usb: preserve error when doing request
Currently, USB request not distinguished different error and always return EIO.
However, some error are recoverable or ignorable in userspace.
Therefore, we preserve the meaning of different error to userspace then
allow userspace to decide how to use the return error.
Reviewed by: adrian
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52244
[mlir][xegpu] Make convert_layout input_layout optional (#210833)
Make the `input_layout` attribute of `xegpu.convert_layout` optional.
When it is not set, the effective input layout defaults to
`target_layout`, i.e. the source is assumed to already be in the target
distribution.
assisted-by-Claude
Co-authored-by: Claude Opus 4.8 <noreply at anthropic.com>
Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Fix a ublk recovery hang, where END_USER_RECOVERY without a
successful START_USER_RECOVERY could be satisfied by a stale
completion latch
- Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl
- MAINTAINERS email address update for Roger Pau Monne
* tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
MAINTAINERS: update my email address
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
ublk: wait on ublk_dev_ready() instead of ub->completion
Merge tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Fix a missing ERESTARTSYS conversion in the read paths, which got
messed up back when some code consolidation was done for read
multishot support
- zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of
"event" for consistency and to be less ambiguous for users. This was
added for 7.2, so let's rename it while we still can. No functional
or code changes, just a strict rename
* tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/zcrx: rename notif to event
io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS
io_uring/zcrx: drop "notif" from stats struct names
io_uring/rw: fix missing ERESTARTSYS conversion in read paths
Merge tag 'v7.2-rc4-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
"This contains eight ksmbd fixes covering POSIX ACL handling, SMB
signing enforcement, DACL parsing and construction hardening, session
lifetime handling, and validation of malformed transform and
compressed SMB2 requests:
- preserve inherited POSIX ACL mask when creating objects.
- enforce the session signing requirement for plaintext SMB requests.
- harden DACL/ACE processing against size overflows, incomplete ACE
copies, and undersized SIDs.
- defer teardown of a previous session until NTLM authentication
succeeds.
- reject undersized encryption-transform and decompressed SMB2
[11 lines not shown]
[mlir] [vector] Allow element/broadcast re-order for FMA if the source is a vector (#211208)
The diagnostic says the transform is not performed as the source may be
a scalar. But we can make it if we can check the source is not a scalar.
AI assisted.
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Eduard Zingerman:
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
sk_psock->cork for the local temporary message and freeing it again
(Chengfeng Ye)
- Reject passing scalar NULL to nonnull arg of a global subprog.
Previously the verifier did not account for the cases directly
passing scalars to a global subprog, e.g.: 'global_func(0);' would
pass even if 'global_func' argument was marked nonnull (Amery Hung)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
selftests/bpf: Test passing scalar NULL to nonnull global subprog
bpf: Reject passing scalar NULL to nonnull arg of a global subprog
security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
PR: 296874
Security: CVE-2026-11771
Security: CVE-2026-12932
Security: CVE-2026-12996
[9 lines not shown]
ietp: guard iicbus_get_addr with devclass check
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58432
security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
PR: 296874
Security: CVE-2026-11771
Security: CVE-2026-12932
Security: CVE-2026-12996
[7 lines not shown]
[lldb] Fix heap-use-after-free in FileSpec usage (#211908)
After #211394, `FileSpec` stores m_filename as a `SmallString` instead
of `ConstString`. When the `FileSpec` goes out of scope / is destructed,
a `StringRef` pointing to m_filename is now invalid. Previously it would
have worked even after `FileSpec` goes out of scope since `ConstString`
stores the string in a global buffer which is never destructed.
This causes heap-use-after-free in `CommandInterpreter` when we use the
result of `GetFilename()` on a temporary `FileSpec`. Store the result of
`HostInfo::GetProgramFileSpec()` as a variable to prevent it from going
out of scope before we're able to call `GetHomeInitFile()`.
Although #211394 introduces this failure, technically speaking this is
an existing bug, it was just masked because of how `FileSpec` used to
use `ConstString` to force a long lifetime.
[LoopInfo] Store blocks using Euler tour representation (#211485)
Block list construction appends each block to all enclosing loops
(O(depth) per block), and each loop owns a separately allocated vector.
Switch to an Euler tour representation: one BlockLayout array per
LoopInfo holding the in-loop blocks in a loop-contiguous reverse
postorder, each loop's list a [begin, end) slice of it, subloop slices
nested inside their parent's. Headers remain first;
`SubLoops`/`TopLevelLoops` orders are unchanged. A few tests observe the
order and are updated. (Previously a loop's list was the function's
reverse postorder restricted to its members, so a subloop's blocks were
interleaved with the parent's own blocks at their RPO positions.)
Mutations first copy a borrowed slice into private storage from
LoopInfo's allocator. `contains(BlockT *)` remains map-based: a
materialized loop's slice is not a membership test. This copy is rare:
across default<O2> over dagcombiner and sqlite3, only 12--14% of loops
built by analyze() are ever mutated; the rest keep the borrowed slice.
[4 lines not shown]
xhci: Refactor xhci_generic_setup code
Our USB TRB buildup subroutines were previously difficult to follow. In
setup_generic_chain_sub(), the routine filled TRB packets based on the
characteristics passed by the caller and the current state (for example,
whether the TRB was the last in the TD).
However, most TRB types (except Normal TRBs) cannot be shared across TDs.
To simplify the logic, refactor xhci_setup_generic() so that TRBs are
constructed according to their transfer type, with dedicated helper
functions for each TRB type.
Sponsored by: The FreeBSD Foundation
Assisted-by: Claude Code (Opus 4.6, Opus 4.8(1M) and Sonet 5.0)
Differential Revision: https://reviews.freebsd.org/D57130
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
nfsd: Commit missing patches for c52bcd09c2a6
Oops, I missed the other files for the commit.
This should fix the build.
Pointy hat goes on me.
(cherry picked from commit 30d4d3db431a5df8084048c4d31e98e74d2f225a)
nfsd: Garbage collect stray NFSv4 state
When a file is deleted on the NFS server by another client,
any NFSv4 state related to that file is left stranded.
This happens because the NFSv4 operations that free the
state use a CFH, which is set by a PutFH operation.
However, the PutFH fails with ESTALE because the file has
been deleted.
This patch adds a function called nfsrv_freestrandedstate()
that frees all the NFSv4 state related to a file and calls
this function when PutFH will be replying ESTALE.
While here, a helper function was defined to handle free'ng
of the nfslockfile structure and replaces the two places
where nearly identical code does this.
(cherry picked from commit c52bcd09c2a6736fe841fd72e3cfb74de5a35b03)
[flang][cuda] Accept statement function in device code (#211957)
Statement functions are inlined during lowering, so they should not be
treated as host procedure calls. Recursively validate their expressions
to reject any host procedure calls within the body.
