Merge tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Last set of fixes, mostly amdgpu, some i915 and xe.
I think the dma-buf revert is probably the most important: while it is
technically correct the fallout from it means we shouldn't enable
DMABUF_DEBUG like that yet, and fix the fallout first.
Summary:
MAINTAINERS update
dma-buf:
- revert dma-debug y on debug kernel due to msm interaction
core:
- fix drm_exec prelocked object interaction
[60 lines not shown]
Merge tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"Here are the (hopefully) last bits for 7.3.
At this time, all changes are small and device-specific ASoC fixes.
Not super-urgent, but should be fairly safe to take"
* tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: amd: yc: disable MSI on resume
ASoC: nau8822: Fix the 128x oversampling switch bits
ASoC: wm8978: Fix the 128x oversampling switch bits
ASoC: max98371: Fix the Speaker DHT Min Volume bits
ASoC: pcm3168a: Fix the DAC zero flag polarity bit
ASoC: cs42l52: Fix the NG Type Switch bit
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
ASoC: stm32: spdifrx: fix synchronization state check
ASoC: Intel: avs: Reset the stream unless it is already prepared
ASoC: SOF: sof-client: Use event-handler mutex consistently
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
Merge tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fixes from Bjorn Helgaas:
- Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe,
which falsely advertise it; removal of unrelated delays in v7.2
caused post-FLR state restoration to fail, resulting in a VFIO
passthrough regression (Alexander Gruhlke)
-Don't treat ~0 as 'device is ready' in pci_dev_wait(); with RRS SV, a
device may respond with RRS (resulting in data of 0x0001) or may not
respond at all (typically resulting in ~0 data). A v6.12 change
treated ~0 as 'ready', resulting in a regression with Intel and
Samsung NVMe SSDs (Alexander Gruhlke)
* tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
Merge tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk fixes from Petr Mladek:
- Switch NBCON consoles to the emergency mode in emergency_restart() to
see messages even in this shutdown code path
- Postpone the start of printk kthreads after smp_init(). It prevents
boot stalls on some HW
- Typo fix in a previous hot-fix patch
* tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
printk: Postpone kthread startup
printk: fix kernel-doc name for nbcon_write_context_is_braille
nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart()
Merge tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix NULL dereference when copying histogram field variable
If event_hist_trigger_parse() creates an action that uses one of
pseudo fields for its keys, the hist_data field element will have a
NULL for its field member. When looking to match that key, the lookup
uses key_field->field->name which will dereference a NULL pointer.
Instead use the helper function that handles such cases:
expr_field_str().
- Take the trace_types_lock when dropping the buffer_meta reference
The tracing_buffer_meta_open() error return drops the trace_array
reference with __trace_array_put() instead of trace_array_put() where
the former doesn't take the lock and the latter does.
[142 lines not shown]
Merge tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fix from Masami Hiramatsu:
- error out if BTF is required but unavailable
Fix to return an error instead of NULL if BTF is not available when
user specify '$args*' meta fetch argument for probe events.
* tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: probes: error if BTF is required but unavailable
PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
With RRS Software Visibility, pci_dev_wait() considers a device ready as
soon as reading the Vendor ID doesn't return the RRS value. Devices aren't
required to respond with RRS while they aren't ready, so the read may
return ~0 and pci_dev_wait() stops waiting too early. This was seen with
Intel [8086:0a54] and Samsung [144d:a80c] NVMe SSDs.
Also wait while the Vendor ID reads ~0. A VF's Vendor ID always reads ~0,
so check its Command register instead, as is done without RRS SV.
Fixes: d591f6804e7e ("PCI: Wait for device readiness with Configuration RRS")
Link: https://lore.kernel.org/r/20250611101442.387378-1-hui.wang@canonical.com
Suggested-by: Lukas Wunner <lukas at wunner.de>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Alexander Gruhlke <gruhlke at mailbox.org>
Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>
Reviewed-by: Lukas Wunner <lukas at wunner.de>
Link: https://patch.msgid.link/20261011190145.23621-3-gruhlke@mailbox.org
PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
The Samsung 990 PRO [144d:a80c] advertises Immediate Readiness, so
pcie_flr() doesn't wait after FLR, but the drive returns ~0 for up to 7 ms.
Since commit 10baa9b4df40 ("PCI: Drop unnecessary retries when restoring
BARs"), the config restore after FLR is lost, which breaks VFIO passthrough
of the drive. Firmware 8B2QJXD7 responds right after FLR, but older
firmware such as 1B2QJXD7 doesn't, and the firmware version isn't visible
here.
[bhelgaas: The Samsung 990 EVO Plus [144d:a80d] with 2B2QKXG7 firmware
seems to have the same problem.]
Ignore Immediate Readiness on these devices, so pcie_flr() waits.
Fixes: 10baa9b4df40 ("PCI: Drop unnecessary retries when restoring BARs")
Link: https://bbs.archlinux.org/viewtopic.php?id=314833
Link: https://bbs.archlinux.org/viewtopic.php?pid=2312085#p2312085
Suggested-by: Lukas Wunner <lukas at wunner.de>
[8 lines not shown]
Merge tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- AMD: Clear S4 wake bits when firmware has _AEI, this is important for
some AMD systems.
- Do not accumulate sunxi npins across probe() attempts with deferred
probe. (desc->npins just went ++ and ++...)
- Qualcomm patch galore: split QUP functions on the Nord pin
controller, fix an OF module alias on IPQ5210 so the module
modprobes, fix two groups on the IPQ5018, make direction changes
exclusive on the SPMI-GPIO, and fix the interrupt target width on
four different SoCs.
* tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
pinctrl: sunxi: dt: do not accumulate npins across probe attempts
pinctrl: amd: Clear S4 wake bits when firmware has _AEI
[10 lines not shown]
Merge tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull power sequencing fix from Bartosz Golaszewski:
- with the PCIe code reworked to power the endpoint via pwrctl before
it starts the link training, we can now remove the workaround for
WLAN power which instead started causing an issue with endpoint
enumeration
* tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
power: sequencing: qcom-wcn: power off WLAN at probe
Merge tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- gracefully handle unsupported fwnode-only, no-device GPIO lookup for
shared pins
- mark the GPIO controller as sleeping in gpio-nct6694
- fix a GPIO device reference leak in kunit tests
- fix memory leak in error path in gpiod_set_array_value_complex()
- fix races in GPIO controller and its associated irqchip setup in
gpio-mxc
- use atomic bitops where races can occur in gpio-mxc
- fix build failure in gpio tools
[12 lines not shown]
printk: Postpone kthread startup
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON console usage allows the bugs to disappear.
The NBCON kthreads for console printing are started very early
during boot using early_initcall(). Since these kthreads are
asynchronously enabling/disabling interrupts during early boot, they
may be interfering with early SMP setup on some hardware platforms.
Starting the console printing kthreads later has shown to avoid the
hanging on systems that could previously reproduce the issue.
Postpone kthread starting until after all arch initcalls have
completed.
Reported-by: Derek Barbosa <debarbos at redhat.com>
[6 lines not shown]
Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
frees.
Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
and ->d_compare() read in rcu mode has to be freed after a grace
period. umount(2) hides most of it because namespace_unlock() waits
for one, but a chdir() out of a lazily unmounted directory or the
close() of the last file on it drops the last reference without.
* ext4_get_link() reads the sbi and the extent status counters for a
symlink stored in a data block. Both are freed after a grace
period now.
* The unicode map of casefolded ext4, f2fs and tmpfs was freed under
generic_ci_d_hash() and generic_ci_d_compare().
[96 lines not shown]
MAINTAINERS: remove myself
After 14 years at Oracle and 23 years working on Linux, I've decided to
step back for a while.
Signed-off-by: "Darrick J. Wong" <djwong at kernel.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
This reverts commit 93ce8ea70451e800601bc9444aa33043de15d67b.
Mehmet reported that the offending commit breaks his AR9271 USB adapter
which uses zero-length replies to commands that don't return a value.
Revert the whole thing to restore the functionality.
Cc: stable at vger.kernel.org # the offending commit is in 6.12.113
Reported-by: Mehmet Fide <mehmet.fide at gmail.com>
Signed-off-by: Toke Høiland-Jørgensen <toke at toke.dk>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Revert "namei: don't reveal overmounted entries in refwalk"
This reverts commit 8189ab688f5a2c745dc90b63374da02f213d6994.
This bug class is bigger than can be fixed with this simple patch.
Back out of it and give us some time to fix this properly.
Signed-off-by: Christian Brauner <brauner at kernel.org>
Merge tag 'drm-misc-fixes-2026-10-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
A revert for the blend mode property patch being applied twice and a
patch to reset the device when frozen in virtio, a power state fix for
vc4, a Kconfig fix for amdxdna, an error handling, reference counting,
and a null pointer dereference fix for rocket, a revert for dma-buf for
a commit introducing a dangling reference, a locking fix for exec, and a
fix for panthor to handle 10-core GPUs.
Signed-off-by: Dave Airlie <airlied at redhat.com>
From: Maxime Ripard <mripard at kernel.org>
Link: https://patch.msgid.link/atCZfcTvshZx6mcA@houat
Merge tag 'soc-fixes-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"A small number of last minute bug fixes came up since LPC.
Most of these are for devicetree files:
- Tegra264 needs fan descriptions to keep the system from overheating
- A cleanup on TI DRA7 caused a regression on PCI support and needs a
fixup
- The beaglev-fire board can no longer probe the mcp3564 sensor after
a an inconsistent update in 7.1
- A few fixes address compile time dtc warnings on tegra
The other three patches are all addressing minor problems
in tegra drivers and the sama5 defconfig"
[10 lines not shown]
tracing: Check operator stack capacity before pushing
predicate_parse() uses the first operator stack entry before processing
any opening parentheses. A push then increments top before writing.
The existing check still permits that write when top already points to
the last allocated entry, which can access beyond the operator stack.
Reject the push when top reaches the last allocated entry.
Cc: stable at vger.kernel.org
Fixes: 39f7c41c908b ("tracing/filters: Enable filtering a cpumask field by another cpumask")
Link: https://patch.msgid.link/atELO9L0I9kg5CpC@Taeyangs-MacBook-Pro.local
Signed-off-by: Taeyang Lee <0wn at theori.io>
Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
tracing: Keep the predicate limit separate from program capacity
predicate_parse() adds two to nr_preds to reserve the terminal TRUE
and FALSE entries. It also uses that increased value as the limit for
parsed predicates. If the initial count is smaller than the number
actually parsed, the program can fill the allocation and subsequent
accesses can go past its end.
Keep nr_preds as the predicate limit and use a separate value for the
allocation size. This leaves space for both terminal entries and a
zeroed entry when parsing stops at the limit.
Cc: stable at vger.kernel.org
Fixes: 39f7c41c908b ("tracing/filters: Enable filtering a cpumask field by another cpumask")
Link: https://patch.msgid.link/atELCd1XjKVhrkFL@Taeyangs-MacBook-Pro.local
Signed-off-by: Taeyang Lee <0wn at theori.io>
Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
tracing: Fix crash in print_graph_function_event()
tracing_set_tracer() assigns the flags of the newly selected tracer
with:
tr->current_trace_flags = t->flags ? : t->tracer->flags;
If the new tracer defines neither static flags nor default flags, like
hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy
for it, and both operands are NULL, so tr->current_trace_flags ends up
being NULL as well.
The ring buffer is not cleared when switching tracers: it is reset
inside tracer_init(), after current_trace_flags was already assigned.
If the buffer still holds function_graph entries of the previous
tracer, printing one of them dereferences the NULL pointer. This was
hit by cat trace during an ftrace stress test:
BUG: kernel NULL pointer dereference, address: 0000000000000000
[31 lines not shown]
Merge tag 'iommu-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull IOMMU fixes from Joerg Roedel:
"AMD IOMMU:
- Revert an interrupt remapping check removal that caused GPU
regressions on some platforms
Generic page tables:
- Fix KUnit builds with distributed Clang ThinLTO by preserving
compiler flags, preventing x86-64 code generation from arm64
bitcode"
* tag 'iommu-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommupt/kunit: Use if_changed_rule for the kunit
Revert "iommu/amd: Remove redundant check in irq_remapping_select()"
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
SDMA can randomly hang on Polaris 10. Hard to reproduce,
but has been occurring sporadically in the Mesa CI
on the RADV Polaris 10 job even when Mesa isn't using
the SDMA engine.
When Mesa actually uses the SDMA on Polaris, the hang
becomes more frequent and the reproduction rate goes up
significantly in the CI system.
We don't know why the hangs occur, but it seems
that inserting a single NOP packet before each
POLL_REGMEM and FENCE packet works around it.
At the moment it's unclear which GPUs are affected,
so let's apply this to SDMA 3.x for now.
Note that this issue is not documented or acknowledged by AMD.
[5 lines not shown]
drm/amdgpu: keep the eviction fence until the last handle is closed
amdgpu_gem_object_close() detaches the user queue eviction fence from
the BO before it checks bo_va->ref_count, so closing any handle of a BO
removes the fence, even when the file still has another handle to the
BO and the bo_va with its GPU mappings stays. The BO can then be evicted
without suspending the user queues of the file, which keep accessing it
through mappings that are only marked for update.
Seen on navi31 with a SDMA user queue: a BO opened twice in the same
file (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second
handle is closed (traced attach/detach of the fence):
attach bo=ffff8c78a6c84c00
GEM_CLOSE handle=7
detach bo=ffff8c78a6c84c00
while handle 6 and the mapping are still in use.
[10 lines not shown]
drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both
use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT
is compiled out in production builds, so a NULL stream->sink causes a
NULL pointer dereference.
link_set_dpms_off() already guards two earlier accesses to stream->sink
with explicit NULL checks, confirming that stream->sink can legitimately
be NULL. The subsequent call to deallocate_usb4_bandwidth() had no
equivalent guard.
Replace the ASSERT() calls with proper NULL checks that return false
early, and add a matching stream->sink guard at the call site in
link_set_dpms_off() consistent with the surrounding pattern.
v2: Keep the existing ASSERT() calls for diagnostics (to report
unexpected NULL sink), and add explicit NULL checks that return false
before dereferencing stream->sink. Also add a matching stream->sink
[19 lines not shown]
drm/amdgpu/userq: actually validate userq BOs
This was supposed to loop over the individual evicted list, as the
kernel and always_valid evicted lists were already handled in
amdgpu_vm_validate.
Without this, BOs that were created and evicted before a userq was made
would never end up in an eviction fence rearm.
Also add the missing ref to the BO before drm_exec locks and refs it.
Fixes: 4cdbba5a16aa ("drm/amdgpu: restructure VM state machine v4")
Signed-off-by: Benjamin Cheng <benjamin.cheng at amd.com>
Reviewed-by: Christian König <christian.koenig at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd)
Cc: stable at vger.kernel.org
