[Deepin-Kernel-SIG] [linux 6.6.y] [Upstream] Update kernel base to 6.6.157 - #2150
Merged
opsiff merged 1398 commits intoSep 15, 2026
Merged
Conversation
[ Upstream commit 1c7dd70c0adfa58fd66b5cbd03efb747ad6d8d8d ] digital_wq_cmd_complete() dumps the response data whenever cmd->resp is not an error pointer. However, a driver can legitimately complete a command with no response skb at all. digital_tg_send_psl_res() is the only caller that passes timeout=0, meaning no response is expected once the command has been transmitted. On that path trf7970a completes the command with trf->rx_skb = ERR_PTR(0); which evaluates to NULL. IS_ERR(NULL) is false, so the NULL response passes the !IS_ERR() check and cmd->resp->data and cmd->resp->len are dereferenced whenever the debug print site is enabled. The driver guards its own dump with "trf->rx_skb && !IS_ERR(trf->rx_skb)"; the digital layer is missing the NULL half of that test. Use IS_ERR_OR_NULL() so that NULL responses are skipped as well. The callback on that path, digital_tg_send_psl_res_complete(), never dereferences resp and dev_kfree_skb() accepts NULL, so only the debug dump needs fixing. Fixes: 59ee236 ("NFC Digital: Implement driver commands mechanism") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Link: https://patch.msgid.link/20260710061254.80975-1-lilinmao@kylinos.cn Signed-off-by: David Heidelberg <david@ixit.cz> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c001abaaa35bc98bf24b51b2d7ff9c84557fcb17) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit d56575a2595ee1f597f39e8a1cfb67ed3501678d ] nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() parse the CORE_INIT_RSP packet without validating that the skb contains enough data. A malformed response (e.g. injected via virtual_ncidev) can declare a large num_supported_rf_interfaces while providing insufficient data, causing reads of uninitialized slab memory. This is later used in nci_init_complete_req(), triggering a KMSAN uninit-value warning. Add skb length checks before accessing packet fields: - Validate the skb has at least 1 byte for the status field. - Validate the skb can hold the fixed-size header before parsing. - In v2, bounds-check each variable-length rf_interface entry and its extension parameters within the parsing loop. - In v1, verify the skb is large enough for both the variable-length rf_interfaces array and the trailing rsp_2 structure. Reported-by: syzbot+46ca2592193f2fb3debc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=46ca2592193f2fb3debc Fixes: bcd684a ("net/nfc/nci: Support NCI 2.x initial sequence") Signed-off-by: Yun Zhou <yun.zhou@windriver.com> Link: https://patch.msgid.link/20260527052625.3309581-1-yun.zhou@windriver.com Signed-off-by: David Heidelberg <david@ixit.cz> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 5487f04c1ccbfa15aa6e531eb1ec9c9ec9c7bf31) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a50184171235045d96104811414b25cf5338cf86 ] bam_dma_probe() calls pm_runtime_use_autosuspend(), but bam_dma_remove() does not call the matching pm_runtime_dont_use_autosuspend() when removing the device. If the autosuspend delay is set to a negative value while autosuspend is enabled, the runtime PM core increments usage_count to prevent runtime suspend. Without calling pm_runtime_dont_use_autosuspend() during teardown, this reference is not dropped and usage_count remains unbalanced. Add the missing pm_runtime_dont_use_autosuspend() call before forcing the device into runtime suspend during removal. This issue was found by manual code inspection. Fixes: 7d25455 ("dmaengine: qcom-bam-dma: Add pm_runtime support") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260808110642.2770355-1-lgs201920130244@gmail.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 8980385438975cbb613c56c0341a79664279d0b4) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit fe5c16bb6252dea6025b748257ddc3b2665495b0 ] c4iw_alloc() creates the per-device debugfs tree (dev->debugfs_root via setup_debugfs()), but it is removed only in c4iw_remove(), not in c4iw_dealloc(). When RDMA device registration fails, the registration worker's err_dealloc_ctx path calls c4iw_dealloc() directly, bypassing c4iw_remove(), so the debugfs dentries leak and outlive the freed c4iw_dev. Move debugfs_remove_recursive() into c4iw_dealloc() so every path that frees ctx->dev also removes its debugfs tree. Fixes: 49ea0c0 ("RDMA/iw_cxgb4: cleanup device debugfs entries on ULD remove") Link: https://patch.msgid.link/r/20260806130128.465460-2-fanwu01@zju.edu.cn Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit f98e894ec029a752cf9c7f7834741bead0fb463d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c6d1ec4fbe56492bb88987d577f04a5fb6955f26 ] syzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via addr_handler() during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230 CPU#1: kworker/u8:4/59 Modules linked in: CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine, BIOS Google 07/24/2026 Workqueue: ib_addr process_one_req RIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138 RSP: 0018:ffffc9000201f850 EFLAGS: 00010293 RAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000 RDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003 RBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a R10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000 R13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0 Call Trace: <TASK> rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236 addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534 process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624 process_one_work kernel/workqueue.c:3375 [inline] process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> " In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate id_priv->cma_dev and bind the associated ib_device to id_priv->id.device. If cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID remains unassociated with any RDMA device. Previously, rdma_restrack_add(&id_priv->res) was invoked unconditionally even when cma_acquire_dev_by_src_ip() failed, passing a resource with a NULL dev pointer and triggering the WARN_ON assertion in res_to_rt(). Fix this by only adding the resource to restrack when acquiring the device succeeds. Reported-by: syzbot+72eddfbadda3e3928e72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=72eddfbadda3e3928e72 Tested-by: syzbot+72eddfbadda3e3928e72@syzkaller.appspotmail.com Fixes: cb5cd0e ("RDMA/core: Add CM to restrack after successful attachment to a device") Link: https://patch.msgid.link/r/20260810220123.191696-1-yanjun.zhu@linux.dev Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 2a63cb9ea862ac7d947952b497eef6520853538c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit d04287e27bf1c0b879a10d929c163f2da69715b6 ] When a VSI is configured as the switch's default forwarding VSI (ICE_SW_LKUP_DFLT) and is then torn down, the rule is left behind in the switch. ice_vsi_release() no longer removes it, and the SR-IOV VF free path (ice_free_vfs() -> ice_free_vf_res() -> ice_vf_vsi_release() -> ice_vsi_release()) does not disable promiscuous mode either, which only happens on VF reset in ice_vf_clear_all_promisc_modes(). A trusted VF that enters unicast promiscuous mode becomes the default forwarding VSI (this is the default mode, when the PF does not have VF true-promiscuous mode enabled). If the VFs are then destroyed without the VF first leaving promiscuous mode, the ICE_SW_LKUP_DFLT rule for the now-freed VSI is leaked. When VFs are recreated, a VSI reuses the freed hw_vsi_id. If it is assigned a different VSI handle than the leaked rule holds, ice_set_dflt_vsi() does not recognize it as already-default, and ice_add_update_vsi_list() folds the dangling (freed) handle into a VSI list, which the firmware rejects. The VSI handle assigned on re-creation varies, so the failure is intermittent rather than every cycle. Reproduce by repeatedly running the cycle below on the two ports of the same card, where $VF0 and $VF1 are the netdevs of vf 15 once they appear. The VF must be brought up so iavf actually pushes the unicast promiscuous request, and the rule must settle before the VFs are torn down again: echo 16 > /sys/class/net/$PF0/device/sriov_numvfs echo 16 > /sys/class/net/$PF1/device/sriov_numvfs ip link set $PF0 vf 15 trust on ip link set $PF1 vf 15 trust on ip link set $VF0 up ip link set $VF1 up ip link set $VF0 promisc on ip link set $VF1 promisc on sleep 1 echo 0 > /sys/class/net/$PF0/device/sriov_numvfs echo 0 > /sys/class/net/$PF1/device/sriov_numvfs Within a few cycles the ice PF and iavf VF log: Failed to set VSI 25 as the default forwarding VSI, error -22 Turning on/off promiscuous mode for VF 63 failed, error: -22 PF returned error -53 (IAVF_ERR_ADMIN_QUEUE_ERROR) to our request 14 This cleanup used to live in ice_vsi_release() but was dropped by the referenced refactor. Restore it. Clear the default forwarding VSI rule in ice_vsi_release() when this VSI owns it, which covers every teardown path. Fixes: 6624e78 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Petr Oros <poros@redhat.com> Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com> Tested-by: Rafal Romanowski <rafal.romanowski@intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 30c48da11491591171a4e19b4021f4ff3a678072) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 6ec64d757af9b75a3c64f9f7dad76bdc1efc06ca ] The Device Tree binding defines the extclk clock as an optional property, but the driver currently uses devm_clk_get() and manually handles the absence of the clock. Use devm_clk_get_optional() to match the binding and simplify the optional clock handling. This also propagates errors other than the absence of the optional clock, including -EPROBE_DEFER. This changes the existing behavior for errors other than -EPROBE_DEFER. RFC to discuss whether these errors should cause probe to fail rather than being treated as an unavailable optional clock. Fixes: 90eb6b5 ("ASoC: pxa-ssp: add support for an external clock in devicetree") Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260811100949.61142-1-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 48cece7b287ec819d32bc5372d7902a802ec0b01) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 0286324da660875dc504fd65b3be87e9c8b9a547 ] fsl_asoc_card_probe() hard-fails with -EINVAL when the CPU DAI (SAI) platform device is not found. Like the codec, the CPU DAI may just be probed later than the machine driver; the order is not guaranteed and varies across kernel versions, so a permanent -EINVAL leaves the card unregistered with no analog playback or capture. Defer probe instead, mirroring commit e396dec ("ASoC: fsl-asoc-card: Defer probe when fail to find codec device"). Tested on i.MX8MP with an ALC5672 on SAI3: the card that failed to register on v6.18 now comes up during boot. Fixes: 708b435 ("ASoC: fsl: Add Freescale Generic ASoC Sound Card with ASRC support") Signed-off-by: LiangCheng Wang <zaq14760@gmail.com> Link: https://patch.msgid.link/20260805-fsl-asoc-defer-cpu-dai-v1-1-43f7f538e384@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit eaaeabf566c3ca1f8a23fa4cfaf5d2f6885194f0) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…n flash [ Upstream commit 08a4267 ] Just like sync_erase() does, getting erase counter from wl_entry is faster than reading from flash. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Stable-dep-of: 420477a84f1e ("UBI: Preserve torture flag when rescheduling failed erasures") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 4e0ab4f291a761b86627531ff580293f6d7e5d1d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a033ab4 ] Function ubi_update_fastmap could be called in IO context, for example: ubifs_writepage do_writepage ubifs_jnl_write_data write_head ubifs_wbuf_write_nolock ubifs_leb_write ubi_leb_write ubi_eba_write_leb try_write_vid_and_data ubi_wl_get_peb ubi_update_fastmap erase_block So it's better to allocate memory with GFP_NOFS mode, in case waiting page writeback(dead loop). Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Stable-dep-of: 420477a84f1e ("UBI: Preserve torture flag when rescheduling failed erasures") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit d8307a8bc986bda4b2f1ac79ed2a6d1510a193b5) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c19286d ] Since erase_block() has same logic with sync_erase(), just replace it with sync_erase(), also rename 'sync_erase()' to 'ubi_sync_erase()'. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Stable-dep-of: 420477a84f1e ("UBI: Preserve torture flag when rescheduling failed erasures") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 3996be3f5b8a9b48208031ebbd817a2e7f96148e) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 420477a84f1e52babfe60a43dbdd0988ed956845 ] In __erase_worker(), when ubi_sync_erase() returns -EINTR, -ENOMEM, -EAGAIN, or -EBUSY, the physical eraseblock is rescheduled for erasure via schedule_erase() with the torture flag hardcoded to 0. This unconditionally drops the torture request. If the error occurred before torture_peb() completed (e.g., -ENOMEM from the ec_hdr allocation in ubi_sync_erase(), errors from self_check_not_bad()/nor_erase_prepare() in ubi_io_sync_erase(), or torture_peb() failing mid-test because its internal do_sync_erase()/ ubi_io_read()/ubi_io_write() returned one of the above error codes), the torture test was never finished. Such a PEB may reach the free pool without being tortured, defeating the purpose of the torture test for detecting marginally-bad eraseblocks. If the error occurred after torture_peb() succeeded (the final do_sync_erase() in ubi_io_sync_erase() or ubi_io_write_ec_hdr() in ubi_sync_erase() failed), the torture has already been done and need not be repeated. Pass the torture flag by pointer to ubi_sync_erase() and ubi_io_sync_erase(), and clear it to zero once torture_peb() has completed successfully. __erase_worker() then forwards the updated wl_wrk->torture to schedule_erase(): torture already done is dropped, torture not completed is preserved across the reschedule. Fixes: 784c145 ("UBI: fix error handling in erase worker") Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 3c5599d3cf1abd18e29a461e349b6a600a48ece8) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit be04fce9945aac2a843f5d16725391eb80d948ef ] In ubi_update_fastmap(), when no fresh PEB is available to replace an old fastmap PEB, the old PEB is reused by erasing it synchronously via ubi_sync_erase() with the torture flag hardcoded to zero. However, old_fm->to_be_tortured[] may be non-zero: it is set during fastmap scanning when ubi_io_read_data()/ubi_io_read_ec_hdr() reports UBI_IO_BITFLIPS, meaning the PEB showed signs of bit decay and should be tortured to verify it is still reliable. When the old PEB is instead returned to the WL sub-system via ubi_wl_put_fm_peb(), the to_be_tortured flag is honored. The synchronous reuse path is inconsistent: it silently skips the torture test for PEBs that exhibited bit-flips. Fix it by passing &old_fm->to_be_tortured[i] to ubi_sync_erase(). Fixes: dbb7d2a ("UBI: Add fastmap core") Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 087d820d4bc48a9bfc50eed6245e8781d9b247c7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 90e0be5 ] The anchor PEB must be picked from first 64 PEBs, these PEBs could have large erase counter greater than other PEBs especially when free space is nearly running out. The ubi_update_fastmap will be called as long as pool/wl_pool is empty, old anchor PEB is erased when updating fastmap. Given an UBI device with N PEBs, free PEBs is nearly running out and pool will be filled with 1 PEB every time ubi_update_fastmap invoked. So t=N/POOL_SIZE[1]/64 means that in worst case the erase counter of first 64 PEBs is t times greater than other PEBs in theory. After running fsstress for 24h, the erase counter statistics for two UBI devices shown as follow(CONFIG_MTD_UBI_WL_THRESHOLD=128): Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 960 29224 29282 29362 100000 .. inf: 64 117897 117934 117940 --------------------------------------------------------- Total : 1024 29224 34822 117940 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8128 2253 2321 2387 10000 .. 99999: 64 35387 35387 35388 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2253 2579 35388 The key point is reducing fastmap updating frequency by enlarging POOL_SIZE, so let UBI reserve ubi->fm_pool.max_size PEBs during attaching. Then POOL_SIZE will become ubi->fm_pool.max_size/2 even in free space running out case. Given an UBI device with 8192 PEBs(16384\8192\4096 is common large-capacity flash), t=8192/128/64=1. The fastmap updating will happen in either wl_pool or pool is empty, so setting fm_pool_rsv_cnt as ubi->fm_pool.max_size can fill wl_pool in full state. After pool reservation, running fsstress for 24h: Device A(1024 PEBs, pool=50, wl_pool=25): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 0 0 0 0 10000 .. 99999: 1024 33801 33997 34056 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 1024 33801 33997 34056 Device B(8192 PEBs, pool=256, wl_pool=128): ========================================================= from to count min avg max --------------------------------------------------------- 0 .. 9: 0 0 0 0 10 .. 99: 0 0 0 0 100 .. 999: 0 0 0 0 1000 .. 9999: 8192 2205 2397 2460 10000 .. 99999: 0 0 0 0 100000 .. inf: 0 0 0 0 --------------------------------------------------------- Total : 8192 2205 2397 2460 The difference of erase counter between first 64 PEBs and others is under WL_FREE_MAX_DIFF(2*UBI_WL_THRESHOLD=2*128=256). Device A: 34056 - 33801 = 255 Device B: 2460 - 2205 = 255 Next patch will add a switch to control whether UBI needs to reserve PEBs for filling pool. Fixes: dbb7d2a ("UBI: Add fastmap core") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217787 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Stable-dep-of: 5b0a6b554e12 ("ubi: Fix rollback for explicit UBI device numbers") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit d99591caca984f7ff6ca4ed742a0575b5a4e1b6b) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…PEBs [ Upstream commit d4c48e5 ] Adding 6th module parameter in 'mtd=xxx' to control whether or not reserving PEBs for filling pool/wl_pool. Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Stable-dep-of: 5b0a6b554e12 ("ubi: Fix rollback for explicit UBI device numbers") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 3f617214c81a2b082858281c2c52ae692bda3a26) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 5b0a6b554e12a97f9771a9a9f4ea1f5457373c73 ] ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num. A successfully attached device can be stored at a higher ubi_devices[] slot, and a later failure can miss it during rollback. Scan the full ubi_devices[] array and detach by the actual array index, matching the way UBI devices are stored. Fixes: 83ff59a ("UBI: support ubi_num on mtd.ubi command line") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 552e565ed8846e7db143e4a6bdf3f5677453c686) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit b992511180e126150c6ad3580a6fd568c385f4c6 ] In xlnx_formatter_pcm_open(), stream_data is allocated and adata->play_stream or adata->capture_stream is assigned early. If a later step, such as snd_pcm_hw_constraint_step() or snd_pcm_hw_constraint_integer(), fails, the function returns the error immediately. ALSA does not call the close callback when open fails, so stream_data is leaked and the stream pointer is left dangling, pointing to a substream that ALSA frees. A later interrupt would then call snd_pcm_period_elapsed() on the freed substream. Free stream_data and clear the stream pointer on the error paths. Fixes: 6f6c3c3 ("ASoC: xlnx: add pcm formatter platform driver") Assisted-by: opencode:deepseek-v4-flash-free Signed-off-by: Rosen Penev <rosenp@gmail.com> Reviewed-by: Michal Simek <michal.simek@amd.com> Link: https://patch.msgid.link/20260811185140.27149-1-rosenp@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 8c38ae4a465691947977c25d10394da22a64a19f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit ff7937d14f5333ec7e6fb50d00a152d7974f4105 ]
Fix two issues introduced before:
- The parameter format string was missing the enable_fm and
need_resv_pool tokens introduced in an earlier commit.
- The bad-block reservation note was misplaced after Example 5
instead of after Example 3. It was misplaced due to an earlier patch.
Fixes: 83ff59a ("UBI: support ubi_num on mtd.ubi command line")
Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 620549b2775e5c6a2541ad614c53193935ad1164)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…AP prefix [ Upstream commit dea754ded9518b51740c417d2c1e02ff540784c6 ] `_list_tests()` runs the kernel to list tests, strips printk timestamp lines via `extract_tap_lines()`, then drops the dummy TAP header from the cleaned `lines`. However the subsequent regex filter mistakenly operates on the original `output` instead of the cleaned `lines`. When the kernel output includes timestamp prefixes (common with UML or slower setups), e.g.: [ 0.100000] suite.test1 [ 0.100000] suite.test2 the anchored regex `^[^\s.]+\.[^\s.]+$` rejects them and `--list_tests` returns an empty list. Filter `lines` instead of `output`, matching the behavior of the adjacent `_list_tests_attr()` which already returns the cleaned list. Add a regression test with timestamp-prefixed input to verify the fix. Link: https://lore.kernel.org/r/20260803190059.36491-1-mohammad.abukhader@hotmail.com Fixes: 723c825 ("kunit: tool: Add command line interface to filter and report attributes") Signed-off-by: Mohammad Abu-Khader <mohammad.abukhader@hotmail.com> Reviewed-by: David Gow <david@davidgow.net> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 47a7a4443c6e73491125144b4de3d8d8e887c38e) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 0c3fc33 ] The URLS array is only valid in the download_rootfs function and does not need to be parsed globally in advance. At the same time, the logic of loading rootfs is refactored to prepare vmtest for supporting local rootfs. Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/r/20240905081401.1894789-5-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Stable-dep-of: 3a59f11e0f98 ("selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c4579f1b7fe1732c1fdb4036df63d6f2d7a182cb) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 2294073 ] Support vmtest to use local rootfs image generated by [0] that is consistent with BPF CI. Now we can specify the local rootfs image through the `-l` parameter like as follows: vmtest.sh -l ./libbpf-vmtest-rootfs-2024.08.22-noble-amd64.tar.zst -- ./test_progs Meanwhile, some descriptions have been flushed. Link: https://github.com/libbpf/ci/blob/main/rootfs/mkrootfs_debian.sh [0] Acked-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/r/20240905081401.1894789-6-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Stable-dep-of: 3a59f11e0f98 ("selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit bfeb336e48a961513b516f0e3217c7c341a5b95d) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 95b1c5d ] Add description in tools/testing/selftests/bpf/README.rst for running vmtest on RV64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/r/20240905081401.1894789-11-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Stable-dep-of: 3a59f11e0f98 ("selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit a4e68a4f68c2a6d1c877095f04aa5c4c55d4ddf9) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…e VM
[ Upstream commit 3a59f11e0f989bdd637c87151992605a6559a7cb ]
vmtest.sh captures the trailing command with command="$@", which flattens
the arguments into a single space-separated string, and then pastes it
into the generated guest init script:
cd /root/bpf
echo ${command}
stdbuf -oL -eL ${command}
That here-doc is unquoted, so the host expands ${command} and the
flattened text lands in the script verbatim. The guest bash then parses
those lines as shell source, re-splitting the text on whitespace and
glob-expanding it against /root/bpf. As a result any command with a glob
or an argument containing spaces is corrupted before it reaches the test
binary. For example:
vmtest.sh -- ./test_progs -a 'verifier_*'
has 'verifier_*' expanded in the guest into the matching object/skeleton
files (verifier_align.bpf.o verifier_align.skel.h ...), so test_progs is
handed a list of filenames instead of the intended name filter and runs no
matching tests.
Quote each argument with printf '%q ' so the command is reproduced
verbatim inside the VM: the escaped text goes through exactly one round
of quote removal when the guest parses the init script, yielding the
original argv with globs and special characters intact. The common case
(e.g. -t <name>) is unaffected.
Only do this when there is a command to quote. printf '%q ' with no
arguments still applies the format once and emits '', which the -s
(debug shell) path would take for a real command and try to run.
Note this makes the trailing command strictly an argv rather than a shell
snippet: passing it pre-quoted as one word, e.g.
vmtest.sh -- "./test_progs -t foo"
no longer works, and neither does embedding guest-side shell syntax such
as ';' or a redirection. 'sh -c ...' still works.
The RV64 recipe in README.rst does depend on the old double parse: it
wraps the denylist in \" so the literal quotes reach the guest, whose
second parse of the init script removes them. Under %q those quotes now
survive into argv, and parse_test_list() strtok_r()s on ',' turns them
into junk filters:
-d ",exceptions," -> ["] [exceptions] ["]
That is harmless for DENYLIST.riscv64 only because its first line is a
comment, so the leading field is empty. A denylist starting with a real
entry would silently lose it - ["*arena*] never matches - so drop the
backslashes and let the host consume the quotes instead.
Fixes: c9709f5 ("bpf: Helper script for running BPF presubmit tests")
Signed-off-by: Vineet Gupta <vineet.gupta@linux.dev>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260807204434.1036279-5-vineet.gupta@linux.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6746ba44cd04d6c5bef49e0382bf50febe02c29b)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 923e41ed59511cffe98357c7d58d0294a1c157ee ] When dma_request_chan() returns -EPROBE_DEFER, the error path jumps to disable_pm and calls pm_runtime_disable() even though pm_runtime_enable() was never called, leaving disable_depth unbalanced and the device permanently PM-disabled. Route the defer path through free_dma to skip pm_runtime_disable(). Fixes: 6bfbf4d ("spi: img-spfi: Use dma_request_chan() instead dma_request_slave_channel()") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Link: https://patch.msgid.link/20260808-spfi-v1-1-6bc4345be430@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 49e717f3f3d20aa201e4ed4d8c0b07e172285ce5) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 177299384a224377b4152242d875e752e5958c02 ] The bd99954 driver creates regmap fields for all the registers. All the fields for VBUS_UCD_FCTRL_SET (extended command 0x33) are accidentally created for VCC_UCD_FCTRL_SET (extended command 0x2b), causing all reads/writes for the fields to access wrong register. Luckily the fields for VBUS_UCD_FCTRL_SET are unused. Taking a look at the data-sheet all the fields in the VBUS_UCD_FCTRL_SET are marked as: "In normal operation, please don’t set these registers" with not much of additional documentation. As the fields are wrong and because there seems to be no users of the fields - it is better to just drop them. This will also decrease the memory footprint. Drop incorrect VBUS_UCD_FCTRL_SET fields. Datasheet: https://fscdn.rohm.com/en/products/databook/datasheet/ic/power/battery_management/bd99954xxx-e.pdf Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: 0902f83 ("power: supply: Support ROHM bd99954 charger") Tested-by: Kalle Niemi <kaleposti@gmail.com> Link: https://patch.msgid.link/758fd430d02286a6f18603a8aecfe443f5ddeb8e.1786356145.git.mazziesaccount@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit f1b4447402fca8defb408d3341439205c4804ff1) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit c774a623c821a173c950e1297f8e8c85a89455be ] According to the technical reference manual the StandbyTimeToEmpty (TTES) register is at 0x1a, not 0x1c. At 0x1c StateOfHealth instead resides. Fixes: 8835cae ("power: supply: bq27xxx: adds specific support for bq27520-g4 revision.") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-3-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 60e5d928081b7640ac0c9f01e9ac46860fedbe68) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit e9387e9ab5121f330d313afb90430c02200f9782 ] bq28z610 currently uses the AveragePower reg, 0x22, for reading both AveragePower and AvailableEnergy. The technical reference manual does not mention AvailableEnergy, and it does not make sense to read a cumulative, always positive, property like AvailableEnergy from a rate property like AveragePower. Set REG_AE as invalid to fix it. Fixes: 707d678 ("power: supply: bq27xxx_battery: Add the BQ28z610 Battery monitor") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-4-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit c86a998bd46da6f0e1c35050776fed2f7d4f6721) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 2da28b059e0ddcd2e1956eeae383246207965573 ] bq27z561 currently uses the AveragePower reg, 0x22, for reading both AveragePower and AvailableEnergy. The technical reference manual does not mention AvailableEnergy, and it does not make sense to read a cumulative, always positive, property like AvailableEnergy from a rate property like AveragePower. Set REG_AE as invalid to fix it. Fixes: 6f24ff9 ("power: supply: bq27xxx_battery: Add the BQ27Z561 Battery monitor") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Link: https://patch.msgid.link/20260811-bq27z746-v1-5-3a4fa38205cc@axis.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 3a6b43ebc0c2e098fea3e6564fd928a7e4c2295a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit d330fb86a7170f845123ae82d95df440fad9b707 ] xs_init() registers xs_reboot_nb before initializing XenStore communications and starting xenwatch. If either operation fails, the notifier remains registered and a later initialization attempt can hit a duplicate registration. Check the notifier registration result and unregister it on every subsequent failure path. Fixes: fd8aa90 ("xen: optimize xenbus driver for multiple concurrent xenstore accesses") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260807032326.940377-1-dbgh9129@gmail.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 57ec8827f414ba5c7d388a12db10689a491b5ac1) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 445c31ac638fd1af203d79bdf25fc0cb3149fbbc ]
Unregistering an s390dbf debug area while one of the associated debugfs
files is being written to can cause a deadlock:
$ echo >.../vmur/level $ rmmod vmur
===================================================
debugfs write
debugfs_file_get()
debug_unregister()
mutex_lock(debug_mutex)
debugfs_remove()
wait for debugfs_file_put()
debug_file_ops.write()
debug_input()
mutex_lock(debug_mutex) ==> DEADLOCK
Fix this by splitting debug_unregister() into an s390dbf and debugfs
part, and running only the s390dbf part with debug_mutex locked.
Fixes: 9372a82 ("s390/debug: fix debug area life cycle")
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit a08b70ed2d1ec907353a72f15163b8e34ff4b2f8)
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…such mappings [ Upstream commit 306219d ] While the kselftest was added at the same time with the kernel support for MTE on hugetlb mappings, the tests may be run on older kernels. Skip the tests if PROT_MTE is not supported on MAP_HUGETLB mappings. Fixes: 27879e8 ("selftests: arm64: add hugetlb mte tests") Cc: Yang Shi <yang@os.amperecomputing.com> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org> Reviewed-by: Dev Jain <dev.jain@arm.com> Reviewed-by: Yang Shi <yang@os.amperecomputing.com> Link: https://lore.kernel.org/r/20250221093331.2184245-3-catalin.marinas@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 6a22da975259142ae25dd6b8598dd45eeb59b7d9) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
…heck_hugetlb_options.c [ Upstream commit 7ae9510 ] The architecture doesn't define precise/imprecise MTE tag check modes, only synchronous and asynchronous. Use the correct naming and also ensure they match the MTE_{ASYNC,SYNC}_ERR type. Fixes: 27879e8 ("selftests: arm64: add hugetlb mte tests") Cc: Yang Shi <yang@os.amperecomputing.com> Reviewed-by: Yang Shi <yang@os.amperecomputing.com> Link: https://lore.kernel.org/r/20250221093331.2184245-2-catalin.marinas@arm.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit b93f47d5c0288560f907c4c047699d52b980b526) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit badc536 ] nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref. Fix this by adding a goto to the existing put_device label before the early return. Fixes: 31deaeb ("nvmet-rdma: avoid circular locking dependency on install_queue()") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 712f3268a62d0df98a7ee991cba963ced2e58007) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 8cb2dbf ] ld: kernel/irq/irqdomain.o: in function `irq_domain_instantiate': kernel/irq/irqdomain.c:296:(.text+0x10dd): undefined reference to `irq_domain_alloc_generic_chips' ld: kernel/irq/irqdomain.c:313:(.text+0x1218): undefined reference to `irq_domain_remove_generic_chips' ld: kernel/irq/irqdomain.o: in function `irq_domain_remove': kernel/irq/irqdomain.c:349:(.text+0x1ddf): undefined reference to `irq_domain_remove_generic_chips' Provide the required stubs. Fixes: e6f67ce ("irqdomain: Add support for generic irq chips creation before publishing a domain") Reported-by: Borislav Betkov <bp@alien8.de> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 6f5fb111a0a7285e73f19fca8014e4fb9790ae8a) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 2224b622260ba590ab56ea1585d6bf7610be25b2 ] scmi_protocol_table_register() can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID table, so a failed module load can leave a dangling pointer after the module storage is released. Unrequest only the successfully registered prefix, in reverse order, before returning the failure. Leave the failed entry and the remaining entries untouched because matching requests can be owned by another driver. Fixes: 2858f6e ("firmware: arm_scmi: Add multiple protocols registration support") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://patch.msgid.link/20260722173521.2184378-1-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit ee556d118b11c6f5b60a32c1e84f366b336ac7d7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 3fd2ef2 ] If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7db88b9 ("wifi: ath11k: add firmware-2.bin support") Cc: stable@vger.kernel.org Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Link: https://patch.msgid.link/20250917192020.1340-1-matvey.kovalev@ispras.ru Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 7554d498e4283c3b4559795abd175eb24a84f47f) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 6ef5b4c ] if (noa_descriptors > WMI_P2P_MAX_NOA_DESCRIPTORS), there is a mix of return and goto. In such a case, 'td' should be freed to avoid a memory leak. While at it, change ath11k_wmi_p2p_noa_event() to return void. '0' was returned in all cases, even in case of error and the only caller does not handle the return value. This is also more consistent with most of functions called from ath11k_wmi_tlv_op_rx(). Fixes: 2408379 ("wifi: ath11k: implement handling of P2P NoA event") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://msgid.link/07f1fc75b2d5b4173ae1b7bb1da5be7f6fc608c8.1713212781.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 7840a2c9c797c890f284457ba378cd484f998476) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit a2dc179481d18f6df7274522571b64dd50f31e81 ] hsr_portdev_setup() skips promiscuous mode on non-master ports when hsr->fwd_offloaded is set. fwd_offloaded is derived only from the ring slaves' NETIF_F_HW_HSR_FWD bit, so this also skips it for the interlink port, which never gets forwarding offload. Without promiscuous mode, the interlink NIC drops unicast frames addressed to hsr_dev's MAC (e.g. SAN traffic to the RedBox), breaking RedBox whenever the ring is HW-offloaded. Fixes: 5055ccc ("net: hsr: Provide RedBox support (HSR-SAN)") Signed-off-by: MD Danish Anwar <danishanwar@ti.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260908090856.2876114-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 4cdb74d35b0e00e3b8ef9af54aff93f6c7e419a5) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 430d67b ] syzbot reported that the seqnr_lock is not acquire for frames received over the interlink port. In the interlink case a new seqnr is generated and assigned to the frame. Frames, which are received over the slave port have already a sequence number assigned so the lock is not required. Acquire the hsr_priv::seqnr_lock during in the invocation of hsr_forward_skb() if a packet has been received from the interlink port. Reported-by: syzbot+3d602af7549af539274e@syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/KppVvGviGg4/m/EItSdCZdBAAJ Fixes: 5055ccc ("net: hsr: Provide RedBox support (HSR-SAN)") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by: Lukasz Majewski <lukma@denx.de> Tested-by: Lukasz Majewski <lukma@denx.de> Link: https://patch.msgid.link/20240906132816.657485-2-bigeasy@linutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 2ea73f9a1fe72a38a59b14d1009359b7a2d890b3) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 3c668ce ] We must initialize prune_proxy_timer before we attempt a del_timer_sync() on it. syzbot reported the following splat: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 1 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-01199-gfc48de77d69d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: netns cleanup_net Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 assign_lock_key+0x238/0x270 kernel/locking/lockdep.c:976 register_lock_class+0x1cf/0x980 kernel/locking/lockdep.c:1289 __lock_acquire+0xda/0x1fd0 kernel/locking/lockdep.c:5014 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __timer_delete_sync+0x148/0x310 kernel/time/timer.c:1648 del_timer_sync include/linux/timer.h:185 [inline] hsr_dellink+0x33/0x80 net/hsr/hsr_netlink.c:132 default_device_exit_batch+0x956/0xa90 net/core/dev.c:11737 ops_exit_list net/core/net_namespace.c:175 [inline] cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:637 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> ODEBUG: assert_init not available (active state 0) object: ffff88806d3fcd88 object type: timer_list hint: 0x0 WARNING: CPU: 1 PID: 11 at lib/debugobjects.c:517 debug_print_object+0x17a/0x1f0 lib/debugobjects.c:514 Fixes: 5055ccc ("net: hsr: Provide RedBox support (HSR-SAN)") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Lukasz Majewski <lukma@denx.de> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240426163355.2613767-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 42ddedd71536d396da315f3d9e7fd1a9b2415b9b) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
[ Upstream commit 14d8114 ] The recent conversion to the automatic kfree() forgot to mark a variable with __free(kfree), leading to memory leaks. Fix it. Fixes: 1052d98 ("ALSA: control: Use automatic cleanup of kfree()") Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr> Closes: https://lore.kernel.org/r/c1e2ef3c-164f-4840-9b1c-f7ca07ca422a@alu.unizg.hr Message-ID: <20240320062722.31325-1-tiwai@suse.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 1fb06c7a5d3073b6be115ca7258b9d5b25a2a8a7) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 814d051 upstream. The feature test for system bpftool uses BPFTOOL as the variable to set its path, defaulting to just "bpftool" if not set by the user. This conflicts with selftests and a few other utilities, which expect BPFTOOL to be set to the in-tree bpftool path by default. For example, bpftool selftests fail to build: $ make -C tools/testing/selftests/bpf/ make: Entering directory '/home/tglozar/dev/linux/tools/testing/selftests/bpf' make: *** No rule to make target 'bpftool', needed by '/home/tglozar/dev/linux/tools/testing/selftests/bpf/tools/include/vmlinux.h'. Stop. make: Leaving directory '/home/tglozar/dev/linux/tools/testing/selftests/bpf' Fix the problem by renaming the variable used for system bpftool from BPFTOOL to SYSTEM_BPFTOOL, so that the new usage does not conflict with the existing one of BPFTOOL. Cc: John Kacur <jkacur@redhat.com> Cc: Luis Goncalves <lgoncalv@redhat.com> Link: https://lore.kernel.org/20250326004018.248357-1-tglozar@redhat.com Fixes: 8a635c3 ("tools/build: Add bpftool-skeletons feature test") Closes: https://lore.kernel.org/linux-kernel/5df6968a-2e5f-468e-b457-fc201535dd4c@linux.ibm.com/ Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Suggested-by: Quentin Monnet <qmo@kernel.org> Acked-by: Quentin Monnet <qmo@kernel.org> Signed-off-by: Tomas Glozar <tglozar@redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit dfda4aabd3213dddd8f0beb0a7be3fa458d361ab) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit 446d285 upstream. The devm_kzalloc() function doesn't return error pointers, it returns NULL on error. Then on the next line it checks the same pointer again by mistake, "->base" instead of "->base[0]". Fixes: fe412e3 ("pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/aAijc10fHka1WAMX@stanley.mountain Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 4cad6ecdfee8cdf194bb9c83e016efe981b571c5) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit af8edae upstream. Blamed commit forgot to change hsr_init_skb() to allocate larger skb for RedBox case. Indeed, send_hsr_supervision_frame() will add two additional components (struct hsr_sup_tlv and struct hsr_sup_payload) syzbot reported the following crash: skbuff: skb_over_panic: text:ffffffff8afd4b0a len:34 put:6 head:ffff88802ad29e00 data:ffff88802ad29f22 tail:0x144 end:0x140 dev:gretap0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 2 UID: 0 PID: 7611 Comm: syz-executor Not tainted 6.12.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:skb_panic+0x157/0x1d0 net/core/skbuff.c:206 Code: b6 04 01 84 c0 74 04 3c 03 7e 21 8b 4b 70 41 56 45 89 e8 48 c7 c7 a0 7d 9b 8c 41 57 56 48 89 ee 52 4c 89 e2 e8 9a 76 79 f8 90 <0f> 0b 4c 89 4c 24 10 48 89 54 24 08 48 89 34 24 e8 94 76 fb f8 4c RSP: 0018:ffffc90000858ab8 EFLAGS: 00010282 RAX: 0000000000000087 RBX: ffff8880598c08c0 RCX: ffffffff816d3e69 RDX: 0000000000000000 RSI: ffffffff816de786 RDI: 0000000000000005 RBP: ffffffff8c9b91c0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000302 R11: ffffffff961cc1d0 R12: ffffffff8afd4b0a R13: 0000000000000006 R14: ffff88804b938130 R15: 0000000000000140 FS: 000055558a3d6500(0000) GS:ffff88806a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1295974ff8 CR3: 000000002ab6e000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> skb_over_panic net/core/skbuff.c:211 [inline] skb_put+0x174/0x1b0 net/core/skbuff.c:2617 send_hsr_supervision_frame+0x6fa/0x9e0 net/hsr/hsr_device.c:342 hsr_proxy_announce+0x1a3/0x4a0 net/hsr/hsr_device.c:436 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1794 expire_timers kernel/time/timer.c:1845 [inline] __run_timers+0x6e8/0x930 kernel/time/timer.c:2419 __run_timer_base kernel/time/timer.c:2430 [inline] __run_timer_base kernel/time/timer.c:2423 [inline] run_timer_base+0x111/0x190 kernel/time/timer.c:2439 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 </IRQ> Fixes: 5055ccc ("net: hsr: Provide RedBox support (HSR-SAN)") Reported-by: syzbot+7f4643b267cc680bfa1c@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Lukasz Majewski <lukma@denx.de> Link: https://patch.msgid.link/20241202100558.507765-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a77a45fbadd9c053e8cf3a9ce2e23bcd23819ea6) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
commit fb1ed67788e21832b614c23767a088c08cfdd2f2 upstream. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources. Fixes: badc536 ("nvme: target: rdma: fix ndev refcount leak on queue connect") Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 32e598324edc3ebb1ac9362d5b9fc30ce0de4873) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Link: https://lore.kernel.org/r/20260912065607.279695368@linuxfoundation.org Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Wentao Guan <guanwentao@uniontech.com> Tested-by: Barry K. Nathan <barryn@pobox.com> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 79643295eba17affbd16ca97f3ef04c90266b28c) Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
deepin-ci-robot
requested review from
Avenger-285714,
Ink-Paper,
MingcongBai,
RevySR,
Wenlp,
hello666888999,
myml and
winnscode
September 15, 2026 05:53
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
🔵 Needs a closer look
The baseline update spans hundreds of files and many security- and concurrency-sensitive kernel subsystems, requiring full build, ABI, and hardware regression validation.
Pull request overview
Updates the Deepin Linux 6.6.y kernel baseline from 6.6.156 to 6.6.157, incorporating upstream stable fixes across core subsystems, drivers, filesystems, networking, architectures, and tests.
Changes:
- Bumps the kernel sublevel to 6.6.157.
- Backports broad correctness, security, race, bounds-checking, and resource-lifetime fixes.
- Updates self-tests, documentation, device trees, and build tooling.
File summaries
| File | Description |
|---|---|
Makefile |
Bumps sublevel to 157. |
Documentation/ABI/testing/configfs-usb-gadget-uac1_legacy |
Removes obsolete UAC1 attributes. |
Documentation/ABI/testing/sysfs-bus-nvdimm |
Clarifies CXL serial format. |
Documentation/usb/gadget-testing.rst |
Updates UAC1 attribute documentation. |
arch/arm/Kconfig |
Restricts eBPF JIT support. |
arch/arm/boot/dts/allwinner/sun4i-a10.dtsi |
Corrects PMU interrupt. |
arch/arm/mach-lpc32xx/common.c |
Exposes UID initialization. |
arch/arm/mach-lpc32xx/common.h |
Declares initialization helpers. |
arch/arm/mach-lpc32xx/phy3250.c |
Initializes UID and power management. |
arch/arm64/boot/dts/amlogic/meson-axg-s400.dts |
Enables analog D-PHY. |
arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts |
Corrects USB PHY configuration. |
arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi |
Removes invalid pin configuration. |
arch/arm64/boot/dts/qcom/msm8998-xiaomi-sagit.dts |
Removes invalid pin configuration. |
arch/arm64/boot/dts/qcom/sc8180x-pmics.dtsi |
Labels the PMIC power key. |
arch/arm64/boot/dts/qcom/sdm632-motorola-ocean.dts |
Corrects LED trigger property. |
arch/arm64/boot/dts/qcom/sm8250-xiaomi-elish-common.dtsi |
Corrects board identifier. |
arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi |
Corrects eMMC reset polarity. |
arch/arm64/boot/dts/ti/k3-am64-main.dtsi |
Corrects MDIO clock source. |
arch/arm64/kernel/compat_alignment.c |
Widens register count arithmetic. |
arch/arm64/lib/Makefile |
Disables recursive KCSAN instrumentation. |
arch/loongarch/kernel/kprobes.c |
Handles missing current probe. |
arch/m68k/emu/nfcon.c |
Returns the console TTY driver. |
arch/m68k/kernel/traps.c |
Corrects non-current stack lookup. |
arch/parisc/kernel/head.S |
Aligns boot assembly data. |
arch/powerpc/configs/85xx-hw.config |
Enables RAS support. |
arch/powerpc/kernel/smp.c |
Guards unavailable IPI callbacks. |
arch/powerpc/platforms/powermac/low_i2c.c |
Retains device-tree node reference. |
arch/riscv/kernel/cpufeature.c |
Clarifies ISA ordering reference. |
arch/s390/kvm/interrupt.c |
Initializes machine-check IRQ data. |
arch/x86/events/intel/uncore.c |
Documents NUMA requirement. |
arch/x86/include/asm/linkage.h |
Corrects CFI symbol termination. |
arch/x86/include/asm/pkeys.h |
Rejects allocation when disabled. |
block/blk-cgroup.c |
Skips unhashed block groups. |
block/blk-iocost.c |
Includes offline CPU statistics. |
block/blk-stat.c |
Includes offline CPU statistics. |
block/kyber-iosched.c |
Includes offline CPU histograms. |
drivers/acpi/video_detect.c |
Releases PCI device reference. |
drivers/base/cacheinfo.c |
Corrects architecture fallback status. |
drivers/base/firmware_loader/fallback.c |
Handles early firmware completion. |
drivers/base/swnode.c |
Prevents reference-index overflow. |
drivers/block/null_blk/null_blk.h |
Adds shared-tag configuration state. |
drivers/bluetooth/btintel.c |
Corrects diagnostic-event bounds check. |
drivers/bluetooth/btqca.c |
Accepts default command completion event. |
drivers/bluetooth/hci_bcm.c |
Disables autosuspend during teardown. |
drivers/bluetooth/hci_h5.c |
Disables autosuspend during teardown. |
drivers/bluetooth/hci_intel.c |
Disables autosuspend during teardown. |
drivers/bluetooth/hci_ldisc.c |
Propagates version-read failures. |
drivers/bluetooth/hci_serdev.c |
Propagates version-read failures. |
drivers/char/ipmi/ipmi_msghandler.c |
Marks failed interfaces shutting down. |
drivers/char/tpm/tpm_i2c_nuvoton.c |
Disables IRQ after interrupted waits. |
drivers/char/xilinx_hwicap/xilinx_hwicap.c |
Cleans up class registration failures. |
drivers/clk/clk-versaclock7.c |
Unwinds failed clock registration. |
drivers/clk/hisilicon/reset.c |
Zero-initializes reset controller. |
drivers/clk/imx/clk-scu.c |
Removes redundant operation assignment. |
drivers/clk/meson/gxbb.c |
Derives parent count safely. |
drivers/clk/tegra/clk-tegra124-emc.c |
Releases node on registration failure. |
drivers/clk/ti/divider.c |
Initializes clock metadata. |
drivers/clk/visconti/clkc.c |
Initializes clock metadata. |
drivers/clk/x86/clk-pmc-atom.c |
Handles clock-name allocation failure. |
drivers/clocksource/clps711x-timer.c |
Avoids unintended secondary setup. |
drivers/clocksource/timer-sun4i.c |
Corrects minimum timer delta. |
drivers/cpufreq/spear-cpufreq.c |
Handles missing parent clock. |
drivers/crypto/intel/qat/qat_common/qat_algs.c |
Clears expanded key material. |
drivers/cxl/cxl.h |
Expands decimal serial buffer. |
drivers/cxl/pmem.c |
Formats serial as unsigned. |
drivers/dma/dw-edma/dw-hdma-v0-core.c |
Corrects channel register arguments. |
drivers/dma/hisi_dma.c |
Returns the correct allocation error. |
drivers/dma/mediatek/mtk-uart-apdma.c |
Returns the correct allocation error. |
drivers/dma/qcom/bam_dma.c |
Disables autosuspend during removal. |
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c |
Disables autosuspend during removal. |
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c |
Accounts aligned VRAM size. |
drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c |
Prevents division by zero. |
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c |
Returns allocation error pointer. |
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c |
Unwinds invalid register width. |
drivers/gpu/drm/bridge/tc358767.c |
Bounds AUX transfer length. |
drivers/gpu/drm/drm_atomic_uapi.c |
Releases aborted commit reference. |
drivers/gpu/drm/drm_dumb_buffers.c |
Removes unused internal include. |
drivers/gpu/drm/i915/i915_pci.c |
Rejects missing device information. |
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c |
Avoids zero-rate OPP updates. |
drivers/gpu/drm/nouveau/nouveau_sgdma.c |
Corrects coherent buffer caching. |
drivers/gpu/drm/omapdrm/dss/dsi.h |
Removes unused ISR copy. |
drivers/gpu/drm/rockchip/rockchip_drm_vop2.c |
Recognizes additional YUV formats. |
drivers/gpu/drm/sun4i/sun4i_backend.c |
Unwinds SAT reset state. |
drivers/gpu/drm/sun4i/sun4i_crtc.c |
Preserves plane initialization errors. |
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c |
Releases port node reference. |
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c |
Corrects HDMI PHY configuration. |
drivers/gpu/drm/tve200/tve200_drv.c |
Adds OF module aliases. |
drivers/gpu/host1x/hw/channel_hw.c |
Corrects gather trace offsets. |
drivers/hid/hid-nintendo.c |
Fixes IMU timestamp accounting. |
drivers/hid/i2c-hid/i2c-hid-core.c |
Reports descriptor errors correctly. |
drivers/hid/i2c-hid/i2c-hid-of-goodix.c |
Unwinds regulator enable failure. |
drivers/hsi/controllers/omap_ssi_core.c |
Configures the DMA mask. |
drivers/hwspinlock/hwspinlock_core.c |
Propagates registration failures. |
drivers/i2c/busses/i2c-ocores.c |
Disables clock after resume failure. |
drivers/i2c/i2c-core-base.c |
Drains new-device writers on removal. |
drivers/i2c/i2c-mux.c |
Releases adapter node on failure. |
drivers/i2c/muxes/i2c-demux-pinctrl.c |
Releases node on allocation failure. |
drivers/iio/chemical/sgp30.c |
Handles thread creation failure. |
drivers/iio/gyro/mpu3050-core.c |
Sign-extends sensor readings. |
drivers/iio/light/cm32181.c |
Returns correct write status. |
drivers/iio/light/isl29028.c |
Returns correct write status. |
drivers/iio/light/tsl2583.c |
Returns correct write status. |
drivers/iio/light/tsl2772.c |
Selects the correct channel type. |
drivers/iio/proximity/srf04.c |
Stops after runtime-PM failure. |
drivers/infiniband/core/core_priv.h |
Declares privileged-QKey query. |
drivers/infiniband/hw/erdma/Kconfig |
Disables unsupported big-endian builds. |
drivers/infiniband/hw/hfi1/hfi.h |
Removes obsolete declaration. |
drivers/infiniband/ulp/isert/ib_isert.h |
Tracks pending login responses. |
drivers/iommu/msm_iommu.c |
Returns the correct allocation error. |
drivers/iommu/mtk_iommu_v1.c |
Corrects maximum LARB count. |
drivers/irqchip/irq-renesas-irqc.c |
Enables generic-chip destruction. |
drivers/md/dm-log-userspace-base.c |
Reserves string terminator space. |
drivers/md/dm-switch.c |
Makes region-table writes atomic. |
drivers/md/raid1.c |
Corrects takeover freeze state. |
drivers/md/raid5-ppl.c |
Stops after final flush completion. |
drivers/media/cec/core/cec-core.c |
Avoids stale RC-device handling. |
drivers/media/cec/platform/meson/ao-cec-g12a.c |
Names the CEC regmap. |
drivers/media/cec/platform/stm32/stm32-cec.c |
Bounds received CEC messages. |
drivers/media/i2c/video-i2c.c |
Clears failed capture thread state. |
drivers/media/pci/cobalt/cobalt-alsa-main.c |
Avoids duplicate ALSA memory free. |
drivers/media/pci/cx23885/cimax2.c |
Cancels work before teardown. |
drivers/media/pci/zoran/zoran_card.c |
Avoids freeing registered device twice. |
drivers/media/test-drivers/vimc/vimc-capture.c |
Uses pixel-format lookup correctly. |
drivers/media/tuners/tda18250.c |
Prevents invalid PLL shift. |
drivers/media/usb/em28xx/em28xx-core.c |
Removes chained device list entry. |
drivers/media/v4l2-core/v4l2-fwnode.c |
Releases endpoint reference. |
drivers/mfd/iqs62x.c |
Hardens firmware record bounds. |
drivers/misc/ad525x_dpot-i2c.c |
Registers device attribute groups. |
drivers/misc/ad525x_dpot-spi.c |
Registers device attribute groups. |
drivers/misc/cardreader/rtsx_pcr.c |
Propagates register-write failure. |
drivers/mtd/mtdoops.c |
Frees page-use bitmap on removal. |
drivers/mtd/mtdpart.c |
Rejects retained dynamic offsets. |
drivers/mtd/mtdswap.c |
Clears released block device pointer. |
drivers/mtd/ubi/cdev.c |
Supplies updated attach argument. |
drivers/mtd/ubi/fastmap-wl.c |
Accounts reserved fastmap pool PEBs. |
drivers/net/bonding/bond_netlink.c |
Initializes change error status. |
drivers/net/dsa/b53/b53_common.c |
Propagates FDB callback errors. |
drivers/net/ethernet/allwinner/sun4i-emac.c |
Correctly detects missing IRQ. |
drivers/net/ethernet/intel/ice/ice_lib.c |
Clears released default VSI. |
drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c |
Retriggers NAPI safely. |
drivers/net/ethernet/qlogic/qede/qede_fp.c |
Preserves TPA buffer data pointer. |
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c |
Preserves deaggregated device association. |
drivers/net/ethernet/realtek/8139cp.c |
Correctly disables RX and TX. |
drivers/net/ethernet/renesas/ravb.h |
Tracks PHC index. |
drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c |
Accounts primary unicast address. |
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c |
Accounts primary unicast address. |
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c |
Accounts primary unicast address. |
drivers/net/ethernet/sun/niu.c |
Enables MSI-X entry-data quirk. |
drivers/net/gtp.c |
Waits for RCU readers. |
drivers/net/vxlan/vxlan_core.c |
Adds MDB bulk-delete and lookup. |
drivers/net/wireless/ath/ath11k/Makefile |
Links firmware and P2P objects. |
drivers/net/wireless/ath/ath11k/pci.c |
Clears IRQ affinity hints. |
drivers/net/wireless/ath/ath11k/testmode.c |
Uses skb-aware TLV parsing. |
drivers/net/wireless/intel/iwlwifi/fw/dump.c |
Widens dump entry count. |
drivers/net/wireless/intel/iwlwifi/mvm/ops.c |
Corrects key-redaction offset. |
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c |
Avoids warning on malformed RX. |
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c |
Corrects non-DBDC chain mask. |
drivers/net/wireless/mediatek/mt76/mt7915/soc.c |
Polls the correct clock register. |
drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c |
Validates EEPROM firmware size. |
drivers/net/wireless/mediatek/mt76/mt7996/mac.c |
Marks MCU reset state. |
drivers/net/wireless/mediatek/mt76/mt7996/main.c |
Avoids invalid TX-rate reporting. |
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |
Initializes EEPROM context. |
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |
Initializes EEPROM context. |
drivers/net/wireless/realtek/rtw88/tx.c |
Frees failed TX packets. |
drivers/net/wireless/realtek/rtw89/mac.c |
Corrects capability element length. |
drivers/nvdimm/btt.c |
Validates free-block lane capacity. |
drivers/nvme/host/core.c |
Zeroes the discard page. |
drivers/nvme/host/pci.c |
Disables controller after IRQ failure. |
drivers/nvme/target/auth.c |
Cancels authentication expiry work. |
drivers/nvme/target/core.c |
Uses synchronized auth teardown. |
drivers/nvme/target/zns.c |
Handles namespaces without block devices. |
drivers/of/base.c |
Avoids alias parsing underflow. |
drivers/parisc/eisa.c |
Advances past invalid IRQ values. |
drivers/pci/controller/dwc/pci-meson.c |
Corrects reset assertion state. |
drivers/pci/controller/pci-hyperv.c |
Supports hierarchical IRQ retriggering. |
drivers/perf/arm_spe_pmu.c |
Makes wakeup arithmetic wrap-safe. |
drivers/perf/cxl_pmu.c |
Uses correct filter register width. |
drivers/pinctrl/bcm/pinctrl-bcm2835.c |
Avoids duplicate GPIO removal. |
drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.h |
Adds EINT pin metadata. |
drivers/platform/mellanox/mlxbf-bootctl.c |
Includes bitfield helpers. |
drivers/platform/x86/dell/dell-wmi-privacy.c |
Holds mutex while inspecting device. |
drivers/platform/x86/dell/dell-wmi-sysman/biosattr-interface.c |
Removes sensitive debug dump. |
drivers/pmdomain/bcm/bcm2835-power.c |
Handles provider registration failure. |
drivers/power/supply/isp1704_charger.c |
Cancels work before removal. |
drivers/power/supply/lp8727_charger.c |
Frees IRQ before canceling work. |
drivers/power/supply/qcom_battmgr.c |
Guarantees string termination. |
drivers/rapidio/rio-scan.c |
Clears failed network pointer. |
drivers/regulator/as3722-regulator.c |
Avoids duplicate node release. |
drivers/regulator/max8998.c |
Avoids duplicate node release. |
drivers/remoteproc/qcom_common.c |
Releases node after allocation failure. |
drivers/remoteproc/qcom_q6v5_adsp.c |
Releases parsed phandle reference. |
drivers/remoteproc/remoteproc_sysfs.c |
Removes obsolete deleted state. |
drivers/rpmsg/qcom_glink_smem.c |
Orders shared FIFO reads. |
drivers/rtc/rtc-gamecube.c |
Propagates RTC registration failure. |
drivers/rtc/rtc-pcf8563.c |
Uses managed clock provider registration. |
drivers/s390/block/dasd.c |
Propagates ESE read failure. |
drivers/scsi/mpt3sas/mpt3sas_base.c |
Skips unallocated DMA entries. |
drivers/scsi/qla2xxx/qla_dbg.c |
Corrects debug-code documentation. |
drivers/scsi/qla2xxx/qla_dfs.c |
Handles numeric parse errors. |
drivers/scsi/qla2xxx/qla_edif.c |
Handles absent SCSI command. |
drivers/scsi/qla2xxx/qla_gs.c |
Reads the correct handle field. |
drivers/scsi/qla2xxx/qla_nx2.c |
Corrects retry exhaustion detection. |
drivers/scsi/scsi_lib.c |
Zeroes DMA padding. |
drivers/scsi/sd.c |
Corrects sense-data validity condition. |
drivers/soc/fsl/qe/qe_ic.c |
Propagates driver registration failure. |
drivers/soc/samsung/exynos-pmu.c |
Manages node reference automatically. |
drivers/soundwire/qcom.c |
Corrects exhausted-port detection. |
drivers/spi/spi-bcm63xx-hsspi.c |
Unwinds failed controller resume. |
drivers/spi/spi-bcm63xx.c |
Unwinds failed controller resume. |
drivers/spi/spi-bcmbca-hsspi.c |
Unwinds failed controller resume. |
drivers/spi/spi-sprd-adi.c |
Handles disabled hwspinlock support. |
drivers/staging/fbtft/fbtft-sysfs.c |
Uses bounded sysfs output helper. |
drivers/staging/greybus/audio_manager_sysfs.c |
Corrects parsed-field count. |
drivers/staging/greybus/hid.c |
Returns transferred byte count. |
drivers/staging/media/sunxi/cedrus/cedrus.c |
Frees control handler on failure. |
drivers/staging/octeon/ethernet-mem.h |
Passes platform device to memory helpers. |
drivers/staging/octeon/ethernet-tx.c |
Kills TX cleanup tasklet. |
drivers/staging/rtl8723bs/os_dep/sdio_intf.c |
Uses complete HAL teardown. |
drivers/target/iscsi/iscsi_target_login.c |
Adds request-buffer terminator space. |
drivers/tty/hvc/Kconfig |
Restricts unsupported ARM CPUs. |
drivers/tty/tty_io.c |
Clears failed cdev pointer. |
drivers/ufs/core/ufs-debugfs.c |
Preserves debugfs string terminator. |
drivers/uio/uio.c |
Notifies users after registration failure. |
drivers/usb/atm/usbatm.c |
Corrects ATM VPI/VCI widths. |
drivers/usb/common/common.c |
Adds global dynamic-ID mutex. |
drivers/usb/gadget/function/f_mass_storage.c |
Enlarges LUN name buffer. |
drivers/usb/gadget/function/u_uac1_legacy.h |
Removes obsolete allocation flags. |
drivers/usb/gadget/functions.c |
Handles incomplete function instances. |
drivers/usb/gadget/legacy/inode.c |
Reads gadget under lock. |
drivers/usb/gadget/udc/r8a66597-udc.c |
Avoids duplicate request free. |
drivers/usb/phy/phy-fsl-usb.h |
Makes local timer helpers static. |
drivers/usb/serial/usb-serial.c |
Serializes dynamic-ID matching. |
drivers/usb/storage/ene_ub6250.c |
Serializes device access during probe. |
drivers/usb/typec/ucsi/debugfs.c |
Clears freed debugfs state. |
drivers/usb/typec/ucsi/displayport.c |
Bounds active altmode index. |
drivers/usb/typec/ucsi/ucsi.h |
Defines common UCSI timeout. |
drivers/usb/typec/ucsi/ucsi_acpi.c |
Uses the common UCSI timeout. |
drivers/vdpa/mlx5/core/mr.c |
Cleans the correct temporary list. |
drivers/vfio/pci/vfio_pci_config.c |
Clears freed MSI permission pointer. |
drivers/video/fbdev/tdfxfb.c |
Uses managed PCI enablement. |
drivers/video/fbdev/uvesafb.c |
Removes callback after init failure. |
drivers/w1/masters/ds2482.c |
Terminates searches after bus errors. |
fs/ecryptfs/crypto.c |
Supplies packet source bounds. |
fs/ecryptfs/ecryptfs_kernel.h |
Extends packet parser interface. |
fs/ext4/file.c |
Serializes buffered and direct I/O. |
fs/ext4/migrate.c |
Corrects temporary inode lifetime. |
fs/ext4/namei.c |
Validates hashed directory entries. |
fs/f2fs/xattr.c |
Honors mount ID mappings. |
fs/fat/misc.c |
Restores FAT entry after failure. |
fs/fat/nfs.c |
Releases scan buffer. |
fs/fuse/control.c |
Initializes inode timestamps uniformly. |
fs/fuse/cuse.c |
Waits for module RCU callbacks. |
fs/hfsplus/hfsplus_fs.h |
Adds thread-record validation helper. |
fs/hugetlbfs/inode.c |
Releases hugepage subpool correctly. |
fs/nfs/filelayout/filelayoutdev.c |
Keys data-server cache by version. |
fs/nfs/flexfilelayout/flexfilelayoutdev.c |
Passes negotiated NFS version. |
fs/nfs/inode.c |
Uses atomic clear-and-wake helper. |
fs/nfs/internal.h |
Declares callback ID removal. |
fs/nfs/netns.h |
Adds per-net data-server cache. |
fs/nfs/nfs4client.c |
Removes callback ID on failure. |
fs/nfsd/nfscache.c |
Honors the pruning limit. |
fs/nfsd/nfsfh.c |
Avoids unnecessary directory warning. |
fs/nfsd/vfs.c |
Releases path after traversal failure. |
fs/nilfs2/bmap.c |
Supplies deletion deformation policy. |
fs/nilfs2/bmap.h |
Extends bmap deletion callback. |
fs/nilfs2/the_nilfs.c |
Validates super-root inode size. |
fs/ocfs2/cluster/heartbeat.h |
Declares callback synchronization helpers. |
fs/ocfs2/cluster/nodemanager.h |
Declares unlocked dependency helper. |
fs/ocfs2/cluster/tcp.h |
Declares listening completion helper. |
fs/ocfs2/dir.c |
Corrects directory-position mask width. |
fs/ocfs2/dlm/dlmmaster.c |
Validates migrate-name length. |
fs/orangefs/devorangefs-req.c |
Clears freed trailer pointer. |
fs/orangefs/orangefs-debugfs.c |
Trims leading configuration spaces. |
fs/smb/client/cifs_debug.c |
Resets each command statistic. |
fs/smb/client/smb1ops.c |
Corrects device xattr size. |
fs/smb/client/smb2file.c |
Hardens error-context bounds. |
fs/smb/server/auth.c |
Frees extended login response. |
fs/smb/server/connection.h |
Declares connection abort helper. |
fs/smb/server/mgmt/user_config.c |
Frees extended login response. |
fs/smb/server/mgmt/user_session.c |
Adds preauthentication cleanup. |
fs/smb/server/mgmt/user_session.h |
Declares preauthentication cleanup. |
fs/smb/server/server.c |
Aborts failed encrypted connections. |
fs/smb/server/vfs.c |
Checks single-byte lock ranges. |
fs/squashfs/cache.c |
Rejects negative copy offsets. |
fs/ubifs/auth.c |
Corrects signature payload bounds. |
fs/udf/inode.c |
Corrects 64-bit extent alignment. |
fs/udf/partition.c |
Rejects the terminal VAT entry. |
fs/udf/symlink.c |
Validates path-component headers. |
include/acpi/processor.h |
Declares idle-driver lifecycle APIs. |
include/linux/efi.h |
Corrects page-fault helper documentation. |
include/linux/kprobes.h |
Adds RCU teardown state. |
include/linux/maple_tree.h |
Corrects range parameter naming. |
include/linux/nfs_xdr.h |
Increases layout-stat capacity. |
include/linux/rcutiny.h |
Renames momentary EQS helper. |
include/linux/rcutree.h |
Renames momentary EQS helper. |
include/linux/rtsx_usb.h |
Adds card-status caching fields. |
include/linux/sunrpc/svc_rdma_pcl.h |
Makes segment iteration bounds safe. |
include/net/bluetooth/hci_core.h |
Protects discovery UUID count. |
include/net/bluetooth/l2cap.h |
Documents channel locking. |
include/net/inet_hashtables.h |
Resolves destination device safely. |
include/net/inetpeer.h |
Adds peer hashing and family ordering. |
include/net/pkt_sched.h |
Defines maximum qdisc packet length. |
include/net/route.h |
Resolves destination device safely. |
include/net/sctp/structs.h |
Corrects outstanding-reset documentation. |
include/sound/core.h |
Adds scoped card-reference cleanup. |
include/uapi/linux/if_link.h |
Exposes HSR interlink attribute. |
include/uapi/linux/landlock.h |
Documents whiteout creation control. |
include/uapi/linux/time_types.h |
Uses architecture UAPI long type. |
include/uapi/rdma/rdma_netlink.h |
Adds RDMA netlink attributes. |
kernel/bpf/ringbuf.c |
Makes pending-position comparison wrap-safe. |
kernel/cgroup/cpuset.c |
Resets failed attachment migration state. |
kernel/entry/common.c |
Reloads ptrace-modified syscall flags. |
kernel/locking/lockdep.c |
Handles lock-class allocation failure. |
kernel/power/snapshot.c |
Frees copy bitmap on failure. |
kernel/power/wakelock.c |
Enforces the configured limit exactly. |
kernel/rcu/tree_nocb.h |
Uses renamed momentary EQS helper. |
kernel/stop_machine.c |
Uses renamed momentary EQS helper. |
kernel/sys.c |
Clears unused auxiliary-vector entries. |
kernel/taskstats.c |
Safely duplicates netlink strings. |
kernel/time/clocksource.c |
Unregisters failed clocksource bus. |
kernel/time/itimer.c |
Initializes legacy timer padding. |
kernel/time/timer.c |
Reactivates migrated debug timers. |
kernel/trace/trace_events_hist.c |
Removes named histogram variables. |
kernel/trace/trace_events_user.c |
Avoids freeing the parent event state. |
lib/string.c |
Widens word-count arithmetic. |
lib/test_hmm.c |
Reports dead-mm faults. |
lib/ucs2_string.c |
Avoids out-of-bounds terminator reads. |
lib/xarray.c |
Accounts split-node allocations. |
mm/kasan/quarantine.c |
Drains all possible CPUs. |
mm/migrate.c |
Reports Tasks RCU quiescent states. |
mm/vmscan.c |
Reports Tasks RCU quiescent states. |
net/batman-adv/main.c |
Restores merged-fragment metadata. |
net/batman-adv/types.h |
Makes cached MAC updates atomic. |
net/bluetooth/hci_core.c |
Retains sent-command skb safely. |
net/bluetooth/hci_event.c |
Preserves advertising after failures. |
net/bluetooth/iso.c |
Handles concurrently closed listeners. |
net/bluetooth/msft.c |
Validates event-prefix length. |
net/bridge/br_netlink_tunnel.c |
Prevents VLAN range underflow. |
net/ceph/messenger_v2.c |
Validates banner payload size. |
net/ceph/osdmap.c |
Validates CRUSH bucket IDs. |
net/core/net_namespace.c |
Safely tears down ref trackers. |
net/dccp/dccp.h |
Updates receive-socket callback signature. |
net/dccp/ipv4.c |
Implements updated callback signature. |
net/dccp/minisocks.c |
Supplies the new callback argument. |
net/hsr/hsr_device.h |
Adds interlink finalization argument. |
net/iucv/af_iucv.c |
Restricts sockets to receiving device. |
net/ipv4/igmp.c |
Resolves destination network safely. |
net/ipv4/ip_tunnel.c |
Caps required tunnel headroom. |
net/ipv4/ipip.c |
Drops failed metadata packets. |
net/ipv4/ipmr.c |
Resolves route device under RCU. |
net/ipv4/syncookies.c |
Supplies the new callback argument. |
net/ipv4/tcp_minisocks.c |
Supplies the new callback argument. |
net/ipv4/tcp_output.c |
Corrects urgent retransmit length. |
net/ipv4/xfrm4_output.c |
Resolves destination device safely. |
net/ipv6/route.c |
Uses RCU-safe exception traversal. |
net/ipv6/sit.c |
Caps required tunnel headroom. |
net/ipv6/xfrm6_input.c |
Enforces transform depth safely. |
net/kcm/kcmsock.c |
Protects BPF execution with RCU. |
net/mac80211/link.c |
Skips invalid AP-VLAN WMM setup. |
net/mac80211/s1g.c |
Corrects teardown destination address. |
net/mac80211/tx.c |
Skips absent countdown offsets. |
net/mptcp/syncookies.c |
Restores local address ID. |
net/netfilter/Kconfig |
Selects socket cgroup metadata. |
net/nfc/digital_core.c |
Handles null command responses. |
net/phonet/pep.c |
Honors short getsockopt buffers. |
net/rds/cong.c |
Uses ordered waitqueue checks. |
net/sched/sch_api.c |
Caps synthetic packet lengths. |
net/sched/sch_codel.c |
Bounds default MTU. |
net/sched/sch_fq_pie.c |
Bounds default quantum. |
net/sched/sch_generic.c |
Initializes watchdog timestamp. |
net/sched/sch_hhf.c |
Validates default quantum. |
net/sched/sch_sfq.c |
Bounds default quantum. |
net/sched/sch_teql.c |
Restores skb device after failure. |
net/sctp/inqueue.c |
Drops chunks for dead transports. |
net/sctp/sm_sideeffect.c |
Prevents association reuse after deletion. |
net/sunrpc/auth_gss/gss_rpc_upcall.c |
Removes redundant net initialization. |
net/sunrpc/auth_gss/gss_rpc_upcall.h |
Removes obsolete initializer declaration. |
net/sunrpc/cache.c |
Safely restarts the cache cleaner. |
net/sunrpc/sunrpc_syms.c |
Initializes per-net GSS mutex. |
net/sunrpc/xdr.c |
Prevents buffer-length underflow. |
net/vmw_vsock/af_vsock.c |
Consumes socket errors correctly. |
net/vmw_vsock/virtio_transport.c |
Flushes RX work last. |
net/xdp/xsk_buff_pool.c |
Recomputes original DMA address. |
net/xfrm/xfrm_output.c |
Avoids freeing consumed packets. |
scripts/mod/modpost.c |
Validates object suffix before parsing. |
scripts/tags.sh |
Restricts generated source paths. |
security/integrity/ima/ima_appraise.c |
Handles failed dentry path generation. |
security/smack/smack.h |
Consolidates CIPSO level state. |
sound/core/init.c |
Preserves managed-card state during release. |
sound/core/pcm_native.c |
Blocks starts during buffer reconfiguration. |
sound/core/ump_convert.c |
Clears the second UMP word. |
sound/drivers/mpu401/mpu401.c |
Validates card index. |
sound/drivers/mts64.c |
Handles negative card index. |
sound/drivers/portman2x4.c |
Handles negative card index. |
sound/drivers/serial-u16550.c |
Validates card index. |
sound/drivers/virmidi.c |
Validates card index. |
sound/pci/asihpi/hpi6000.c |
Propagates transport failure. |
sound/pci/hda/hda_proc.c |
Compares complete connection arrays. |
sound/soc/amd/yc/acp6x-mach.c |
Adds MSI Thin A15 quirk. |
sound/soc/codecs/rt700-sdw.c |
Cancels all delayed work. |
sound/soc/fsl/fsl-asoc-card.c |
Defers unavailable CPU DAI. |
sound/soc/fsl/mpc5200_psc_i2s.c |
Cleans DMA after registration failure. |
sound/soc/samsung/aries_wm8994.c |
Retains shared OF node. |
sound/soc/soc-dapm.c |
Corrects enum bounds check. |
sound/usb/midi.c |
Prevents oversized USB transfers. |
tools/bpf/bpftool/struct_ops.c |
Clears released global state. |
tools/build/Makefile.feature |
Adds bpftool skeleton detection. |
tools/build/feature/Makefile |
Implements skeleton feature test. |
tools/include/linux/compiler.h |
Defines the const attribute. |
tools/include/nolibc/arch-powerpc.h |
Adds syscall register clobbers. |
tools/perf/pmu-events/metric.py |
Adds deterministic metric ordering. |
tools/perf/util/data-convert-json.c |
Frees trace sequence storage. |
tools/perf/util/intel-bts.c |
Corrects minimum auxtrace size. |
tools/perf/util/intel-pt.c |
Corrects minimum auxtrace size. |
tools/perf/util/thread-stack.c |
Bounds branch-stack copying. |
tools/testing/kunit/kunit.py |
Filters the processed test lines. |
tools/testing/selftests/arm64/mte/check_buffer_fill.c |
Emits TAP header. |
tools/testing/selftests/arm64/mte/check_child_memory.c |
Emits TAP header. |
tools/testing/selftests/arm64/mte/check_gcr_el1_cswitch.c |
Emits TAP header. |
tools/testing/selftests/arm64/mte/check_mmap_options.c |
Emits TAP header. |
tools/testing/selftests/arm64/mte/check_tags_inclusion.c |
Emits TAP header. |
tools/testing/selftests/arm64/mte/check_user_mem.c |
Emits TAP header. |
tools/testing/selftests/bpf/test_sockmap.c |
Correctly unwinds I/O vectors. |
tools/testing/selftests/rseq/rseq-x86-thread-pointer.h |
Removes glibc-specific version dependency. |
tools/testing/selftests/zram/zram_lib.sh |
Uses POSIX test syntax. |
Review details
- Files reviewed: 300/1170 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update kernel base to 6.6.157.
git log --oneline v6.6.156..v6.6.157 | wc
1418 12946 105361
17+3+1398=1418
Merged(17):
selftests/mm/cow: generalize do_run_with_thp() helper
ubi: fastmap: Wait until there are enough free PEBs before filling pools
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
selftests/mm/khugepaged: enlighten for multi-size THP
selftests/mm: support multi-size THP interface in thp_settings
selftests/mm: factor out thp settings management
selftests/mm/kugepaged: restore thp settings at exit
HID: i2c-hid: Revert to await reset ACK before reading report descriptor
HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions
HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset()
USB: core: Use device_driver directly in struct usb_driver and usb_device_driver
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
ksmbd: fix overflow in dacloffset bounds check
LoongArch: Do not save/restore percpu base register in rethook trampoline
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
Skip(3): #conflict and solved later
6536d707ed924 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
a8aa89686e705 perf/x86/amd/uncore: Add group validation
e0e7c57c8f654 perf/x86/amd/uncore: Refactor uncore management