Commit Graph

1383019 Commits

Author SHA1 Message Date
Takashi Iwai
acff093287 Merge tag 'asoc-fix-v6.17-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v6.17

A pile of fixes that accumilated over the past few -rcs, this is all
driver specifics including a small pile of quirks for new systems.
2025-09-18 09:11:12 +02:00
Richard Fitzgerald
7dd670db9a ALSA: hda: intel-dsp-config: Prevent SEGFAULT if ACPI_HANDLE() is NULL
Check in snd_intel_dsp_check_soundwire() that the pointer returned by
ACPI_HANDLE() is not NULL, before passing it on to other functions.

The original code assumed a non-NULL return, but if it was unexpectedly
NULL it would end up passed to acpi_walk_namespace() as the start
point, and would result in

[    3.219028] BUG: kernel NULL pointer dereference, address:
0000000000000018
[    3.219029] #PF: supervisor read access in kernel mode
[    3.219030] #PF: error_code(0x0000) - not-present page
[    3.219031] PGD 0 P4D 0
[    3.219032] Oops: Oops: 0000 [#1] SMP NOPTI
[    3.219035] CPU: 2 UID: 0 PID: 476 Comm: (udev-worker) Tainted: G S
AW   E       6.17.0-rc5-test #1 PREEMPT(voluntary)
[    3.219038] Tainted: [S]=CPU_OUT_OF_SPEC, [A]=OVERRIDDEN_ACPI_TABLE,
[W]=WARN, [E]=UNSIGNED_MODULE
[    3.219040] RIP: 0010:acpi_ns_walk_namespace+0xb5/0x480

This problem was triggered by a bugged DSDT that the kernel couldn't parse.
But it shouldn't be possible to SEGFAULT the kernel just because of some
bugs in ACPI.

Fixes: 0650857570 ("ALSA: hda: add autodetection for SoundWire")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-17 18:19:04 +02:00
Takashi Iwai
44499ecb4f ALSA: usb: qcom: Fix false-positive address space check
The sanity check previously added to uaudio_transfer_buffer_setup()
assumed the allocated buffer being linear-mapped.  But the buffer
allocated via usb_alloc_coherent() isn't always so, rather to be used
with (SG-)DMA API.  This leaded to a false-positive warning and the
driver failed to work.

Actually uaudio_transfer_buffer_setup() deals only with the DMA-API
addresses for MEM_XFER_BUF type, while other callers of
uaudio_iommu_map() are with pages with physical addresses for
MEM_EVENT_RING and MEM_XFER_RING types.  So this patch splits the
mapping helper function to two different ones, uaudio_iommu_map() for
the DMA pages and uaudio_iommu_map_pa() for the latter, in order to
handle mapping differently for each type.  Along with it, the
unnecessary address check that caused probe error is dropped, too.

Fixes: 3335a1bbd6 ("ALSA: qc_audio_offload: try to reduce address space confusion")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Reported-and-tested-by: Luca Weiss <luca.weiss@fairphone.com>
Closes: https://lore.kernel.org/DBR2363A95M1.L9XBNC003490@fairphone.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-17 15:10:58 +02:00
Jack Yu
1dd28fd86c ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
Adjust register settings for SAR adc button detection mode
to fix noise issue in headset.

Signed-off-by: Jack Yu <jack.yu@realtek.com>
Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-17 12:38:59 +01:00
Mark Brown
f7a5195c2d Fix lpaif_type and DAI configuration for I2S
Merge series from Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>:

Fix the lpaif_type configuration for the I2S interface.
The proper lpaif interface type required to allow DSP to vote
appropriate clock setting for I2S interface and also Add support
for configuring the DAI format on MI2S interfaces to allow setting
the appropriate bit clock and frame clock polarity, ensuring correct
audio data transmissionover MI2S.
2025-09-16 13:09:08 +01:00
Balamurugan C
cc648f4dde ASoC: Intel: PTL: Add entry for HDMI-In capture support to non-I2S codec boards.
Adding HDMI-In capture support for the PTL products which doesn't have
onboard I2S codec. But need to support HDMI-In capture via I2S and
audio playback through HDMI/DP monitor.

Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250915025655.1154279-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-15 12:49:12 +01:00
Venkata Prasad Potturu
d7871f400c ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
Use dev_get_drvdata(dev->parent) instead of dev_get_platdata(dev)
to correctly obtain acp_chip_info members in the acp I2S driver.
Previously, some members were not updated properly due to incorrect
data access, which could potentially lead to null pointer
dereferences.

This issue was missed in the earlier commit
("ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot"),
which only addressed set_tdm_slot(). This change ensures that all
relevant functions correctly retrieve acp_chip_info, preventing
further null pointer dereference issues.

Fixes: e3933683b2 ("ASoC: amd: acp: Remove redundant acp_dev_data structure")

Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20250910171419.3682468-1-venkataprasad.potturu@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-15 12:49:11 +01:00
Mac Chiang
73caf2bcf3 ASoC: Intel: sof_sdw: use PRODUCT_FAMILY for Fatcat series
PRODUCT_NAME is machine-specific. Use PRODUCT_FAMILY to ensure
the machine quirk is applied with consistent audio configurations
across Fatcat series products.

Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250915025456.1154200-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-15 12:49:10 +01:00
Mohammad Rafi Shaik
c7a321e4e9 ASoC: qcom: sc8280xp: Fix sound card driver name match data for QCS8275
The QCS8275 board is based on Qualcomm's QCS8300 SoC family, and all
supported firmware files are located in the qcs8300 directory. The
sound topology and ALSA UCM configuration files have also been migrated
from the qcs8275 directory to the actual SoC qcs8300 directory in
linux-firmware. With the current setup, the sound topology fails
to load, resulting in sound card registration failure.

This patch updates the driver match data to use the correct driver name
qcs8300 for the qcs8275-sndcard, ensuring that the sound card driver
correctly loads the sound topology and ALSA UCM configuration files
from the qcs8300 directory.

Fixes: 34d340d48e ("ASoC: qcom: sc8280xp: Add support for QCS8275")
Cc: stable@vger.kernel.org
Signed-off-by: Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20250914131549.1198740-1-mohammad.rafi.shaik@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-15 12:49:09 +01:00
Bou-Saan Che
d99c203034 ALSA: hda/realtek: Fix volume control on Lenovo Thinkbook 13x Gen 4
The issue was caused by incorrect configuration in the driver,
which prevented proper volume control on certain systems.

Signed-off-by: Bou-Saan Che <yungmeat@inboxia.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-15 09:25:01 +02:00
Bou-Saan Che
c1d31894d8 ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 5
The laptop does not contain valid _DSD for these amps, so requires
entries into the CS35L41 configuration table to function correctly.

Signed-off-by: Bou-Saan Che <yungmeat@inboxia.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-15 09:24:49 +02:00
Bou-Saan Che
f205ed23f0 ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 5
This laptop does not contain _DSD so needs to be supported using the
configuration table.

Signed-off-by: Bou-Saan Che <yungmeat@inboxia.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-15 09:24:32 +02:00
Donald Menig
ec8f26092e ALSA: hda/realtek: Add ALC295 Dell TAS2781 I2C fixup
This patch adds a new fixup for the ALC295 codec on some Dell
laptops that use the TAS2781 I2C amplifier.

The fixup correctly initializes the amplifier and pins, allowing
sound to work on all speakers of these devices.

The fixup chain is added to the relevant quirk entries for
Dell Polaris models.

[ adjusted for 6.17 kernel code by tiwai ]

Fixes: 1e9c708dc3 ("ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects")
Link: https://bugzilla.suse.com/show_bug.cgi?id=1249575
Signed-off-by: Donald Menig <djmenig@outlook.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-14 09:44:29 +02:00
Shenghao Ding
b0035df56d ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits
A a potential race condition reported by one of my customers that leads to
a NULL pointer dereference, where the call to efi.get_variable should be
guarded with efi_rt_services_supported() to ensure that function exists.

Fixes: 4fe2385134 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-11 18:11:17 +02:00
Mohammad Rafi Shaik
596e8ba2fa ASoC: qcom: sc8280xp: Enable DAI format configuration for MI2S interfaces
Add support for configuring the DAI format on MI2S interfaces,
this enhancement allows setting the appropriate bit clock and
frame clock polarity, ensuring correct audio data transmission
over MI2S.

Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>
Rule: add
Link: https://lore.kernel.org/stable/20250908053631.70978-4-mohammad.rafi.shaik%40oss.qualcomm.com
Message-ID: <20250908053631.70978-4-mohammad.rafi.shaik@oss.qualcomm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-09 14:27:22 +01:00
Mohammad Rafi Shaik
33b55b94bc ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
The q6i2s_set_fmt() function was defined but never linked into the
I2S DAI operations, resulting DAI format settings is being ignored
during stream setup. This change fixes the issue by properly linking
the .set_fmt handler within the DAI ops.

Fixes: 30ad723b93 ("ASoC: qdsp6: audioreach: add q6apm lpass dai support")
Cc: stable@vger.kernel.org
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>
Message-ID: <20250908053631.70978-3-mohammad.rafi.shaik@oss.qualcomm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-09 14:27:21 +01:00
Mohammad Rafi Shaik
5f1af203ef ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
Fix missing lpaif_type configuration for the I2S interface.
The proper lpaif interface type required to allow DSP to vote
appropriate clock setting for I2S interface.

Fixes: 25ab80db6b ("ASoC: qdsp6: audioreach: add module configuration command helpers")
Cc: stable@vger.kernel.org
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Signed-off-by: Mohammad Rafi Shaik <mohammad.rafi.shaik@oss.qualcomm.com>
Message-ID: <20250908053631.70978-2-mohammad.rafi.shaik@oss.qualcomm.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-09 14:27:20 +01:00
Amadeusz Sławiński
690aa09b18 ASoC: Intel: catpt: Expose correct bit depth to userspace
Currently wrong bit depth is exposed in hw params, causing clipped
volume during playback. Expose correct parameters.

Fixes: a126750fc8 ("ASoC: Intel: catpt: PCM operations")
Reported-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Tested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-09-09 12:41:59 +01:00
Shenghao Ding
71d2893a23 ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data
A bug reported by one of my customers that the order of TAS2781
calibrated-data is incorrect, the correct way is to move R0_Low
and insert it between R0 and InvR0.

Fixes: 4fe2385134 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib")
Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
Link: https://patch.msgid.link/20250907222728.988-1-shenghao-ding@ti.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-08 09:36:39 +02:00
Linus Torvalds
76eeb9b8de Linux 6.17-rc5 v6.17-rc5 2025-09-07 14:22:57 -07:00
Linus Torvalds
bd8f3bff4a Merge tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:

 - i801: drop superfluous WDT entry for Birch

 - rtl9300:
    - fix channel number check in probe
    - check data length boundaries in xfer
    - drop broken SMBus quick operation

* tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: rtl9300: remove broken SMBus Quick operation support
  i2c: rtl9300: ensure data length is within supported range
  i2c: rtl9300: fix channel number bound check
  i2c: i801: Hide Intel Birch Stream SoC TCO WDT
2025-09-07 12:30:31 -07:00
Linus Torvalds
2c3bac6085 Merge tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras
Pull EDAC fix from Borislav Petkov:

 - Remove a misplaced dma_free_coherent() call in altera_edac

* tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/altera: Delete an inappropriate dma_free_coherent() call
2025-09-07 08:41:32 -07:00
Linus Torvalds
6ab41fca2e Merge tag 'timers-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
 "Fix a severe slowdown regression in the timer vDSO code related to the
  while() loop in __iter_div_u64_rem(), when the AUX-clock is enabled"

* tag 'timers-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  vdso/vsyscall: Avoid slow division loop in auxiliary clock update
2025-09-07 08:29:44 -07:00
Linus Torvalds
b7369eb731 Merge tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
 "Fix an 'allocation from atomic context' regression in the futex
  vmalloc variant"

* tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Move futex_hash_free() back to __mmput()
2025-09-07 08:26:28 -07:00
Linus Torvalds
6a8a34a56a Merge tag 'perf-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf event fix from Ingo Molnar:
 "Fix regression where PERF_EVENT_IOC_REFRESH counters miss a PMU-stop"

* tag 'perf-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix the POLL_HUP delivery breakage
2025-09-07 08:24:20 -07:00
Linus Torvalds
00e6982822 Merge tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:

 - LTO fix for clang when building with CONFIG_CMODEL_MEDLOW

 - Fix for ACPI CPPC CSR read/write return values

 - Several fixes for incorrect access widths in thread_info.cpu reads

 - Fix an issue in __put_user_nocheck() that was causing the glibc
   tst-socket-timestamp test to fail

 - Initialize struct kexec_buf records in several kexec-related
   functions, which were generating UBSAN warnings

 - Two fixes for sparse warnings

* tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: Fix sparse warning about different address spaces
  riscv: Fix sparse warning in __get_user_error()
  riscv: kexec: Initialize kexec_buf struct
  riscv: use lw when reading int cpu in asm_per_cpu
  riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id
  riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
  riscv: uaccess: fix __put_user_nocheck for unaligned accesses
  riscv: use lw when reading int cpu in new_vmalloc_check
  ACPI: RISC-V: Fix FFH_CPPC_CSR error handling
  riscv: Only allow LTO with CMODEL_MEDANY
2025-09-07 08:15:56 -07:00
Linus Torvalds
b236920731 Merge tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:

 - Two changes to prepare for the future Rust 1.91.0 release (expected
   2025-10-30, currently in nightly): a target specification format
   change and a renamed, soon-to-be-stabilized 'core' function.

* tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: support Rust >= 1.91.0 target spec
  rust: use the new name Location::file_as_c_str() in Rust >= 1.91.0
2025-09-06 12:33:09 -07:00
Wolfram Sang
d035b4baeb Merge tag 'i2c-host-fixes-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current
i2c-host-fixes for v6.17-rc5

- i801: fix device IDs
- in rtl9300:
  - fix channel number check in probe
  - check data length boundaries in xfer
  - drop unsupported SMBus quick operation
2025-09-06 10:17:35 +02:00
Linus Torvalds
d1d10cea08 Merge tag 'perf-tools-fixes-for-v6.17-2025-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
Pull perf tools fixes from Namhyung Kim:
 "Fixes for use-after-free that resulted in segfaults after merging the
  bpf tree.

  Also a couple of build and test fixes"

* tag 'perf-tools-fixes-for-v6.17-2025-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  perf symbol-elf: Add support for the block argument for libbfd
  perf test: Checking BPF metadata collection fails on version string
  perf tests: Fix "PE file support" test build
  perf bpf-utils: Harden get_bpf_prog_info_linear
  perf bpf-utils: Constify bpil_array_desc
  perf bpf-event: Fix use-after-free in synthesis
2025-09-05 15:01:46 -07:00
Alexandre Ghiti
a03ee11b8f riscv: Fix sparse warning about different address spaces
We did not propagate the __user attribute of the pointers in
__get_kernel_nofault() and __put_kernel_nofault(), which results in
sparse complaining:

>> mm/maccess.c:41:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@     expected void const [noderef] __user *from @@     got unsigned long long [usertype] * @@
   mm/maccess.c:41:17: sparse:     expected void const [noderef] __user *from
   mm/maccess.c:41:17: sparse:     got unsigned long long [usertype] *

So fix this by correctly casting those pointers.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508161713.RWu30Lv1-lkp@intel.com/
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: f6bff7827a ("riscv: uaccess: use 'asm_goto_output' for get_user()")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Cyril Bur <cyrilbur@tenstorrent.com>
Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-2-7e6350beb700@rivosinc.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:33:52 -06:00
Alexandre Ghiti
fef7ded169 riscv: Fix sparse warning in __get_user_error()
We used to assign 0 to x without an appropriate cast which results in
sparse complaining when x is a pointer:

>> block/ioctl.c:72:39: sparse: sparse: Using plain integer as NULL pointer

So fix this by casting 0 to the correct type of x.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508062321.gHv4kvuY-lkp@intel.com/
Fixes: f6bff7827a ("riscv: uaccess: use 'asm_goto_output' for get_user()")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Cyril Bur <cyrilbur@tenstorrent.com>
Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-1-7e6350beb700@rivosinc.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:33:44 -06:00
Breno Leitao
95c54cd9c7 riscv: kexec: Initialize kexec_buf struct
The kexec_buf structure was previously declared without initialization.
commit bf454ec31a ("kexec_file: allow to place kexec_buf randomly")
added a field that is always read but not consistently populated by all
architectures. This un-initialized field will contain garbage.

This is also triggering a UBSAN warning when the uninitialized data was
accessed:

	------------[ cut here ]------------
	UBSAN: invalid-load in ./include/linux/kexec.h:210:10
	load of value 252 is not a valid value for type '_Bool'

Zero-initializing kexec_buf at declaration ensures all fields are
cleanly set, preventing future instances of uninitialized memory being
used.

Fixes: bf454ec31a ("kexec_file: allow to place kexec_buf randomly")
Signed-off-by: Breno Leitao <leitao@debian.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:31:28 -06:00
Radim Krčmář
f4ea67a722 riscv: use lw when reading int cpu in asm_per_cpu
REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide.
The struct currently has a hole after cpu, so little endian accesses
seemed fine.

Fixes: be97d0db5f ("riscv: VMAP_STACK overflow detection thread-safe")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Link: https://lore.kernel.org/r/20250725165410.2896641-5-rkrcmar@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:31:24 -06:00
Radim Krčmář
8a16586fa7 riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id
emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide.
The struct currently has a hole after cpu, so little endian accesses
seemed fine.

Fixes: 2ddec2c80b ("riscv, bpf: inline bpf_get_smp_processor_id()")
Cc: stable@vger.kernel.org
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://lore.kernel.org/r/20250812090256.757273-4-rkrcmar@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:31:20 -06:00
Radim Krčmář
ad5348c765 riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG
emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide.
The struct currently has a hole after cpu, so little endian accesses
seemed fine.

Fixes: 19c56d4e5b ("riscv, bpf: add internal-only MOV instruction to resolve per-CPU addrs")
Cc: stable@vger.kernel.org
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Acked-by: Björn Töpel <bjorn@kernel.org>
Tested-by: Björn Töpel <bjorn@rivosinc.com> # QEMU
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20250812090256.757273-3-rkrcmar@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:31:17 -06:00
Aurelien Jarno
1046791390 riscv: uaccess: fix __put_user_nocheck for unaligned accesses
The type of the value to write should be determined by the size of the
destination, not by the value itself, which may be a constant. This
aligns the behavior with x86_64, where __typeof__(*(__gu_ptr)) is used
to infer the correct type.

This fixes an issue in put_cmsg, which was only writing 4 out of 8
bytes to the cmsg_len field, causing the glibc tst-socket-timestamp test
to fail.

Fixes: ca1a66cdd6 ("riscv: uaccess: do not do misaligned accesses in get/put_user()")
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250724220853.1969954-1-aurelien@aurel32.net
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:30:48 -06:00
Radim Krčmář
e108c8a94f riscv: use lw when reading int cpu in new_vmalloc_check
REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide.
The struct currently has a hole after cpu, so little endian accesses
seemed fine.

Fixes: 503638e0ba ("riscv: Stop emitting preventive sfence.vma for new vmalloc mappings")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Signed-off-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Link: https://lore.kernel.org/r/20250725165410.2896641-4-rkrcmar@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-09-05 15:30:45 -06:00
Linus Torvalds
d3e45016f7 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
 "Obvious driver patch plus update to sr to add back rotational media
  flag since CDROMS are rotational"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: sr: Reinstate rotational media flag
  scsi: lpfc: Fix buffer free/clear order in deferred receive path
2025-09-05 14:26:03 -07:00
Linus Torvalds
53b48f62f2 Merge tag 'spi-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
 "The largest batch of fixes here is a series of fixes for the Freescale
  LPSPI driver which James Clark pulled out of their BSP while looking
  at support for the NXP S32G version of the controller.

  The majority of this turned out to be bug fixes that affect existing
  systems with the actual S32G support being just a small quirk that
  would be unremarkable by itself, the whole series has had a good
  amount of testing and review and the individual patches are all pretty
  straightforward by themselves.

  We also have a few other driver specific fixes, including a relatively
  large but simple one for the Cadence QuadSPI driver"

* tag 'spi-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: spi-qpic-snand: unregister ECC engine on probe error and device remove
  spi: cadence-quadspi: Implement refcount to handle unbind during busy
  spi: spi-fsl-lpspi: Add compatible for S32G
  spi: spi-fsl-lpspi: Parameterize reading num-cs from hardware
  spi: spi-fsl-lpspi: Treat prescale_max == 0 as no erratum
  spi: spi-fsl-lpspi: Constify devtype datas
  dt-bindings: lpspi: Document support for S32G
  spi: spi-fsl-lpspi: Clear status register after disabling the module
  spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  spi: spi-fsl-lpspi: Fix transmissions when using CONT
  spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback
2025-09-05 13:29:31 -07:00
Linus Torvalds
e5d5d23319 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:

 - Incorrect __BITS_PER_LONG as 64 when compiling the compat vDSO

 - Unreachable PLT for ftrace_caller() in a module's .init.text
   following past reworking of the module VA range selection

 - Memory leak in the ACPI iort_rmr_alloc_sids() after a failed
   krealloc_array()

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE
  ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids()
  arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO
2025-09-05 13:11:10 -07:00
Linus Torvalds
730c1451fb Merge tag 'audit-pr-20250905' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit fix from Paul Moore:
 "A single small audit patch to fix a potential out-of-bounds read
  caused by a negative array index when comparing paths"

* tag 'audit-pr-20250905' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: fix out-of-bounds read in audit_compare_dname_path()
2025-09-05 12:35:25 -07:00
Linus Torvalds
c2f3b108c0 Merge tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:

 - Fix two potential NULL pointer references

 - Two debugging improvements (to help debug recent issues) a new
   tracepoint, and minor improvement to DebugData

 - Trivial comment cleanup

* tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: prevent NULL pointer dereference in UTF16 conversion
  smb: client: show negotiated cipher in DebugData
  smb: client: add new tracepoint to trace lease break notification
  smb: client: fix spellings in comments
  smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show()
2025-09-05 11:14:23 -07:00
Linus Torvalds
260aa8d5f0 Merge tag 'hwmon-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:

 - ina238: Various value range fixes when writing limit attributes

 - mlxreg-fan: Prevent fans from getting stuck at 0 RPM

* tag 'hwmon-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ina238) Correctly clamp power limits
  hwmon: (ina238) Correctly clamp shunt voltage limit
  hwmon: (ina238) Correctly clamp temperature
  hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
2025-09-05 11:08:06 -07:00
Linus Torvalds
3d1e36499e Merge tag 'gpio-fixes-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:

 - fix GPIO submenu regression in Kconfig

 - fix make clean under tools/gpio/

* tag 'gpio-fixes-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  tools: gpio: remove the include directory on make clean
  gpio: fix GPIO submenu in Kconfig
2025-09-05 10:33:46 -07:00
Linus Torvalds
dd6cbcc589 Merge tag 'platform-drivers-x86-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver fixes from Ilpo Järvinen:

 - acer-wmi: Stop using ACPI bitmap for platform profile choices

 - amd/hfi: Fix pcct_tbl leak

 - amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks

 - asus-wmi:
     - Fix registration races
     - Fix ROG button mapping, tablet mode on ASUS ROG Z13
     - Support more keys on ExpertBook B9

 - hp-wmi: Add support for Fn+P hotkey

 - intel/pmc: Add Bartlett Lake support

 - intel/power-domains: Use topology_logical_package_id() for package ID

* tag 'platform-drivers-x86-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
  platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID
  platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile choices
  platform/x86: hp-wmi: Add support for Fn+P hotkey
  platform/x86/intel/pmc: Add Bartlett Lake support to intel_pmc_core
  platform/x86: asus-wmi: Fix racy registrations
  platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list
  platform/x86: asus-wmi: map more keys on ExpertBook B9
  platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13
  platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk
  platform/x86/amd: hfi: Fix pcct_tbl leak in amd_hfi_metadata_parser()
2025-09-05 10:28:48 -07:00
Linus Torvalds
e9eaca6bf6 Merge tag 'block-6.17-20250905' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe:

 - NVMe pull request via Keith
     - Fix protection information ref tag for device side gen/strip
       (Christoph)

 - MD pull request via Yu
     - fix data loss for writemostly in raid1 (Yu Kuai)
     - fix potentional data loss by skipping recovery (Li Nan)

* tag 'block-6.17-20250905' of git://git.kernel.dk/linux:
  md: prevent incorrect update of resync/recovery offset
  md/raid1: fix data lost for writemostly rdev
  nvme: fix PI insert on write
2025-09-05 10:25:57 -07:00
panfan
a7ed7b9d0e arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE
On arm64, it has been possible for a module's sections to be placed more
than 128M away from each other since commit:

  commit 3e35d303ab ("arm64: module: rework module VA range selection")

Due to this, an ftrace callsite in a module's .init.text section can be
out of branch range for the module's ftrace PLT entry (in the module's
.text section). Any attempt to enable tracing of that callsite will
result in a BRK being patched into the callsite, resulting in a fatal
exception when the callsite is later executed.

Fix this by adding an additional trampoline for .init.text, which will
be within range.

No additional trampolines are necessary due to the way a given
module's executable sections are packed together. Any executable
section beginning with ".init" will be placed in MOD_INIT_TEXT,
and any other executable section, including those beginning with ".exit",
 will be placed in MOD_TEXT.

Fixes: 3e35d303ab ("arm64: module: rework module VA range selection")
Cc: <stable@vger.kernel.org> # 6.5.x
Signed-off-by: panfan <panfan@qti.qualcomm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20250905032236.3220885-1-panfan@qti.qualcomm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2025-09-05 16:56:20 +01:00
Linus Torvalds
c8ed9b5c02 Merge tag 'drm-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
 "Weekly drm fixes roundup, nouveau has two fixes for fence/irq racing
  problems that should fix a bunch of instability in userspace.

  Otherwise amdgpu along with some single fixes to bridge, xe, ivpu.

  Looks about usual for this time in the release.

  scheduler:
   - fix race in unschedulable tracepoint

  bridge:
   - ti-sn65dsi86: fix REFCLK setting

  xe:
   - Fix incorrect migration of backed-up object to VRAM

  amdgpu:
   - UserQ fixes
   - MES 11 fix
   - eDP/LVDS fix
   - Fix non-DC audio clean up
   - Fix duplicate cursor issue
   - Fix error path in PSP init

  nouveau:
   - fix nonstall interrupt handling
   - fix race on fence vs irq emission
   - update MAINTAINERS entry

  ivpu:
   - prevent recovery work during device remove"

* tag 'drm-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/kernel:
  drm/amd/amdgpu: Fix missing error return on kzalloc failure
  drm/bridge: ti-sn65dsi86: fix REFCLK setting
  MAINTAINERS: Update git entry for nouveau
  drm/xe: Fix incorrect migration of backed-up object to VRAM
  drm/sched: Fix racy access to drm_sched_entity.dependency
  accel/ivpu: Prevent recovery work from being queued during device removal
  nouveau: Membar before between semaphore writes and the interrupt
  nouveau: fix disabling the nonstall irq due to storm code
  drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG
  drm/amdgpu: drop hw access in non-DC audio fini
  drm/amd: Re-enable common modes for eDP and LVDS
  drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal
  drm/amdgpu/sdma: bump firmware version checks for user queue support
2025-09-05 08:50:25 -07:00
Linus Torvalds
01c93aa01c Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
 "Fix a regression caused by my commits that reimplemented the sha1,
  sha256, and sha512 crypto_shash algorithms on top of the library API.
  Specifically, the export_core and import_core methods stopped being
  supported, which broke some hardware offload drivers (such as qat)
  that recently started depending on these for fallback functionality.

  Later I'd like to make these drivers just use the library API for
  their fallback. Then these methods won't be needed anymore. But for
  now, this fixes the regression for 6.17"

* tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  crypto: sha512 - Implement export_core() and import_core()
  crypto: sha256 - Implement export_core() and import_core()
  crypto: sha1 - Implement export_core() and import_core()
2025-09-05 07:57:07 -07:00
Linus Torvalds
4e47e46718 Merge tag 'pcmcia-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux
Pull PCMCIA fixes and cleanups from Dominik Brodowski:
 "A number of minor PCMCIA bugfixes and cleanups, including the removal
  of unused code paths"

[ Dominik suggested this might be 6.18 material, but having looked
  through this, it looks appropriate early: minor trivial fixes and then
  one slightly bigger patch that removes dead code  - Linus ]

* tag 'pcmcia-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux:
  pcmcia: Add error handling for add_interval() in do_validate_mem()
  pcmcia: cs: Remove unused pcmcia_get_socket_by_nr
  pcmcia: omap: Add missing check for platform_get_resource
  pcmcia: Use str_off_on() and str_yes_no() helpers
  pcmcia: remove PCCARD_IODYN
  pcmcia: ds: Emphasize "really" epizeuxis
  pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
2025-09-05 07:52:44 -07:00