kernel/linux.git, branch v6.1.189

Linux 6.1.189

2026-10-03T10:28:55+00:00

Link: https://lore.kernel.org/r/20260930152416.775402466@linuxfoundation.org Tested-by: Florian Fainelli Tested-by: Peter Schneider Tested-by: Salvatore Bonaccorso Tested-by: Pavel Machek (CIP) Tested-by: Ron Economos Tested-by: Miguel Ojeda Tested-by: Brett A C Sheffield Tested-by: Barry K. Nathan Signed-off-by: Greg Kroah-Hartman

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

2026-10-03T10:28:55+00:00

commit 1cf11d80db5df805b538c942269e05a65bcaf5bc upstream. The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced. The call stack leading to the error looks like this: hda_component_manager_init |-> component_match_add |-> component_match_add_release |-> __component_match_add ( ... ,**matchptr, ... ) |-> *matchptr = ERR_PTR(-ENOMEM); // assign |-> component_master_add_with_match( ... match) |-> component_match_realloc(match, match->num); // dereference Add IS_ERR() check to prevent the crash. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ae7abe36e352 ("ALSA: hda/realtek: Add CS35L41 support for Thinkpad laptops") Cc: stable@vger.kernel.org Signed-off-by: Denis Arefev Signed-off-by: Takashi Iwai [Roman: Instead of modifying hda_component_manager_init() (which does not yet exist in version 6.1), a check needs to be added to the cs35l41_generic_fixup() function—the very function introduced by the offending commit, which calls component_match_add() without verifying its successful completion.] Signed-off-by: Roman Demidov Signed-off-by: Greg Kroah-Hartman

drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()

2026-10-03T10:28:55+00:00

commit cc9a8e238e42c1f43b98c097995137d644b69245 upstream. kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.ws_size is set, leading to a potential NULL pointer dereference in atom_get_src_int() when accessing WS entries. Return -ENOMEM on allocation failure to avoid the NULL dereference. Signed-off-by: Guangshuo Li Signed-off-by: Alex Deucher [ Roman: added parentheses to the 'if' statement, matching the upstream commit. ] Signed-off-by: Roman Demidov Signed-off-by: Greg Kroah-Hartman

lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected

2026-10-03T10:28:55+00:00

commit 799f532de13601f91ecb9cc6169d45d6e6933b0f upstream. Enabled ASD/ADD configuration for LAN7801 in the absence of EEPROM. After the lite reset these contents go back to defaults where ASD/ ADD is disabled. The check is already available for LAN7800. Reviewed-by: Simon Horman Signed-off-by: Rengarajan S Link: https://lore.kernel.org/r/20240529140256.1849764-3-rengarajan.s@microchip.com Signed-off-by: Jakub Kicinski Cc: Minh Tiến Nguyễn Signed-off-by: Greg Kroah-Hartman

lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected

2026-10-03T10:28:55+00:00

commit 5160b129f65fc6e1a4aa282d44f824e12aa800ee upstream. The 125MHz and 25MHz clock configurations are enabled in the initialization regardless of EEPROM (125MHz is needed for RGMII 1000Mbps operation). After a lite reset (lan78xx_reset), these contents go back to defaults(all 0, so no 125MHz or 25MHz clock). Reviewed-by: Simon Horman Signed-off-by: Rengarajan S Link: https://lore.kernel.org/r/20240529140256.1849764-2-rengarajan.s@microchip.com Signed-off-by: Jakub Kicinski Cc: Minh Tiến Nguyễn Signed-off-by: Greg Kroah-Hartman

tools/thermal/tmon: Fix compilation warning for wrong format

2026-10-03T10:28:55+00:00

commit 9da39ef332c417ce52732564c1c682a6e1209302 upstream. The following warnings are shown during compilation: tui.c: In function 'show_cooling_device': tui.c:216:40: warning: format '%d' expects argument of type 'int', but argument 7 has type 'long unsigned int' [-Wformat=] 216 | "%02d %12.12s%6d %6d", | ~~^ | | | int | %6ld ...... 219 | ptdata.cdi[j].cur_state, | ~~~~~~~~~~~~~~~~~~~~~~~ | | | long unsigned int tui.c:216:44: warning: format '%d' expects argument of type 'int', but argument 8 has type 'long unsigned int' [-Wformat=] 216 | "%02d %12.12s%6d %6d", | ~~^ | | | int | %6ld ...... 220 | ptdata.cdi[j].max_state); | ~~~~~~~~~~~~~~~~~~~~~~~ | | | long unsigned int To fix this, the correct string format must be used for printing. Signed-off-by: Florian Eckert Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20231204141335.2798194-1-fe@dev.tdt.de Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman

perf test: Change all remaining #!/bin/sh to #!/bin/bash

2026-10-03T10:28:55+00:00

commit 2f5d370dec3f800b44bbf7b68875d521e0af43cd upstream. There are 43 instances of posix shell tests and 35 instances of bash. To give us a single consistent language for testing in, replace all #!/bin/sh to #!/bin/bash. Common sources that are included in both different shells will now work as expected. And we no longer have to fix up bashisms that appear to work when someone's system has sh symlinked to bash, but don't work on other systems that have both shells installed. Although we could have chosen sh, it's not backwards compatible so it wouldn't be possible to bulk convert without re-writing the existing bash tests. Choosing bash also gives us some nicer features including 'local' variable definitions and regexes in if statements that are already widely used in the tests. It's not expected that there are any users with only sh available due to the large number of bash tests that exist. Discussed in relation to running shellcheck here: https://lore.kernel.org/linux-perf-users/e3751a74be34bbf3781c4644f518702a7270220b.1749785642.git.collin.funk1@gmail.com/ Signed-off-by: James Clark Reviewed-by: Collin Funk Acked-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250623-james-perf-bash-tests-v1-1-f572f54d4559@linaro.org Signed-off-by: Namhyung Kim When commit b02027776ac5 ("perf tests: Fix flakiness in BPF counters test on hybrid systems") was backported to several stable series (v5.15.221, v6.1.188, v6.6.157, v6.12.110, v6.18.52, v7.2.6) it introduced specific bash syntax. For versions after 2f5d370dec3f ("perf test: Change all remaining #!/bin/sh to #!/bin/bash") in v6.17-rc1 this is not a problem as the shebang was already hanged to #!/bin/bash. For the older stable series this introduced invalid syntax if #!/bin/sh is not bash: $ sh -n tools/perf/tests/shell/stat_bpf_counters.sh tools/perf/tests/shell/stat_bpf_counters.sh: 12: Syntax error: "(" unexpected $ checkbashism tools/perf/tests/shell/stat_bpf_counters.sh possible bashism in tools/perf/tests/shell/stat_bpf_counters.sh line 52 (bash arrays, ${name[0|*|@]}): base_instructions=$(perf stat --no-big-num -e instructions:u -- "${workload[@]}" 2>&1 | \ awk -v i=0 -v c=0 '/instructions/ { \ if ($1 != " 0) printf "%.0f", c; else print "&1 | \ awk -v i=0 -v c=0 '/instructions/ { \ if ($1 != " 0) printf "%.0f", c; else print "&1) Change shebang for the stat_bpf_counters.sh script. No upstream commit exists for this change as for versions post 6.17-rc1 the scripts were converted to #!/bin/bash already. Signed-off-by: Salvatore Bonaccorso Signed-off-by: Greg Kroah-Hartman

net: tls: fix silent data drop under pipe back-pressure

2026-10-03T10:28:54+00:00

[ Upstream commit 7e7be31bfdb066c1c780dcd6b1224078fc54063f ] tls_sw_splice_read() uses len when advancing rxm->offset / rxm->full_len after skb_splice_bits(), rather than copied (the actual number of bytes successfully spliced into the pipe). When the destination pipe cannot accept all the requested bytes, splice_to_pipe() returns fewer bytes than len, and 'len - copied' of data is effectively skipped over. Fixes: e062fe99cccd ("tls: splice_read: fix accessing pre-processed records") Link: https://patch.msgid.link/20260429222944.2139041-2-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin

xfs: fix blockgc group quota scanning when usrquota isn't enforced

2026-10-03T10:28:54+00:00

commit f8f6382ff13109e19d0fc1d0224ff7d29641e56a upstream. LOLLM noticed the copy-paste error here -- if user quotas aren't enforced but we're near the group quota limit, we fail to set FLAG_GID and hence we might not actually free any preallocations, causing unnecessary EDQUOT. Fix that. Cc: stable@vger.kernel.org # v5.12 Fixes: c237dd7c709432 ("xfs: flush eof/cowblocks if we can't reserve quota for inode creation") Signed-off-by: Darrick J. Wong Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino Signed-off-by: Greg Kroah-Hartman

smb: client: validate POSIX create context length

2026-10-03T10:28:54+00:00

commit fa2e9900dd2a3f5a1e7ef5a8c5e8d435feedbfcc upstream. parse_posix_ctxt() reads the fixed nlink, reparse_tag, and mode fields before checking that the POSIX create context contains them. A short context can pass the generic checks and still make these fixed-width reads run past its declared data. The current in-tree smb2_open_file() path passes a NULL posix pointer, so this handler is not reached on the ordinary open path. Still require the POSIX data to cover all three fields before reading them because the helper performs those unguarded reads. Keep the existing soft-failure behavior so malformed optional metadata does not fail the open. Fixes: 69dda3059e7a ("cifs: add SMB2_open() arg to return POSIX data") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi Tested-by: Frank Sorenson Signed-off-by: Paulo Alcantara Signed-off-by: Greg Kroah-Hartman