaluating power and performance without spinning builds. Enable both menu and teo governors for CPUidle. Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com> Signed-off-by: Sneh Mankad <sneh.mankad@oss.qualcomm.com>
Merge tag 'v6.18.52' into qcom-6.18.y
qcom.config: Enable CPUidle Teo and Menu governors
Add support for the Cypress CYPD6129 dual Type-C PD controller on the
Talos Lyra EVK.
Enable the controller on I2C5 at address 0x40, configure its GPIO86
interrupt and wakeup support, and describe both USB Type-C connectors.
Connect the connectors to USB1 and USB2 through USB role-switch
remote-endpoint links.
Configure both USB controllers in OTG mode with usb-role-switch support
so that the CYPD6129 controller can manage their USB data roles.
USB1 is routed to the daughter-card board-to-board connector. Add a
fixed USB1 VBUS regulator controlled by PM8150 GPIO10 to provide and
control VBUS for the USB port on the daughter card. Configure the
corresponding PM8150 GPIO pinctrl state and keep the regulator enabled
for the board configuration.
Add the TLMM GPIO64 VBUS boost enable as a GPIO hog. This enables the
5 V boost converter required to generate the VBUS supply for the USB
daughter-card connector. The boost converter output is set to 5 V by
the feedback network consisting of R2403 and R2401:
VOUT = 0.6 * (1 + R2403 / R2401)
= 0.6 * (1 + 75K / 10K)
= 5 V
The changes also add the I2C5 alias, CYPD6129 pinctrl configuration,
wakeup-source properties, USB endpoint connections, and the required
VBUS power-control GPIO descriptions.
Link: https://lore.kernel.org/all/20261012131518.858396-1-akash.kumar@oss.qualcomm.com/
Signed-off-by: Akash Kumar <akakum@qti.qualcomm.com>
akakum-qualcomm
force-pushed
the
talos-lyra-cypd6129
branch
from
October 13, 2026 07:28
4fa6e7e to
c658969
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
arm64: dts: qcom: talos-lyra-evk: Add CYPD6129 Type-C support