aboutsummaryrefslogtreecommitdiffstats
path: root/drivers (follow)
AgeCommit message (Collapse)AuthorFilesLines
2025-09-19clk: keystone: sci-clk: use devm_kmemdup_array()Raag Jadav1-4/+1
Convert to use devm_kmemdup_array() which is more robust. Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Nishanth Menon <nm@ti.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-09-19clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabledMatthias Schiffer1-0/+2
As described in AM335x Errata Advisory 1.0.42, WKUP_DEBUGSS_CLKCTRL can't be disabled - the clock module will just be stuck in transitioning state forever, resulting in the following warning message after the wait loop times out: l3-aon-clkctrl:0000:0: failed to disable Just add the clock to enable_init_clks, so no attempt is made to disable it. Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com> Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Acked-by: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-09-19clk: amlogic: fix recent code refactoringMarek Szyprowski1-1/+1
Commit 4c4e17f27013 ("clk: amlogic: naming consistency alignment") refactored some internals in the g12a meson clock driver. Unfortunately it introduced a bug in the clock init data, which results in the following kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ... Data abort info: ... [0000000000000000] user address but active_mm is swapper Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc1+ #11158 PREEMPT Hardware name: Hardkernel ODROID-N2 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __clk_register+0x60/0x92c lr : __clk_register+0x48/0x92c ... Call trace: __clk_register+0x60/0x92c (P) devm_clk_hw_register+0x5c/0xd8 meson_eeclkc_probe+0x74/0x110 g12a_clkc_probe+0x2c/0x58 platform_probe+0x5c/0xac really_probe+0xbc/0x298 __driver_probe_device+0x78/0x12c driver_probe_device+0xdc/0x164 __driver_attach+0x9c/0x1ac bus_for_each_dev+0x74/0xd0 driver_attach+0x24/0x30 bus_add_driver+0xe4/0x208 driver_register+0x60/0x128 __platform_driver_register+0x24/0x30 g12a_clkc_driver_init+0x1c/0x28 do_one_initcall+0x64/0x308 kernel_init_freeable+0x27c/0x4f8 kernel_init+0x20/0x1d8 ret_from_fork+0x10/0x20 Code: 52800038 aa0003fc b9010018 52819801 (f9400260) ---[ end trace 0000000000000000 ]--- Fix this by correcting the clock init data. Fixes: 4c4e17f27013 ("clk: amlogic: naming consistency alignment") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on BananPi M2S Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Jerome Brunet <jbrunet@baylibre.com> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2025-09-19Merge tag 'sunxi-clk-fixes-for-6.17' of ↵Stephen Boyd1-1/+1
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull an Allwinner clk driver fix from Chen-Yu Tsai: - One fix for the clock rate readback on the recently added dual divider clocks * tag 'sunxi-clk-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: mp: Fix dual-divider clock rate readback
2025-09-20firewire: core: fix overlooked update of subsystem ABI versionTakashi Sakamoto1-1/+1
In kernel v6.5, several functions were added to the cdev layer. This required updating the default version of subsystem ABI up to 6, but this requirement was overlooked. This commit updates the version accordingly. Fixes: 6add87e9764d ("firewire: cdev: add new version of ABI to notify time stamp at request/response subaction of transaction#") Link: https://lore.kernel.org/r/20250920025148.163402-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2025-09-19net: stmmac: remove mac_interfaceRussell King (Oracle)4-8/+6
mac_interface has served little purpose, and has only caused confusion. Now that we have cleaned up all platform glue drivers which should not have been using mac_interface, there are no users remaining. Remove mac_interface. This results in the special dwmac specific "mac-mode" DT property becoming redundant, and an in case, no DTS files in the kernel make use of this property. Add a warning if the property is set, and it is different from the "phy-mode". Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Acked-by: Vladimir Zapolskiy <vz@mleia.com> Link: https://patch.msgid.link/E1uytpv-00000006H2x-196h@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: thead: convert to use phy_interfaceRussell King (Oracle)1-12/+12
dwmac-thead supports either MII or RGMII interface modes only. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-thead to use phy_interface when determining the interface mode rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpq-00000006H2q-0ajY@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: sun8i: convert to use phy_interfaceRussell King (Oracle)1-2/+2
dwmac-sun8i supports MII, RMII and RGMII interface modes only. It is unclear whether the dwmac core interface is different from the one presented to the outside world. However, as none of the DTS files set "mac-mode", mac_interface will be identical to phy_interface. Convert dwmac-sun8i to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Acked-by: Chen-Yu Tsai <wens@csie.org> Link: https://patch.msgid.link/E1uytpl-00000006H2k-08pH@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: stm32: convert to use phy_interfaceRussell King (Oracle)1-13/+13
dwmac-stm32 supports MII, RMII, GMII and RGMII interface modes, selecting the dwmac core interface mode via bits 23:21 of the SYSCFG register. The bit combinations are identical to the dwmac phy_intf_sel_i signals. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-stm32 to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpf-00000006H2c-3hiU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: starfive: convert to use phy_interfaceRussell King (Oracle)1-3/+3
dwmac-starfive uses RMII or RGMII interface modes without any PCS, and selects the dwmac core accordingly using a register field with the same bit encoding as the core's phy_intf_sel_i signals. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-starfive to use phy_interface when determining the interface mode rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpa-00000006H2X-3GWx@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: socfpga: convert to use phy_interfaceRussell King (Oracle)1-1/+1
dwmac-socfpga uses MII, RMII, GMII, RGMII, SGMII and 1000BASE-X interface modes, and supports the Lynx PCS. The Lynx PCS will only be used for SGMII and 1000BASE-X modes, with the MAC programmed to use GMII or MII mode to talk to the PCS. This suggests that the Synopsys optional dwmac PCS is not present. None of the DTS files set "mac-mode", so mac_interface will be identical to phy_interface. Convert dwmac-socfpga to use phy_interface when determining the interface mode rather than mac_interface. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpV-00000006H2R-2nA6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: ingenic: convert to use phy_interfaceRussell King (Oracle)1-10/+15
dwmac-ingenic uses only MII, RMII, GMII or RGMII interface modes, none of which require any kind of conversion between the MAC and external world. Thus, mac_interface and phy_interface will be the same. Convert dwmac-ingenic to use phy_interface when determining the interface mode that the dwmac core should be configured to at reset, rather than mac_interface. Also convert the error prints to use phy_modes() and terminate with a newline so that we get a human readable string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpQ-00000006H2L-2Jzb@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: imx: convert to use phy_interfaceRussell King (Oracle)1-10/+10
Checking the IMX8MP documentation, there is no requirement for a separate mac_interface mode definition. As mac_interface and phy_interface will be the same, use phy_interface internally rather than mac_interface. Also convert the error prints to use phy_modes() so that we get a meaningful string rather than a number for the interface mode. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpL-00000006H2F-1o6b@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: stmmac: use phy_interface in stmmac_check_pcs_mode()Russell King (Oracle)1-0/+3
In the majority, if not all cases, mac_interface and phy_interface are the same with the exception of some drivers that I have suggested only use phy_interface and set mac_interface to PHY_INTERFACE_MODE_NA. The only two that currently set mac_interface to PHY_INTERFACE_MODE_NA are dwmac-loongson and dwmac-lpc18xx, neither of which use RGMII nor SGMII. In order to phase out the use of mac_interface, we need to have a path for existing drivers so they can update to only using phy_interface without causing regressions. Therefore, in order to keep the "pcs" code working, we need to choose the STMMAC integrated PCS mode based on phy_interface if mac_interface is PHY_INTERFACE_MODE_NA. This will allow more drivers to set mac_interface to PHY_INTERFACE_MODE_NA without risking regressions. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Link: https://patch.msgid.link/E1uytpG-00000006H29-1Ltk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net/mlx5: Remove dead code from total_vfs setterVlad Dumitrescu1-11/+2
The mlx5_devlink_total_vfs_set function branches based on per_pf_support twice. Remove the second branch as the first one exits the function when per_pf_support is false. Accidentally added as part of commit a4c49611cf4f ("net/mlx5: Implement devlink total_vfs parameter"). Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/linux-rdma/aMQWenzpdjhAX4fm@stanley.mountain/ Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com> Link: https://patch.msgid.link/a6142a60-1948-439a-b0ae-ff1df26a37f8@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: phy: micrel: use %pe in print formatJakub Kicinski1-4/+4
New cocci check complains: drivers/net/phy/micrel.c:4308:6-13: WARNING: Consider using %pe to print PTR_ERR() drivers/net/phy/micrel.c:5742:6-13: WARNING: Consider using %pe to print PTR_ERR() Link: https://lore.kernel.org/1758192227-701925-1-git-send-email-tariqt@nvidia.com Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20250918183119.2396019-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19ethernet: rvu-af: Remove slash from the driver namePetr Malat1-2/+1
Having a slash in the driver name leads to EIO being returned while reading /sys/module/rvu_af/drivers content. Remove DRV_STRING as it's not used anywhere. Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") Signed-off-by: Petr Malat <oss@malat.biz> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250918152106.1798299-1-oss@malat.biz Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19ptp_ocp: make ptp_ocp driver compatible with PTP_EXTTS_REQUEST2Vadim Fedorenko1-4/+2
Originally ptp_ocp driver was not strictly checking flags for external timestamper and was always activating rising edge timestamping as it's the only supported mode. Recent changes to ptp made it incompatible with PTP_EXTTS_REQUEST2 ioctl. Adjust ptp_clock_info to provide supported mode and be compatible with new infra. While at here remove explicit check of periodic output flags from the driver and provide supported flags for ptp core to check. Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20250918131146.651468-1-vadim.fedorenko@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: ti: icssm-prueth: unwind cleanly in probe()Dan Carpenter1-16/+14
This error handling triggers a Smatch warning: drivers/net/ethernet/ti/icssm/icssm_prueth.c:1574 icssm_prueth_probe() warn: 'prueth->pru1' is an error pointer or valid The warning is harmless because the pru_rproc_put() function has an IS_ERR_OR_NULL() check built in. However, there is a small bug if syscon_regmap_lookup_by_phandle() fails. In that case we should call of_node_put() on eth0_node and eth1_node. It's a little bit easier to re-write this code to only free things which we know have been allocated successfully. Fixes: 511f6c1ae093 ("net: ti: icssm-prueth: Adds ICSSM Ethernet driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Parvathi Pudi <parvathi@couthit.com> Link: https://patch.msgid.link/aMvVagz8aBRxMvFn@stanley.mountain Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net/mlx5e: Add flow rules for the decrypted ESP packetsJianbo Liu3-17/+241
The previous commit introduced two new flow groups to enable L4 RSS for decrypted IPsec traffic. This commit implements the logic to populate these groups with the necessary steering rules. The rules are created dynamically whenever the first IPSec offload rule is configured via the xfrm subsystem and the decryption tables for RX are created. Each rule matches a specific decrypted traffic type based on its ip version (or ethertype) and outer/inner l4_type_ext, directing it to the appropriate L4 RSS-enabled TIR. The lifecycle of these steering rules is tied directly to the RX tables. They are deleted when the RX tables are destroyed. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1758179963-649455-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net/mlx5e: Add flow groups for the packets decrypted by crypto offloadJianbo Liu5-6/+85
When using IPsec crypto offload, the hardware decrypts the packet payload but preserves the ESP header. This prevents the standard RSS mechanism from accessing the inner L4 (TCP/UDP) headers. As a result, the RSS hash is calculated only on the outer L3 IP headers, causing all traffic for a given IPsec tunnel to be directed to a single queue, leading to poor traffic distribution. Newer firmware introduces the ability to match on l4_type_ext, which exposes the L4 protocol type following an ESP header. This allows the driver to create steering rules that can identify the inner protocols of decrypted packets. This commit leverages this new capability to improve traffic distribution. It adds two new flow groups to steer decrypted packets to dedicated TIRs that was configured to perform RSS on the inner L4 headers. These groups are inserted after the standard L4 group and before the group that handles undecrypted ESP packets added in this series. The first new group matches decrypted packets based on the outer IP version (or ethertype) and l4_type_ext. The second new group matches decrypted tunneled packets based on the inner IP version and l4_type_ext. Eight new traffic types are also defined to support this functionality. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1758179963-649455-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net/mlx5e: Recirculate decrypted packets into TTC tableJianbo Liu2-5/+23
In the commit 5e466345291a ("net/mlx5e: IPsec: Add IPsec steering in local NIC RX"), the decrypted packets are handled in RX error flow table. There is only one rule in the table, which forwards packets to the default ESP TIR. This patch updates the design to allow RSS after decryption. For ESP traffic, SPI and IP addresses are the fields selected for RSS hash, and it's common that only one SPI is configured in RX direction, so RSS can't work properly as all the packets are hashed to one key in this case. To take advantage of RSS and improve performance, the decrypted packets need to be forwarded back to TTC table, where RSS can work based on the decrypted packet types. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1758179963-649455-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net/mlx5: Change TTC rules to match on undecrypted ESP packetsJianbo Liu5-15/+109
The TTC (Traffic Type Classifier) table classifies the traffic and steers packet to TIRs, where RSS works based on the hash calculated from the selected packet fields. For AH/ESP packets, SPI and IP addresses are the fields used to calculate the hash value for RSS. So, it's hard to distribute packets to different receiving queues as there is usually only one SPI in that direction. IPSec hardware offloads, crypto offload and full (packet) offload were introduced later. For crypto offload, hardware does encryption, decryption and authentication, kernel does the others. Kernel always sends/receives formatted ESP packets with plaintext data instead of the ciphertext data, all other fields are unmodified. For full offload, hardware will take care of almost everything, kernel just sends/receives packets without any IPSec headers. Currently, all packets with ESP protocols are forwarded to IPSec offload tables if IPSec rules are configured. In a downstream patch, the decrypted packets will be recirculated to TTC table, in order to use RSS, which does the hash on L4 fields after IPSec headers are stripped by full offload. So those packets handled by crypto offload must filtered out, as they still have the ESP headers, but apparently no need to be decrypted again. To do that, ipsec_next_header is added for the packet matching, as it is valid only after passing through IPSec decryption. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1758179963-649455-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19net: tun: Update napi->skb after XDP processWang Liang1-0/+3
The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline] BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline] BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079 CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 skb_reset_mac_header include/linux/skbuff.h:3150 [inline] napi_frags_skb net/core/gro.c:723 [inline] napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:558 kasan_mempool_unpoison_object include/linux/kasan.h:388 [inline] napi_skb_cache_get+0x37b/0x6d0 net/core/skbuff.c:295 __alloc_skb+0x11e/0x2d0 net/core/skbuff.c:657 napi_alloc_skb+0x84/0x7d0 net/core/skbuff.c:811 napi_get_frags+0x69/0x140 net/core/gro.c:673 tun_napi_alloc_frags drivers/net/tun.c:1404 [inline] tun_get_user+0x77c/0x3e20 drivers/net/tun.c:1784 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kmem_cache_free+0x18f/0x400 mm/slub.c:4797 skb_pp_cow_data+0xdd8/0x13e0 net/core/skbuff.c:969 netif_skb_check_for_xdp net/core/dev.c:5390 [inline] netif_receive_generic_xdp net/core/dev.c:5431 [inline] do_xdp_generic+0x699/0x11a0 net/core/dev.c:5499 tun_get_user+0x2523/0x3e20 drivers/net/tun.c:1872 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f After commit e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode"), the original skb may be freed in skb_pp_cow_data() when XDP program was attached, which was allocated in tun_napi_alloc_frags(). However, the napi->skb still point to the original skb, update it after XDP process. Reported-by: syzbot+64e24275ad95a915a313@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=64e24275ad95a915a313 Fixes: e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode") Signed-off-by: Wang Liang <wangliang74@huawei.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20250917113919.3991267-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-09-19Merge tag 'iommu-fixes-v6.17-rc6' of ↵Linus Torvalds5-17/+54
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fixes for memory leak and memory corruption bugs on S390 and AMD-Vi - Race condition fix in AMD-Vi page table code and S390 device attach code - Intel VT-d: Fix alignment checks in __domain_mapping() - AMD-Vi: Fix potentially incorrect DTE settings when device has aliases * tag 'iommu-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/amd/pgtbl: Fix possible race while increase page table level iommu/amd: Fix alias device DTE setting iommu/s390: Make attach succeed when the device was surprise removed iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() iommu/s390: Fix memory corruption when using identity domain iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init()
2025-09-19cpufreq: intel_pstate: Use likely() optimization in intel_pstate_sample()Yaxiong Tian1-1/+1
The comment above the condition `if (cpu->last_sample_time)` clearly indicates that the branch is taken for the vast majority of invocations after the first sample in a cycle. The first sample is a one-time initialization case. Add likely() hint to the condition to improve branch prediction for this performance-critical path in intel_pstate_sample(). Signed-off-by: Yaxiong Tian <tianyaxiong@kylinos.cn> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-19cpufreq: Add defensive check during driver registrationZihuan Zhang1-0/+1
Currently, cpufreq allows drivers to implement both ->target() and ->target_index() callbacks, but that can lead to ambiguous or incorrect behavior. For this reason, prevent cpufreq drivers implementing both ->target() and ->target_index() at the same time from registering. This check can help to catch driver implementation mistakes early and improve overall robustness, without affecting existing valid drivers. Signed-off-by: Zihuan Zhang <zhangzihuan@kylinos.cn> Link: https://patch.msgid.link/20250908085738.31602-1-zhangzihuan@kylinos.cn [ rjw: Subject adjustment and changelog rewrite ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-19cpufreq: intel_pstate: Enable HWP without EPP if DEC is enabledRafael J. Wysocki1-16/+56
So far, HWP has never been enabled without EPP (Energy-Performance Preference) interface support, since the lack of the latter indicates an incomplete implementation of HWP, which was the case on early development vehicle platforms. However, HWP can be expected to work if DEC (Dynamic Efficiency Control) is enabled as indicated by setting bit 27 in MSR_IA32_POWER_CTL (DEC enable bit). Accordingly, allow HWP to be enabled if the EPP interface is not supported so long as DEC is enabled in the processor. Still, the EPP control sysfs interface is useless when EPP is not supported, so do not expose it in that case. Link: https://lore.kernel.org/linux-pm/20250904000608.260817-2-srinivas.pandruvada@linux.intel.com/ Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Co-developed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-19ACPI: processor: idle: Redefine two functions as voidRafael J. Wysocki1-22/+19
Notice that acpi_processor_power_init() and acpi_processor_power_exit() don't need to return any values because their callers don't check them anyway, so redefine those functions as void. While at it, rearrange the code in acpi_processor_power_init() to reduce the indentation level, get rid of a redundant local variable in that function, and rephrase a code comment in it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
2025-09-19ACPI: processor: Update cpuidle driver check in __acpi_processor_start()Rafael J. Wysocki1-1/+1
Commit 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") moved the ACPI idle driver registration to acpi_processor_driver_init() and acpi_processor_power_init() does not register an idle driver any more. Accordingly, the cpuidle driver check in __acpi_processor_start() needs to be updated to avoid calling acpi_processor_power_init() without a cpuidle driver, in which case the registration of the cpuidle device in that function would lead to a NULL pointer dereference in __cpuidle_register_device(). Fixes: 7a8c994cbb2d ("ACPI: processor: idle: Optimize ACPI idle driver registration") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/5044465.31r3eYUQgx@rafael.j.wysocki [ rjw: Changelog update ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-09-19vfio/pds: replace bitmap_free with vfreeZilin Guan1-1/+1
host_seq_bmp is allocated with vzalloc but is currently freed with bitmap_free, which uses kfree internally. This mismach prevents the resource from being released properly and may result in memory leaks or other issues. Fix this by freeing host_seq_bmp with vfree to match the vzalloc allocation. Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Reviewed-by: Brett Creeley <brett.creeley@amd.com> Link: https://lore.kernel.org/r/20250913153154.1028835-1-zilin@seu.edu.cn Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2025-09-19vfio: return -ENOTTY for unsupported device featureAlex Mastro1-1/+1
The two implementers of vfio_device_ops.device_feature, vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return -ENOTTY in the fallthrough case when the feature is unsupported. For consistency, the base case, vfio_ioctl_device_feature, should do the same when device_feature == NULL, indicating an implementation has no feature extensions. Signed-off-by: Alex Mastro <amastro@fb.com> Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2025-09-19hisi_acc_vfio_pci: Fix reference leak in hisi_acc_vfio_debug_initMiaoqian Lin1-1/+5
The debugfs_lookup() function returns a dentry with an increased reference count that must be released by calling dput(). Fixes: b398f91779b8 ("hisi_acc_vfio_pci: register debugfs for hisilicon migration driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Reviewed-by: Longfang Liu <liulongfang@huawei.com> Link: https://lore.kernel.org/r/20250901081809.2286649-1-linmq006@gmail.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2025-09-19vfio/platform: Mark reset drivers for removalAlex Williamson4-3/+9
While vfio-platform itself is on a reprieve from being removed[1], these reset drivers don't support any current hardware, are not being tested, and suggest a level of support that doesn't really exist. Mark them for removal to surface any remaining user such that we can potentially drop them and simplify the code if none appear. Link: https://lore.kernel.org/all/20250806170314.3768750-3-alex.williamson@redhat.com [1] Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Link: https://lore.kernel.org/r/20250825175807.3264083-3-alex.williamson@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2025-09-19vfio/amba: Mark for removalAlex Williamson2-1/+6
vfio-amba has only been touched to keep up with the rest of the code base for the past 10 years. We have no basis to believe that it's currently tested or used. Mark it for deprecation. Reviewed-by: Pranjal Shrivastava <praan@google.com> Reviewed-by: Mostafa Saleh <smostafa@google.com> Reviewed-by: Eric Auger <eric.auger@redhat.com> Link: https://lore.kernel.org/r/20250825175807.3264083-2-alex.williamson@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2025-09-19ASoC: fsl: fsl_qmc_audio: Reduce amount ofMark Brown1-11/+33
Merge series from Christophe Leroy <christophe.leroy@csgroup.eu>: This is a RESEND of v3 sent one month ago, see: https://lore.kernel.org/all/cover.1754993232.git.christophe.leroy@csgroup.eu/ This series reduces significantly the amount of interrupts on fsl_qmc_audio device. Patches 1 and 2 are preparatory patches. Patch 3 is the main change Patch 4 is a cleanup which is enabled by previous patch
2025-09-19Merge tag 'block-6.17-20250918' of git://git.kernel.dk/linuxLinus Torvalds6-0/+6
Pull block fixes from Jens Axboe: "A set of fixes for an issue with md array assembly and drbd for devices supporting write zeros" * tag 'block-6.17-20250918' of git://git.kernel.dk/linux: drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameter md: init queue_limits->max_hw_wzeroes_unmap_sectors parameter
2025-09-19Merge tag 'gpio-fixes-for-v6.17-rc7' of ↵Linus Torvalds2-2/+21
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an ACPI I2C HID driver breakage due to not initializing a structure on the stack and passing garbage down to GPIO core - ignore touchpad wakeup on GPD G1619-05 - fix debouncing configuration when looking up GPIOs in ACPI * tag 'gpio-fixes-for-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: acpi: initialize acpi_gpio_info struct gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05 gpiolib: acpi: Program debounce when finding GPIO
2025-09-19Input: atmel_mxt_ts - add support for generic touchscreen configurationsSvyatoslav Ryhel1-4/+7
This provides support for generic touchscreen configuration options like swapped-x-y, min-x, min-y, size-x, size-y, etc. Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com> Link: https://lore.kernel.org/r/20250909054903.11519-3-clamor95@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-09-19PCI: sg2042: Add Sophgo SG2042 PCIe driverChen Wang3-0/+145
Add support for PCIe controller in Sophgo SG2042 SoC. The controller uses the Cadence PCIe core programmed by pcie-cadence* common driver. The PCIe controller in SG2042 works in host mode only, supporting data rate up to 16 GT/s and lanes up to x16 or x8. Signed-off-by: Chen Wang <unicorn_wang@outlook.com> [mani: reworded description and minor code cleanups] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/01b0a57cd9dba8bed7c1f2d52997046c2c6f042b.1757643388.git.unicorn_wang@outlook.com
2025-09-19PCI: cadence: Check for the existence of cdns_pcie::ops before using itChen Wang3-6/+6
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This is going to be true for the upcoming Sophgo platform which doesn't set the ops. Hence, add a check to prevent NULL pointer dereference. Signed-off-by: Chen Wang <unicorn_wang@outlook.com> [mani: reworded subject and description] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
2025-09-19can: esd_usb: Avoid errors triggered from USB disconnectStefan Mätje1-8/+26
The USB stack calls during disconnect the esd_usb_disconnect() callback. esd_usb_disconnect() calls netdev_unregister() for each network which in turn calls the net_device_ops::ndo_stop callback esd_usb_close() if the net device is up. The esd_usb_close() callback tries to disable all CAN Ids and to reset the CAN controller of the device sending appropriate control messages. Sending these messages in .disconnect() is moot and always fails because either the device is gone or the USB communication is already torn down by the USB stack in the course of a rmmod operation. Move the code that sends these control messages to a new function esd_usb_stop() which is approximately the counterpart of esd_usb_start() to make code structure less convoluted. Then change esd_usb_close() not to send the control messages at all if the ndo_stop() callback is executed from the USB .disconnect() callback. Add a new flag in_usb_disconnect to the struct esd_usb device structure to mark this condition which is checked by esd_usb_close() whether to skip the send operations in esd_usb_start(). Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu> Link: https://patch.msgid.link/20250821143422.3567029-6-stefan.maetje@esd.eu [mkl: minor change patch description to imperative language] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: esd_usb: Rework display of error messagesStefan Mätje1-16/+20
- esd_usb_open(): Get rid of duplicate "couldn't start device: %d\n" message already printed from esd_usb_start(). - Fix duplicate printout of network device name when network device is registered. Add an unregister message for the network device as counterpart to the register message. - Add the printout of error codes together with the error messages in esd_usb_close() and some in esd_usb_probe(). The additional error codes should lead to a better understanding what is really going wrong. - Convert all occurrences of error status prints to use "ERR_PTR(err)" instead of printing the decimal value of "err". - Rename retval to err in esd_usb_read_bulk_callback() to make the naming of error status variables consistent with all other functions. Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu> Link: https://patch.msgid.link/20250821143422.3567029-5-stefan.maetje@esd.eu [mkl: minor change patch description to imperative language] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19Merge tag 'mmc-v6.17-rc2-2' of ↵Linus Torvalds4-20/+87
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mvsdio: Fix dma_unmap_sg() nents value - sdhci: Fix clock management for UHS-II - sdhci-pci-gli: Fix initialization of UHS-II for GL9767 * tag 'mmc-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a power-on mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function mmc: sdhci: Move the code related to setting the clock from sdhci_set_ios_common() into sdhci_set_ios() mmc: mvsdio: Fix dma_unmap_sg() nents value
2025-09-19can: rcar_can: Convert to %peGeert Uytterhoeven1-7/+7
Replace numerical error codes by mnemotechnic error codes, to improve the user experience in case of errors. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/adb2dc49c78b45191de410f645a5e423d341f94e.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: rcar_can: Do not print alloc_candev() failuresGeert Uytterhoeven1-1/+0
If alloc_candev() failed due to out-of-memory, the core memory allocation code has already printed an error message. If alloc_candev() failed for a different reason, alloc_netdev_mqs() has already printed an error message. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/2d6ad4be211a35492570fd7219ca7a89b384bfad.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: rcar_can: Mailbox bitfield conversionGeert Uytterhoeven1-5/+7
Convert CAN Mailbox Register field accesses to use the FIELD_PREP() and FIELD_GET() bitfield access macro. This gets rid of explicit shifts, and keeps a clear separation between hardware register layouts and offical CAN definitions. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/c75c7d6ed5929c4becf7c9178cec04a0731e8ab1.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: rcar_can: BCR bitfield conversionGeert Uytterhoeven1-7/+8
Convert CAN Bit Configuration Register field accesses to use the FIELD_PREP() bitfield access macro. While at it, fix the misspelling of BRP. This gets rid of custom function-like field preparation macros. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/01cfaedba2be22515ba8700893ea7f113df959c0.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: rcar_can: TFCR bitfield conversionGeert Uytterhoeven1-5/+2
Convert CAN Transmit FIFO Control Register field accesses to use the FIELD_GET() bitfield access macro. This gets rid of an explicit shift. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/a8b1dc6f1249a01af9b691ca59e2e5cc2dba6d44.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-09-19can: rcar_can: CTLR bitfield conversionGeert Uytterhoeven1-13/+20
Convert CAN Control Register field accesses to use the FIELD_PREP() bitfield access macro. Add a few more comments and definitions while at it. This gets rid of explicit (and sometimes confusing) shifts. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/077640e31949dc3c9d128a08ade94c9e9cd25672.1755857536.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>