Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v6.18.21 2026-01-02T11:56:56+00:00 2026-01-02T11:56:56+00:00 Yongxin Liu yongxin.liu@windriver.com 2025-11-28T10:24:38+00:00 urn:sha1:76033cf8c2e488c191a64eab11c4858b6d83685d commit 611cf41ef6ac8301d23daadd8e78b013db0c5071 upstream. The intel_pmc_ipc() function uses ACPI_ALLOCATE_BUFFER to allocate memory for the ACPI evaluation result but never frees it, causing a 192-byte memory leak on each call. This leak is triggered during network interface initialization when the stmmac driver calls intel_mac_finish() -> intel_pmc_ipc(). unreferenced object 0xffff96a848d6ea80 (size 192): comm "dhcpcd", pid 541, jiffies 4294684345 hex dump (first 32 bytes): 04 00 00 00 05 00 00 00 98 ea d6 48 a8 96 ff ff ...........H.... 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ backtrace (crc b1564374): kmemleak_alloc+0x2d/0x40 __kmalloc_noprof+0x2fa/0x730 acpi_ut_initialize_buffer+0x83/0xc0 acpi_evaluate_object+0x29a/0x2f0 intel_pmc_ipc+0xfd/0x170 intel_mac_finish+0x168/0x230 stmmac_mac_finish+0x3d/0x50 phylink_major_config+0x22b/0x5b0 phylink_mac_initial_config.constprop.0+0xf1/0x1b0 phylink_start+0x8e/0x210 __stmmac_open+0x12c/0x2b0 stmmac_open+0x23c/0x380 __dev_open+0x11d/0x2c0 __dev_change_flags+0x1d2/0x250 netif_change_flags+0x2b/0x70 dev_change_flags+0x40/0xb0 Add __free(kfree) for ACPI object to properly release the allocated buffer. Cc: stable@vger.kernel.org Fixes: 7e2f7e25f6ff ("arch: x86: add IPC mailbox accessor function and add SoC register access") Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com> Link: https://patch.msgid.link/20251128102437.3412891-2-yongxin.liu@windriver.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2025-12-18T13:03:17+00:00 Randy Dunlap rdunlap@infradead.org 2025-11-11T06:09:16+00:00 urn:sha1:57c6cea2073c4561487967476bd9c05a4d4e49e7 [ Upstream commit 2d45db63260c6ae3cf007361e04a1c41bd265084 ] Add a missing struct short description and a missing leading " *" to lp855x.h to avoid kernel-doc warnings: Warning: include/linux/platform_data/lp855x.h:126 missing initial short description on line: * struct lp855x_platform_data Warning: include/linux/platform_data/lp855x.h:131 bad line: Only valid when mode is PWM_BASED. Fixes: 7be865ab8634 ("backlight: new backlight driver for LP855x devices") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20251111060916.1995920-1-rdunlap@infradead.org Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2025-10-28T15:06:14+00:00 Qiu Wenbo qiuwenbo@kylinsec.com.cn 2025-10-28T06:30:09+00:00 urn:sha1:f0f7a3f542c1698edb69075f25a3f846207facba regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free issue that leads to random failures when other drivers (typically Intel THC) attempt to allocate interrupts. The root cause is that the reference count of the pinctrl_intel_platform module unexpectedly drops to zero when this driver defers its probe. This behavior can also be reproduced by unloading the module directly. Fix the issue by removing the redundant release of the GPIO device during regulator unregistration. Cc: stable@vger.kernel.org Fixes: 1e5d088a52c2 ("platform/x86: int3472: Stop using devm_gpiod_get()") Signed-off-by: Qiu Wenbo <qiuwenbo@kylinsec.com.cn> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com> Reviewed-by: Hans de Goede <hansg@kernel.org> Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com> Link: https://patch.msgid.link/20251028063009.289414-1-qiuwenbo@gnome.org Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> 2025-10-08T16:44:38+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-08T16:44:38+00:00 urn:sha1:99cedb6b8f4101e2780f10b9e76d2f346a1e4316 Pull input updates from Dmitry Torokhov: - Conversions to yaml/json schema and fixes for input-related device tree bindings - New drivers: - Awinic AW86927 haptic chip - Hynitron CST816x series controller - Himax HX852x(ES) touchscreen controller - Fix uinput to not leak kernel memory via a gap in uinput_ff_upload_compat structure - Prevent overflow in pressure calculation in tsc2007 driver causing phantom touches - Make the Atmel maxTouch driver support generic touchscreen configuration (flip, rotate, etc) - Drop support for platform data in tca8418_keypad, pxa27x-keypad, spear-keyboard and twl4030_keypad drivers, they all now rely on generic device properties for configuration - Other assorted changes and fixes * tag 'input-for-v6.18-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (50 commits) Input: atmel_mxt_ts - allow reset GPIO to sleep Input: aw86927 - fix error code in probe() Input: psxpad-spi - add a check for the return value of spi_setup() Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Input: aw86927 - add driver for Awinic AW86927 dt-bindings: input: Add Awinic AW86927 dt-bindings: touchscreen: remove touchscreen.txt dt-bindings: arm: bcm: raspberrypi,bcm2835-firmware: Add touchscreen child node dt-bindings: touchscreen: convert eeti bindings to json schema Input: pm8941-pwrkey - disable wakeup for resin by default dt-bindings: input: pm8941-pwrkey: Document wakeup-source property Input: add driver for Hynitron CST816x series dt-bindings: input: touchscreen: add hynitron cst816x series Input: imx6ul_tsc - set glitch threshold by DTS property dt-bindings: touchscreen: fsl,imx6ul-tsc: support glitch thresold dt-bindings: touchscreen: add debounce-delay-us property Input: ps2-gpio - fix typo Input: atmel_mxt_ts - add support for generic touchscreen configurations dt-bindings: input: maxtouch: add common touchscreen properties dt-bindings: touchscreen: convert zet6223 bindings to json schema ... 2025-10-04T23:26:32+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-04T23:26:32+00:00 urn:sha1:6093a688a07da07808f0122f9aa2a3eed250d853 Pull Char/Misc/IIO/Binder updates from Greg KH: "Here is the big set of char/misc/iio and other driver subsystem changes for 6.18-rc1. Loads of different stuff in here, it was a busy development cycle in lots of different subsystems, with over 27k new lines added to the tree. Included in here are: - IIO updates including new drivers, reworking of existing apis, and other goodness in the sensor subsystems - MEI driver updates and additions - NVMEM driver updates - slimbus removal for an unused driver and some other minor updates - coresight driver updates and additions - MHI driver updates - comedi driver updates and fixes - extcon driver updates - interconnect driver additions - eeprom driver updates and fixes - minor UIO driver updates - tiny W1 driver updates But the majority of new code is in the rust bindings and additions, which includes: - misc driver rust binding updates for read/write support, we can now write "normal" misc drivers in rust fully, and the sample driver shows how this can be done. - Initial framework for USB driver rust bindings, which are disabled for now in the build, due to limited support, but coming in through this tree due to dependencies on other rust binding changes that were in here. I'll be enabling these back on in the build in the usb.git tree after -rc1 is out so that developers can continue to work on these in linux-next over the next development cycle. - Android Binder driver implemented in Rust. This is the big one, and was driving a huge majority of the rust binding work over the past years. Right now there are two binder drivers in the kernel, selected only at build time as to which one to use as binder wants to be included in the system at boot time. The binder C maintainers all agreed on this, as eventually, they want the C code to be removed from the tree, but it will take a few releases to get there while both are maintained to ensure that the rust implementation is fully stable and compliant with the existing userspace apis. All of these have been in linux-next for a while" * tag 'char-misc-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (320 commits) rust: usb: keep usb::Device private for now rust: usb: don't retain device context for the interface parent USB: disable rust bindings from the build for now samples: rust: add a USB driver sample rust: usb: add basic USB abstractions coresight: Add label sysfs node support dt-bindings: arm: Add label in the coresight components coresight: tnoc: add new AMBA ID to support Trace Noc V2 coresight: Fix incorrect handling for return value of devm_kzalloc coresight: tpda: fix the logic to setup the element size coresight: trbe: Return NULL pointer for allocation failures coresight: Refactor runtime PM coresight: Make clock sequence consistent coresight: Refactor driver data allocation coresight: Consolidate clock enabling coresight: Avoid enable programming clock duplicately coresight: Appropriately disable trace bus clocks coresight: Appropriately disable programming clocks coresight: etm4x: Support atclk coresight: catu: Support atclk ... 2025-10-04T22:50:37+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-04T22:50:37+00:00 urn:sha1:cc07b0a3afc8c15c1308497033453b44f7ccfc49 Pull MTD updates from Miquel Raynal: "MTD core: - Bad blocks increment is skipped if the block is already known bad (improves user statistics relevance) - Expose the OOB layout via debugfs Raw NAND: - Add support for Loongson-2K1000 and Loongson-2K0500 NAND controllers, including extra features, such as chip select and 6-byte NAND ID reading support - Drop the s3c2410 driver SPI NAND: - Important SPI NAND continuous read improvements and fixes - Add support for FudanMicro FM25S01A - Add support for continuous reads in Gigadevice vendor driver ECC: - Add support for the Realtek ECC engine SPI NOR: - Some flashes can't perform reads or writes with start or end being an odd number in Octal DTR mode. File systems like UBIFS can request such reads or writes, causing the transaction to error out. Pad the read or write transactions with extra bytes to avoid this problem. And the usual amount of various miscellaneous fixes" * tag 'mtd/for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (46 commits) mtd: rawnand: sunxi: drop unused module alias mtd: rawnand: stm32_fmc2: drop unused module alias mtd: rawnand: rockchip: drop unused module alias mtd: rawnand: pl353: drop unused module alias mtd: rawnand: omap2: drop unused module alias mtd: rawnand: atmel: drop unused module alias mtd: onenand: omap2: drop unused module alias mtd: hyperbus: hbmc-am654: drop unused module alias mtd: jedec_probe: use struct_size() helper for cfiq allocation mtd: cfi: use struct_size() helper for cfiq allocation mtd: nand: raw: gpmi: fix clocks when CONFIG_PM=N mtd: rawnand: omap2: fix device leak on probe failure mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands mtd: nand: realtek-ecc: Add Realtek external ECC engine support dt-bindings: mtd: Add realtek,rtl9301-ecc mtd: spinand: repeat reading in regular mode if continuous reading fails mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails mtd: spinand: fix direct mapping creation sizes mtd: rawnand: fsmc: Default to autodetect buswidth mtd: nand: move nand_check_erased_ecc_chunk() to nand/core ... 2025-10-01T18:54:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-01T18:54:40+00:00 urn:sha1:2d274536245b58a43753a23d84dfadc9df1df489 Pull MMC updates from Ulf Hansson: "MMC core: - Improve RPMB frame handling code - Add support for a new max-sd-hs-hz DT property to limit frequency - Add support to manage regulator-under-voltage events - Support regulator-under-voltage for eMMC to mitigate data corruptions - Add mmc_read_tuning() to allow a host to validate its tuning sequence - Add some helpers to align checks for CMD23 support - Read the CCCR register for SDIO over SPI rather than the unsupported CMD7 MMC host: - Add COMPILE_TEST option for a couple of drivers - Convert drivers to use the modern PM macros - dw_mmc-exynos: Enable support for the Exynos8890 variant - mmc_spi: Don't use crc ack during multiple block read - renesas_sdhi: Enable 64-bit polling mode for R-Car gen3 and RZ/G2L SoCs - rtsx_usb: Add support for over-current-protection - sdhci-cadence: Add support for multi-block read gap tuning - sdhci-msm: - Add support for tuning for SDR50 mode for SD cards - Enable support for the Lemans variant - sdhci-pci: Disable SD card clock before update for a few Intel platforms - sdhci-pxav3: Add support for UHS pinctrl settings - tmio: Add 64-bit read/write support in polling mode MEMSTICK: - Convert to use timeouts to prevent indefinite waiting - rtsx_usb: Add support for over-current-protection" * tag 'mmc-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (77 commits) dt-bindings: mmc: samsung,exynos-dw-mshc: add specific compatible for exynos8890 mmc: select REGMAP_MMIO with MMC_LOONGSON2 mmc: add COMPILE_TEST to multiple drivers mmc: core: Improve RPMB frame handling code mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() mmc: core: Parse and use the new max-sd-hs-hz DT property dt-bindings: mmc: controller: Add max-sd-hs-hz property mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card dt-bindings: mmc: sdhci-msm: Document the Lemans compatible mmc: sh_mmcif: Remove dummy PM resume callback dt-bindings: mmc: sdhci-pxa: Add minItems to pinctrl-names mmc: sdio: Drop dev_pm_domain_detach() call mmc: dw_mmc-rockchip: use modern PM macros mmc: dw_mmc-pci: use modern PM macros mmc: dw_mmc-k3: use modern PM macros mmc: dw_mmc: exynos: use modern PM macros mmc: via-sdmmc: use modern PM macros mmc: sdhci-msm: use modern PM macros mmc: mtk-sd: use modern PM macros mmc: wmt-sdmmc: use modern PM macros ... 2025-10-01T16:42:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-01T16:42:51+00:00 urn:sha1:989253cc46ff3f4973495b58e02c7fcb1ffb713e Pull hwmon updates from Guenter Roeck: "New drivers: - Kontron SMARC-sAM67 - GPD device sensors - MP29502 - MP2869, MP29608, MP29612 and MP29816 series Added chip support to existing drivers: - asus-ec-sensors: Add B650E-I Add PRIME Z270-A Add Pro WS WRX90E-SAGE SE Add ROG STRIX X670E-E GAMING WIFI Add ROG STRIX X870-I GAMING WIFI Add ROG STRIX X870E-E GAMING WIFI Add ROG STRIX Z690-E GAMING WIFI Add ROG STRIX Z790E GAMING WIFI II Add STRIX B850-I GAMING WIFI Add TUF GAMING X670E PLUS WIFI Add X670E-I GAMING WIFI Add Z790-I GAMING WIFI - dell-smm: Add support for Dell OptiPlex 7040 - ina238: Major cleanup, and Add support for INA700 Add support for INA780 - k10temp: Add device ID for Strix Halo Add support for AMD Family 1Ah-based models - lenovo-ec-sensors: Update P8 supprt - lm75: Add NXP P3T1750 support - pmbus/adm1275: Add sq24905c support - pmbus/isl68137: Add support for Renesas RAA228244 and RAA228246 - pmbus/mp5990: Add support for MP5998 - sht21: Add support for SHT20, SHT25 - sl28cpld: Add sa67mcu compatible Other notable changes: - core: Handle locking internally Introduce 64-bit energy attribute support - cros_ec: Register into thermal framework, improve PWM control - lm75: allow interrupt for ti,tmp75 - mlxreg-fan: Add support for new flavour of capability register - sbtsi_temp: AMD CPU extended temperature range support - sht21: Add devicetree support Various other minor improvements and fixes" * tag 'hwmon-for-v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (86 commits) dt-bindings: hwmon: (lm75) allow interrupt for ti,tmp75 hwmon: (mlxreg-fan) Add support for new flavour of capability register hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems hwmon: (cros_ec) register fans into thermal framework cooling devices hwmon: (cros_ec) add PWM control over fans platform/chrome: update pwm fan control host commands hwmon: add SMARC-sAM67 support dt-bindings: hwmon: sl28cpld: add sa67mcu compatible hwmon: (asus-ec-sensors) add TUF GAMING X670E PLUS WIFI hwmon: (dell-smm) Add support for Dell OptiPlex 7040 hwmon: (dell-smm) Add support for automatic fan mode hwmon: (gpd-fan) complete Kconfig dependencies hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex hwmon: (asus-ec-sensors) add ROG STRIX X870E-E GAMING WIFI hwmon: (dell-smm) Move clamping of fan speed out of i8k_set_fan() hwmon: (dell-smm) Remove Dell Precision 490 custom config data hwmon: (asus-ec-sensors) add ROG STRIX X670E-E GAMING WIFI hwmon: (gpd-fan) Fix range check for pwm input hwmon: (pmbus/mp5990) add support for MP5998 dt-bindings: trivial-devices: add mps,mp5998 ... 2025-10-01T16:16:28+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-10-01T16:16:28+00:00 urn:sha1:57cf7a603b6d2524edffaa3068d9aa7a41641d93 Pull chrome platform updates from Tzung-Bi Shih: "New: - Add a new API cros_ec_device_registered() for checking if the cros_ec_deivce is ready Improvements: - Use TRAILING_OVERLAP() to fix -Wflex-array-member-not-at-end warning - Defer probe until parent EC device is ready in cros_ec_keyb Cleanups: - Remove redundant and simplify code in cros_ec_chardev - Centralize cros_ec_device allocation and initialization to remove duplicate code" * tag 'chrome-platform-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: Input: cros_ec_keyb - Defer probe until parent EC device is registered platform/chrome: cros_ec: Add a flag to track registration state platform/chrome: cros_ec: Separate initialization from cros_ec_register() platform/chrome: Centralize common cros_ec_device initialization platform/chrome: Centralize cros_ec_device allocation platform/chrome: wilco_ec: Remove redundant semicolons platform/chrome: cros_ec: Avoid -Wflex-array-member-not-at-end warning platform/chrome: cros_ec_chardev: Decouple fops from struct cros_ec_dev platform/chrome: cros_ec_chardev: Remove redundant struct field 2025-09-30T23:53:59+00:00 Linus Torvalds torvalds@linux-foundation.org 2025-09-30T23:53:59+00:00 urn:sha1:70de5572a82b3d510df31d2c572c15cd53a00870 Pull clocksource updates from Thomas Gleixner: - Further preparations for modular clocksource/event drivers - The usual device tree updates to support new chip variants and the related changes to thise drivers - Avoid a 64-bit division in the TEGRA186 driver, which caused a build fail on 32-bit machines. - Small fixes, improvements and cleanups all over the place * tag 'timers-clocksource-2025-09-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits) dt-bindings: timer: exynos4210-mct: Add compatible for ARTPEC-9 SoC clocksource/drivers/sh_cmt: Split start/stop of clock source and events clocksource/drivers/clps711x: Fix resource leaks in error paths clocksource/drivers/arm_global_timer: Add auto-detection for initial prescaler values clocksource/drivers/ingenic-sysost: Convert from round_rate() to determine_rate() clocksource/drivers/timer-tegra186: Don't print superfluous errors clocksource/drivers/timer-rtl-otto: Simplify documentation clocksource/drivers/timer-rtl-otto: Do not interfere with interrupts clocksource/drivers/timer-rtl-otto: Drop set_counter function clocksource/drivers/timer-rtl-otto: Work around dying timers clocksource/drivers/timer-ti-dm : Capture functionality for OMAP DM timer clocksource/drivers/arm_arch_timer_mmio: Add MMIO clocksource clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver clocksource/drivers/arm_arch_timer: Add standalone MMIO driver ACPI: GTDT: Generate platform devices for MMIO timers clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support dt: bindings: fsl,vf610-pit: Add compatible for s32g2 and s32g3 clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT clocksource/drivers/vf-pit: Unify the function name for irq ack clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable ...