Merge tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
"A bunch of isolated fixes of Xen related drivers"
* tag 'for-linus-7.4a-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
Xen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages()
xen: don't allow gnttab_dma_[alloc|free]_pages() in PV guest
xen/pvcalls: destroy the per-socket workqueue on release
xen/pvcalls: unwind pvcalls_new_active_socket() step by step
xen/privcmd: fix double free when an irqfd is shut down twice
xen/gntdev: fix deadlock between map ioctl and mmap
xen/platform-pci: Disable device before releasing PCI regions
xen/grant-table: annotate on-stack work in gnttab_unmap_refs_sync()
Merge tag 'hwmon-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fixes from Guenter Roeck:
- Read tracking-mode voltage fault limits dynamically in the mp2975
PMBus driver instead of caching probe-time snapshots, avoiding false
over-voltage alarms when CPU voltage changes at runtime.
- Fix SCMI sensor probe by enabling supported sensors via firmware IDs
before exposing channels and checking channel config allocations.
- Fix runtime PM enable and reference count imbalances during probe and
teardown in the gpio-fan driver.
- Fix max31760 fan controller initialization and reporting, including
leaving standby at probe, initial 0 RPM reporting, and swapped
temperature limit registers.
- Assorted minor sensor reading, interval clamping, and register
[14 lines not shown]
Merge tag 'ovl-fixes-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs fixes from Amir Goldstein:
- Fixes for data-only layers (composefs), some for regressions from
v6.16, which relaxed the requirements for redirects to data-only
layers
- Fix a use-after-free in lookup of a hardlink with a FUSE upper,
reported by Sashiko
- Fix a mount failure right after unmount of an overlay with the same
upperdir
- Reject lower layers on the same fs with different idmaps, which could
decode file handles through the wrong layer
- Minor fixes for a memory leak, an error message and readdir d_ino
[13 lines not shown]
Merge tag 'ntfs-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Validate that $INDEX_ALLOCATION is open and non-resident before
reading or writing index blocks, preventing NULL pointer dereferences
when an earlier index operation has not opened it
- Check that index allocation inodes are non-resident and child VCNs
are non-negative and within bounds before directory lookup reads,
preventing a deadlock when $INDEX_ALLOCATION is missing or damaged
- Validate file names against the index entry's key length, preventing
out-of-bounds reads when directory enumeration resumes using a copied
key
- Return -ENOENT for NTFS_IOC_LIST_STREAMS on deleted base files and
fix unsigned underflow in its buffer bounds check, preventing
out-of-bounds writes when the sizing and filling passes disagree
[11 lines not shown]
Merge tag 'ksmbd-for-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb
Pull smb server fixes from Namjae Jeon:
- Evaluate explicit-access requests in DACL order with exact SID
matching, and prevent guest and anonymous sessions from matching
Authenticated Users
- Apply Unix group and OWNER RIGHTS ACEs, and keep their denials when
POSIX ACL fallback determines access
- Allow the parent directory’s DACL to grant explicitly requested
DELETE and FILE_READ_ATTRIBUTES through FILE_DELETE_CHILD and
FILE_LIST_DIRECTORY
- Exclude metadata-only file and stream opens from sharing conflicts
and stream delete-sharing checks, while accounting for writes implied
by overwrites and named-stream creation
[20 lines not shown]
Merge tag 'keys-v7.4-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull key fixes from Jarkko Sakkinen:
- Invoke the match callback before the state checks in
keyring_search_iterator(), so that a non-matching revoked,
expired or invalidated key cannot decide the search result
- Take key->sem for reading around the ->asym_*() method calls
in the keyctl pkey operations, as a key reference does not
pin the module providing the key type
* tag 'keys-v7.4-rc3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: Protect pkey method checks against type removal
KEYS: do not let an unmatched key decide the search result
Merge tag 'drm-fixes-2026-11-14' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly drm fixes, this is a bit bigger as we missed xe last week due
to a tree screw up, so it's mostly xe and amdgpu, then the usual
scattering of fixes across drivers.
sched:
- Ensure stopped entity cannot be re-added to the run-queue
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
i915:
- Fix for PTL GitLab #9196: eDP-2 on DDI B ends up in a state where
[87 lines not shown]
Merge tag 'watchdog-fixes-for-v7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull watchdog fixes from Guenter Roeck:
- gunyah_wdt: Re-enable the watchdog on resume
- mediatek: Register reset controller before watchdog device
- meson_gxbb_wdt: fix suspend/resume handling of HW_RUNNING watchdog
- mtk_wdt: Stop a running watchdog over system sleep even if not opened
- npcm: fix clock prepare leak when setting timeout on a running
watchdog
- omap: Fix early_enable handling in omap_wdt_probe()
- orion_wdt: load the pretimeout counter on Armada 370/XP start
[22 lines not shown]
Merge tag 'drm-misc-fixes-2026-11-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
Short summary of fixes pull:
bridge:
- ssd2825: Fix panel enable sequence
- sii902x: validate I2S data lane values
display:
- hdmi: Fixes to SCDC
gud:
- Avoid divide error in gud_stats_debugfs
meson:
- load ENCL gamma table while ENCL is disabled
nouveau:
- disp: Set atomic functions in struct drm_mode_config_funcs
[18 lines not shown]
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
"Fix hugetlb write fault livelock, permission overlay and GCS state
preservation across CPU suspend, cpuidle context tracking during
system suspend, GCS mode handling on signal return, AMU counter errata
workarounds, kexec loading of images with a non-zero text_offset and a
spurious ptrace warning:
- Fix hugetlb write fault livelocks caused by stale read-only TLB
entries after another CPU makes the page writable and only performs
a local invalidate. Unlike the generic fault path, hugetlb has no
fix_spurious_fault() fallback
- Save and restore POR_EL0, GCSPR_EL0 and GCSCRE0_EL1 across CPU
suspend
- Restrict cpuidle context tracking in cpu_suspend() to idle tasks,
avoiding context tracking warnings during system suspend
[30 lines not shown]
hwmon: (aht10) Fix update_interval overflow on 64-bit
On 64-bit, update_interval writes are clamped to LONG_MAX ms, but
ms_to_ktime() overflows above 9223372036854 ms and the interval wraps.
LONG_MAX becomes -1 ms, so every read starts a new measurement and
update_interval reads back -1.
Clamp to INT_MAX like sht4x, so the limit is the same on all platforms.
Fixes: 8c78f0dee437 ("hwmon: Add AHT10 Temperature and Humidity Sensor Driver")
Cc: stable at vger.kernel.org
Signed-off-by: Rupesh Majhi <zoone.rupert at gmail.com>
Link: https://patch.msgid.link/20261108172651.220121-1-zoone.rupert@gmail.com
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
hwmon: (scmi) Check channel config allocation
scmi_hwmon_add_chan_info() can fail to allocate a channel's config
array. Ignoring that error leaves a channel with a NULL config pointer
in the hwmon chip info, which hwmon dereferences while registering the
device.
Check the helper's return value and abort probe on failure.
Reported-by: Sashiko <sashiko-bot at kernel.org>
Closes: https://sashiko.dev/#/bug/linux-d10ced6b-a6f0-403b-9619-f5a6573f9e7f
Fixes: b23688aefb8b ("hwmon: add support for sensors exported via ARM SCMI")
Cc: stable at vger.kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla at kernel.org>
Link: https://patch.msgid.link/20261109151927.1672956-1-sudeep.holla@kernel.org
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
hwmon: (nct6775) Handle dual use registers
The REG_TARGET register has different meaning, depending on if pwm is in
thermal_cruise or speed_cruise.
This means we can't assume it's always word sized, so we need to handle
it differently depending on which mode we're in.
The code already does this, but the register was configured as word
sized for the speed_cruise mode, which would do the wrong thing in
thermal_cruise mode.
Fixes: 6c009501ff20 ("hwmon: (nct6775) Add support for NCT6102D/6106D")
Fixes: 29c7cb485b32 ("hwmon: (nct6775) Integrate new model nct6116")
Fixes: 437b3c2a4bdc ("hwmon: (nct6775) Add support for NCT6126D")
Cc: stable at vger.kernel.org
Signed-off-by: Anton Lundin <glance at ac2.se>
Link: https://patch.msgid.link/20261109082511.851377-2-glance@ac2.se
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
hwmon: (scmi) Configure sensors before exposing channels
SCMI hwmon enables sensors with SENSOR_CONFIG_SET, but only after
registering the hwmon device and only for temperature sensors. This
leaves other sensor classes disabled on firmware that defaults sensors
to off, and exposes temperature channels before they are ready.
Configure each supported sensor while building the channel list, before
registering the hwmon device. Leave failed sensors out of the list so
their channels remain hidden, while continuing with other sensors.
Cc: Marek Vasut <marek.vasut at mailbox.org>
Reported-by: Sashiko <sashiko-bot at kernel.org>
Closes: https://sashiko.dev/#/bug/linux-4bdf9a68-22d5-4305-b684-f11fe6d1dbcc
Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read")
Cc: stable at vger.kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla at kernel.org>
Link: https://patch.msgid.link/20261109151927.1672956-2-sudeep.holla@kernel.org
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
hwmon: (scmi) Enable temperature sensors using their sensor IDs
scmi_hwmon_probe() groups sensors by hwmon type, so the index in
scmi_sensors->info[hwmon_temp] is not necessarily the SCMI sensor ID.
Passing that index to config_set() targets a different sensor if the
platform exposes non-temperature sensors ahead of temperature sensors.
The intended temperature sensor can remain disabled, causing subsequent
readings to fail. If configuring the wrong sensor fails, thermal
registration of the intended sensor is also skipped.
Use the firmware sensor ID, as the read and thermal registration paths
already do, so temperature sensors are enabled correctly.
The patch was reviewed and the commit message expanded with OpenCode
AI assistance.
Fixes: 72804d1631b3 ("hwmon: (scmi) Enable sensors to assure they can be read")
Cc: stable at vger.kernel.org
Signed-off-by: Xu Rao <raoxu at uniontech.com>
[3 lines not shown]
hwmon: (pmbus/mp2975) Get vout fault limits dynamically
The over- and under-voltage fault limits of the tracking mode are
relative to the voltage reference, which follows the VID/AVS requests
issued to the device and therefore changes at runtime.
The driver reads the voltage reference once during probe and derives the
limits from that snapshot, which the PMBus core caches in addition. As a
result in2_crit and in2_lcrit reflect the operating point at probe, rather
than the thresholds the device enforces. On systems where the device
supplies the CPU core voltage, in2_crit was reported anywhere between
1.15V and 1.70V across identical systems, causing false over-voltage
reports once the CPU voltage exceeded the value latched at probe.
Read the voltage reference and the over-voltage offset selector whenever
a limit is requested, and mark both limits with pmbus_set_update(), so
that the core does not cache them. The voltage reference is available on
page 3 only. Let the core change the page, so that the page it caches
matches the device, except for a single rail configuration, for which the
[17 lines not shown]
hwmon: (sy7636a) fix negative temperatures
The thermistor readout is a signed 8-bit value in degrees Celsius.
Fixes: de34a4053250 ("hwmon: sy7636a: Add temperature driver for sy7636a")
Cc: stable at vger.kernel.org
Signed-off-by: Pablo Mazzini <pmazzini at gmail.com>
Link: https://patch.msgid.link/20261108093602.329554-3-pmazzini@gmail.com
Signed-off-by: Guenter Roeck <linux at roeck-us.net>
Merge tag 'sound-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes as usual. A couple of regression fixes are
included in addition to the various quirks and device-specific fixes.
ALSA Core:
- PCM: Fix potential inconsistent PCM state reporting after XRUN
HD-audio:
- Fix sysfs hint parser
- Revert CS4208 fixup for MacBookAir 7,2 due to regressions
- ACPI _DSD fixes for CS35L41 side-codec on various HP laptops
- Device quirks for Acer (Predator, TravelLite) and Dell (Pro QC1255,
XPS 8940)
USB-audio:
- Fix for USB controller bugs reporting oversized packets
- Fix UAF on disconnect in caiaq
[40 lines not shown]
Merge tag 'block-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- ublk fixes: don't publish a new device in the idr until it's fully
set up, and don't hold ublk_ctl_mutex across device removal, as a
stuck filesystem on one device otherwise blocked ADD_DEV and DEL_DEV
for every other ublk device.
- s390/dasd fixes: re-initialize the RCD buffer magic before every
request start, fix a wrong free and refcount leak in the check_tcw
error path, don't trust the userspace-supplied result field in the
format check, and a typo fix.
* tag 'block-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
s390/dasd: Don't trust userspace-supplied result field in format check
s390/dasd: Fix wrong free and refcount leak in build_check_tcw error path
s390/dasd: Re-initialize RCD buffer with "V1.0" before every start
s390/dasd: Fix typo 'immediatly' -> 'immediately'
[2 lines not shown]
Merge tag 'io_uring-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
- Don't end the NAPI busy poll early on need_resched() when a single
NAPI is registered, as that left the rest of the wait timeout
sleeping in schedule_hrtimeout() rather than busy polling.
* tag 'io_uring-7.4-20261112' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/napi: don't end the single NAPI busy poll early on need_resched()
Merge tag 'cifs-fixes-7.4-rc3' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
- Fix silent data loss in writeback
Since the move to netfslib a transient failure (a reconnect, a lost
handle, an interrupted wait, -ENOMEM, or a task killed while close()
flushes its dirty pages) ended writeback with the folios clean and
no error, dropping the write.
Retry it instead, bounded by the hard and retrans mount options, and
have umount -f abort the retries and the reconnect and credit waits
so the unmount's own sync can't hang
- Prefer a non-O_DIRECT handle for writeback, as Windows rejects
unaligned I/O on O_DIRECT handles and silently dropped about 1% of
the writes in generic/051
[50 lines not shown]
Merge tag 'erofs-for-7.4-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs fixes from Gao Xiang:
- Fix stacked fs check for file-backed mounts with extra devices
- Disallow file-backed mounts on shared backing inodes
- Reset metadata offsets when fsoffset= is used to fix xattr reads
inside and outside the metabox in ont shot
- Refine on-disk format summary
* tag 'erofs-for-7.4-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
docs: erofs: refine the on-disk overview
erofs: reset buf->off in erofs_init_metabuf()
erofs: treat files shared by inode_share as stacked
erofs: apply the stacked fs check to extra file-backed devices
arm64: suspend: Only track cpuidle context for idle tasks
Commit 19235e472798 ("cpuidle, arm64: Fix the ARM64 cpuidle logic") moved
the calls to ct_cpuidle_enter() and ct_cpuidle_exit() into cpu_suspend() so
that arm64 cpuidle could keep RCU watching longer and manage context
tracking internally. However, cpu_suspend() is called not only by cpuidle
via psci_cpu_suspend_enter() (which runs in the context of the idle task),
but also during system suspend via psci_system_suspend_enter() (which runs
in the context of the task initiating suspend, such as a process writing to
/sys/power/state).
When entering system suspend, current is a non-idle task. Calling
ct_cpuidle_enter() invokes ct_kernel_exit() from kernel space (!user) on a
non-idle task. With CONFIG_RCU_EQS_DEBUG enabled, this violates context
tracking invariants and triggers a warning:
WARNING: kernel/context_tracking.c:120 at ct_kernel_exit+0x1b4/0x1f4
kernel/context_tracking.c:118
Call trace:
[33 lines not shown]
arm64: ptrace: don't warn on missing siginfo in a group-stop
PTRACE_ATTACH to a group-stopped child can enter do_jobctl_trap(),
which calls ptrace_stop() without siginfo. If the tracer writes
NT_ARM_SYSTEM_CALL, system_call_set() can change syscallno from
NO_SYSCALL before update_syscall_orig_x0_after_ptrace() checks
last_siginfo. WARN_ON_ONCE(!info) then fires for a valid ptrace stop.
Keep the early return when siginfo is absent, but remove the warning.
This leaves orig_x0 untouched at a non-seized group-stop and preserves
the existing syscall-exit-stop handling.
Fixes: 88b839ce497c ("arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry")
Cc: stable at vger.kernel.org
Signed-off-by: Zhao Gongyi <zhaogongyi at bytedance.com>
Acked-by: Oleg Nesterov <oleg at redhat.com>
Acked-by: Will Deacon <will at kernel.org>
[catalin.marinas at arm.com: modified comment as per Will's suggestion]
Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
xen: don't allow gnttab_dma_[alloc|free]_pages() in PV guest
Today gnttab_dma_alloc_pages() or gnttab_dma_free_pages are never
called when running as a PV guest, but this holds for in-tree callers
only.
Bail out early when being called in PV mode in order to ensure no out
of tree module or future use cases are violating this assumption.
This enables to safely remove PV-only code from both functions.
Reviewed-by: Jan Beulich <jbeulich at suse.com>
Signed-off-by: Juergen Gross <jgross at suse.com>
Message-ID: <20261110095605.369848-2-jgross at suse.com>
Xen/gnttab: improve error handling in gnttab_dma_{alloc,free}_pages()
Both decrease-reservation and populate-physmap can succeed partially. For
the former this may be pretty unlikely, but clearly the latter can hit
both out-of-memory conditions in the hypervisor or denial because of the
allocation exceeding the domain's allowance (there's no interaction with
the balloon driver here either).
In gnttab_dma_free_pages() we simply can't give back to the system what
hasn't been re-filled with backing memory. For gnttab_dma_alloc_pages()
both parts of the overall region need dealing with differently.
While no present caller of gnttab_dma_free_pages() checks its return
value, also don't use -EFAULT there: It really is an out-of-memory
condition. (In gnttab_dma_alloc_pages() -EFAULT doesn't look quite right
either, but I couldn't think of a clearly better error code there.)
Fixes: 9bdc7304f536 ("xen/grant-table: Allow allocating buffers suitable for DMA")
Signed-off-by: Jan Beulich <jbeulich at suse.com>
[3 lines not shown]
ALSA: aw2-alsa: select SND_PCM
Several stanzas in sound/pci/Kconfig select SND_PCM.
SND_AW2 selects nothing at all.
aw2-alsa calls snd_pcm_new, which sound/core/pcm.c provides under SND_PCM.
aw2-alsa.c:(.text+0x554): undefined reference to `snd_pcm_new'
4 symbols are undefined in all.
The driver can be built into vmlinux while SND_PCM is a module, in which
case the symbols are not there at link time.
Select rather than depend on: SND_PCM has no prompt of its own and is only
ever enabled by a select, so a depends on would leave SND_AW2
unselectable.
Reproduced on v7.3, arm64, with CONFIG_SND_AW2=y and CONFIG_SND_PCM=m.
[8 lines not shown]
Merge tag 'asoc-fix-v7.4-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v7.4
Another week, another pile of driver specific fixes and quirks. We do
have one major fix which addresses a bug introduced by confusion with
the counted_by interfaces that was causing major disruption for a number
of platforms.
KEYS: do not let an unmatched key decide the search result
With the dns_resolver key type available, put a key named "foo" in a
fresh session keyring, revoke it, and search for "bar":
keyctl new_session >/dev/null
A=$(printf '127.0.0.1\0' | keyctl padd dns_resolver foo @s)
keyctl revoke "$A"
keyctl search @s dns_resolver bar
Results:
keyctl_search: Key has been revoked
The search returns -EKEYREVOKED even though there is no key named "bar".
It should return -ENOKEY.
A dns_resolver search walks the keys in the keyring and uses
dns_resolver_cmp() to compare their descriptions with the requested
[15 lines not shown]
