Repository navigation
Conversation
…capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent: UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int' Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided. Fixes: 0390a10 ("ASoC: SOF: ipc4-topology: use different channel mask for each sdw amp feedback") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20261008090130.15135-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
Protect IPC RX and FW state handler list unregister/dispatch paths with client_event_handler_mutex to match list registration and locking comments. Fixes: 5c19da3 ("ASoC: SOF: Use guard()/scoped_guard() for mutex locks where it makes sense") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://patch.msgid.link/20261008090143.15158-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
hdmi_add_cvt() stores each converter's NID into the fixed-size spec->cvt_nids[] array (used only by the Intel Haswell pin-connection fixup), but only when spec->num_cvts is still within ARRAY_SIZE(cvt_nids); the num_cvts counter itself is incremented unconditionally regardless of whether the store happened. A codec that reports more converters than cvt_nids[] can hold therefore ends up with num_cvts > ARRAY_SIZE(cvt_nids). hdmi_read_pin_conn(), on the intel_hsw_fixup path, copies num_cvts elements from cvt_nids[] with memcpy(), so once num_cvts exceeds the array size this reads past cvt_nids[] and writes the resulting garbage NIDs into per_pin->mux_nids[]. Clamp the copy length to the actual size of cvt_nids[] instead of trusting num_cvts, which is also used unbounded as the size of the separate, dynamically-sized spec->cvts array and must not be truncated at the source. Fixes: bce0d2a ("ALSA: hda - Allow unlimited pins and converters in patch_hdmi.c") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20261008085122.9442-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
snd_hdmi_write_eld_info() parses a "sad_count N" line from the root-writable ELD proc interface and assigns N directly to e->sad_count with no upper bound, unlike the per-index "sadN_*" lines a few lines below which are already bounded to ELD_MAX_SAD. snd_hdmi_eld_update_pcm_info() later iterates "for (i = 0; i < e->sad_count; i++)" over the fixed e->sad[ELD_MAX_SAD] array, so an oversized sad_count read from the proc file causes it to walk past the array. Reject sad_count values above ELD_MAX_SAD, matching the existing per-index guard. Fixes: acb0599 ("ALSA: hda - ELD proc interface write updates") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20261008085133.9528-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit ad96ce3 ("swiotlb: determine potential physical address limit") changed default_swiotlb_limit() to return the maximum physical address that could ever be used by dynamically allocated pools, so that the value stays constant when CONFIG_SWIOTLB_DYNAMIC=y. However, io_tlb_default_mem.phys_limit is returned even when the default pool cannot grow, e.g. when swiotlb_init_remap() is called with a remap callback. This breaks Xen dom0 on x86: pci_xen_swiotlb_init() passes SWIOTLB_ANY and xen_swiotlb_fixup(), so phys_limit is set to the top of dom0 memory, although xen_swiotlb_fixup() makes the default pool below the 32-bit boundary. xen_swiotlb_dma_supported() then rejects 32-bit DMA masks, even though the bounce buffer is perfectly usable by such devices. Return phys_limit only if the default pool can actually grow, otherwise report the real end of the default pool, like in the !CONFIG_SWIOTLB_DYNAMIC case. Reported-by: Andreas Greve <andreas.greve@a-greve.de> Reported-by: James Dingwall <james@dingwall.me.uk> Fixes: ad96ce3 ("swiotlb: determine potential physical address limit") Closes: https://lore.kernel.org/xen-devel/f74668db-52fd-4575-8372-7bfdf10d62ac@a-greve.de/ Cc: stable@vger.kernel.org Assisted-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Tested-by: James Dingwall <james@dingwall.me.uk> Link: https://lore.kernel.org/all/20261005070518.1590097-1-m.szyprowski@samsung.com/ Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
had_build_channel_allocation_map() allocates a single struct snd_pcm_chmap_elem via kzalloc() and stores it as intelhaddata->chmap->chmap. struct snd_pcm_chmap.chmap is expected to be a zero-terminated array (see snd_pcm_std_chmaps[]), but had_register_chmap_ctls() never overrides the TLV callback installed by snd_pcm_add_chmap_ctls(), so the generic pcm_chmap_ctl_tlv() from ALSA core is left in place. pcm_chmap_ctl_tlv() is reachable by any local user via SNDRV_CTL_IOCTL_TLV_READ on the "Playback Channel Map" control and walks the array with "for (map = info->chmap; map->channels; map++)". Since the driver's single element is never terminated, this walks past the allocation. The same pointer is also freed on hot-unplug and rebuilt on hot-plug under intelhaddata->mutex, while the TLV callback runs under card->controls_rwsem without that mutex, so the walk can also race a concurrent free of the array. Fix this by allocating a second, zeroed element so the array is properly terminated, and by dropping the inherited TLV callback entirely at registration time, since the driver never implements one of its own. Fixes: 5dab11d ("ALSA: x86: hdmi: Add audio support for BYT and CHT") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Link: https://patch.msgid.link/20261008085411.13742-1-peter.ujfalusi@linux.intel.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
…rg/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: - Update .mailmap entries for Andy Yan and John Garry - Fix read-only MAP_SHARED /dev/zero mappings so they retain shared-file semantics instead of being treated as anonymous memory, also avoiding a CONFIG_DEBUG_VM assertion - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by using the wrong printf format for size_t values - Fix a boot-time crash when early function tracing causes CPA to free kernel page tables before the workqueues used for deferred freeing are available - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by an mlock-on-fault VMA self-merging, and one caused by partially remapping a locked VMA * tag 'mm-hotfixes-stable-2026-10-07-21-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: update entry for Andy Yan drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly selftests/mm: cleanup -Wformat issues in hugetlb-mmap mm: don't schedule deferred kernel page table freeing while booting mailmap: update addresses for John Garry mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
…inux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix runtime PM leak in error path in gpio-xilinx - fix race when arming the IRQ poll worker in gpio-mpsse - fix devres cleanup path on probe error in gpio-exar * tag 'gpio-fixes-for-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mpsse: fix race when arming the IRQ poll worker gpio: exar: initialize the ID before registering its cleanup gpio: xilinx: fix runtime PM leak on request error path
…/linux/kernel/git/brgl/linux Pull power sequencing fixes from Bartosz Golaszewski: - add missing PCI device IDs for Thinkpad T14s gen6 which should have been part of commit a39ac46 ("power: sequencing: pcie-m2: Match WCN6855 and WCN7851 UART BT variants by subdevice ID") in pwrseq-pcie-m2 - fix memory leak in pwrseq-pcie-m2 (leaking the array returned by of_regulator_bulk_get_all()) * tag 'pwrseq-fixes-for-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids
The ext4 T: entry names the repository without a branch, so tools that default to the repository's HEAD select master, which still points at a merge from October 2020 (96485e4). Development happens on dev, which is also the branch linux-next merges. Name it. The Sashiko review bot, for one, falls back to HEAD this way and has been reviewing ext4 patches against that tree. Its review of an EA inode refcount fix reported a Critical double decrement and an undefined function after applying the patch to that stale baseline; neither holds on dev. Link: https://lore.kernel.org/all/20260916072420.316321F000FF@smtp.kernel.org/ Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com> Acked-by: Jan Kara <jack@suse.cz> Link: https://patch.msgid.link/20260923101749.3505886-1-matthias.goergens@gmail.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
…2028. Signed-off-by: Theodore Ts'o <tytso@mit.edu>
…nux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Mark the ext4 data=journal feature as being deprecated and will be removed in 2028. Also designate the primary branch that Sashiko and other tools use to find the primary development branch in the ext4 tree" * tag 'ext4_for_linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: mark data=journal as deprecated and will be removed in January 2028. MAINTAINERS: name the ext4 dev branch
…org/drm/i915/kernel into drm-fixes drm/i915 fixes for v7.3-rc7: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/49ac4a9f496e1dadbf71740eb0d1f443598b2632@intel.com
Commit 730ff06 ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.") started handing out RX buffers with zero headroom so that two buffers fit into one page at the default MTU. The MANA TX path, however, stores the per scatter-gather entry DMA mappings in `struct mana_skb_head` at skb->head, and mana_start_xmit() therefore calls skb_cow_head(skb, MANA_HEADROOM). The port advertises this requirement as ndev->needed_headroom = MANA_HEADROOM. As a result every packet that is received and then forwarded out of a MANA port fails the skb_cow() in ip_forward() and gets reallocated and copied by pskb_expand_head(). This is invisible to a plain RX or TX workload, but it puts a full skb reallocation plus memcpy on the hot path of every single forwarded packet, which is exactly what a router/NVA workload does. Restore the headroom. Note that reserving MANA_HEADROOM (232) is not enough: ip_forward() asks for LL_RESERVED_SPACE(dev), which rounds hard_header_len + needed_headroom up to HH_DATA_MOD and is 256 bytes on ethernet. Use LL_RESERVED_SPACE() directly so the value keeps tracking both constants. Also, since LL_RESERVED_SPACE() tracks MANA_HEADROOM, it grows with MAX_SKB_FRAGS and for MAX_SKB_FRAGS >= 19 it is greater than 256, so we have to account for that by using the headroom the RX queue actually uses (instead of assuming XDP_PACKET_HEADROOM) and turning MANA_XDP_MTU_MAX into MANA_XDP_MTU_MAX(ndev) (note that at the default CONFIG_MAX_SKB_FRAGS=17 they are equivalent). At the default MTU on a 4K page this means a buffer no longer fits twice into a page (SKB_DATA_ALIGN(1500 + MANA_RXBUF_PAD + 256) = 2112), so the frag-vs-single decision is now made by computing the real buffer size instead of comparing the MTU against PAGE_SIZE / 2. The page_pool fragment path is still used wherever at least two buffers genuinely fit, e.g. on 16K and 64K page sizes. Measured on an Azure VM with a MANA NIC acting as a forwarding NVA (UDP, 1400 byte payload, 4 streams, 8 Gbps offered, only the forwarding node's kernel differs), 8 runs each, median: forwarded pps throughput before 272,830 3.06 Gbps after 390,560 4.37 Gbps (+43%) perf on the forwarding node, same workload: memset_orig __pi_memcpy pskb_expand_head before 10.07% 3.96% present after 0.94% 0.64% gone Cc: stable@vger.kernel.org Fixes: 730ff06 ("net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.") Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261003013647.2051416-1-hamzamahfooz@linux.microsoft.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
A veth device advertises NETDEV_XDP_ACT_NDO_XMIT only if its peer has an XDP program attached or GRO enabled, that is, only if the peer will have NAPI to receive the frames. veth_set_features() updates the peer's flag when GRO is toggled, but returns early if the device is down, and veth_open() only refreshes the flags of the device being opened. Toggling GRO while the device is down therefore leaves the peer's flag stale after the device comes up. If GRO was enabled while down, the device comes up with NAPI but the peer does not advertise NDO_XMIT, and devmap rejects redirects to the peer with -EOPNOTSUPP. If GRO was disabled while down, the device comes up without NAPI but the peer still advertises NDO_XMIT, so redirects are accepted and then dropped in veth_xdp_xmit() with -ENXIO. Commit 7a6102a ("veth: Update XDP feature set when bringing up device") made veth_open() refresh the device's own flags. Refresh the peer's flags there too. The peer's flag depends on this device's XDP program and GRO setting, not on whether the peer is up, so it is correct to set it even if the peer is down. Fixes: 8267fc7 ("veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag") Signed-off-by: Tianyi Gao <tianyi@cloudflare.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> Acked-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Link: https://patch.msgid.link/20261006173241.65945-2-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Test that toggling GRO on a veth device while it is down updates the peer's ndo-xmit XDP feature once the device comes up, for both GRO on and GRO off. xdp-features is only visible through netlink, so read it with the ynl CLI, as double_udp_encap.sh does. Skip the checks if the CLI is not found, as in an installed kselftest tree. Signed-off-by: Tianyi Gao <tianyi@cloudflare.com> Link: https://patch.msgid.link/20261006173241.65945-3-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
…led-while-down' Tianyi Gao says: ==================== veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down Toggling GRO on a veth device while it is down leaves its peer's NETDEV_XDP_ACT_NDO_XMIT flag stale once the device comes up. XDP redirects into the peer are then rejected with -EOPNOTSUPP, or, if GRO was turned off, accepted and then dropped with -ENXIO. Patch 1 refreshes the peer's flags in veth_open(). Patch 2 extends veth.sh to check the peer's flag after GRO is toggled while the device is down, in both directions. ==================== Link: https://patch.msgid.link/20261006173241.65945-1-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
mlx5e_poll_ico_cq() requires sq->cc to be updated only after mlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur. The current implementation updates sq->cc before the CQ doorbell record, violating this ordering requirement. Update the CQ doorbell record first and use dma_wmb() before updating sq->cc. This ensures that the CQ space is released to the device before the corresponding ICOSQ consumer index is updated by software. Fixes: fd9b4be ("net/mlx5e: RX, Support multiple outstanding UMR posts") Signed-off-by: Li RongQing <lirongqing@baidu.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Link: https://patch.msgid.link/20261006105820.257208-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The KSZ8765 is similar to the KSZ8795 but has two fiber ports. KSZ8_PORT_STATUS_0 is used to detect fiber mode. It is currently defined as 0x08, which is the Global Control 6 MIB Control register and has bit 7 defined as Flush Counter. Set KSZ8_PORT_STATUS_0 to 0x18, which is the Port 1 Status 0 register where bit 7 is the Fiber Mode bit. This issue was discovered when upgrading an embedded device from kernel 5.10 to 6.16. The device was using a KSZ8765 device tree configuration and the corresponding hardware, but during boot the kernel incorrectly detected it as a KSZ8795. The relevant boot messages were: ksz-switch spi0.0: found switch: KSZ8795, rev 0 ksz-switch spi0.0: Device tree specifies chip KSZ8765 but found KSZ8795, please fix it! Cc: stable@vger.kernel.org Fixes: 91a9891 ("net: dsa: microchip: move switch chip_id detection to ksz_common") Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Sebastien Royen <sebastien.royen@armadeus.com> Link: https://patch.msgid.link/20261007080557.15719-1-sebastien.royen@armadeus.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_flower_tmplt_create() to plug the leak. The issue was found during a review of Wentao Liang's patch referenced below. Fixes: fe22f74 ("mlxsw: spectrum_flower: Add ability to match on port ranges") Reported-by: Wentao Liang <vulab@iscas.ac.cn> Closes: https://lore.kernel.org/netdev/20260917113236.2149095-1-vulab@iscas.ac.cn/ Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/95339cf970ce78e1a74aa86ffcc104ecf7c7762c.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add a test that creates a tc chain template matching on both source and destination port ranges and verifies via devlink-resource occupancy that this does not leak port range registers, neither while the template exists nor after it is deleted. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/e7b37b80adb7ac8b0ef20a22d7654a6656c1c545.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Petr Machata says: ==================== mlxsw: Fix port range register leak When the mlxsw driver parses a port range template rule, it acquires the actual port range registers. The parsing is only done to determine the element usage, so the registers can be deallocated right away, but this is never done, and the registers are leaked. Plug this leak and add a selftest that would have caught it. ==================== Link: https://patch.msgid.link/cover.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the entry from the list, but never frees it, so the entry of every deleted mirror and goto matchall filter is leaked. Free the entry after unlinking it. The leak was discovered by an AI code review agent, and reproduced with kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and deleting matchall mirror and goto filters. With the fix, kmemleak no longer reports the leak. Cc: stable@vger.kernel.org Fixes: 1ede4ac ("net: sparx5: add bookkeeping code for matchall rules") Signed-off-by: Daniel Machon <daniel.machon@microchip.com> Link: https://patch.msgid.link/20261007-sparx5-matchall-kfree-net-v1-1-c8918685b337@microchip.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent. Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset(). Fixes: 65249fe ("net: add support for skbs with unreadable frags") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Mina Almasry <almasrymina@google.com> Link: https://patch.msgid.link/20261007-b4-skb-copy-csum-stale-bytes-v1-1-adbbde033fb3@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN. If the first slot is shorter than ETH_HLEN and more slots follow, the head ends up shorter than an Ethernet header while skb->len is longer, and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is shorter than ETH_HLEN, eth_type_trans() reads the header past the end of the data instead. Pull at least ETH_HLEN, and drop the packet if that fails, which also drops packets too short to hold an Ethernet header. This also checks the return value of the pull, which was ignored. Fixes: 0d16021 ("xen: add virtual network device driver") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261007-b4-xen-netfront-short-head-v1-1-12d7113a7e4e@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM. packet_parse_headers() sets skb->protocol to VLAN but advances skb->network_header past the VLAN tags. virtio_net_hdr_to_skb() then flow dissects these packets, which parses the network header as a VLAN tag, and fails. Call packet_parse_headers() after virtio_net_hdr_to_skb() instead. This matches tun_get_user() and tap_get_user() and thus simplifies overall complexity. Commit 01fdecc ("net: packet: fix wrong transport_header when sending VLAN-tagged frame") fixed the same issue for the transport header probe in packet_parse_headers(). That probe is now skipped if virtio_net_hdr_to_skb() already set the transport header, avoiding a redundant dissection. Implementation details: - Do not set skb->protocol to the RX wildcard ETH_P_ALL. SOCK_RAW then derives it from the link layer header, as before. SOCK_DGRAM now leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM. - Keep virtio_net_hdr_set_proto() last, so that the link layer protocol takes priority over gso_type. Reported-by: Junnan Zhang <zhangjn_dev@163.com> Closes: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/ Fixes: dfed913 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO") Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Link: https://patch.msgid.link/20261007175816.3138556-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above it does. Fixes: ad4f15d ("xen/netfront: don't bug in case of too many frags") Cc: stable@vger.kernel.org Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://patch.msgid.link/20261007-b4-xen-netfront-fill-frags-leak-v1-1-a8a01ff9cd52@toxicpanda.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The commit in fixes introduced a high cap for delayas U64_MAX value while ktime_t is actually s64. This is wrong cap as it becomes negative value and any comparison to a real delay will fail to update delay value. Use KTIME_MAX constant as correct max cap for PCIe delay. The issue was hit in production (a negative value is observed): # cat /sys/class/timecard/ocp0/ts_window_adjust -3 Fixes: aa05fe6 ("ptp: ocp: Improve PCIe delay estimation") Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Daniel Machon <daniel.machon@microchip.com> Link: https://patch.msgid.link/20261007203359.417270-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Treble cutoff (TC) is at bit 6 of Treble Control, not at bit 2, which is part of the treble volume (TRBL[3:0]). Fixes: 54db41c ("ASoC: wm8955: Use SOC_ENUM_SINGLE_DECL()") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/b398bc6dcf8dc2b93504608cdf952823ca238cd5.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
…trol The Right Output Mixer Right Input Volume (MIXINR_MIXOUTR_VOL) is at bits 2:0 of Output Mixer6, not at bits 8:6, which hold the IN2LN volume (IN2LN_MIXOUTR_VOL). Fixes: 942c435 ("ASoC: Add WM8993 CODEC driver") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/1ea1d115cea5b183dd51bba5cd9e38157b3482ee.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
The mic (xMZC) and PGA (xPZC) zero cross bits are bits 3 and 2 of each channel's Audio Path register. SOC_DOUBLE takes one register and two shifts, so both controls only write the left register. Use SOC_DOUBLE_R, as the Mic Boost Switch next to them does. Fixes: 2a9ae13 ("ASoC: Add initial WM8737 driver") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/36cab58287bd24955e73bfe3a6fb24cae8fad7b8.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
The EQ3 band 1 gain is in WM5100_EQ3_1, not in WM5100_EQ1_1, which holds the EQ1 band 1 gain. Fixes: 6d4baf0 ("ASoC: Add WM5100 driver") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/d7f690e391feda7a6d8f38d0b238b165bc1f4fe2.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
The noise gate type is wm8750_enum[7], bit 1 of WM8750_NGATE, not wm8750_enum[4], which is the 3D upper cut-off. Fixes: abadfc9 ("[ALSA] ASoC codecs: WM8750 support") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/ce530dfb932d9e8def75059ab9d669360adc76e8.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
ADC polarity is bit 0 of WM8510_ADC, not bit 0 of WM8510_COMP, which is the loopback enable. wm8974, which has the same register layout, already uses WM8974_ADC for this control. Fixes: 5d42151 ("[ALSA] ASoC: Add WM8510 driver") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: HyeongJun An <sammiee5311@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/6ada61df8c8fc97ffb1623e74f6742ca498032fa.1791959026.git.sammiee5311@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
…rol's bits HyeongJun An <sammiee5311@gmail.com> says: These are more fixes found by the overlap scan from the first series [1]. In each driver a control writes bits that belong to another control, or writes the left channel bits for a right channel control. [1] https://lore.kernel.org/all/20261008130953.2446692-1-sammiee5311@gmail.com/ Link: https://patch.msgid.link/cover.1791959026.git.sammiee5311@gmail.com
With deferrable card binding, a card that fails to bind is retried only when a new ASoC component is registered. da7213 requests its MCLK in the component probe callback, so if the clock provider registers late, the card bind defers and the provider's later registration never triggers a rebind, leaving the sound card unregistered. Request MCLK in the I2C probe instead, so a missing clock defers the codec driver probe through the driver core before the component is registered. Fixes: 42d9985 ("ASoC: core: Move all users to deferrable card binding") Signed-off-by: Le Qi <le.qi@oss.qualcomm.com> Link: https://patch.msgid.link/20261014065321.740850-1-le.qi@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
The DECENTA MATX03 (ALC897, SSID 1e0b:1297) exposes a high gain range on both the Line In pin boost and the ADC input amp. Pin 0x1a reports nsteps=0x03 with stepsize=0x27, that is 0, 9.75, 19.5 and 29.25 dB. ADC 0x08 reports nsteps=0x3f with stepsize=0x02, that is 0 to 31.5 dB in 0.5 dB steps, and defaults to 0x3f (maximum). The combined 60.75 dB analogue cascade overloads the front-end when the source level is high, producing audible noise during Line In monitoring. Add a new fixup alc897_fixup_limit_linein_boost that overrides the amp capabilities of pin 0x1a to nsteps=1 (max ~11.75 dB) and ADC 0x08 to nsteps=1 (max ~0.5 dB). The total gain drops from 60.75 dB to ~12.25 dB, eliminating the clipping. Signed-off-by: wangdicheng <wangdicheng@kylinos.cn> Link: https://patch.msgid.link/20261015021210.106392-1-wangdich9700@163.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
When a PCM stream is stopped via SNDRV_PCM_IOCTL_DROP ioctl, it calls snd_pcm_stop() but sync-stop operation is missing. Although this is usually no big issue, let's add snd_pcm_sync_stop() call, just to be sure. Link: https://patch.msgid.link/20261014142454.320703-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
The HP Laptop 15-fc0xxx is based on an AMD platform where the digital microphone is provided by the snd-soc-acp6x-mach driver, not by the HDA codec. The ALC236_FIXUP_HP_DMIC quirk configures pin 0x12 as an internal DMIC, which is a misconfiguration for this machine: the pin is not wired to a codec DMIC and the setting has no effect on the actual microphone path (which works via ACP6x). Replace ALC236_FIXUP_HP_DMIC with ALC236_FIXUP_HP_MUTE_LED_MICMUTE_GPIO, the standard quirk used by the closely related HP Laptop 15-fd0xxx and other ALC236 HP machines. This removes the misleading DMIC pin config and adds proper mute LED and micmute LED support that was missing from the original quirk. Fixes: 7204607 ("ALSA: hda/realtek: add quirk for HP Laptop 15-fc0xxx") Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221233 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222044 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20261015065640.377466-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
bardliao
requested review from
bhiregoudar,
dbaluta,
jack-cy-yu,
kv2019i,
lgirdwood,
oder-chiou,
plbossart,
ranj063,
shumingfan and
ujfalusi
as code owners
October 15, 2026 13:28
There was a problem hiding this comment.
🟡 Changes recommended
The unresolved critical NULL-socket dereference in stream-parser teardown blocks approval.
1 open finding
What changed in this PR
Merges upstream sound updates alongside fixes across networking, filesystems, drivers, and architecture support.
Changes:
- Correct audio controls, PCM handling, synchronization, and resource cleanup.
- Update kernel interfaces, hardware quirks, and architecture workarounds.
- Extend selftests and refresh build settings and documentation.
Blocking issue — critical, 2 votes: net/strparser/strparser.c:514 unconditionally locks a socket during teardown, but general-mode parsers support sk == NULL. Guard socket synchronization with if (strp->sk) to prevent a NULL dereference.
| File | Description |
|---|---|
| tools/testing/selftests/ublk/kublk.c | Explicitly discard shutdown write result. |
| tools/testing/selftests/sched_ext/Makefile | Register remote-dequeue testing. |
| tools/testing/selftests/net/Makefile | Register UDP splice checksum testing. |
| tools/testing/selftests/net/.gitignore | Ignore new test binary. |
| tools/testing/selftests/Makefile | Register mount-related test suites. |
| tools/testing/selftests/filesystems/umount_propagation/Makefile | Build unmount propagation tests. |
| tools/testing/selftests/filesystems/overlayfs/Makefile | Register automount-layer testing. |
| tools/testing/selftests/filesystems/overlayfs/.gitignore | Ignore automount test binary. |
| tools/testing/selftests/filesystems/open_tree_ns/Makefile | Register covered-tree testing. |
| tools/testing/selftests/filesystems/open_tree_ns/.gitignore | Ignore covered-tree test binary. |
| tools/testing/selftests/filesystems/mount_cycle/settings | Set suite timeout. |
| tools/testing/selftests/filesystems/mount_cycle/Makefile | Build mount-cycle tests. |
| tools/testing/selftests/filesystems/mount_cycle/.gitignore | Ignore generated test binaries. |
| tools/testing/selftests/filesystems/mntns_unbindable/Makefile | Build unbindable-namespace testing. |
| tools/testing/selftests/filesystems/Makefile | Register write-hint testing. |
| tools/testing/selftests/filesystems/empty_mntns/.gitignore | Ignore additional test binaries. |
| tools/testing/selftests/filesystems/.gitignore | Ignore write-hint test binary. |
| tools/testing/selftests/bpf/testing_helpers.h | Declare userfaultfd helper. |
| tools/testing/selftests/alsa/Makefile | Register loopback audio testing. |
| tools/testing/selftests/alsa/.gitignore | Ignore loopback test binary. |
| tools/spi/Makefile | Add tools header path. |
| sound/virtio/virtio_pcm.h | Declare PCM message reset support. |
| sound/virtio/virtio_pcm_ops.c | Reset messages during PCM preparation. |
| sound/usb/mixer_quirks.c | Update mixer registration arguments. |
| sound/usb/line6/capture.c | Copy only complete capture frames. |
| sound/usb/card.h | Add feedback-quirk flag. |
| sound/usb/caiaq/device.h | Separate MIDI and PCM locking. |
| sound/soc/stm/stm32_spdifrx.c | Correct synchronization-state comparison. |
| sound/soc/rockchip/rockchip_sai.c | Handle runtime-resume errors. |
| sound/soc/rockchip/rockchip_i2s.c | Handle runtime-resume errors. |
| sound/soc/renesas/rcar/msiof.c | Normalize successful open returns. |
| sound/soc/renesas/fsi.c | Normalize successful open returns. |
| sound/soc/qcom/qdsp6/q6prm.c | Select command destination domain. |
| sound/soc/qcom/qdsp6/q6apm.h | Update command helper signature. |
| sound/soc/qcom/Kconfig | Select SCM support for APM. |
| sound/soc/mediatek/mt8365/mt8365-dai-i2s.c | Bound coefficient-table indexing. |
| sound/soc/mediatek/mt8188/mt8188-mt6359.c | Merge capture backend constraints. |
| sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | Normalize successful constraint returns. |
| sound/soc/intel/atom/sst-mfld-platform-pcm.c | Return zero after successful open. |
| sound/soc/fsl/imx-pcm-rpmsg.c | Return zero after successful open. |
| sound/soc/codecs/wm8985.c | Correct ADC oversampling bit. |
| sound/soc/codecs/wm8983.c | Correct ADC oversampling bit. |
| sound/soc/codecs/wm8978.c | Correct oversampling control bits. |
| sound/soc/codecs/wm8955.c | Correct treble cutoff field. |
| sound/soc/codecs/wm8782.c | Normalize successful startup returns. |
| sound/soc/codecs/wm8510.c | Correct ADC inversion register. |
| sound/soc/codecs/wm_hubs.c | Correct output mixer field. |
| sound/soc/codecs/wcd939x.h | Remove obsolete port-enable state. |
| sound/soc/codecs/rt766-sdca.h | Define detection IRQ register. |
| sound/soc/codecs/rt722-sdca-sdw.c | Always cancel removal-time work. |
| sound/soc/codecs/rt712-sdca-sdw.c | Always cancel removal-time work. |
| sound/soc/codecs/rt711-sdw.c | Always cancel removal-time work. |
| sound/soc/codecs/rt711-sdca-sdw.c | Always cancel removal-time work. |
| sound/soc/codecs/rt5682s.c | Disable delayed work during shutdown. |
| sound/soc/codecs/rt5682-sdw.c | Always cancel jack-detection work. |
| sound/soc/codecs/pcm3168a.c | Correct zero-flag polarity selection. |
| sound/soc/codecs/nau8822.c | Correct oversampling control bits. |
| sound/soc/codecs/max98371.c | Correct minimum-gain field. |
| sound/soc/codecs/es8375.c | Allow optional master clock. |
| sound/soc/codecs/cs42l56.c | Correct limiter cushion register. |
| sound/soc/codecs/cs42l52.c | Correct noise-gate type bit. |
| sound/soc/codecs/cpcap.c | Remove redundant driver-data assignment. |
| sound/soc/atmel/atmel-pcm-pdc.c | Return zero after successful open. |
| sound/soc/amd/yc/acp6x-pdm-dma.c | Normalize successful open returns. |
| sound/soc/amd/yc/acp6x-mach.c | Add board audio quirk. |
| sound/soc/amd/vangogh/acp5x-pcm-dma.c | Normalize successful open returns. |
| sound/soc/amd/renoir/acp3x-pdm-dma.c | Normalize successful open returns. |
| sound/soc/amd/raven/acp3x-pcm-dma.c | Normalize successful open returns. |
| sound/soc/amd/ps/ps-sdw-dma.c | Normalize successful open returns. |
| sound/soc/amd/ps/ps-pdm-dma.c | Normalize successful open returns. |
| sound/soc/amd/ps/pci-ps.c | Disable and release removal-time interrupts. |
| sound/soc/amd/mach-config.h | Split ACP machine declarations. |
| sound/soc/amd/acp/Kconfig | Select ES9356 codec support. |
| sound/soc/amd/acp/acp-platform.c | Normalize successful open returns. |
| sound/pci/ice1712/ice1712.c | Correct probe cleanup ownership. |
| sound/pci/ctxfi/ctdaio.c | Free cleared input mappings. |
| sound/pci/cs46xx/dsp_spos.c | Correct DSP code bounds checking. |
| sound/hda/core/local.h | Declare response-counter reset support. |
| sound/hda/common/hda_jack.h | Add jack-table linkage. |
| sound/hda/codecs/side-codecs/Kconfig | Imply serial multi-instantiation support. |
| sound/hda/codecs/side-codecs/aw88399_hda.h | Remove obsolete reliability state. |
| sound/hda/codecs/hdmi/hdmi.c | Bound converter-array copying. |
| sound/core/ump.c | Check source bounds before dereferencing. |
| sound/core/timer.c | Set user-timer module ownership. |
| sound/core/seq/seq_ports.h | Add deletion-list linkage. |
| sound/core/seq/oss/seq_oss_midi.c | Prevent duplicate device release. |
| sound/core/rawmidi.c | Drain queued input work before close. |
| sound/core/info.c | Adjust shutdown-time proc-entry handling. |
| security/landlock/domain.h | Work around Clang counted-array handling. |
| net/vmw_vsock/af_vsock.c | Purge remaining receive buffers. |
| net/strparser/strparser.c | Synchronize teardown; critical NULL-socket issue remains. |
| net/sched/sch_codel.c | Remove artificial MTU floor. |
| net/sched/em_text.c | Validate algorithm-name termination. |
| net/sched/cls_route.c | Validate routing attributes on replacement. |
| net/sched/act_skbedit.c | Limit TX queue skipping to egress. |
| net/sched/act_ct.c | Use renamed pending-flow flag. |
| net/openvswitch/actions.c | Skip fragment-header checksum updates. |
| net/netfilter/nft_set_rbtree.c | Skip inactive elements during GC. |
| net/netfilter/nf_nat_core.c | Reject invalid NAT manipulation types. |
| net/netfilter/nf_nat_bpf.c | Validate NAT manipulation arguments. |
| net/netfilter/nf_flow_table_core.c | Avoid collecting pending flows. |
| net/netfilter/ipvs/ip_vs_lblcr.c | Bound scheduler-table growth. |
| net/netfilter/ipvs/ip_vs_lblc.c | Correct accounting and bound growth. |
| net/netfilter/ipvs/ip_vs_conn.c | Exclude templates from one-packet mode. |
| net/netfilter/ipset/ip_set_bitmap_gen.h | Avoid target-side comment initialization. |
| net/mctp/device.c | Publish fully initialized device state. |
| net/mac80211/spectmgmt.c | Reject unsupported channel definitions. |
| net/mac80211/rx.c | Reject fragment-length overflow. |
| net/mac80211/ieee80211_i.h | Extend station-lookup arguments. |
| net/mac80211/fils_aead.c | Handle empty AES-SIV plaintext. |
| net/mac80211/drop.h | Add defragmentation overflow reason. |
| net/mac80211/agg-rx.c | Permanently stop session timer. |
| net/ipv6/seg6_iptunnel.c | Use namespace-aware packet hashing. |
| net/ipv6/route.c | Remove message-size warning. |
| net/ipv6/addrconf.c | Convert prefix-route expiry correctly. |
| net/ipv4/tcp.c | Exclude network IOV fragments from mapping. |
| net/ipv4/tcp_ipv4.c | Defer request-option freeing through RCU. |
| net/ipv4/tcp_input.c | Update timestamps before old-ACK processing. |
| net/ipv4/ip_output.c | Validate checksum placement before fragmentation. |
| net/ipv4/fib_trie.c | Remove message-size warning. |
| net/ipv4/fib_semantics.c | Handle absent nexthop information. |
| net/core/sock.c | Restrict and bound memory reservations. |
| net/core/page_pool.c | Update recycling statistics under lock. |
| net/core/gso.c | Initialize segmentation recursion state. |
| net/core/dev_ioctl.c | Check timestamp-operation availability. |
| net/can/gw.c | Reset routed-frame identifiers. |
| net/bridge/netfilter/nf_conntrack_bridge.c | Validate checksum placement before fragmentation. |
| net/bluetooth/rfcomm/sock.c | Free packets without socket owners. |
| net/bluetooth/mgmt.c | Pass correct management status. |
| net/bluetooth/hci_sock.c | Lock stale-device state updates. |
| net/bluetooth/hci_debugfs.c | Correct timestamp formatting. |
| mm/shmem.c | Honor forced huge-page collapse. |
| mm/damon/core.c | Use quota-configuration helper. |
| Makefile | Advance release suffix to -rc7. |
| lib/dim/Makefile | Register DIM KUnit tests. |
| kernel/workqueue.c | Guard absent worker queue state. |
| kernel/time/jiffies.c | Saturate overflowing tick conversions. |
| kernel/sysctl.c | Correct negative-value conversion order. |
| kernel/sched/ext/sub.c | Flush rescue state during offline handling. |
| kernel/sched/ext/internal.h | Document per-task queue sequencing. |
| kernel/rcu/srcutree.c | Check callback-list emptiness during cleanup. |
| kernel/nsproxy.c | Expose namespace-proxy freeing. |
| kernel/irq/Makefile | Use dedicated interrupt-test configuration. |
| kernel/irq/Kconfig | Add interrupt-refcount test configuration. |
| kernel/futex/core.c | Order hash publication before grace-period tracking. |
| kernel/dma/swiotlb.c | Respect default pool growth configuration. |
| io_uring/tw.c | Protect task-work publication with RCU. |
| io_uring/memmap.h | Update region-accounting arguments. |
| io_uring/loop.c | Register loop callers for cancellation. |
| io_uring/bpf_filter.c | Mark shared source filters copy-on-write. |
| init/Kconfig | Detect inline-memset compiler flags. |
| include/vdso/getrandom.h | Correct documentation wording. |
| include/uapi/linux/random.h | Correct documented member name. |
| include/uapi/linux/alloc_tag.h | Make counter padding explicit. |
| include/sound/soc-component.h | Update component construction interfaces. |
| include/sound/cs35l56.h | Define additional capture port. |
| include/sound/control.h | Extend virtual-master hook arguments. |
| include/net/xdp.h | Add reusable-buffer flag reset support. |
| include/net/strparser.h | Separate parser state flags into bytes. |
| include/net/sch_generic.h | Add TC egress detection. |
| include/net/netfilter/nf_flow_table.h | Generalize pending-flow flag. |
| include/net/ip.h | Add checksum-start validation. |
| include/net/can.h | Add CAN packet identifiers. |
| include/net/bluetooth/rfcomm.h | Define closed-DLC state. |
| include/net/amt.h | Remove obsolete skb control state. |
| include/linux/usb/serial.h | Declare dynamic-ID attribute removal. |
| include/linux/tty.h | Add timed-break wait state. |
| include/linux/skbuff.h | Broaden egress-flag availability. |
| include/linux/sched/ext.h | Add per-task queue sequencing. |
| include/linux/rtnetlink.h | Update TX queue-skip interfaces. |
| include/linux/perf_event.h | Update event-header initialization. |
| include/linux/nvme.h | Correct zone-report filter values. |
| include/linux/nsproxy.h | Declare namespace-proxy freeing. |
| include/linux/netfs.h | Declare post-resize stale-data cleanup. |
| include/linux/netfilter_netdev.h | Align egress-flag configuration guards. |
| include/linux/netdevice.h | Extend wireless device-path information. |
| include/linux/mtd/nand.h | Declare pipelined ECC detection. |
| include/linux/mount.h | Classify unmount state as internal. |
| include/linux/kvm_host.h | Remove VCPU-ID bitmap. |
| include/linux/io_uring_types.h | Track inherited ring restrictions. |
| include/linux/hrtimer_rearm.h | Clear correct thread-flag mask. |
| include/linux/cpufreq.h | Add reference-frequency driver support. |
| include/linux/can/skb.h | Initialize CAN packet identifiers. |
| include/linux/can/core.h | Update CAN identifier helper arguments. |
| fs/xfs/libxfs/xfs_log_format.h | Clarify legacy intent-flag compatibility. |
| fs/smb/client/cifsfs.h | Pass previous sizes to resize helpers. |
| fs/notify/mark.c | Respect filesystem notification restrictions. |
| fs/netfs/internal.h | Declare pre-resize stale-data cleanup. |
| fs/netfs/direct_write.c | Clear stale data before extending writes. |
| fs/netfs/buffered_read.c | Zero unread portions of folio gaps. |
| fs/fs_context.c | Reject internal-superblock reconfiguration. |
| fs/file_table.c | Respect mount-reference consumption. |
| fs/fcntl.c | Reject immutable-inode write-hint changes. |
| fs/ext4/super.c | Warn about journal-data deprecation. |
| fs/btrfs/transaction.c | Clear setup state on early exit. |
| fs/btrfs/scrub.c | Release roots on path-resolution failure. |
| drivers/virt/nitro_enclaves/ne_misc_dev.c | Detach failed enclave file state. |
| drivers/usb/typec/anx7411.c | Quiesce interrupts and work on removal. |
| drivers/usb/storage/sierra_ms.c | Reject incomplete control responses. |
| drivers/usb/serial/bus.c | Adjust dynamic-ID teardown ordering. |
| drivers/usb/host/ohci-st.c | Disable removal-time wakeup support. |
| drivers/usb/host/ohci-spear.c | Disable removal-time wakeup support. |
| drivers/usb/host/ohci-s3c2410.c | Disable removal-time wakeup support. |
| drivers/usb/host/ohci-da8xx.c | Disable wakeup during cleanup. |
| drivers/usb/gadget/udc/aspeed-vhub/vhub.h | Declare deferred wakeup work. |
| drivers/usb/gadget/udc/aspeed-vhub/dev.c | Reject wakeup for unregistered gadgets. |
| drivers/usb/gadget/function/f_midi2.c | Expand MIDI jack descriptor storage. |
| drivers/usb/dwc3/dwc3-am62.c | Balance error-path runtime-PM references. |
| drivers/usb/dwc2/hcd.c | Shut down wakeup timer synchronously. |
| drivers/usb/class/cdc-acm.h | Remove obsolete counter snapshots. |
| drivers/usb/chipidea/ci_hdrc_tegra.c | Disable runtime PM after resume failure. |
| drivers/usb/cdns3/cdns3-pci-wrap.c | Defer incomplete multifunction initialization. |
| drivers/usb/cdns3/cdns3-gadget.c | Cancel work after releasing interrupts. |
| drivers/tty/vt/selection.c | Avoid selection-length underflow. |
| drivers/tty/vcc.c | Initialize packets and lock TTY cleanup. |
| drivers/tty/serial/vt8500_serial.c | Release clocks after enable failure. |
| drivers/tty/serial/sifive.c | Avoid injected newlines for Braille consoles. |
| drivers/tty/serial/imx.c | Avoid injected newlines for Braille consoles. |
| drivers/tty/serial/amba-pl011.c | Avoid injected newlines for Braille consoles. |
| drivers/tty/serial/8250/8250_bcm7271.c | Reorder removal-time timer cancellation. |
| drivers/thunderbolt/stream.c | Advertise NOWAIT support. |
| drivers/thunderbolt/quirks.c | Disable unstable dock link states. |
| drivers/thunderbolt/nhi_regs.h | Remove reset register definitions. |
| drivers/tee/tee_shm.c | Reject zero-page dynamic allocations. |
| drivers/tee/qcomtee/qcomtee_object.h | Document argument-type count. |
| drivers/tee/qcomtee/qcomtee_msg.h | Correct documented member name. |
| drivers/tee/qcomtee/async.c | Correct documented parameter references. |
| drivers/tee/optee/optee_msg.h | Clarify FF-A offset units. |
| drivers/staging/greybus/uart.c | Reset saved terminal settings. |
| drivers/spi/spi-xilinx.c | Correct comment spelling. |
| drivers/spi/spi-sun6i.c | Correct comment spelling. |
| drivers/spi/spi-stm32.c | Correct comment spelling. |
| drivers/spi/spi-s3c64xx.c | Correct comment wording. |
| drivers/spi/spi-pic32.c | Correct comment wording. |
| drivers/spi/spi-mxic.c | Unwind clocks after resume failure. |
| drivers/spi/spi-mtk-nor.c | Balance error-path runtime-PM references. |
| drivers/spi/spi-dw-mmio.c | Configure generic DMA support. |
| drivers/spi/spi-bcm63xx.c | Correct comment spelling. |
| drivers/spi/spi-atmel.c | Use DMA submission helpers. |
| drivers/spi/spi-at91-usart.c | Use DMA submission helpers. |
| drivers/spi/Makefile | Register Realtek NOR driver. |
| drivers/soundwire/intel_auxdevice.c | Extend wake-capable codec identifiers. |
| drivers/rtc/rtc-mpfs.c | Validate reference-clock acquisition. |
| drivers/rtc/dev.c | Initialize alarm ioctl storage. |
| drivers/ptp/ptp_ocp.c | Correct initial timing bound. |
| drivers/of/irq.c | Release interrupt-controller node references. |
| drivers/of/base.c | Release Coreboot lookup references. |
| drivers/nvme/target/pci-epf.c | Reject undersized SGL segments. |
| drivers/nvme/target/nvmet.h | Add namespace I/O lifetime state. |
| drivers/nvme/target/fabrics-cmd-auth.c | Correct challenge-message sizing. |
| drivers/nvme/host/fc.c | Remove controller-deletion warning. |
| drivers/net/wireless/ti/wlcore/main.c | Balance incomplete-initialization PM references. |
| drivers/net/wireless/nxp/nxpwifi/uap_event.c | Remove deauthenticated station entries. |
| drivers/net/wireless/nxp/nxpwifi/init.c | Synchronize wakeup-timer cleanup. |
| drivers/net/wireless/nxp/nxpwifi/11n.c | Correct BA-entry validity handling. |
| drivers/net/wireless/nxp/nxpwifi/11n_aggr.c | Release failed aggregate packets. |
| drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | Extend BA deletion event layout. |
| drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.h | Track separate SAR table versions. |
| drivers/net/wireless/mediatek/mt76/mt7925/mac.c | Exclude automatic band selection from TGID. |
| drivers/net/wireless/mediatek/mt76/mt7603/init.c | Initialize global WCID. |
| drivers/net/wireless/mediatek/mt76/mt76.h | Add primary-link WCID lookup. |
| drivers/net/wireless/intel/iwlegacy/3945-mac.c | Release EEPROM data on removal. |
| drivers/net/wireless/ath/ath9k/wmi.h | Track command response status. |
| drivers/net/wireless/ath/ath9k/htc.h | Remove RX initialization state. |
| drivers/net/wireless/ath/ath12k/core.h | Remove panic-notifier state. |
| drivers/net/wireless/ath/ath11k/mac.c | Reset station accounting on start. |
| drivers/net/wireguard/queueing.h | Preserve encapsulated timestamp types. |
| drivers/net/wireguard/noise.c | Validate handshake initiation identity. |
| drivers/net/virtio_net.c | Initialize receive header context. |
| drivers/net/veth.c | Refresh peer XDP capabilities. |
| drivers/net/team/team_mode_broadcast.c | Free packets without eligible ports. |
| drivers/net/pcs/pcs-rzn1-miic.c | Reset register protection before unlocking. |
| drivers/net/ethernet/stmicro/stmmac/stmmac.h | Rename service-VLAN accounting state. |
| drivers/net/ethernet/stmicro/stmmac/hwif.h | Update VLAN hash-operation arguments. |
| drivers/net/ethernet/realtek/r8169_main.c | Disable EEE on affected hardware. |
| drivers/net/ethernet/microchip/vcap/vcap_api.c | Stop scanning after deleting matching keys. |
| drivers/net/ethernet/microchip/sparx5/sparx5_tc_matchall.c | Free removed matchall entries. |
| drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c | Preserve MAC assignment provenance. |
| drivers/net/ethernet/microchip/sparx5/sparx5_main.h | Track MAC assignment provenance. |
| drivers/net/ethernet/microchip/sparx5/sparx5_main.c | Mark generated MAC addresses random. |
| drivers/net/ethernet/mellanox/mlxsw/spectrum.h | Declare ACL rule-information freeing. |
| drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | Handle absent timestamp completions. |
| drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | Order completion-space publication. |
| drivers/net/ethernet/marvell/mvneta.c | Reset reusable XDP flags. |
| drivers/net/ethernet/intel/ice/ice_txrx.c | Order descriptor doorbell writes. |
| drivers/net/ethernet/intel/ice/ice_eswitch.c | Release referenced metadata destinations. |
| drivers/net/ethernet/intel/ice/devlink/port.c | Erase VSI indexing before freeing. |
| drivers/net/ethernet/intel/e1000e/netdev.c | Add ThinkPad power-management quirk. |
| drivers/net/ethernet/broadcom/genet/bcmgenet.h | Track receive buffer offsets and sizes. |
| drivers/net/ethernet/broadcom/bnxt/bnxt.h | Remove PCI channel-freeze state. |
| drivers/net/ethernet/airoha/airoha_eth.h | Define traffic-meter retry limits. |
| drivers/net/dsa/microchip/ksz_common.h | Correct port-status register offset. |
| drivers/net/can/vxcan.c | Reset identifiers across namespaces. |
| drivers/net/can/usb/f81604.c | Correct interrupt-data structure layout. |
| drivers/net/can/dev/skb.c | Initialize CAN packet header offsets. |
| drivers/net/bonding/bond_main.c | Balance XDP references and static keys. |
| drivers/mtd/spi-nor/core.c | Release exclusive-operation locking automatically. |
| drivers/mtd/nand/ecc.c | Add pipelined ECC detection. |
| drivers/mtd/mtdcore.c | Correct cleanup and master-device acquisition. |
| drivers/mtd/devices/block2mtd.c | Reject zero erase sizes. |
| drivers/mmc/host/sdhci-sprd.c | Quiesce runtime PM before removal. |
| drivers/mmc/host/mtk-sd.c | Cancel request-timeout work on removal. |
| drivers/mmc/host/cavium-thunderx.c | Destroy slot platform devices. |
| drivers/mmc/host/cavium-octeon.c | Destroy slot platform devices. |
| drivers/md/dm-crypt.c | Reject LMK with AEAD transforms. |
| drivers/input/keyboard/atkbd.c | Add IdeaPad keyboard quirk. |
| drivers/iio/proximity/vl53l0x-i2c.c | Claim direct mode for raw reads. |
| drivers/iio/proximity/sx9324.c | Correct scan sample precision. |
| drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | Unregister devices after PM setup failure. |
| drivers/iio/proximity/isl29501.c | Use signed register-write results. |
| drivers/iio/pressure/rohm-bm1390.c | Propagate measurement errors. |
| drivers/iio/pressure/bmp280-core.c | Correct sampling-frequency table bounds. |
| drivers/iio/industrialio-trigger.c | Cancel trigger reenable work before freeing. |
| drivers/iio/imu/adis16480.c | Use protected debugfs operations. |
| drivers/iio/imu/adis16400.c | Protect serial-number debugfs operations. |
| drivers/iio/health/max30102.c | Check FIFO status before scan-mask access. |
| drivers/iio/gyro/adis16136.c | Protect serial-number debugfs operations. |
| drivers/iio/frequency/adf4377.c | Initialize clock registration structures. |
| drivers/iio/dac/rohm-bd79703.c | Validate raw-write selectors. |
| drivers/iio/adc/pac1934.c | Handle label-allocation failure. |
| drivers/iio/adc/max1363.c | Sign-extend differential measurements. |
| drivers/iio/adc/axp288_adc.c | Add Haier bias-current quirk. |
| drivers/iio/adc/aspeed_adc.c | Propagate reset-deassertion errors. |
| drivers/iio/adc/adi-axi-adc.c | Initialize device mutex. |
| drivers/iio/adc/ad7173.c | Correct enhanced-filter field placement. |
| drivers/iio/accel/sca3000.c | Correct sampling-frequency selection flow. |
| drivers/iio/accel/kxcjk-1013.c | Skip unchanged event configurations. |
| drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | Account for input-body buffer sizing. |
| drivers/hid/hid-universal-pidff.c | Add VelocityOne Race support. |
| drivers/hid/hid-multitouch.c | Permanently stop removal-time timers. |
| drivers/hid/hid-ids.h | Define Turtle Beach device identifiers. |
| drivers/hid/bpf/hid_bpf_dispatch.c | Correct signed response-length comparison. |
| drivers/gpu/drm/xe/xe_bo.h | Declare pin-accounting helpers. |
| drivers/gpu/drm/vc4/vc4_validate.c | Pass bin-slot allocation timeout. |
| drivers/gpu/drm/vc4/vc4_drv.h | Extend bin-slot allocation arguments. |
| drivers/gpu/drm/vc4/vc4_drv.c | Release firmware references on failure. |
| drivers/gpu/drm/panthor/panthor_sched.c | Validate group queue counts. |
| drivers/gpu/drm/nouveau/nvkm/engine/device/user.c | Handle absent GSP resource management. |
| drivers/gpu/drm/nouveau/nouveau_abi16.c | Restrict Turing graphics workaround. |
| drivers/gpu/drm/mediatek/mtk_hdmi_regs_v2.h | Correct downsampling register offset. |
| drivers/gpu/drm/mediatek/mtk_hdmi_ddc_v2.c | Balance adapter-registration PM references. |
| drivers/gpu/drm/i915/gt/intel_rps.c | Avoid unmasking inactive RPS interrupts. |
| drivers/gpu/drm/i915/display/intel_display_params.h | Add disabled-by-default DC balance control. |
| drivers/gpu/drm/i915/display/intel_display_params.c | Expose DC balance parameter. |
| drivers/gpu/drm/gud/gud_pipe.c | Correct connector-state fallback selection. |
| drivers/gpu/drm/drm_fb_helper.c | Defer restoration after framebuffer probe failures. |
| drivers/gpu/drm/display/drm_dp_helper.c | Propagate backlight-enable errors. |
| drivers/gpu/drm/aspeed/aspeed_gfx_drv.c | Manage clock enabling and cleanup. |
| drivers/gpu/drm/amd/display/dc/resource/dce80/dce80_resource.c | Initialize display configuration defaults. |
| drivers/gpu/drm/amd/display/dc/dml2_0/Makefile | Correct sanitizer flag detection. |
| drivers/gpu/drm/amd/display/dc/dml/Makefile | Correct sanitizer flag detection. |
| drivers/gpu/drm/amd/display/dc/dc.h | Track panel-mode initialization. |
| drivers/gpu/drm/amd/amdgpu/vi.c | Add Radeon reset quirk. |
| drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | Remove SDMA user-queue registration. |
| drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c | Preserve requested TLB flush types. |
| drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | Preserve requested TLB flush types. |
| drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | Release failed sysfs instance objects. |
| drivers/gpio/gpio-xilinx.c | Balance runtime-PM request failures. |
| drivers/firmware/cirrus/cs_dsp.c | Clear running state on startup failure. |
| drivers/edac/versalnet_edac.c | Release remote-processor reference. |
| drivers/cpufreq/cpufreq.c | Use driver-provided reference frequencies. |
| drivers/clk/qcom/gpucc-kaanapali.c | Adjust GPU power-domain voting. |
| drivers/clk/qcom/gpucc-glymur.c | Adjust GPU power-domain voting. |
| drivers/char/tpm/tpm2-sessions.c | Fail invalid null-key integrity checks. |
| drivers/char/tpm/tpm-interface.c | Respect TPM buffer capacity. |
| drivers/char/mem.c | Handle potentially shared zero mappings. |
| drivers/block/virtio_blk.c | Set zoned write granularity. |
| drivers/block/drbd/drbd_nl_gen.c | Remove multicast-group definitions. |
| drivers/android/binderfs.c | Register devices before publishing dentries. |
| drivers/android/binder.c | Clean up superseded transaction fixups. |
| Documentation/networking/strparser.rst | Document teardown locking requirements. |
| Documentation/driver-api/driver-model/devres.rst | Remove obsolete SPI helper entries. |
| Documentation/devicetree/bindings/spi/snps,dw-apb-ssi.yaml | Add SL2610 compatible string. |
| Documentation/devicetree/bindings/soundwire/qcom,soundwire.yaml | Add Shikra SoundWire compatibility. |
| Documentation/devicetree/bindings/sound/qcom,msm8916-wcd-digital-codec.yaml | Add SDM670 codec compatibility. |
| Documentation/devicetree/bindings/sound/nvidia,tegra-audio-common.yaml | Describe auxiliary audio devices. |
| Documentation/arch/arm64/silicon-errata.rst | Document Cortex-A725 erratum support. |
| block/mq-deadline.c | Correct callback-origin comment. |
| block/fops.c | Reject conflicting polling and metadata modes. |
| arch/x86/um/ptrace_32.c | Enable register-offset definitions. |
| arch/x86/um/asm/ptrace.h | Enable register macros consistently. |
| arch/x86/kvm/vmx/tdx.c | Remove obsolete VCPU-count check. |
| arch/x86/kvm/svm/svm.h | Track full-ASID flush requirements. |
| arch/x86/kvm/mmu/mmu.c | Reject invalid shadow-walk roots. |
| arch/x86/kernel/cpu/amd.c | Detect affected TLBI implementations. |
| arch/x86/include/asm/tlb.h | Repeat TLBSYNC on affected CPUs. |
| arch/x86/entry/vdso/vdso64/Makefile | Apply inline-memset compiler flags. |
| arch/um/drivers/vector_transports.c | Set network headers before conversion. |
| arch/s390/kernel/vdso/Makefile | Apply inline-memset compiler flags. |
| arch/riscv/mm/extable.c | Use native-word alignment masks. |
| arch/riscv/kvm/aia_device.c | Use VCPU-creation state helper. |
| arch/riscv/kernel/vdso/Makefile | Apply inline-memset compiler flags. |
| arch/riscv/kernel/suspend.c | Clear hypervisor CSRs on resume. |
| arch/riscv/kernel/smpboot.c | Clear secondary-CPU hypervisor CSRs. |
| arch/riscv/kernel/setup.c | Clear boot-CPU hypervisor CSRs. |
| arch/riscv/kernel/patch.c | Map executable-memory patch targets. |
| arch/riscv/kernel/entry.S | Correct shadow-stack loading conditions. |
| arch/riscv/Kconfig.socs | Restrict SiFive platforms to 64-bit. |
| arch/riscv/Kconfig | Adjust architecture-specific CPU-count limits. |
| arch/riscv/include/uapi/asm/vendor/mips.h | Use userspace-safe bit constant. |
| arch/riscv/include/asm/futex.h | Untag futex user addresses. |
| arch/riscv/include/asm/errata_list_vendors.h | Register additional SiFive erratum. |
| arch/riscv/include/asm/cpufeature.h | Declare hypervisor-CSR cleanup. |
| arch/powerpc/kernel/vdso/Makefile | Apply inline-memset compiler flags. |
| arch/loongarch/vdso/Makefile | Apply inline-memset compiler flags. |
| arch/arm64/tools/cpucaps | Generalize broken-AMU capability naming. |
| arch/arm64/mm/mmu.c | Correct TLB flush range endpoints. |
| arch/arm64/kvm/emulate-nested.c | Populate nested trap forwarding consistently. |
| arch/arm64/kernel/vdso/Makefile | Apply inline-memset compiler flags. |
| arch/arm64/kernel/Makefile | Exclude stack-switching code from KCOV. |
| arch/arm64/kernel/cpufeature.c | Use generalized AMU workaround. |
| arch/arm64/boot/dts/qcom/x1-microsoft-denali.dtsi | Adjust microphone pins and sample clock. |
| arch/arm64/boot/dts/freescale/imx8mp-var-dart-sonata.dts | Supply SD interface signaling voltage. |
| arch/arc/kernel/smp.c | Remove unused profiling include. |
| arch/arc/kernel/setup.c | Release CPU clock references. |
| arch/arc/Kconfig | Remove obsolete LL/SC restriction. |
| arch/arc/include/asm/atomic64-arcv2.h | Add relaxed atomic64 compare-exchange. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+514
to
+516
| lock_sock(strp->sk); | ||
| /* sync with pending strp_recv */ | ||
| release_sock(strp->sk); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream merge