aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-02-02Merge branch 'net-phy-dp83867-always-program-r-sgmii-enable-bits'Jakub Kicinski1-40/+23
Sean Anderson says: ==================== net: phy: dp83867: Always program R/SGMII enable bits The hardware designers at my company neglected to read the datasheet for this PHY and did not add appropriate resistors to configure it for SGMII. Add support for configuring the it based on phy-mode instead of relying on the resistors for a suitable default. ==================== Link: https://patch.msgid.link/20260129171205.3868605-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: phy: dp83867: Always program R/SGMII enable bitsSean Anderson1-24/+10
If the board designers have neglected to populate the appropriate resistors on the strapping pins then the phy may default to the wrong interface mode. Enable/disable the RGMII/SGMII enable bits as necessary to select the correct interface. The dp83867 strapping pins have four levels and typically configure two features at once. LED_0 controls both port mirroring and whether SGMII is enabled. If it is pulled to VDDIO, both port mirroring and SGMII will be enabled. For variants of the dp83867 that do not support SGMII, this will prevent data from being transferred. As we now explicitly set the SGMII and RGMII enable bits, we do not need to detect whether SGMII has been inadvertently enabled. Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260129171205.3868605-3-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: phy: dp83867: Program TX FIFO for all interfacesSean Anderson1-17/+14
All supported interfaces use the TX FIFO register at least some of the time, so there's no point in checking the interface. Retain the check for the RX FIFO level since it is only used by SGMII. Signed-off-by: Sean Anderson <sean.anderson@linux.dev> Link: https://patch.msgid.link/20260129171205.3868605-2-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: stmmac: fix stm32 (and potentially others) resume regressionRussell King (Oracle)1-1/+2
Marek reported that suspending stm32 causes the following errors when the interface is administratively down: $ echo devices > /sys/power/pm_test $ echo mem > /sys/power/state ... ck_ker_eth2stp already disabled ... ck_ker_eth2stp already unprepared ... On suspend, stm32 starts the eth2stp clock in its suspend method, and stops it in the resume method. This is because the blamed commit omits the call to the platform glue ->suspend() method, but does make the call to the platform glue ->resume() method. This problem affects all other converted drivers as well - e.g. looking at the PCIe drivers, pci_save_state() will not be called, but pci_restore_state() will be. Similar issues affect all other drivers. Fix this by always calling the ->suspend() method, even when the network interface is down. This fixes all the conversions to the platform glue ->suspend() and ->resume() methods. Link: https://lore.kernel.org/r/20260114081809.12758-1-marex@nabladev.com Fixes: 07bbbfe7addf ("net: stmmac: add suspend()/resume() platform ops") Reported-by: Marek Vasut <marex@nabladev.com> Tested-by: Marek Vasut <marex@nabladev.com> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1vlujh-00000007Hkw-2p6r@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02fs: consolidate fsverity_info lookup in buffer.cChristoph Hellwig1-16/+11
Look up the fsverity_info once in end_buffer_async_read_io, and then pass it along to the I/O completion workqueue in struct postprocess_bh_ctx. This amortizes the lookup better once it becomes less efficient. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20260202060754.270269-8-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02fsverity: push out fsverity_info lookupChristoph Hellwig7-35/+63
Pass a struct fsverity_info to the verification and readahead helpers, and push the lookup into the callers. Right now this is a very dumb almost mechanic move that open codes a lot of fsverity_info_addr() calls in the file systems. The subsequent patches will clean this up. This prepares for reducing the number of fsverity_info lookups, which will allow to amortize them better when using a more expensive lookup method. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Acked-by: David Sterba <dsterba@suse.com> # btrfs Link: https://lore.kernel.org/r/20260202060754.270269-7-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02fsverity: deconstify the inode pointer in struct fsverity_infoChristoph Hellwig3-5/+6
A lot of file system code expects a non-const inode pointer. Dropping the const qualifier here allows using the inode pointer in verify_data_block and prepares for further argument reductions. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://lore.kernel.org/r/20260202060754.270269-6-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02fsverity: kick off hash readahead at data I/O submission timeChristoph Hellwig9-74/+161
Currently all reads of the fsverity hashes are kicked off from the data I/O completion handler, leading to needlessly dependent I/O. This is worked around a bit by performing readahead on the level 0 nodes, but still fairly ineffective. Switch to a model where the ->read_folio and ->readahead methods instead kick off explicit readahead of the fsverity hashed so they are usually available at I/O completion time. For 64k sequential reads on my test VM this improves read performance from 2.4GB/s - 2.6GB/s to 3.5GB/s - 3.9GB/s. The improvements for random reads are likely to be even bigger. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: David Sterba <dsterba@suse.com> # btrfs Link: https://lore.kernel.org/r/20260202060754.270269-5-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02ext4: move ->read_folio and ->readahead to readpage.cChristoph Hellwig3-30/+31
Keep all the read into pagecache code in a single file. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Acked-by: Theodore Ts'o <tytso@mit.edu> Link: https://lore.kernel.org/r/20260202060754.270269-4-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contextsJakub Kicinski2-10/+2
Initializing input_xfrm to RXH_XFRM_NO_CHANGE in RSS contexts is problematic. I think I did this to make it clear that the context does not have its own settings applied. But unlike ETH_RSS_HASH_NO_CHANGE which is zero, RXH_XFRM_NO_CHANGE is 0xff. We need to be careful when reading the value back, and remember to treat 0xff as 0. Remove the initialization and switch to storing 0. This lets us also remove the workaround in ethnl_rss_set(). Get side does not need any adjustments and context get no longer reports: RSS input transformation: symmetric-xor: on symmetric-or-xor: on Unknown bits in RSS input transformation: 0xfc for NICs which don't support input_xfrm. Remove the init of hfunc to ETH_RSS_HASH_NO_CHANGE while at it. As already mentioned this is a noop since ETH_RSS_HASH_NO_CHANGE is 0 and struct is zalloc'd. But as this fix exemplifies storing NO_CHANGE as state is fragile. This issue is implicitly caught by running our selftests because YNL in selftests errors out on unknown bits. Fixes: d3e2c7bab124 ("ethtool: rss: support setting input-xfrm via Netlink") Link: https://patch.msgid.link/20260130190311.811129-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()Eric Dumazet1-3/+4
Extend the RCU section a bit so that we can use the safer skb_dst_dev_rcu() helper. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260130191906.3781856-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02bnxt_en: Allow ntuple filters for dropsJoe Damato1-6/+7
It appears that in commit 7efd79c0e689 ("bnxt_en: Add drop action support for ntuple"), bnxt gained support for ntuple filters for packet drops. However, support for this does not seem to work in recent kernels or against net-next: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 rmgr: Cannot insert RX class rule: Operation not supported Cannot insert classification rule The issue is that the existing code uses ethtool_get_flow_spec_ring_vf, which will return a non-zero value if the ring_cookie is set to RX_CLS_FLOW_DISC, which then causes bnxt_add_ntuple_cls_rule to return -EOPNOTSUPP because it thinks the user is trying to set an ntuple filter for a vf. Fix this by first checking that the ring_cookie is not RX_CLS_FLOW_DISC. After this patch, ntuple filters for drops can be added: % sudo ethtool -U eth0 flow-type udp4 src-ip 1.1.1.1 action -1 Added rule with ID 0 % ethtool -n eth0 44 RX rings available Total 1 rules Filter: 0 Rule Type: UDP over IPv4 Src IP addr: 1.1.1.1 mask: 0.0.0.0 Dest IP addr: 0.0.0.0 mask: 255.255.255.255 TOS: 0x0 mask: 0xff Src port: 0 mask: 0xffff Dest port: 0 mask: 0xffff Action: Drop Reviewed-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260131003042.2570434-1-joe@dama.to Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02tools: ynl: cli: make the output compactJakub Kicinski1-3/+6
Make the default (non-JSON) output more compact. Looking at RSS context dumps is pretty much impossible without this, because default print shows the indirection table with line per entry: 'indir': [0, 1, 2, ... And indirection tables have 100-200 entries each. The compact output is far more readable: 'indir': [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, Reviewed-by: Donald Hunter <donald.hunter@gmail.com> Link: https://patch.msgid.link/20260131203029.1173492-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02docs: networking: mention that RSS table should be 4x the queue countJakub Kicinski1-4/+8
Spell out the recommendation that the RSS table should be 4x the queue count to avoid traffic imbalance. Include minor rephrasing and removal of the explicit 128 entry example since a 128 entry table is inadequate on modern machines. Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260131225454.1225151-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02selftests: drv-net: rss: validate min RSS table sizeJakub Kicinski2-0/+89
Add a test which checks that the RSS table is at least 4x the max queue count supported by the device. The original RSS spec from Microsoft stated that the RSS indirection table should be 2 to 8 times the CPU count, presumably assuming queue per CPU. If the CPU count is not a power of two, however, a power-of-2 table 2x larger than queue count results in a 33% traffic imbalance. Validate that the indirection table is at least 4x the queue count. This lowers the imbalance to 16% which empirically appears to be more acceptable to memcache-like workloads. Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260131225454.1225151-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02net: spacemit: display phy driver informationChukun Pan1-0/+2
Print the PHY driver used and interrupt status after connection. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260201100001.33102-1-amadeus@jmu.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02linkwatch: use __dev_put() in callers to prevent UAFJiayuan Chen1-5/+15
After linkwatch_do_dev() calls __dev_put() to release the linkwatch reference, the device refcount may drop to 1. At this point, netdev_run_todo() can proceed (since linkwatch_sync_dev() sees an empty list and returns without blocking), wait for the refcount to become 1 via netdev_wait_allrefs_any(), and then free the device via kobject_put(). This creates a use-after-free when __linkwatch_run_queue() tries to call netdev_unlock_ops() on the already-freed device. Note that adding netdev_lock_ops()/netdev_unlock_ops() pair in netdev_run_todo() before kobject_put() would not work, because netdev_lock_ops() is conditional - it only locks when netdev_need_ops_lock() returns true. If the device doesn't require ops_lock, linkwatch won't hold any lock, and netdev_run_todo() acquiring the lock won't provide synchronization. Fix this by moving __dev_put() from linkwatch_do_dev() to its callers. The device reference logically pairs with de-listing the device, so it's reasonable for the caller that did the de-listing to release it. This allows placing __dev_put() after all device accesses are complete, preventing UAF. The bug can be reproduced by adding mdelay(2000) after linkwatch_do_dev() in __linkwatch_run_queue(), then running: ip tuntap add mode tun name tun_test ip link set tun_test up ip link set tun_test carrier off ip link set tun_test carrier on sleep 0.5 ip tuntap del mode tun name tun_test KASAN report: ================================================================== BUG: KASAN: use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] BUG: KASAN: use-after-free in netdev_unlock_ops include/net/netdev_lock.h:47 [inline] BUG: KASAN: use-after-free in __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 Read of size 8 at addr ffff88804de5c008 by task kworker/u32:10/8123 CPU: 0 UID: 0 PID: 8123 Comm: kworker/u32:10 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events_unbound linkwatch_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x156/0x4c9 mm/kasan/report.c:482 kasan_report+0xdf/0x1a0 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] netdev_unlock_ops include/net/netdev_lock.h:47 [inline] __linkwatch_run_queue+0x865/0x8a0 net/core/link_watch.c:245 linkwatch_event+0x8f/0xc0 net/core/link_watch.c:304 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> ================================================================== Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE") Reported-by: syzbot+1ec2f6a450f0b54af8c8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6824d064.a70a0220.3e9d8.001a.GAE@google.com/T/ Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260201135915.393451-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-02-02clk: Disable KUNIT_UML_PCIPeng Fan1-1/+1
commit 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()") enables KUNIT_UML_PCI, but clk driver could not work with it. Deselect KUNIT_UML_PCI to avoid the failure. Dump as below: WARNING: CPU: 0 PID: 227 at lib/logic_iomem.c:141 __raw_readl+0xac/0xe0 CPU: 0 UID: 0 PID: 227 Comm: kunit_try_catch Tainted: G Tainted: [N]=TEST Stack: a0883d00 00000001 00000000 ffffff00 603ef142 60044832 6002598b 00000000 00000000 600211b3 00000001 00000000 Call Trace: [<6032534c>] ? __raw_readl+0xac/0xe0 [<60044832>] ? dump_stack_lvl+0x57/0x73 [<6002598b>] ? _printk+0x0/0x61 [<600211b3>] ? __warn.cold+0x61/0xeb [<600212cc>] ? warn_slowpath_fmt+0x8f/0x9c [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6032534c>] ? __raw_readl+0xac/0xe0 [<6002123d>] ? warn_slowpath_fmt+0x0/0x9c [<6029e2ad>] ? clk_gate_endisable+0xcd/0x110 [<6029e315>] ? clk_gate_enable+0x15/0x20 [<6028795e>] ? clk_core_enable+0x6e/0xf0 [<60289f1f>] ? clk_enable+0x4f/0xa0 [<602a06af>] ? clk_gate_test_enable+0xbf/0x360 [<60053df9>] ? os_nsecs+0x29/0x40 [<600cd300>] ? ktime_get_ts64+0x0/0x130 [<600816c0>] ? to_kthread+0x0/0x50 [<602507bb>] ? kunit_try_run_case+0x7b/0x100 [<600816c0>] ? to_kthread+0x0/0x50 [<60252aa0>] ? kunit_generic_run_threadfn_adapter+0x0/0x30 [<60252ab2>] ? kunit_generic_run_threadfn_adapter+0x12/0x30 [<60082091>] ? kthread+0xf1/0x270 [<60047591>] ? new_thread_handler+0x41/0x60 ---[ end trace 0000000000000000 ]--- Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03tpm: st33zp24: Fix missing cleanup on get_burstcount() errorAlper Ak1-2/+4
get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier. Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: bf38b8710892 ("tpm/tpm_i2c_stm_st33: Split tpm_i2c_tpm_st33 in 2 layers (core + phy)") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-02-03tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failureAlper Ak1-2/+4
get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send(). Use goto out_err to ensure proper cleanup when get_burstcount() fails. Fixes: aad628c1d91a ("char/tpm: Add new driver for Infineon I2C TIS TPM") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2026-02-02dt-bindings: clk: rs9: Fix DIF pattern matchMarek Vasut1-1/+10
The pattern match [0-19] is incorrect and does not cover range of 0..19, use pattern 1?[0-9] to cover range 0..19 instead. Update the example to validate all parts of the pattern match and prevent such failures in the future. Fixes: 26c1bc67aa2f ("dt-bindings: clk: rs9: Add Renesas 9-series I2C PCIe clock generator") Signed-off-by: Marek Vasut <marek.vasut@mailbox.org> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-02clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS()Geert Uytterhoeven1-4/+4
Convert the Renesas 9-series PCIe clock generator driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-02clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841Marek Vasut1-1/+1
The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else there is going to be out of bounds write when pointers 4..7 are set into struct rs9_driver_data .clk_dif[4..7] field. Since there are other structure members past this struct clk_hw pointer array, writing to .clk_dif[4..7] fields corrupts both the struct rs9_driver_data content and data around it, sometimes without crashing the kernel. However, the kernel does surely crash when the driver is unbound or during suspend. Fix this, increase the struct clk_hw pointer array size to the maximum output count of 9FGV0841, which is the biggest chip that is supported by this driver. Cc: stable@vger.kernel.org Fixes: f0e5e1800204 ("clk: rs9: Add support for 9FGV0841") Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Reported-by: Geert Uytterhoeven <geert+renesas@glider.be> Closes: https://lore.kernel.org/CAMuHMdVyQpOBT+Ho+mXY07fndFN9bKJdaaWGn91WOFnnYErLyg@mail.gmail.com Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-02-03pinctrl: mediatek: remove unused drv_offset fieldAkari Tsuyukusa2-2/+0
The 'drv_offset' member in 'struct mtk_pinctrl_devdata' has been unused since the driver's inception. Drive strength control for MediaTek pinctrl drivers is actually configured via 'pin_drv_grp', making this specific offset field redundant. Remove the unused field from the common 'mtk_pinctrl_devdata' structure and its corresponding initialization in the mt8365 driver to clean up the code and avoid confusion. Signed-off-by: Akari Tsuyukusa <akkun11.open@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetreeJiayu Du1-2/+5
When probing the k230 pinctrl driver, the kernel triggers a NULL pointer dereference. The crash trace showed: [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068 [ 0.740737] ... [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc In k230_pinctrl_parse_functions(), we attempt to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized after k230_pinctrl_parse_dt() completes. At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid dereference of info->pctl_dev->dev. Use the already available device pointer from platform_device instead of accessing through uninitialized pctl_dev. Fixes: d94a32ac688f ("pinctrl: canaan: k230: Fix order of DT parse and pinctrl register") Signed-off-by: Jiayu Du <jiayu.riscv@isrc.iscas.ac.cn> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: single: fix refcount leak in pcs_add_gpio_func()Wei Li1-0/+2
of_parse_phandle_with_args() returns a device_node pointer with refcount incremented in gpiospec.np. The loop iterates through all phandles but never releases the reference, causing a refcount leak on each iteration. Add of_node_put() calls to release the reference after extracting the needed arguments and on the error path when devm_kzalloc() fails. This bug was detected by our static analysis tool and verified by my code review. Fixes: a1a277eb76b3 ("pinctrl: single: create new gpio function range") Signed-off-by: Wei Li <unsw.weili@gmail.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpersFelix Gu1-4/+6
of_parse_phandle_with_fixed_args() increments the reference count of the returned device node, so it must be explicitly released using of_node_put() after use. Fix the reference leak in aml_bank_pins() and aml_bank_number() by adding the missing of_node_put() calls. Fixes: 6e9be3abb78c ("pinctrl: Add driver support for Amlogic SoCs") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Xianwei Zhao <xianwei.zhao@amlogic.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definitionLuca Weiss1-1/+1
The i2s2_data function is available on both gpio12 and gpio13. Fix the groups definition. Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: core: Remove duplicate error messagesAndy Shevchenko1-3/+1
pinctrl_claim_hogs() is covered to report any error via message. Since that it's not needed in the callers. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: core: Simplify devm_pinctrl_*()Andy Shevchenko1-47/+20
Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: core: Remove unused devm_pinctrl_unregister()Andy Shevchenko3-26/+0
There are no users, drop it for good. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03dt-bindings: pinctrl: spacemit: fix drive-strength check warningYixun Lan1-1/+1
The problem is that one value from drive-strength may match to more than two different enum groups which lead to DT complaint, switch to use 'anyOf' to fix this kind warning. Fixes: c3efac0592f8 ("dt-bindings: pinctrl: spacemit: convert drive strength to schema format") Signed-off-by: Yixun Lan <dlan@kernel.org> Acked-by: Conor Dooley <conor.dooley@microchip.com> Reported-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-03pinctrl: fix kismet issues with GENERIC_PINCTRLConor Dooley1-3/+3
lkp reported that GENERIC_PINCTRL can be select when its dependencies are not. Swap the "depends on" out for "select", as is used in other parts of the pinctrl core that are expected to be selected by drivers. Fixes: 43722575e5cd ("pinctrl: add generic functions + pins mapper") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202601271725.gqlQ8Jl7-lkp@intel.com/ Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-02-02ASoC: es8328: error handling and resume fixesMark Brown1-43/+73
Merge series from Hsieh Hung-En <hungen3108@gmail.com>: This series fixes some issues and improves robustness in the es8328 driver.
2026-02-02ASoC: amd: acp: Add ACP7.0 match entries for CirrusMark Brown1-36/+292
Merge series from Simon Trimmer <simont@opensource.cirrus.com>: This patch series adds a number of ACP7.0 match table entries that are being used in customer products. Some of the configurations are very similar so the series begins with renaming and sorting the existing structures so that the end result is easier to manage.
2026-02-02Anbernic RG-DS AW87391 Speaker AmpsMark Brown199-828/+1554
Merge series from Chris Morgan <macroalpha82@gmail.com>: Add support for the Anbernic RG-DS Speaker Amplifiers. The Anbernic RG-DS uses two AW87391 ICs at 0x58 and 0x5B on i2c2. However, the manufacturer did not provide a firmware file, only a sequence of register writes to each device to enable and disable them. Add support for this *specific* configuration in the AW87390 driver. Since we are relying on a device specific sequence I am using a device specific compatible string. This driver does not currently support the aw87391 for any other device as I have none to test with valid firmware. Attempts to create firmware with the AwinicSCPv4 have not been successful.
2026-02-02Merge tag 'cgroup-for-6.19-rc8-fixes' of ↵Linus Torvalds1-7/+63
git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Three dmem fixes from Chen Ridong addressing use-after-free, RCU warning, and NULL pointer dereference issues introduced with the dmem controller. All changes are confined to kernel/cgroup/dmem.c and can only affect dmem controller users" * tag 'cgroup-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/dmem: avoid pool UAF cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: fix NULL pointer dereference when setting max
2026-02-02spi: add multi-lane supportMark Brown14-27/+641
Merge series from David Lechner <dlechner@baylibre.com>: This series is adding support for SPI controllers and peripherals that have multiple SPI data lanes (data lanes being independent sets of SDI/SDO lines, each with their own serializer/deserializer). This series covers this specific use case: +--------------+ +---------+ | SPI | | SPI | | Controller | | ADC | | | | | | CS0 |--->| CS | | SCLK |--->| SCLK | | SDO |--->| SDI | | SDI0 |<---| SDOA | | SDI1 |<---| SDOB | | SDI2 |<---| SDOC | | SDI3 |<---| SDOD | +--------------+ +--------+ The ADC is a simultaneous sampling ADC that can convert 4 samples at the same time. It has 4 data output lines (SDOA-D) that each contain the data of one of the 4 channels. So it requires a SPI controller with 4 separate deserializers in order to receive all of the information at the same time. This should also work for the use case in [1] as well. (Some of the patches in this series were already submitted there). In that case the SPI controller is used kind of like it is two separate SPI controllers, each with its own chip select, clock, and data lines. [1]: https://lore.kernel.org/linux-spi/20250616220054.3968946-1-sean.anderson@linux.dev/ The DT bindings are a fairly straight-forward mapping of which pins on the peripheral are connected to which pins on the controller. The SPI core code parses this and makes the information available to drivers. When a peripheral driver sees that multiple data lanes are wired up, it can chose to use them when sending messages. The SPI message API is a bit higher-level than just specifying the number of data lines for a SPI transfer though. I did some research on other SPI controllers that have this feature. They tend to be the kind meant for connecting to two flash memory chips at the same time but can be used more generically as well. They generally have the option to either use one lane at a time (Sean's use case), or can mirror the same data on multiple lanes (no users of this yet) or can perform striping of a single data FIFO/DMA stream to/from the two lanes (our use case). For now, the API assumes that if you want to do mirror/striping, then you want to use all available data lanes. Otherwise, it just uses the first data lane for "normal" SPI transfers.
2026-02-02ASoC: qcom: q6asm: drop DSP responses for closed data streamsCédric Bellegarde1-2/+2
'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after a stream had been closed. However, those responses were still handled, causing lockups. Fix this by unconditionally dropping all DSP responses associated with closed data streams. Signed-off-by: Cédric Bellegarde <cedric.bellegarde@adishatz.org> Link: https://patch.msgid.link/20260102215225.609166-1-cedric.bellegarde@adishatz.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-02-02ASoC: wcd-mbhc-v2: remove unnecessary module_init/exit functionsEthan Nelson-Moore1-12/+0
The wcd-mbhc-v2 driver has unnecessary empty module_init and module_exit functions. Remove them. Note that if a module_init function exists, a module_exit function must also exist; otherwise, the module cannot be unloaded. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20260131020111.46108-1-enelsonmoore@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-02-02rcu: Mark lockdep_assert_rcu_helper() __always_inlineArnd Bergmann1-1/+1
There are some configurations in which lockdep_assert_rcu_helper() ends up not being inlined, for some reason. This leads to a link failure because now the caller tries to pass a nonexistant __ctx_lock_RCU structure: ld: lib/test_context-analysis.o: in function `test_rcu_assert_variants': test_context-analysis.c:(.text+0x275c): undefined reference to `RCU' ld: test_context-analysis.c:(.text+0x276c): undefined reference to `RCU_BH' ld: test_context-analysis.c:(.text+0x2774): undefined reference to `RCU_SCHED' I saw this in one out of many 32-bit arm builds using gcc-15.2, but it probably happens in others as well. Mark this function as __always_inline to fix the build. Fixes: fe00f6e84621 ("rcu: Support Clang's context analysis") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Link: https://patch.msgid.link/20260202095507.1237440-1-arnd@kernel.org
2026-02-02uprobes: Fix incorrect lockdep condition in filter_chain()Breno Leitao1-1/+1
The list_for_each_entry_rcu() in filter_chain() uses rcu_read_lock_trace_held() as the lockdep condition, but the function holds consumer_rwsem, not the RCU trace lock. This gives me the following output when running with some locking debug option enabled: kernel/events/uprobes.c:1141 RCU-list traversed in non-reader section!! filter_chain register_for_each_vma uprobe_unregister_nosync __probe_event_disable Remove the incorrect lockdep condition since the rwsem provides sufficient protection for the list traversal. Fixes: cc01bd044e6a ("uprobes: travers uprobe's consumer list locklessly under SRCU protection") Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260128-uprobe_rcu-v2-1-994ea6d32730@debian.org
2026-02-02x86/ibs: Fix typo in dc_l2tlb_miss commentXiang-Bin Shi1-1/+1
The comment for dc_l2tlb_miss incorrectly describes it as a "hit". This contradicts the field name and the actual bit definition. Fix the comment to correctly describe it as a "miss". Signed-off-by: Xiang-Bin Shi <eric91102091@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260123075719.160734-1-eric91102091@gmail.com
2026-02-02jfs: avoid -Wtautological-constant-out-of-range-compare warningArnd Bergmann1-2/+2
A recent change for the range check started triggering a clang warning: fs/jfs/jfs_dtree.c:2906:31: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 2906 | if (stbl[i] < 0 || stbl[i] >= DTPAGEMAXSLOT) { | ~~~~~~~ ^ ~~~~~~~~~~~~~ fs/jfs/jfs_dtree.c:3111:30: error: result of comparison of constant 128 with expression of type 's8' (aka 'signed char') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 3111 | if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) { | ~~~~~~~ ^ ~~~~~~~~~~~~~ Both the old and the new check were useless, but the previous version apparently did not lead to the warning. Remove the extraneous range check for simplicity. Fixes: cafc6679824a ("jfs: replace hardcoded magic number with DTPAGEMAXSLOT constant") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
2026-02-02PM: wakeup: Handle empty list in wakeup_sources_walk_start()Samuel Wu1-3/+1
In the case of an empty wakeup_sources list, wakeup_sources_walk_start() will return an invalid but non-NULL address. This also affects wrappers of the aforementioned function, like for_each_wakeup_source(). Update wakeup_sources_walk_start() to return NULL in case of an empty list. Fixes: b4941adb24c0 ("PM: wakeup: Add routine to help fetch wakeup source object.") Signed-off-by: Samuel Wu <wusamuel@google.com> [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260124012133.2451708-2-wusamuel@google.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-02readahead: push invalidate_lock out of page_cache_ra_unboundedChristoph Hellwig3-8/+16
Require the invalidate_lock to be held over calls to page_cache_ra_unbounded instead of acquiring it in this function. This prepares for calling page_cache_ra_unbounded from ->readahead for fsverity read-ahead. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20260202060754.270269-3-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02selftests/sched_ext: Fix init_enable_count flakinessTejun Heo1-11/+23
The init_enable_count test is flaky. The test forks 1024 children before attaching the scheduler to verify that existing tasks get ops.init_task() called. The children were using sleep(1) before exiting. 7900aa699c34 ("sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()") changed when tasks are removed from scx_tasks - previously when the task_struct was freed, now immediately in finish_task_switch() when the task dies. Before the commit, pre-forked children would linger on scx_tasks until freed regardless of when they exited, so the scheduler would always see them during iteration. The sleep(1) was unnecessary. After the commit, children are removed as soon as they die. The sleep(1) masks the problem in most cases but the test becomes flaky depending on timing. Fix by synchronizing properly using a pipe. All children block on read() and the parent signals them to exit by closing the write end after attaching the scheduler. The children are auto-reaped so there's no need to wait on them. Reported-by: Ihor Solodrai <ihor.solodrai@linux.dev> Cc: David Vernet <void@manifault.com> Cc: Andrea Righi <arighi@nvidia.com> Cc: Changwoo Min <changwoo@igalia.com> Cc: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02fsverity: don't issue readahead for non-ENOENT errors from __filemap_get_folioChristoph Hellwig1-3/+4
Issuing more reads on errors is not a good idea, especially when the most common error here is -ENOMEM. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20260202060754.270269-2-hch@lst.de Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-02-02Merge tag 'clk-microchip-6.20' of ↵Stephen Boyd4-28/+34
https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Claudiu Beznea: - clean up microchip/clk-core.c to: -- fix a sparse warning related to multiple initializations of pic32_sclk_ops.determine_rate() -- correct the return values of roclk_get_parent() and sclk_get_parent() -- drop an unused include header - adjust the PolarFire driver Kconfig section as the driver is now used by non-PolarFire devices - update the documentation for the Microchip PIC64GX SoC clock controller * tag 'clk-microchip-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: dt-bindings: clock: mpfs-clkcfg: Add pic64gx compatibility dt-bindings: clock: mpfs-ccc: Add pic64gx compatibility clk: microchip: drop POLARFIRE from ARCH_MICROCHIP_POLARFIRE clk: microchip: core: remove unused include asm/traps.h clk: microchip: core: correct return value on *_get_parent() clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops
2026-02-02Merge tag 'v6.20-rockchip-clk-1' of ↵Stephen Boyd1-1/+1
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull a Rockchip clk driver update from Heiko Stuebner: Additional check for an error pointer and not only for NULL when a gatelink is added. * tag 'v6.20-rockchip-clk-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link()
generated by cgit