summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2025-06-02Merge tag 'rpmsg-v6.16' of ↵Linus Torvalds6-165/+6
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - Remove some dead and unused code from core and virtio modules - Improve the error messages from the Qualcomm SMD driver and initialize an uninitialized variable in the send path * tag 'rpmsg-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() rpmsg: qcom_smd: Improve error handling for qcom_smd_parse_edge rpmsg: Remove unused method pointers *send_offchannel rpmsg: virtio: Remove uncallable offchannel functions rpmsg: core: Remove deadcode
2025-06-02Merge tag 'rproc-v6.16' of ↵Linus Torvalds14-1836/+1266
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Fix resource cleanup in the remoteproc attach error handling code paths - Refactor the various TI K3 drivers to extract and reuse common code between them - Add support in the i.MX remoteproc driver for determining from the firmware if Linux should wait on a "firmware ready" signal at startup - Improve the Xilinx R5F power down mechanism to handle use cases where this is shared with other entities in the system * tag 'rproc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (46 commits) remoteproc: k3: Refactor release_tsp() functions into common driver remoteproc: k3: Refactor reserved_mem_init() functions into common driver remoteproc: k3: Refactor mem_release() functions into common driver remoteproc: k3: Refactor of_get_memories() functions into common driver remoteproc: k3: Refactor .da_to_va rproc ops into common driver remoteproc: k3: Refactor .get_loaded_rsc_table ops into common driver remoteproc: k3: Refactor .detach rproc ops into common driver remoteproc: k3: Refactor .attach rproc ops into common driver remoteproc: k3: Refactor .stop rproc ops into common driver remoteproc: k3: Refactor .start rproc ops into common driver remoteproc: k3: Refactor .unprepare rproc ops into common driver remoteproc: k3: Refactor .prepare rproc ops into common driver remoteproc: k3-dsp: Assert local reset during .prepare callback remoteproc: k3-dsp: Don't override rproc ops in IPC-only mode remoteproc: k3: Refactor rproc_request_mbox() implementations into common driver remoteproc: k3-m4: Ping the mbox while acquiring the channel remoteproc: k3: Refactor rproc_release() implementation into common driver remoteproc: k3-m4: Introduce central function to release rproc from reset remoteproc: k3-dsp: Correct Reset deassert logic for devices w/o lresets remoteproc: k3: Refactor rproc_reset() implementation into common driver ...
2025-06-02Merge tag 'mailbox-v6.16' of ↵Linus Torvalds10-220/+536
git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: "Core: - misc cleanup sophgo: - add driver for CV18XX series qcom: - add SM7150 APCS compatible - apcs: added separate clock node imx: - fix tx doorbell send microchip: - misc compile option fix mediatek: - Refine GCE_GCTL_VALUE setting" * tag 'mailbox-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox: qcom-apcs-ipc: Assign OF node to clock controller child device dt-bindings: mailbox: qcom,apcs: Add separate node for clock-controller dt-bindings: mailbox: qcom: Add the SM7150 APCS compatible mailbox: sophgo: add mailbox driver for CV18XX series SoC dt-bindings: mailbox: add Sophgo CV18XX series SoC mailbox: Use guard/scoped_guard for spinlock mailbox: Use guard/scoped_guard for con_mutex mailbox: Remove devm_mbox_controller_unregister mailbox: Propagate correct error return value mailbox: Not protect module_put with spin_lock_irqsave mailbox: Use dev_err when there is error mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting mailbox: imx: Fix TXDB_V2 sending mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error
2025-06-02genirq/matrix: Remove unused irq_matrix_alloc_reserved tracepointSteven Rostedt1-8/+0
The tracepoint irq_matrix_alloc_reserved was added but never used. Remove it. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: Juergen Gross <jgross@suse.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Link: https://lore.kernel.org/20250529135739.26e5c075@gandalf.local.home Fixes: ec0f7cd273dc4 ("genirq/matrix: Add tracepoints") Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-06-02xdp: Remove unused mem_return_failed eventSteven Rostedt1-26/+0
The change to allow page_pool to handle its own page destruction instead of relying on XDP removed the trace_mem_return_failed() tracepoint caller, but did not remove the mem_return_failed trace event. As trace events take up memory when they are created regardless of if they are used or not, having this unused event around wastes around 5K of memory. Remove the unused event. Link: https://lore.kernel.org/all/20250529130138.544ffec4@gandalf.local.home/ Cc: netdev <netdev@vger.kernel.org> Cc: Jonathan Lemon <jonathan.lemon@gmail.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Link: https://lore.kernel.org/20250529160550.1f888b15@gandalf.local.home Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-06-02ftrace: Don't allocate ftrace module map if ftrace is disabledYe Bin1-0/+3
If ftrace is disabled, it is meaningless to allocate a module map. Add a check in allocate_ftrace_mod_map() to not allocate if ftrace is disabled. Link: https://lore.kernel.org/20250529111955.2349189-3-yebin@huaweicloud.com Signed-off-by: Ye Bin <yebin10@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-06-02ftrace: Fix UAF when lookup kallsym after ftrace disabledYe Bin1-3/+7
The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS RIP: 0010:sized_strscpy+0x81/0x2f0 RSP: 0018:ffff88812d76fa08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffffffc0601010 RCX: dffffc0000000000 RDX: 0000000000000038 RSI: dffffc0000000000 RDI: ffff88812608da2d RBP: 8080808080808080 R08: ffff88812608da2d R09: ffff88812608da68 R10: ffff88812608d82d R11: ffff88812608d810 R12: 0000000000000038 R13: ffff88812608da2d R14: ffffffffc05d0218 R15: fefefefefefefeff FS: 00007fef552de740(0000) GS:ffff8884251c7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc05d0218 CR3: 00000001146f0000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ftrace_mod_get_kallsym+0x1ac/0x590 update_iter_mod+0x239/0x5b0 s_next+0x5b/0xa0 seq_read_iter+0x8c9/0x1070 seq_read+0x249/0x3b0 proc_reg_read+0x1b0/0x280 vfs_read+0x17f/0x920 ksys_read+0xf3/0x1c0 do_syscall_64+0x5f/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The above issue may happen as follows: (1) Add kprobe tracepoint; (2) insmod test.ko; (3) Module triggers ftrace disabled; (4) rmmod test.ko; (5) cat /proc/kallsyms; --> Will trigger UAF as test.ko already removed; ftrace_mod_get_kallsym() ... strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); ... The problem is when a module triggers an issue with ftrace and sets ftrace_disable. The ftrace_disable is set when an anomaly is discovered and to prevent any more damage, ftrace stops all text modification. The issue that happened was that the ftrace_disable stops more than just the text modification. When a module is loaded, its init functions can also be traced. Because kallsyms deletes the init functions after a module has loaded, ftrace saves them when the module is loaded and function tracing is enabled. This allows the output of the function trace to show the init function names instead of just their raw memory addresses. When a module is removed, ftrace_release_mod() is called, and if ftrace_disable is set, it just returns without doing anything more. The problem here is that it leaves the mod_list still around and if kallsyms is called, it will call into this code and access the module memory that has already been freed as it will return: strscpy(module_name, mod_map->mod->name, MODULE_NAME_LEN); Where the "mod" no longer exists and triggers a UAF bug. Link: https://lore.kernel.org/all/20250523135452.626d8dcd@gandalf.local.home/ Cc: stable@vger.kernel.org Fixes: aba4b5c22cba ("ftrace: Save module init functions kallsyms symbols for tracing") Link: https://lore.kernel.org/20250529111955.2349189-2-yebin@huaweicloud.com Signed-off-by: Ye Bin <yebin10@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2025-06-02Merge tag 'nand/for-6.16' into mtd/nextMiquel Raynal443-2965/+6633
The SPI NAND subsystem has seen the introduction of DTR operations (the equivalent of DDR transfers), which involved quite a few preparation patches for clarifying macro names. In the raw NAND subsystem, the brcmnand driver has been "fixed" for old legacy SoCs with an update of the ->exec_op() hook, there has been the introduction of a new controller driver named Loongson-1, and the Qualcomm driver has received quite a few misc fixes as well as a new compatible. Aside from this, there is the usual load of misc improvement and fixes.
2025-06-02Merge tag 'spi-nor/for-6.16' into mtd/nextMiquel Raynal1-34/+39
SPI NOR changes for 6.16 Notable changes: - Cleanup some Macronix flash entries. - Add SFDP table fixups for Macronix MX25L3255E.
2025-06-02bcachefs: Run check_dirents second time if requiredKent Overstreet4-27/+49
If we move a key backwards, we'll need a second pass to run the rest of the fsck checks. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Run snapshot deletion out of system_long_wqKent Overstreet1-1/+1
We don't want this running out of the same workqueue, and blocking, writes. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Make check_key_has_snapshot saferKent Overstreet2-22/+37
Snapshot deletion v2 added sentinal values for deleted snapshots, so "key for deleted snapshot" - i.e. snapshot deletion missed something - is safe to repair automatically. But if we find a key for a missing snapshot we have no idea what happened, and we shouldn't delete it unless we're very sure that everything else is consistent. So hook it up to the new bch2_require_recovery_pass(), we'll now only delete if snapshots and subvolumes have recenlty been checked. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: BCH_RECOVERY_PASS_NO_RATELIMITKent Overstreet5-13/+53
Add a superblock flag to temporarily disable ratelimiting for a recovery pass. This will be used to make check_key_has_snapshot safer: we don't want to delete a key for a missing snapshot unless we know that the snapshots and subvolumes btrees are consistent, i.e. check_snapshots and check_subvols have run recently. Changing those btrees - creating/deleting a subvolume or snapshot - will set the "disable ratelimit" flag, i.e. ensuring that those passes run if check_key_has_snapshot discovers an error. We're only disabling ratelimiting in the snapshot/subvol delete paths, we're not so concerned about the create paths. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: bch2_require_recovery_pass()Kent Overstreet3-2/+37
Add a helper for requiring that a recovery pass has already run: either run it directly, if we're still in recovery, or if we're not in recovery check if it has run recently and schedule it if it hasn't. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: bch_err_throw()Kent Overstreet60-405/+459
Add a tracepoint for any time we return an error and unwind. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Repair code for directory i_sizeKent Overstreet2-1/+10
We had a bug due due to an incomplete revert of the patch implementing directory i_size (summing up the size of the dirents), leading to completely screwy i_size values that underflow. Most userspace programs don't seem to care (e.g. du ignores it), but it turns out this broke sshfs, so needs to be repaired. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Kill un-reverted directory i_size codeKent Overstreet3-14/+6
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Delete redundant fsck_err()Kent Overstreet2-18/+0
'inode_has_wrong_backpointer'; we have more specific errors for every case afterwards. Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02bcachefs: Convert BUG() to errorKent Overstreet1-1/+2
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
2025-06-02PCI: WARN (not BUG()) when we fail to assign optional resourcesIlpo Järvinen1-5/+8
Resource fitting/assignment code checks if there's a remainder in add_list (aka. realloc_head in the inner functions) using BUG_ON(). This problem typically results in a mere PCI device resource assignment failure which does not warrant using BUG_ON(). The machine could well come up usable even if this condition occurs because the realloc_head relates to resources which are optional anyway. Change BUG_ON() to WARN_ON_ONCE() and free the list if it's not empty. [bhelgaas: subject] Reported-by: Tudor Ambarus <tudor.ambarus@linaro.org> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://lore.kernel.org/linux-pci/5f103643-5e1c-43c6-b8fe-9617d3b5447c@linaro.org Link: https://lore.kernel.org/r/20250511215223.7131-1-ilpo.jarvinen@linux.intel.com
2025-06-02PCI: Remove unused pci_printk()Ilpo Järvinen1-3/+0
include/linux/pci.h provides low-level pci_printk() interface that is not used since the commits fab874e12593 ("PCI/AER: Descope pci_printk() to aer_printk()") and 588021b28642 ("PCI: shpchp: Remove 'shpchp_debug' module parameter"). PCI logging should not use pci_printk() but pci_*() wrappers that follow the usual logging wrapper patterns. Remove pci_printk(). Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://lore.kernel.org/r/20250407101215.1376-1-ilpo.jarvinen@linux.intel.com
2025-06-02dm-table: check BLK_FEAT_ATOMIC_WRITES inside limits_lockBenjamin Marzinski1-1/+1
dm_set_device_limits() should check q->limits.features for BLK_FEAT_ATOMIC_WRITES while holding q->limits_lock, like it does for the rest of the queue limits. Fixes: b7c18b17a173 ("dm-table: Set BLK_FEAT_ATOMIC_WRITES for target queue limits") Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2025-06-02Merge tag 'kvmarm-fixes-6.16-1' of ↵Paolo Bonzini8-74/+134
https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.16, take #1 - Make the irqbypass hooks resilient to changes in the GSI<->MSI routing, avoiding behind stale vLPI mappings being left behind. The fix is to resolve the VGIC IRQ using the host IRQ (which is stable) and nuking the vLPI mapping upon a routing change. - Close another VGIC race where vCPU creation races with VGIC creation, leading to in-flight vCPUs entering the kernel w/o private IRQs allocated. - Fix a build issue triggered by the recently added workaround for Ampere's AC04_CPU_23 erratum. - Correctly sign-extend the VA when emulating a TLBI instruction potentially targeting a VNCR mapping. - Avoid dereferencing a NULL pointer in the VGIC debug code, which can happen if the device doesn't have any mapping yet.
2025-06-02rtmutex_api: provide correct extern functionsPaolo Bonzini1-12/+21
Commit fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock") changed the set of functions that mutex.c defines when CONFIG_DEBUG_LOCK_ALLOC is set. - it removed the "extern" declaration of mutex_lock_killable_nested from include/linux/mutex.h, and replaced it with a macro since it could be treated as a special case of _mutex_lock_killable. It also removed a definition of the function in kernel/locking/mutex.c. - likewise, it replaced mutex_trylock() with the more generic mutex_trylock_nest_lock() and replaced mutex_trylock() with a macro. However, it left the old definitions in place in kernel/locking/rtmutex_api.c, which causes failures when building with CONFIG_RT_MUTEXES=y. Bring over the changes. Fixes: fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock") Reported-by: Randy Dunlap <rdunlap@infradead.org> Tested-by: Randy Dunlap <rdunlap@infradead.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2025-06-02Merge branch 'next' into for-linusDmitry Torokhov13704-271594/+699685
Prepare input updates for 6.16 merge window.
2025-06-02smb: client: use ParentLeaseKey in cifs_do_createHenrique Carvalho1-0/+23
Implement ParentLeaseKey logic in cifs_do_create() by looking up the parent cfid, copying its lease key into the fid struct, and setting the appropriate lease flag. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02smb: client: use ParentLeaseKey in open_cached_dirHenrique Carvalho1-1/+23
Implement ParentLeaseKey logic in open_cached_dir() by looking up the parent cfid, copying its lease key into the fid struct, and setting the appropriate lease flag. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02smb: client: add ParentLeaseKey supportHenrique Carvalho3-6/+18
According to MS-SMB2 3.2.4.3.8, when opening a file the client must lookup its parent directory, copy that entry’s LeaseKey into ParentLeaseKey, and set SMB2_LEASE_FLAG_PARENT_LEASE_KEY_SET. Extend lease context functions to carry a parent_lease_key and lease_flags and to add them to the lease context buffer accordingly in smb3_create_lease_buf. Also add a parent_lease_key field to struct cifs_fid and lease_flags to cifs_open_parms. Only applies to the SMB 3.x dialect family. Fixes: f047390a097e ("CIFS: Add create lease v2 context for SMB3") Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02cifs: Fix cifs_query_path_info() for Windows NT serversPali Rohár1-0/+8
For TRANS2 QUERY_PATH_INFO request when the path does not exist, the Windows NT SMB server returns error response STATUS_OBJECT_NAME_NOT_FOUND or ERRDOS/ERRbadfile without the SMBFLG_RESPONSE flag set. Similarly it returns STATUS_DELETE_PENDING when the file is being deleted. And looks like that any error response from TRANS2 QUERY_PATH_INFO does not have SMBFLG_RESPONSE flag set. So relax check in check_smb_hdr() for detecting if the packet is response for this special case. This change fixes stat() operation against Windows NT SMB servers and also all operations which depends on -ENOENT result from stat like creat() or mkdir(). Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02cifs: Fix validation of SMB1 query reparse point responsePali Rohár1-2/+18
Validate the SMB1 query reparse point response per [MS-CIFS] section 2.2.7.2 NT_TRANSACT_IOCTL. NT_TRANSACT_IOCTL response contains one word long setup data after which is ByteCount member. So check that SetupCount is 1 before trying to read and use ByteCount member. Output setup data contains ReturnedDataLen member which is the output length of executed IOCTL command by remote system. So check that output was not truncated before transferring over network. Change MaxSetupCount of NT_TRANSACT_IOCTL request from 4 to 1 as io_rsp structure already expects one word long output setup data. This should prevent server sending incompatible structure (in case it would be extended in future, which is unlikely). Change MaxParameterCount of NT_TRANSACT_IOCTL request from 2 to 0 as NT IOCTL does not have any documented output parameters and this function does not parse any output parameters at all. Fixes: ed3e0a149b58 ("smb: client: implement ->query_reparse_point() for SMB1") Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02cifs: Correctly set SMB1 SessionKey field in Session Setup RequestPali Rohár4-3/+6
[MS-CIFS] specification in section 2.2.4.53.1 where is described SMB_COM_SESSION_SETUP_ANDX Request, for SessionKey field says: The client MUST set this field to be equal to the SessionKey field in the SMB_COM_NEGOTIATE Response for this SMB connection. Linux SMB client currently set this field to zero. This is working fine against Windows NT SMB servers thanks to [MS-CIFS] product behavior <94>: Windows NT Server ignores the client's SessionKey. For compatibility with [MS-CIFS], set this SessionKey field in Session Setup Request to value retrieved from Negotiate response. Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-02cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE modePali Rohár1-10/+10
SMB1 Session Setup NTLMSSP Request in non-UNICODE mode is similar to UNICODE mode, just strings are encoded in ASCII and not in UTF-16. With this change it is possible to setup SMB1 session with NTLM authentication in non-UNICODE mode with Windows SMB server. This change fixes mounting SMB1 servers with -o nounicode mount option together with -o sec=ntlmssp mount option (which is the default sec=). Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-01smb: client: add NULL check in automount_fullpathRuben Devos1-0/+3
page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointer dereference. Signed-off-by: Ruben Devos <devosruben6@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>
2025-06-01Merge tag 'hardening-v6.16-rc1-fix1-take2' of ↵Linus Torvalds5-18/+65
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - randstruct: gcc-plugin: Fix attribute addition with GCC 15 - ubsan: integer-overflow: depend on BROKEN to keep this out of CI - overflow: Introduce __DEFINE_FLEX for having no initializer - wifi: iwlwifi: mld: Work around Clang loop unrolling bug [ Take two after a jump scare due to some repo rewriting by 'b4' - Linus ] * tag 'hardening-v6.16-rc1-fix1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: randstruct: gcc-plugin: Fix attribute addition overflow: Introduce __DEFINE_FLEX for having no initializer ubsan: integer-overflow: depend on BROKEN to keep this out of CI wifi: iwlwifi: mld: Work around Clang loop unrolling bug
2025-06-01Merge tag 'linux-watchdog-6.16-rc1' of ↵Linus Torvalds22-66/+749
git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - Add watchdog timer for the NXP S32 platform - Add driver for Intel OC WDT - Add exynos990-wdt - Various other fixes and improvements * tag 'linux-watchdog-6.16-rc1' of git://www.linux-watchdog.org/linux-watchdog: (22 commits) watchdog: iTCO_wdt: Update the heartbeat value after clamping timeout watchdog: Add driver for Intel OC WDT watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFT watchdog: iTCO: Drop driver-internal locking watchdog: apple: set max_hw_heartbeat_ms instead of max_timeout watchdog: qcom: introduce the device data for IPQ5424 watchdog device dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) support watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() watchdog: s3c2410_wdt: Add exynos990-wdt compatible data dt-bindings: watchdog: samsung-wdt: Add exynos990-wdt compatible dt-bindings: watchdog: Add rk3562 compatible dt-bindings: watchdog: fsl,scu-wdt: Document imx8qm watchdog: Add the Watchdog Timer for the NXP S32 platform dt-bindings: watchdog: Add NXP Software Watchdog Timer watchdog: Correct kerneldoc warnings watchdog: stm32: Fix wakeup source leaks on device unbind watchdog: Do not enable by default during compile testing watchdog: cros-ec: Avoid -Wflex-array-member-not-at-end warning watchdog: da9052_wdt: respect TWDMIN watchdog: da9052_wdt: do not disable wdt during probe ...
2025-06-01Merge tag 'i3c/for-6.16' of ↵Linus Torvalds4-92/+98
git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "There is not much this this, mostly fixes around interrupt and IBI handling: - mipi-i3c-hci: interrupt handling fixes - svc: i.MX94 and i.MX95 support, IBI handling fixes" * tag 'i3c/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: controllers do not need to depend on I3C i3c: master: svc: switch to bulk clk API for flexible clock support dt-bindings: i3c: silvaco,i3c-master: add i.MX94 and i.MX95 I3C i3c: master: svc: skip address resend on repeat START i3c: master: svc: Emit STOP asap in the IBI transaction i3c: master: svc: Receive IBI requests in interrupt context i3c: mipi-i3c-hci: Move unexpected INTR_STATUS print before IO handler i3c: mipi-i3c-hci: Change name of INTR_STATUS bit 11 i3c: mipi-i3c-hci: Clear INTR_STATUS unconditionally i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler() i3c: mipi-i3c-hci: Allow only relevant INTR_STATUS bit updates
2025-06-01Merge tag 'edac_urgent_for_v6.16_rc1' of ↵Linus Torvalds1-3/+3
git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: "Limit a register write width in altera_edac to avoid hw errors" * tag 'edac_urgent_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Use correct write width with the INTTEST register
2025-06-01Merge tag 'for-linus' of https://github.com/openrisc/linuxLinus Torvalds5-45/+89
Pull OpenRISC updates from Stafford Horne: "Just a few documentation updates from the community: - Device tree documentation conversion from txt to yaml - Documentation addition to help users getting started with initramfs on OpenRISC * tag 'for-linus' of https://github.com/openrisc/linux: dt-bindings: interrupt-controller: Convert openrisc,ompic to DT schema dt-bindings: interrupt-controller: Convert opencores,or1k-pic to DT schema Documentation:openrisc: Add build instructions with initramfs
2025-06-01Merge tag 'parisc-for-6.16-rc1' of ↵Linus Torvalds30-60/+61
git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "Fix building with gcc-15, formatting fix on unaligned warnings and replace __ASSEMBLY__ with __ASSEMBLER__ in headers" * tag 'parisc-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc/unaligned: Fix hex output to show 8 hex chars parisc: fix building with gcc-15 parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers
2025-06-01randstruct: gcc-plugin: Fix attribute additionKees Cook2-11/+43
Based on changes in the 2021 public version of the randstruct out-of-tree GCC plugin[1], more carefully update the attributes on resulting decls, to avoid tripping checks in GCC 15's comptypes_check_enum_int() when it has been configured with "--enable-checking=misc": arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519 132 | const struct kexec_file_ops kexec_image_ops = { | ^~~~~~~~~~~~~~ internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517 fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803 comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519 ... Link: https://archive.org/download/grsecurity/grsecurity-3.1-5.10.41-202105280954.patch.gz [1] Reported-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org> Closes: https://github.com/KSPP/linux/issues/367 Closes: https://lore.kernel.org/lkml/20250530000646.104457-1-thiago.bauermann@linaro.org/ Reported-by: Ingo Saitz <ingo@hannover.ccc.de> Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104745 Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin") Tested-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org> Link: https://lore.kernel.org/r/20250530221824.work.623-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org>
2025-06-01overflow: Introduce __DEFINE_FLEX for having no initializerKees Cook1-6/+19
While not yet in the tree, there is a proposed patch[1] that was depending on the prior behavior of _DEFINE_FLEX, which did not have an explicit initializer. Provide this via __DEFINE_FLEX now, which can also have attributes applied (e.g. __uninitialized). Examples of the resulting initializer behaviors can be seen here: https://godbolt.org/z/P7Go8Tr33 Link: https://lore.kernel.org/netdev/20250520205920.2134829-9-anthony.l.nguyen@intel.com [1] Fixes: 47e36ed78406 ("overflow: Fix direct struct member initialization in _DEFINE_FLEX()") Signed-off-by: Kees Cook <kees@kernel.org>
2025-06-01watchdog: iTCO_wdt: Update the heartbeat value after clamping timeoutZiyan Fu1-0/+1
When executing "modprobe iTCO_wdt heartbeat=700", the user-specified 'heartbeat' parameter exceeds the valid range, the driver clamps the timeout to default 30s but fails to update the logged 'heartbeat' value, resulting in misleading log output: iTCO_wdt iTCO_wdt: timeout value out of range, using 30 iTCO_wdt iTCO_wdt: initialized. heartbeat=700 sec (nowayout=0) After validating the range, update the 'heartbeat' value with the clamped timeout value to ensure that log messages accurately reflect the actual runtime parameters. Signed-off-by: Ziyan Fu <fuzy5@lenovo.com> Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org> Link: https://lore.kernel.org/r/20250429102533.11886-1-13281011316@163.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: Add driver for Intel OC WDTDiogo Ivo3-0/+245
Add a driver for the Intel Over-Clocking Watchdog found in Intel Platform Controller (PCH) chipsets. This watchdog is controlled via a simple single-register interface and would otherwise be standard except for the presence of a LOCK bit that can only be set once per power cycle, needing extra handling around it. Signed-off-by: Diogo Ivo <diogo.ivo@siemens.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250317-ivo-intel_oc_wdt-v3-1-32c396f4eefd@siemens.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFTAntonio Borneo1-3/+14
The optional SMCWD_GET_TIMELEFT command can be used to detect if the watchdog has already been started. See the implementation in OP-TEE secure OS [1]. At probe time, check if the watchdog is already started and then set WDOG_HW_RUNNING in the watchdog status. This will cause the watchdog framework to ping the watchdog until a userspace watchdog daemon takes over the control. Link: https://github.com/OP-TEE/optee_os/commit/a7f2d4bd8632 [1] Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250520085952.210723-1-antonio.borneo@foss.st.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: iTCO: Drop driver-internal lockingGuenter Roeck1-24/+0
The locking code in the iTCO watchdog driver has been carried along from before the watchdog core existed. The watchdog core protects calls into drivers since commit f4e9c82f64b5 ("watchdog: Add Locking support"), making driver-internal locking unnecessary. Drop it. Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org> Link: https://lore.kernel.org/r/20250517160936.3231017-1-linux@roeck-us.net Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: apple: set max_hw_heartbeat_ms instead of max_timeoutFlorian Klink1-2/+5
The hardware only supports timeouts slightly below 3mins, but by using max_hw_heartbeat_ms we can let the kernel take care of supporting larger timeouts than that requested from userspace. Switching to max_hw_heartbeat_ms also means our set_timeout function now needs to configure the hardware to the minimum of either the requested timeout (in seconds) or the maximum supported by the user (in seconds). Signed-off-by: Florian Klink <flokli@flokli.de> Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org> Link: https://lore.kernel.org/r/20250506142621.11428-2-flokli@flokli.de Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: qcom: introduce the device data for IPQ5424 watchdog deviceKathiravan Thirumoorthy1-0/+7
To retrieve the restart reason from IMEM, certain device specific data like IMEM compatible to lookup, location of IMEM to read, etc should be defined. To achieve that, introduce the separate device data for IPQ5424 and add the required details subsequently. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250502-wdt_reset_reason-v3-3-b2dc7ace38ca@oss.qualcomm.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) supportLad Prabhakar1-1/+3
Document support for the watchdog IP found on the Renesas RZ/V2N (R9A09G056) SoC. The watchdog IP is identical to that on RZ/V2H(P), so `renesas,r9a09g057-wdt` will be used as a fallback compatible, enabling reuse of the existing driver without changes. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250502120054.47323-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer ↵Henry Martin1-0/+2
dereference in lenovo_se30_wdt_probe() devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. Fixes: c284153a2c55 ("watchdog: lenovo_se30_wdt: Watchdog driver for Lenovo SE30 platform") Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250424071648.89016-1-bsdhenrymartin@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
2025-06-01watchdog: s3c2410_wdt: Add exynos990-wdt compatible dataIgor Belwon1-1/+38
The Exynos990 has two watchdog clusters - cl0 and cl2. Add new driver data for these two clusters, making it possible to use the watchdog timer on this SoC. Signed-off-by: Igor Belwon <igor.belwon@mentallysanemainliners.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20250420-wdt-resends-april-v1-2-f58639673959@mentallysanemainliners.org Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
generated by cgit v1.2.3 (git 2.39.0) at 2025-10-03 02:35:01 +0300