Linus Torvalds [Tue, 17 Feb 2026 17:30:52 +0000 (09:30 -0800)]
Merge tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial driver updates from Greg KH:
"Here is the small amount of tty and serial driver updates for 7.0-rc1.
Nothing major in here at all, just some driver updates and minor
tweaks and cleanups including:
- sh-sci serial driver updates
- 8250 driver updates
- attempt to make the tty ports have their own workqueue, but was
reverted after testing found it to have problems on some platforms.
This will probably come back for 7.1 after it has been reworked and
resubmitted
- other tiny tty driver changes
All of these have been in linux-next for a while with no reported
problems"
* tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)
Revert "tty: tty_port: add workqueue to flip TTY buffer"
tty: tty_port: add workqueue to flip TTY buffer
serial: 8250_pci: Remove custom deprecated baud setting routine
serial: 8250_omap: Remove custom deprecated baud setting routine
dt-bindings: serial: renesas,scif: Document RZ/G3L SoC
serial: 8250: omap: set out-of-band wakeup if wakeup pinctrl exists
tty: hvc-iucv: Remove KMSG_COMPONENT macro
dt-bindings: serial: google,goldfish-tty: Convert to DT schema
dt-bindings: serial: sh-sci: Fold single-entry compatibles into enum
serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done
serial: 8250: 8250_omap.c: Add support for handling UART error conditions
serial: SH_SCI: improve "DMA support" prompt
serial: Kconfig: fix ordering of entries for menu display
serial: 8250: fix ordering of entries for menu display
serial: imx: change SERIAL_IMX_CONSOLE to bool
8250_men_mcb: drop unneeded MODULE_ALIAS
serial: men_z135_uart: drop unneeded MODULE_ALIAS
dt-bindings: serial: renesas,rsci: Document RZ/V2H(P) and RZ/V2N SoCs
serial: rsci: Convert to FIELD_MODIFY()
dt-bindings: serial: 8250: add SpacemiT K3 UART compatible
...
Linus Torvalds [Tue, 17 Feb 2026 17:20:58 +0000 (09:20 -0800)]
Merge tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here is the big set of staging driver updates for 7.0-rc1. Well, not
that big, just lots of tiny coding style cleanups primarily in one
driver as everyone seems to have glomed onto it for some reason that
escapes me (is there a tutorial out there somewhere pointing people at
this?)
Not much overall, the changes can be summarized as:
- cleanups for the rtl8723bs driver, so many cleanups...
- vme_user driver cleanups
- sm750fb driver cleanups
- tiny greybus driver cleanups
- other really small staging driver cleanups
All of these have been in linux-next for a while with no reported
issues"
* tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (119 commits)
staging: rtl8723bs: refactor ODM_SetIQCbyRFpath to reduce duplication
staging: rtl8723bs: rename CamelCase function Set_MSR to set_msr
staging: rtl8723bs: remove unnecessary blank lines in rtw_io.c
staging: rtl8723bs: remove stale TODO item regarding %pM
staging: rtl8723bs: remove unused allocation wrapper functions
staging: rtl8723bs: use standard skb allocation APIs
staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
staging: rtl8723bs: replace rtw_malloc() with kmalloc()
staging: rtl8723bs: introduce kmemdup() where applicable
staging: sm750fb: Clean up variable names
staging: rtl8723bs: fix null dereference in find_network
staging: rtl8723bs: use unaligned access macros in rtw_security.c
staging: rtl8723bs: fix potential race in expire_timeout_chk
staging: rtl8723bs: remove dead debugging code in rtw_mlme_ext.c
staging: rtl8723bs: modernize hex output in rtw_report_sec_ie
staging: rtl8723bs: fix spacing around operators
staging: rtl8723bs: rename u1bTmp to val
staging: rtl8723bs: remove unused private debug counters
staging: rtl8723bs: remove thread wraper functions and add IS_ERR() check
staging: rtl8723bs: fix firmware memory leak on error
...
Linus Torvalds [Tue, 17 Feb 2026 17:11:04 +0000 (09:11 -0800)]
Merge tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO driver updates from Greg KH:
"Here is the big set of char/misc/iio and other smaller driver
subsystem changes for 7.0-rc1. Lots of little things in here,
including:
- Loads of iio driver changes and updates and additions
- gpib driver updates
- interconnect driver updates
- i3c driver updates
- hwtracing (coresight and intel) driver updates
- deletion of the obsolete mwave driver
- binder driver updates (rust and c versions)
- mhi driver updates (causing a merge conflict, see below)
- mei driver updates
- fsi driver updates
- eeprom driver updates
- lots of other small char and misc driver updates and cleanups
All of these have been in linux-next for a while, with no reported
issues"
* tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (297 commits)
mux: mmio: fix regmap leak on probe failure
rust_binder: return p from rust_binder_transaction_target_node()
drivers: android: binder: Update ARef imports from sync::aref
rust_binder: fix needless borrow in context.rs
iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin
iio: sca3000: Fix a resource leak in sca3000_probe()
iio: proximity: rfd77402: Add interrupt handling support
iio: proximity: rfd77402: Document device private data structure
iio: proximity: rfd77402: Use devm-managed mutex initialization
iio: proximity: rfd77402: Use kernel helper for result polling
iio: proximity: rfd77402: Align polling timeout with datasheet
iio: cros_ec: Allow enabling/disabling calibration mode
iio: frequency: ad9523: correct kernel-doc bad line warning
iio: buffer: buffer_impl.h: fix kernel-doc warnings
iio: gyro: itg3200: Fix unchecked return value in read_raw
MAINTAINERS: add entry for ADE9000 driver
iio: accel: sca3000: remove unused last_timestamp field
iio: accel: adxl372: remove unused int2_bitmask field
iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll()
iio: magnetometer: Remove IRQF_ONESHOT
...
Linus Torvalds [Tue, 17 Feb 2026 16:48:45 +0000 (08:48 -0800)]
Merge tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
- Fix partial IOVA mapping cleanup in error handling
- Minor prep series ignoring discard return value, as
the inline value is always known
- Ensure BLK_FEAT_STABLE_WRITES is set for drbd
- Fix leak of folio in bio_iov_iter_bounce_read()
- Allow IOC_PR_READ_* for read-only open
- Another debugfs deadlock fix
- A few doc updates
* tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
blk-mq: use NOIO context to prevent deadlock during debugfs creation
blk-stat: convert struct blk_stat_callback to kernel-doc
block: fix enum descriptions kernel-doc
block: update docs for bio and bvec_iter
block: change return type to void
nvmet: ignore discard return value
md: ignore discard return value
block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova
block: fix folio leak in bio_iov_iter_bounce_read()
block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ
drbd: always set BLK_FEAT_STABLE_WRITES
Linus Torvalds [Tue, 17 Feb 2026 16:33:49 +0000 (08:33 -0800)]
Merge tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more io_uring updates from Jens Axboe:
"This is a mix of cleanups and fixes. No major fixes in here, just a
bunch of little fixes. Some of them marked for stable as it fixes
behavioral issues
- Fix an issue with SOCKET_URING_OP_SETSOCKOPT for netlink sockets,
due to a too restrictive check on it having an ioctl handler
- Remove a redundant SQPOLL check in ring creation
- Kill dead accounting for zero-copy send, which doesn't use ->buf
or ->len post the initial setup
- Fix missing clamp of the allocation hint, which could cause
allocations to fall outside of the range the application asked
for. Still within the allowed limits.
- Fix for IORING_OP_PIPE's handling of direct descriptors
- Tweak to the API for the newly added BPF filters, making them
more future proof in terms of how applications deal with them
- A few fixes for zcrx, fixing a few error handling conditions
- Fix for zcrx request flag checking
- Add support for querying the zcrx page size
- Improve the NO_SQARRAY static branch inc/dec, avoiding busy
conditions causing too much traffic
- Various little cleanups"
* tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/bpf_filter: pass in expected filter payload size
io_uring/bpf_filter: move filter size and populate helper into struct
io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
io_uring/rsrc: improve regbuf iov validation
io_uring: remove unneeded io_send_zc accounting
io_uring/cmd_net: fix too strict requirement on ioctl
io_uring: delay sqarray static branch disablement
io_uring/query: add query.h copyright notice
io_uring/query: return support for custom rx page size
io_uring/zcrx: check unsupported flags on import
io_uring/zcrx: fix post open error handling
io_uring/zcrx: fix sgtable leak on mapping failures
io_uring: use the right type for creds iteration
io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots
io_uring/filetable: clamp alloc_hint to the configured alloc range
io_uring/rsrc: replace reg buffer bit field with flags
io_uring/zcrx: improve types for size calculation
io_uring/tctx: avoid modifying loop variable in io_ring_add_registered_file
io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check
The issue is reproducible with a simple userspace program that
performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
separate threads on the same spidev file descriptor.
Fix this by simplifying the locking model and removing the lock
inversion entirely. spidev_sync() no longer performs any locking,
and all callers serialize access using spi_lock.
buf_lock is removed since its functionality is fully covered by
spi_lock, eliminating the possibility of lock ordering issues.
This removes the lock inversion and prevents deadlocks without
changing userspace ABI or behaviour.
Christian Loehle [Mon, 16 Feb 2026 18:50:05 +0000 (00:20 +0530)]
cpuidle: menu: Remove single state handling
cpuidle systems where the governor has no choice because there's only
a single idle state are now handled by cpuidle core and bypass the
governor, so remove the related handling.
Christian Loehle [Mon, 16 Feb 2026 18:50:04 +0000 (00:20 +0530)]
cpuidle: teo: Remove single state handling
cpuidle systems where the governor has no choice because there's only
a single idle state are now handled by cpuidle core and bypass the
governor, so remove the related handling.
cpuidle systems where the governor has no choice because there's only
a single idle state are now handled by cpuidle core and bypass the
governor, so remove the related handling.
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com>
[ rjw: Extended the change to drop a redundant local variable ] Link: https://patch.msgid.link/20260216185005.1131593-3-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reason for this is that the s390 specific smp initialization code schedules
a work which rebuilds scheduling domains way before the scheduler is smp
aware. With the mentioned commit the (invalid) rebuild request is not
anymore silently discarded but instead leads to warning.
Address this by avoiding the early rebuild request.
Reported-by: Marc Hartmayer <marc@linux.ibm.com> Tested-by: Marc Hartmayer <marc@linux.ibm.com> Fixes: 6ee43047e8ad ("cpuset: Remove unnecessary checks in rebuild_sched_domains_locked") [1] Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
The commit c8424e776b09 ("MODSIGN: Export module signature definitions")
replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with the
dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG in s390
kernels built with MODULES=n if nothing else selects MODULE_SIG_FORMAT.
Furthermore, the signature verification in s390 kexec does not require
MODULE_SIG_FORMAT because it requires only the struct module_signature and,
therefore, does not depend on code in kernel/module_signature.c.
But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION is
also incorrect because it makes KEXEC_SIG available on s390 only if some
other arbitrary option (for instance a file system or device driver)
selects it directly or indirectly.
To properly make KEXEC_SIG available for s390 kernels built with MODULES=y
as well as MODULES=n _and_ also not depend on arbitrary options selecting
SYSTEM_DATA_VERIFICATION, set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and select
SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.
cpuidle: Skip governor when only one idle state is available
On certain platforms (PowerNV systems without a power-mgt DT node),
cpuidle may register only a single idle state. In cases where that
single state is a polling state (state 0), the ladder governor may
incorrectly treat state 1 as the first usable state and pass an
out-of-bounds index. This can lead to a NULL enter callback being
invoked, ultimately resulting in a system crash.
[ 13.342636] cpuidle-powernv : Only Snooze is available
[ 13.351854] Faulting instruction address: 0x00000000
[ 13.376489] NIP [0000000000000000] 0x0
[ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668
Fix this by adding a bail-out in cpuidle_select() that returns state 0
directly when state_count <= 1, bypassing the governor and keeping the
tick running.
Fixes: dc2251bf98c6 ("cpuidle: Eliminate the CPUIDLE_DRIVER_STATE_START symbol") Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com> Link: https://patch.msgid.link/20260216185005.1131593-2-aboorvad@linux.ibm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Inseo An [Tue, 17 Feb 2026 12:14:40 +0000 (21:14 +0900)]
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
nf_tables_addchain() publishes the chain to table->chains via
list_add_tail_rcu() (in nft_chain_add()) before registering hooks.
If nf_tables_register_hook() then fails, the error path calls
nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy()
with no RCU grace period in between.
This creates two use-after-free conditions:
1) Control-plane: nf_tables_dump_chains() traverses table->chains
under rcu_read_lock(). A concurrent dump can still be walking
the chain when the error path frees it.
2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly
installs the IPv4 hook before IPv6 registration fails. Packets
entering nft_do_chain() via the transient IPv4 hook can still be
dereferencing chain->blob_gen_X when the error path frees the
chain.
Add synchronize_rcu() between nft_chain_del() and the chain destroy
so that all RCU readers -- both dump threads and in-flight packet
evaluation -- have finished before the chain is freed.
Fixes: 91c7b38dc9f0 ("netfilter: nf_tables: use new transaction infrastructure to handle chain") Signed-off-by: Inseo An <y0un9sa@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
net: remove WARN_ON_ONCE when accessing forward path array
Although unlikely, recent support for IPIP tunnels increases chances of
reaching this WARN_ON_ONCE if userspace manages to build a sufficiently
long forward path.
Remove it.
Fixes: ddb94eafab8b ("net: resolve forwarding path from virtual netdevice and HW destination address") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
Julian Anastasov [Sat, 14 Feb 2026 14:58:50 +0000 (16:58 +0200)]
ipvs: do not keep dest_dst if dev is going down
There is race between the netdev notifier ip_vs_dst_event()
and the code that caches dst with dev that is going down.
As the FIB can be notified for the closed device after our
handler finishes, it is possible valid route to be returned
and cached resuling in a leaked dev reference until the dest
is not removed.
To prevent new dest_dst to be attached to dest just after the
handler dropped the old one, add a netif_running() check
to make sure the notifier handler is not currently running
for device that is closing.
Julian Anastasov [Sat, 14 Feb 2026 14:58:49 +0000 (16:58 +0200)]
ipvs: skip ipv6 extension headers for csum checks
Protocol checksum validation fails for IPv6 if there are extension
headers before the protocol header. iph->len already contains its
offset, so use it to fix the problem.
Phil Sutter [Sat, 14 Feb 2026 14:54:06 +0000 (15:54 +0100)]
include: uapi: netfilter_bridge.h: Cover for musl libc
Musl defines its own struct ethhdr and thus defines __UAPI_DEF_ETHHDR to
zero. To avoid struct redefinition errors, user space is therefore
supposed to include netinet/if_ether.h before (or instead of)
linux/if_ether.h. To relieve them from this burden, include the libc
header here if not building for kernel space.
Reported-by: Alyssa Ross <hi@alyssa.is> Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
Florian Westphal [Wed, 11 Feb 2026 11:53:09 +0000 (12:53 +0100)]
netfilter: nf_conntrack_h323: don't pass uninitialised l3num value
Mihail Milev reports: Error: UNINIT (CWE-457):
net/netfilter/nf_conntrack_h323_main.c:1189:2: var_decl:
Declaring variable "tuple" without initializer.
net/netfilter/nf_conntrack_h323_main.c:1197:2:
uninit_use_in_call: Using uninitialized value "tuple.src.l3num" when calling "__nf_ct_expect_find".
net/netfilter/nf_conntrack_expect.c:142:2:
read_value: Reading value "tuple->src.l3num" when calling "nf_ct_expect_dst_hash".
Brian Witte [Wed, 4 Feb 2026 20:26:36 +0000 (14:26 -0600)]
netfilter: nf_tables: revert commit_mutex usage in reset path
It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset
and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set'
rule run at the same time.
Previous patches made it safe to run individual reset handlers concurrently
so commit_mutex is no longer required to prevent this.
Brian Witte [Wed, 4 Feb 2026 20:26:38 +0000 (14:26 -0600)]
netfilter: nft_quota: use atomic64_xchg for reset
Use atomic64_xchg() to atomically read and zero the consumed value
on reset, which is simpler than the previous read+sub pattern and
doesn't require lock serialization.
Fixes: bd662c4218f9 ("netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests") Fixes: 3d483faa6663 ("netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests") Fixes: 3cb03edb4de3 ("netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests") Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Brian Witte <brianwitte@mailfence.com> Signed-off-by: Florian Westphal <fw@strlen.de>
Niranjan H Y [Sat, 14 Feb 2026 10:47:10 +0000 (16:17 +0530)]
ASoC: tas2783A: add explicit port prepare handling
TAS2783a required port prepare bits to be set during playback
even when it is using simplified CP_SM.
Normally, SoundWire core handles prepare sequencing automatically
depending on the type of the device available. For simplified CP_SM
there is no need to set the prepare bits. However, due to a hardware
limitation in TAS2783A, the port must still be explicitly prepared and
de-prepared by the driver to ensure reliable playback.
Add a custom .port_prep() callback to program DPN_PREPARECTRL during
PRE_PREP and PRE_DEPREP operations.
Claudiu Beznea [Fri, 13 Feb 2026 17:24:34 +0000 (19:24 +0200)]
ASoC: renesas: rz-ssi: Fix playback and capture
In the current codebase the rz_ssi_stream_get() is called at the beginning
of rz_ssi_dai_trigger() before rz_ssi_stream_init() is called.
Since rz_ssi_stream_init() sets the ssi->{playback, capture}->substream,
relying on it in rz_ssi_stream_get() is incorrect. Fix this by checking
substream->stream instead as the original code did.
====================
selftests: forwarding: fix br_netfilter related test failures
This patch series fixes kselftests that fail when the br_nefilter
module is loaded. The failures occur because the tests generate
packets that are either modified or encapsulated, but their IP
headers are not fully correct for sanity checks performed by
be_netfilter.
Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com>
====================
Aleksei Oladko [Fri, 13 Feb 2026 13:19:07 +0000 (13:19 +0000)]
selftests: forwarding: fix pedit tests failure with br_netfilter enabled
The tests use the tc pedit action to modify the IPv4 source address
("pedit ex munge ip src set"), but the IP header checksum is not
recalculated after the modification. As a result, the modified packet
fails sanity checks in br_netfilter after bridging and is dropped,
which causes the test to fail.
Fix this by ensuring net.bridge.bridge-nf-call-iptables is set to 0
during the test execution. This prevents the bridge from passing
L2 traffic to netfilter, bypassing the checksum validation that
causes the test failure.
Fixes: 92ad3828944e ("selftests: forwarding: Add a test for pedit munge SIP and DIP") Fixes: 226657ba2389 ("selftests: forwarding: Add a forwarding test for pedit munge dsfield") Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260213131907.43351-4-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Aleksei Oladko [Fri, 13 Feb 2026 13:19:06 +0000 (13:19 +0000)]
selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled
The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv6 packet has an incorrect payload length set in the IPv6 header.
After VXLAN decapsulation, such packets do not pass sanity checks in
br_netfilter and are dropped, which causes the test to fail.
Fix this by setting the correct IPv6 payload length for the encapsulated
packet generated by mausezahn, so that the packet is accepted
by br_netfilter.
Aleksei Oladko [Fri, 13 Feb 2026 13:19:05 +0000 (13:19 +0000)]
selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled
The test generates VXLAN traffic using mausezahn, where the encapsulated
inner IPv4 packet contains a zero IP header checksum. After VXLAN
decapsulation, such packets do not pass sanity checks in br_netfilter
and are dropped, which causes the test to fail.
Fix this by calculating and setting a valid IPv4 header checksum for the
encapsulated packet generated by mausezahn, so that the packet is accepted
by br_netfilter. Fixed by using the payload_template_calc_checksum() /
payload_template_expand_checksum() helpers that are only available
in v6.3 and newer kernels.
Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test") Signed-off-by: Aleksei Oladko <aleksey.oladko@virtuozzo.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260213131907.43351-2-aleksey.oladko@virtuozzo.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Erik Sanjaya [Tue, 17 Feb 2026 10:21:12 +0000 (17:21 +0700)]
ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 UX3405MA
The ASUS Zenbook 14 UX3405MA uses an ALC294 codec with CS35L41
amplifiers over SPI. The existing quirk for this model only configured
the amplifiers, leaving the headset microphone on the combo jack
non-functional.
Introduce a new fixup that configures pin 0x19 as headset mic input
and chains to ALC245_FIXUP_CS35L41_SPI_2 to preserve speaker
functionality.
Similar to the fix done for the UM3406HA in commit 018f659753fd
("ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14").
In that configuration, the netconsole driver is useless anyway, so
avoid this with an added dependency that prevents CONFIG_NETCONSOLE
to be enabled without CONFIG_PRINTK.
Fixes: 60325c27d3cf ("printk: Add execution context (task name/CPU) to printk_info") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260213074431.1729627-1-arnd@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The first patch fixes a warning in the mdb_n_entries code which was
reported by syzbot, the second patch adds tests for different ways
which used to trigger said warning. For more information please check
the individual commit messages.
====================
selftests: forwarding: bridge_mdb_max: add tests for mdb_n_entries warning
Recently we were able to trigger a warning in the mdb_n_entries counting
code. Add tests that exercise different ways which used to trigger that
warning.
net: bridge: mcast: always update mdb_n_entries for vlan contexts
syzbot triggered a warning[1] about the number of mdb entries in a context.
It turned out that there are multiple ways to trigger that warning today
(some got added during the years), the root cause of the problem is that
the increase is done conditionally, and over the years these different
conditions increased so there were new ways to trigger the warning, that is
to do a decrease which wasn't paired with a previous increase.
For example one way to trigger it is with flush:
$ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1
$ ip l add dumdum up master br0 type dummy
$ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1
$ ip link set dev br0 down
$ ip link set dev br0 type bridge mcast_vlan_snooping 1
^^^^ this will enable snooping, but will not update mdb_n_entries
because in __br_multicast_enable_port_ctx() we check !netif_running
$ bridge mdb flush dev br0
^^^ this will trigger the warning because it will delete the pg which
we added above, which will try to decrease mdb_n_entries
Fix the problem by removing the conditional increase and always keep the
count up-to-date while the vlan exists. In order to do that we have to
first initialize it on port-vlan context creation, and then always increase
or decrease the value regardless of mcast options. To keep the current
behaviour we have to enforce the mdb limit only if the context is port's or
if the port-vlan's mcast snooping is enabled.
Arnd Bergmann [Fri, 13 Feb 2026 16:51:51 +0000 (17:51 +0100)]
efi: export sysfb_primary_display for EDID
The sysfb_primary_display structure is now part of efi-init.c but
conditionally defined. One of the users is missing in the condition:
aarch64-linux-ld: drivers/video/fbdev/core/fbmon.o: in function `fb_firmware_edid':
fbmon.c:(.text.fb_firmware_edid+0x3c): undefined reference to `sysfb_primary_display'
Export it whenever CONFIG_FIRMWARE_EDID is set, so the fbdev core
code can use it.
Fixes: 4fcae6358871 ("sysfb: Move edid_info into sysfb_primary_display") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202602111543.Do4nkY5l-lkp@intel.com/ Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata")
converted the com20020-pci driver to use a card info structure instead
of a single flag mask in driver_data. However, it failed to take into
account that in the original code, driver_data of 0 indicates a card
with no special flags, not a card that should not have any card info
structure. This introduced a null pointer dereference when cards with
no flags were probed.
Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in
com20020pci_probe()") then papered over this issue by rejecting cards
with no driver_data instead of resolving the problem at its source.
Fix the original issue by introducing a new card info structure for
2.5Mbit cards that does not set any flags and using it if no
driver_data is present.
Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/rds: rds_sendmsg should not discard payload_len
Commit 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with
connection teardown") modifies rds_sendmsg to avoid enqueueing work
while a tear down is in progress. However, it also changed the return
value of rds_sendmsg to that of rds_send_xmit instead of the
payload_len. This means the user may incorrectly receive errno values
when it should have simply received a payload of 0 while the peer
attempts a reconnections. So this patch corrects the teardown handling
code to only use the out error path in that case, thus restoring the
original payload_len return value.
Fixes: 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260213035409.1963391-1-achender@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Ziyi Guo [Thu, 12 Feb 2026 22:40:40 +0000 (22:40 +0000)]
xen-netback: reject zero-queue configuration from guest
A malicious or buggy Xen guest can write "0" to the xenbus key
"multi-queue-num-queues". The connect() function in the backend only
validates the upper bound (requested_num_queues > xenvif_max_queues)
but not zero, allowing requested_num_queues=0 to reach
vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers
WARN_ON_ONCE(!size) in __vmalloc_node_range().
On systems with panic_on_warn=1, this allows a guest-to-host denial
of service.
The Xen network interface specification requires
the queue count to be "greater than zero".
Add a zero check to match the validation already present
in xen-blkback, which has included this
guard since its multi-queue support was added.
Fixes: 8d3d53b3e433 ("xen-netback: Add support for multiple queues") Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Ziyi Guo [Thu, 12 Feb 2026 21:41:54 +0000 (21:41 +0000)]
net: usb: catc: enable basic endpoint checking
catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add a catc_usb_ep enum for endpoint numbers, replacing magic constants
throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()
calls after usb_set_interface() to verify endpoint types before use,
rejecting devices with mismatched descriptors at probe time.
Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.
Takashi Iwai [Tue, 17 Feb 2026 10:44:11 +0000 (11:44 +0100)]
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314
Acer Swift SF314 (SSID 1025:136d) needs a bit of tweaks of the pin
configurations for NID 0x16 and 0x19 to make the headphone / headset
jack working. NID 0x17 can remain as is for the working speaker, and
the built-in mic is supported via SOF.
ovpn: tcp - don't deref NULL sk_socket member after tcp_close()
When deleting a peer in case of keepalive expiration, the peer is
removed from the OpenVPN hashtable and is temporary inserted in a
"release list" for further processing.
This happens in:
ovpn_peer_keepalive_work()
unlock_ovpn(release_list)
This processing includes detaching from the socket being used to
talk to this peer, by restoring its original proto and socket
ops/callbacks.
In case of TCP it may happen that, while the peer is sitting in
the release list, userspace decides to close the socket.
This will result in a concurrent execution of:
The last function call will set sk->sk_socket to NULL.
When the releasing routine is resumed, ovpn_tcp_socket_detach()
will attempt to dereference sk->sk_socket to restore its original
ops member. This operation will crash due to sk->sk_socket being NULL.
Fix this race condition by testing-and-accessing
sk->sk_socket atomically under sk->sk_callback_lock.
Paolo Abeni [Tue, 17 Feb 2026 10:15:54 +0000 (11:15 +0100)]
Merge tag 'ovpn-net-20260212' of https://github.com/OpenVPN/ovpn-net-next
Antonio Quartulli says:
====================
This batch includes the following fixes:
* set sk_user_data before installing callbacks, to avoid dropping early
packets
* fix use-after-free in ovpn_net_xmit when accessing shared skbs that
got released
* fix TX bytes stats by adding-up every positively processed GSO
segment
====================
Nam Cao [Thu, 12 Feb 2026 11:41:25 +0000 (12:41 +0100)]
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
PLIC ignores interrupt completion message for disabled interrupt, explained
by the specification:
The PLIC signals it has completed executing an interrupt handler by
writing the interrupt ID it received from the claim to the
claim/complete register. The PLIC does not check whether the completion
ID is the same as the last claim ID for that target. If the completion
ID does not match an interrupt source that is currently enabled for
the target, the completion is silently ignored.
This caused problems in the past, because an interrupt can be disabled
while still being handled and plic_irq_eoi() had no effect. That was fixed
by checking if the interrupt is disabled, and if so enable it, before
sending the completion message. That check is done with irqd_irq_disabled().
However, that is not sufficient because the enable bit for the handling
hart can be zero despite irqd_irq_disabled(d) being false. This can happen
when affinity setting is changed while a hart is still handling the
interrupt.
This problem is easily reproducible by dumping a large file to uart (which
generates lots of interrupts) and at the same time keep changing the uart
interrupt's affinity setting. The uart port becomes frozen almost
instantaneously.
Fix this by checking PLIC's enable bit instead of irqd_irq_disabled().
====================
eth: fbnic: fix and improve header/data split configuration
This series fixes TCP HDS configuration in the fbnic driver and adds a
devmem selftest for the intended behavior.
The issues fixed include setting the correct CSR for EN_HDR_SPLIT,
adjusting the hds threshold clamp to avoid long headers overflowing into
the payload page, and configuring the device to use L4/L3/L2 header
boundaries when present by programming the DMA hint bit unconditionally
for all steering rule types.
Prior to these fixes, small payloads fail devmem.check_rx_hds().
TAP version 13
1..4
ok 1 devmem.check_rx
ok 2 devmem.check_tx
ok 3 devmem.check_tx_chunks
ok 4 devmem.check_rx_hds
To: Alexander Duyck <alexanderduyck@fb.com>
To: Jakub Kicinski <kuba@kernel.org>
To: kernel-team@meta.com
To: Andrew Lunn <andrew+netdev@lunn.ch>
To: David S. Miller <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
To: Paolo Abeni <pabeni@redhat.com>
To: Mohsin Bashir <mohsin.bashr@gmail.com>
To: Shuah Khan <shuah@kernel.org> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
====================
Bobby Eshleman [Thu, 12 Feb 2026 01:00:44 +0000 (17:00 -0800)]
selftests: drv-net: add HDS payload sweep test for devmem TCP
Add check_rx_hds test that verifies header/data split works across
payload sizes. The test sweeps payload sizes from 1 byte to 8KB, if any
data propagates up to userspace as SCM_DEVMEM_LINEAR, then the test
fails. This shows that regardless of payload size, ncdevmem's
configuration of hds-thresh to 0 is respected.
Add -L (--fail-on-linear) flag to ncdevmem that causes the receiver to
fail if any SCM_DEVMEM_LINEAR cmsg is received.
Use socat option for fixed block sizing and tcp nodelay to disable
nagle's algo to avoid buffering.
Bobby Eshleman [Thu, 12 Feb 2026 01:00:43 +0000 (17:00 -0800)]
eth: fbnic: set DMA_HINT_L4 for all flows
fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool
.get_ringparam. To enable proper splitting for all flow types, even for
IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all
RSS and NFC flow steering rules. According to the spec, L4 falls back to
L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found.
This makes sure that the correct header boundary is used regardless of
traffic type. This is important for zero-copy use cases where we must
ensure that all ZC packets are split correctly.
Bobby Eshleman [Thu, 12 Feb 2026 01:00:42 +0000 (17:00 -0800)]
eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes
Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum
was too small to guarantee that very long L2+L3+L4 headers always fit
within the header buffer. When EN_HDR_SPLIT is disabled and a packet
exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead
of the header boundary, resulting in some of the header landing in the
payload page. The increased minimum ensures headers always fit with the
MAX_HEADER_BYTES cut off and land in the header page.
Bobby Eshleman [Thu, 12 Feb 2026 01:00:41 +0000 (17:00 -0800)]
eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0
Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead
of RDE_CTL1.
Because drop mode configuration and header splitting enablement both use
RDE_CTL0, we consolidate these configurations into the single function
fbnic_config_drop_mode.
kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package
Stefano reports that after commit 62089b804895 ("kbuild: rpm-pkg:
Generate debuginfo package manually"), building with an rpm package
using rpm 4.20.0 fails with:
RPM build errors:
Dependency tokens must begin with alpha-numeric, '_' or '/': #�) = 0x0d000002
Dependency tokens must begin with alpha-numeric, '_' or '/': �) = 0x0d000000
Dependency tokens must begin with alpha-numeric, '_' or '/': ) = 0x7c0e000000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
This error comes from the automatic requirements feature of rpm. The
-debuginfo subpackage has no dependencies, so disable this feature with
'AutoReq: 0' for this subpackage, avoiding the error. This matches the
official %_debug_template macro that rpm provides. While automatic
provides should be default enabled, be explicit like %_debug_template
does.
Additionally, while in the area, add the manual debug information
package to the Development/Debug group, further aligning with
%_debug_template.
Jens Axboe [Tue, 10 Feb 2026 17:00:44 +0000 (10:00 -0700)]
io_uring/bpf_filter: pass in expected filter payload size
It's quite possible that opcodes that have payloads attached to them,
like IORING_OP_OPENAT/OPENAT2 or IORING_OP_SOCKET, that these paylods
can change over time. For example, on the openat/openat2 side, the
struct open_how argument is extensible, and could be extended in the
future to allow further arguments to be passed in.
Allow registration of a cBPF filter to give the size of the filter as
seen by userspace. If that filter is for an opcode that takes extra
payload data, allow it if the application payload expectation is the
same size than the kernels. If that is the case, the kernel supports
filtering on the payload that the application expects. If the size
differs, the behavior depends on the IO_URING_BPF_FILTER_SZ_STRICT flag:
1) If IO_URING_BPF_FILTER_SZ_STRICT is set and the size expectation
differs, fail the attempt to load the filter.
2) If IO_URING_BPF_FILTER_SZ_STRICT isn't set, allow the filter if
the userspace pdu size is smaller than what the kernel offers.
3) Regardless if IO_URING_BPF_FILTER_SZ_STRICT, fail loading the filter
if the userspace pdu size is bigger than what the kernel supports.
An attempt to load a filter due to sizing will error with -EMSGSIZE.
For that error, the registration struct will have filter->pdu_size
populated with the pdu size that the kernel uses.
Reported-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Jens Axboe [Tue, 10 Feb 2026 16:29:59 +0000 (09:29 -0700)]
io_uring/bpf_filter: move filter size and populate helper into struct
Rather than open-code this logic in io_uring_populate_bpf_ctx() with
a switch, move it to the issue side definitions. Outside of making this
easier to extend in the future, it's also a prep patch for using the
pdu size for a given opcode filter elsewhere.
Linus Torvalds [Mon, 16 Feb 2026 21:41:38 +0000 (13:41 -0800)]
Merge tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull more slab updates from Vlastimil Babka:
- Two stable fixes for kmalloc_nolock() usage from NMI context (Harry
Yoo)
- Allow kmalloc_nolock() allocations to be freed with kfree() and thus
also kfree_rcu() and simplify slabobj_ext handling - we no longer
need to track how it was allocated to use the matching freeing
function (Harry Yoo)
* tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags
mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]()
mm/slab: use prandom if !allow_spin
mm/slab: do not access current->mems_allowed_seq if !allow_spin
Jens Axboe [Mon, 16 Feb 2026 21:16:27 +0000 (14:16 -0700)]
io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
By having them share the same space in struct io_cancel_data, it ends up
disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from
working. Eg you cannot match on both a file and user_data for
cancelation purposes. This obviously isn't a common use case as nobody
has reported this, but it does result in -ENOENT potentially being
returned when trying to match on both, rather than actually doing what
the API says it would.
Linus Torvalds [Mon, 16 Feb 2026 21:00:36 +0000 (13:00 -0800)]
Merge tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull more misc vfs updates from Christian Brauner:
"Features:
- Optimize close_range() from O(range size) to O(active FDs) by using
find_next_bit() on the open_fds bitmap instead of linearly scanning
the entire requested range. This is a significant improvement for
large-range close operations on sparse file descriptor tables.
- Add FS_XFLAG_VERITY file attribute for fs-verity files, retrievable
via FS_IOC_FSGETXATTR and file_getattr(). The flag is read-only.
Add tracepoints for fs-verity enable and verify operations,
replacing the previously removed debug printk's.
- Prevent nfsd from exporting special kernel filesystems like pidfs
and nsfs. These filesystems have custom ->open() and ->permission()
export methods that are designed for open_by_handle_at(2) only and
are incompatible with nfsd. Update the exportfs documentation
accordingly.
Fixes:
- Fix KMSAN uninit-value in ovl_fill_real() where strcmp() was used
on a non-null-terminated decrypted directory entry name from
fscrypt. This triggered on encrypted lower layers when the
decrypted name buffer contained uninitialized tail data.
The fix also adds VFS-level name_is_dot(), name_is_dotdot(), and
name_is_dot_dotdot() helpers, replacing various open-coded "." and
".." checks across the tree.
- Fix read-only fsflags not being reset together with xflags in
vfs_fileattr_set(). Currently harmless since no read-only xflags
overlap with flags, but this would cause inconsistencies for any
future shared read-only flag
- Return -EREMOTE instead of -ESRCH from PIDFD_GET_INFO when the
target process is in a different pid namespace. This lets userspace
distinguish "process exited" from "process in another namespace",
matching glibc's pidfd_getpid() behavior
Cleanups:
- Use C-string literals in the Rust seq_file bindings, replacing the
kernel::c_str!() macro (available since Rust 1.77)
- Fix typo in d_walk_ret enum comment, add porting notes for the
readlink_copy() calling convention change"
* tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
fs: add porting notes about readlink_copy()
pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns
nfsd: do not allow exporting of special kernel filesystems
exportfs: clarify the documentation of open()/permission() expotrfs ops
fsverity: add tracepoints
fs: add FS_XFLAG_VERITY for fs-verity files
rust: seq_file: replace `kernel::c_str!` with C-Strings
fs: dcache: fix typo in enum d_walk_ret comment
ovl: use name_is_dot* helpers in readdir code
fs: add helpers name_is_dot{,dot,_dotdot}
ovl: Fix uninit-value in ovl_fill_real
fs: reset read-only fsflags together with xflags
fs/file: optimize close_range() complexity from O(N) to O(Sparse)
Linus Torvalds [Mon, 16 Feb 2026 20:37:13 +0000 (12:37 -0800)]
Merge tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfs updates from Christian Brauner:
- pid: introduce task_ppid_vnr() helper
- pidfs: convert rb-tree to rhashtable
Mateusz reported performance penalties during task creation because
pidfs uses pidmap_lock to add elements into the rbtree. Switch to an
rhashtable to have separate fine-grained locking and to decouple from
pidmap_lock moving all heavy manipulations outside of it
Also move inode allocation outside of pidmap_lock. With this there's
nothing happening for pidfs under pidmap_lock
- pid: reorder fields in pid_namespace to reduce false sharing
- Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie
callers"
- ipc: Add SPDX license id to mqueue.c
* tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
pid: introduce task_ppid_vnr() helper
pidfs: implement ino allocation without the pidmap lock
Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers"
pid: reorder fields in pid_namespace to reduce false sharing
pidfs: convert rb-tree to rhashtable
ipc: Add SPDX license id to mqueue.c
Linus Torvalds [Mon, 16 Feb 2026 20:21:22 +0000 (12:21 -0800)]
Merge tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog
Pull watchdog updates from Wim Van Sebroeck:
- iTCO: Drop vendor support
- s3c2410_wdt: Drop S3C2410 support
- Convert mpc8xxx-wdt to YAML
- Several small fixes and improvements
* tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog:
dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog
dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML
dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more
dt-bindings: watchdog: samsung-wdt: Drop S3C2410
watchdog: s3c2410_wdt: Drop S3C2410 support
dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level
watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
watchdog: rz: Discard pm_runtime_put() return values
watchdog: Make API functions const correct
watchdog: imx7ulp_wdt: handle the nowayout option
watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF
watchdog: Always return time left until watchdog times out
watchdog: iTCO: Drop vendor support
watchdog: starfive-wdt: Fix PM reference leak in probe error path
fix it87_wdt early reboot by reporting running timer
Linus Torvalds [Mon, 16 Feb 2026 19:15:19 +0000 (11:15 -0800)]
Merge tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Add support for the TI LP5812 4x3 matrix RGB LED driver, including
autonomous animation engine control and extensive scan multiplexing
modes
- Add a new driver for the ams Osram AS3668 4-channel I2C LED
controller
- Extend the is31fl32xx driver to support the is31fl3293 variant,
which features 3 channels and 12-bit PWM resolution
Improvements & Fixes:
- Prevent the ExpressWire KTD2801 chip from entering an undefined
state by disabling interrupts during time-sensitive communication
- Ensure the Qualcomm LPG driver detects hardware write failures by
checking the return value of regmap_bulk_write() during LUT
programming
- Fix kernel-doc warnings in the lm3692x driver by documenting
missing struct members and standardizing the comment style
- Update the ExpressWire library to use fsleep() and unexport
internal-only functions
- Improve the is31fl32xx driver by reordering code to eliminate
unnecessary forward declarations
Cleanups & Refactoring:
- Simplify the LP55XX common LED driver by utilizing the
for_each_available_child_of_node_scoped() macro for more concise
node iteration
Device Tree Bindings Updates:
- Add new YAML bindings for the TI LP5860 and LP5812 LED controllers,
and the ams Osram AS3668
- Convert the TI LM3697 white LED driver binding to DT schema format
- Allow multicolor LED nodes to be named with numeric suffixes (e.g.,
multi-led-0) to handle multiple instances without unit addresses
- Document support for the PMH0101 variant in the Qualcomm LPG PWM
and SPMI Flash LED bindings
- Add the issi,is31fl3293 compatible string to the is31fl32xx
binding"
* tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds:
dt-bindings: leds: Convert ti,lm3697 to DT schema
leds: as3668: Driver for the ams Osram 4-channel i2c LED driver
dt-bindings: leds: Add new as3668 support
docs: leds: Document TI LP5812 LED driver
leds: Add basic support for TI/National Semiconductor LP5812 LED Driver
leds: qcom-lpg: Check the return value of regmap_bulk_write()
dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible
dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM
dt-bindings: leds: Allow differently named multicolor LEDs
leds: lp55xx: Simplify with scoped for each OF child loop
dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver
leds: is31f132xx: Add support for is31fl3293
leds: is31f132xx: Re-order code to remove forward declarations
dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx
leds: expresswire: Fix chip state breakage
dt-bindings: leds: Add LP5860 LED controller
leds: lm3692x: Fix kernel-doc for struct lm3692x_led
Linus Torvalds [Mon, 16 Feb 2026 19:05:44 +0000 (11:05 -0800)]
Merge tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- Add comprehensive support for the ROHM BD72720 PMIC, including core
MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers
- Add support for the Rockchip RK801 PMIC, including core MFD and
regulator drivers
- Add support for the ROHM BD73900 PMIC by leveraging existing common
drivers
- Wire up RTC, hwmon, and input sub-devices for the Apple SMC
(macsmc) driver
- Add support for the Delta Networks TN48M switch CPLD via the
simple-mfd-i2c driver
- Add support for the TS133 variant to the QNAP MCU driver
- Provide support for the sama7d65 XLCD controller in the Atmel HLCDC
driver
- Add backlight sub-device support to the Congatec Board Controller
(cgbc)
- Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver
Improvements & Fixes:
- Implement a "wrapper regmap" for the ROHM BD72720 to handle dual
I2C slave addresses (0x4b and 0x4c) transparently for child devices
- Introduce mutex locking around 'mfd_of_node_list' in the MFD core
to ensure safe concurrent access
- Fix a potential regulator resource leak in the Arizona core driver
during boot sequence failures
- Resolve child device duplication issues on driver rebind for
Qualcomm PM8xxx and OMAP USB host drivers by using
of_platform_depopulate()
- Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a
unique domain suffix
- Implement LOCK register handling for the TI TPS65214 variant to
unlock registers at probe time
- Fully convert the Loongson-2K BMC driver to use managed resources
(pcim) and the standard PCI resource API
- Ensure the Apple SMC mutex is correctly initialized during probe to
prevent NULL pointer dereferences
- Expand the ROHM BD71828 power-supply driver to support 9-bit
register addresses
- Simplify the Samsung S5M RTC driver by querying platform device IRQ
resources directly
- Revert an incorrect read-to-write mask change in the DA9052 SPI
driver to restore default OTP behavior
- Fix kernel-doc warnings in the TI TPS6105x driver
- Cleanups & Refactoring
- Simplify the MFD core by utilizing the scoped
for_each_child_of_node_scoped() macro and streamlining device_node
storage
- Rename ROHM BD71828 IC-specific entities to use consistent prefixes
for better extensibility
- Refactor ROHM BD71828 regmap definitions using the
regmap_reg_range() macro
- Update the ROHM BD71828 driver to use standard C-style comment
headers
- Remove the now unused 'irq_data' field from the Samsung SEC core
structure
- Drop unnecessary use of irqd_get_trigger_type() in the Maxim
MAX77759 driver
- Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected
- Add missing charger-related registers to the ROHM BD71828 core
header and Type-C CC registers to the AXP717
Device Tree Binding Updates:
- Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC,
Bitmain BM1880 System Controller, and NXP LPC32xx System Control
Block
- Clarify trickle-charge terminology and add properties for voltage
drop (VDR) correction and upper charge limits to the generic
battery binding
- Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for
Aspeed SCU
- Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102,
pmh0101, pmk8850, etc)
- Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom
(Microchip), and various MediaTek SCPSYS and regulator components
- Fix a dead link to the audio codec binding in the DA9055
documentation"
* tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits)
dt-bindings: mfd: da9055: Fix dead link to codec binding
mfd: cgbc: Add support for backlight
dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali
dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu
mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
mfd: ls2kbmc: Use PCI API instead of direct accesses
mfd: ls2kbmc: Fully convert to use managed resources
dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat
dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys
dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom
mfd: omap-usb-host: Fix OF populate on driver rebind
mfd: qcom-pm8xxx: Fix OF populate on driver rebind
dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc
mfd: qnap-mcu: Add driver data for TS133 variant
dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible
mfd: sec: Fix IRQ domain names duplication
mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
mfd: macsmc: Initialize mutex
dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block
mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT
...
Yu Kuai [Sat, 14 Feb 2026 05:43:50 +0000 (13:43 +0800)]
blk-mq: use NOIO context to prevent deadlock during debugfs creation
Creating debugfs entries can trigger fs reclaim, which can enter back
into the block layer request_queue. This can cause deadlock if the
queue is frozen.
Previously, a WARN_ON_ONCE check was used in debugfs_create_files()
to detect this condition, but it was racy since the queue can be frozen
from another context at any time.
Introduce blk_debugfs_lock()/blk_debugfs_unlock() helpers that combine
the debugfs_mutex with memalloc_noio_save()/restore() to prevent fs
reclaim from triggering block I/O. Also add blk_debugfs_lock_nomemsave()
and blk_debugfs_unlock_nomemrestore() variants for callers that don't
need NOIO protection (e.g., debugfs removal or read-only operations).
Replace all raw debugfs_mutex lock/unlock pairs with these helpers,
using the _nomemsave/_nomemrestore variants where appropriate.
Linus Torvalds [Mon, 16 Feb 2026 17:30:44 +0000 (09:30 -0800)]
Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS updates from Thomas Bogendoerfer:
"Cleanups and fixes"
* tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits)
Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST"
Revert "clk: microchip: fix typo in reference to a config option"
MIPS: Implement ARCH_HAS_CC_CAN_LINK
MIPS: rb532: Fix MMIO UART resource registration
MIPS: Work around LLVM bug when gp is used as global register variable
MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI
MIPS: Loongson2ef: Use pcibios_align_resource() to block io range
MIPS: Loongson2ef: Register PCI controller in early stage
clk: microchip: fix typo in reference to a config option
MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC
clk: microchip: core: allow driver to be compiled with COMPILE_TEST
MIPS: drop unused pic32.h header
watchdog: pic32-wdt: update include to use pic32.h from platform_data
watchdog: pic32-dmt: update include to use pic32.h from platform_data
serial: pic32_uart: update include to use pic32.h from platform_data
rtc: pic32: update include to use pic32.h from platform_data
pinctrl: pic32: update include to use pic32.h from platform_data
mmc: sdhci-pic32: update include to use pic32.h from platform_data
irqchip/irq-pic32-evic: update include to use pic32.h from platform_data
clk: microchip: core: update include to use pic32.h from platform_data
...
Zhai Can [Sat, 14 Feb 2026 16:14:52 +0000 (00:14 +0800)]
ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO
On the THUNDEROBOT ZERO laptop, the second NVMe slot and the discrete
NVIDIA GPU are both controlled by power-resource PXP. Due to the SSDT table
bug (lack of reference), PXP will be shut dow as an "unused" power resource
during initialization, making the NVMe slot #2 + NVIDIA both inaccessible.
This issue was introduced by commit a1224f34d72a ("ACPI: PM: Check
states of power resources during initialization"). Here are test
results on the three consecutive commits:
(bad again!) a1224f34d72a ACPI: PM: Check states of power resources during initialization
(good) bc2836859643 ACPI: PM: Do not turn off power resources in unknown state
(bad) 519d81956ee2 Linux 5.15-rc6
On commit bc2836859643 ("ACPI: PM: Do not turn off power resources in
unknown state") this was not an issue because the power resource state
left UNKNOWN thus being ignored.
See also commit 9b04d99788cf ("ACPI: PM: Do not turn of unused power
resources on the Toshiba Click Mini") which is another almost identical
case to this one.
Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221087 Signed-off-by: Zhai Can <bczhc0@126.com> Link: https://patch.msgid.link/20260214161452.2849346-1-bczhc0@126.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Randy Dunlap [Mon, 16 Feb 2026 05:29:51 +0000 (21:29 -0800)]
blk-stat: convert struct blk_stat_callback to kernel-doc
Most of struct blk_stat_callback documentation is already in kernel-doc
format. Convert the remaining struct members to kernel-doc to avoid
kernel-doc warnings:
Warning: block/blk-stat.h:62 struct member 'list' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'timer_fn' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'rcu' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:133 No description found for return value of
'blk_stat_is_active'
Randy Dunlap [Mon, 16 Feb 2026 05:29:41 +0000 (21:29 -0800)]
block: fix enum descriptions kernel-doc
Fix all kernel-doc warnings in blk_types.h:
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_READ' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_FLUSH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DISCARD' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_SECURE_ERASE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_APPEND' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE_ZEROES' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_OPEN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_CLOSE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_FINISH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET_ALL' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_IN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_OUT' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_LAST' not described in enum 'req_op'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
André Draszik [Tue, 10 Feb 2026 17:23:51 +0000 (17:23 +0000)]
regulator: s2mps11: fix pctrlsel macro usage in s2mpg10_of_parse_cb()
Commit 979dd8da76eb ("regulator: s2mps11: add S2MPG11 regulator")
incorrectly ended up using macros for S2MPG10 in the S2MPG11 case. They
happen to end up giving the same result, but for clarity, the correct
macros should be used.
André Draszik [Tue, 10 Feb 2026 17:23:50 +0000 (17:23 +0000)]
regulator: s2mps11: drop redundant sanity checks in s2mpg10_of_parse_cb()
The sanity checks being removed in this commit are useless as earlier
code already checks for all conditions, including all error cases like
out-of-bounds conditions. In other words, the code being removed here
has no effect, as any potential error it could catch will already have
been caught by earlier code.
The checks removed here are also incomplete (as they're off-by-one) -
they should have been checking >= ARRAY_SIZE() to be complete.
Simply remove this redundant and incorrect code.
No functional change.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/all/aYmsu8qREppwBESH@stanley.mountain/ Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-fixes-v2-1-ab3d3457f1ae@linaro.org Signed-off-by: Mark Brown <broonie@kernel.org>
Gustavo Salvini [Tue, 10 Feb 2026 15:51:56 +0000 (12:51 -0300)]
ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR
The ASUS Vivobook Pro 15X (M6501RR) with AMD Ryzen 9 6900HX has an
internal DMIC that is not detected without a DMI quirk entry, as the
BIOS does not set the AcpDmicConnected ACPI _DSD property.
Adding the DMI entry enables the ACP6x DMIC machine driver to probe
successfully.
fs/ntfs3: add delayed-allocation (delalloc) support
This patch implements delayed allocation (delalloc) in ntfs3 driver.
It introduces an in-memory delayed-runlist (run_da) and the helpers to
track, reserve and later convert those delayed reservations into real
clusters at writeback time. The change keeps on-disk formats untouched and
focuses on pagecache integration, correctness and safe interaction with
fallocate, truncate, and dio/iomap paths.
Key points:
- add run_da (delay-allocated run tree) and bookkeeping for delayed clusters.
- mark ranges as delalloc (DELALLOC_LCN) instead of immediately allocating.
Actual allocation performed later (writeback / attr_set_size_ex / explicit
flush paths).
- direct i/o / iomap paths updated to avoid dio collisions with
delalloc: dio falls back or forces allocation of delayed blocks before
proceeding.
Pavel Begunkov [Mon, 16 Feb 2026 13:55:30 +0000 (13:55 +0000)]
io_uring/rsrc: improve regbuf iov validation
Deduplicate io_buffer_validate() calls by moving the checks into
io_sqe_buffer_register(). Now we also don't need special handling in
io_buffer_validate() passing through buffer removal requests. I also
was using it as a cleanup before some other changes.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Dylan Yudaken [Sun, 15 Feb 2026 23:15:23 +0000 (23:15 +0000)]
io_uring: remove unneeded io_send_zc accounting
zc->len and zc->buf are not actually used once you get to the retry
stage. The buffer remains in kmsg->msg.msg_iter, which is setup in
io_send_setup.
Note: it still seems needed in io_send due to io_send_select_buffer
needing it (for the len parameter).
io_uring/cmd_net: fix too strict requirement on ioctl
Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted
in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct
proto, but only in struct proto_ops.
Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op
operations, both requiring ioctl, thus the check was warranted.
Since then, 4 new cmd_op operations have been added, none of which
depend on ioctl. This patch moves the ioctl check, so it only applies
to the original operations.
AFAICT, the ioctl requirement was unintentional, and it wasn't
visible in the blamed patch within 3 lines of context.
Linus Torvalds [Mon, 16 Feb 2026 15:04:01 +0000 (07:04 -0800)]
Merge tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull kprobes updates from Masami Hiramatsu:
- Use a dedicated kernel thread to optimize the kprobes instead of
using workqueue thread. Since the kprobe optimizer waits a long time
for synchronize_rcu_task(), it can block other workers in the same
queue if it uses a workqueue.
- kprobe-events: return immediately if no new probe events are
specified on the kernel command line at boot time. This shortens
the kernel boot time.
- When a kprobe is fully removed from the kernel code, retry optimizing
another kprobe which is blocked by that kprobe.
* tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
kprobes: Use dedicated kthread for kprobe optimizer
tracing: kprobe-event: Return directly when trace kprobes is empty
kprobes: retry blocked optprobe in do_free_cleaned_kprobes
Some XRUN-related error messages may repeat themselves, because there
can be multiple pending packets. Modify notify_xrun() function to
return whether it's being stopped or not, and show the error message
only once when the XRUN is actually handled.
Along with it, fix a typo of word package to packet in the error
message.
Takashi Iwai [Mon, 16 Feb 2026 14:12:07 +0000 (15:12 +0100)]
ALSA: usb-audio: Add sanity check for OOB writes at silencing
At silencing the playback URB packets in the implicit fb mode before
the actual playback, we blindly assume that the received packets fit
with the buffer size. But when the setup in the capture stream
differs from the playback stream (e.g. due to the USB core limitation
of max packet size), such an inconsistency may lead to OOB writes to
the buffer, resulting in a crash.
For addressing it, add a sanity check of the transfer buffer size at
prepare_silent_urb(), and stop the data copy if the received data
overflows. Also, report back the transfer error properly from there,
too.
Note that this doesn't fix the root cause of the playback error
itself, but this merely covers the kernel Oops.
Takashi Iwai [Mon, 16 Feb 2026 14:12:05 +0000 (15:12 +0100)]
ALSA: usb-audio: Update the number of packets properly at receiving
At receiving the packets from the implicit feedback source, we didn't
update ctx->packets field but only the ctx->packet_size[] data.
In exceptional cases, this might lead to unexpectedly superfluous data
transfer (although this won't happen usually due to the nature of USB
isochronous transfer). Fix it to update the field properly.
Linus Torvalds [Mon, 16 Feb 2026 03:45:00 +0000 (19:45 -0800)]
Merge tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu
Pull m68knommu updates from Greg Ungerer:
- defconfig cleanup
- fix for legacy 68000 CPU memmove() of non-aligned pointers
- replace strcpy() with strscpy() for ucsimm target
* tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm
m68k: nommu: fix memmove() with differently aligned src and dest for 68000
m68k: defconfig: Clean up references to non-existing configs
Shyam Prasad N [Sat, 14 Feb 2026 10:29:13 +0000 (15:59 +0530)]
cifs: some missing initializations on replay
In several places in the code, we have a label to signify
the start of the code where a request can be replayed if
necessary. However, some of these places were missing the
necessary reinitializations of certain local variables
before replay.
This change makes sure that these variables get initialized
after the label.
Cc: stable@vger.kernel.org Reported-by: Yuchan Nam <entropy1110@gmail.com> Tested-by: Yuchan Nam <entropy1110@gmail.com> Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
Pavel Begunkov [Sun, 15 Feb 2026 22:06:52 +0000 (22:06 +0000)]
io_uring: delay sqarray static branch disablement
io_key_has_sqarray static branch can be easily switched on/off by the
user every time patching the kernel. That can be very disruptive as it
might require heavy synchronisation across all CPUs. Use deferred static
keys, which can rate-limit it by deferring, batching and potentially
effectively eliminating dec+inc pairs.
Fixes: 9b296c625ac1d ("io_uring: static_key for !IORING_SETUP_NO_SQARRAY") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Pavel Begunkov [Sun, 15 Feb 2026 21:34:28 +0000 (21:34 +0000)]
io_uring/query: return support for custom rx page size
Add an ability to query if the zcrx rx page size setting is available.
Note, even when the API is supported by io_uring, the registration can
still get rejected for various reasons, e.g. when the NIC or the driver
doesn't support it, when the particular specified size is unsupported,
when the memory area doesn't satisfy all requirements, etc.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Linus Torvalds [Sun, 15 Feb 2026 18:47:59 +0000 (10:47 -0800)]
Merge tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull documentation fixes from Jonathan Corbet:
"A handful of small, late-arriving documentation fixes"
* tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
docs: toshiba_haps: fix grammar error in SSD warning
Docs/mm: fix typos and grammar in page_tables.rst
Docs/core-api: fix typos in rbtree.rst
docs: clarify wording in programming-language.rst
docs: process: maintainer-pgp-guide: update kernel.org docs link
docs: kdoc_parser: allow __exit in function prototypes
Linus Torvalds [Sun, 15 Feb 2026 18:24:46 +0000 (10:24 -0800)]
Merge tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux
Pull 9p updates from Dominique Martinet:
- 9p/xen racy double-free fix
- track 9p RPC waiting time as IO
* tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux:
9p/xen: protect xen_9pfs_front_free against concurrent calls
9p: Track 9P RPC waiting time as IO
wait: Introduce io_wait_event_killable()
Linus Torvalds [Sun, 15 Feb 2026 18:20:37 +0000 (10:20 -0800)]
Merge tag 'tsm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm
Pull TSM updates from Dan Williams:
"A couple of updates to the maximum buffer sizes supported for the
configfs-tsm-reports interface.
This interface is a common transport that conveys the varied
architecture specific launch attestation reports for confidential VMs.
- Prepare the configfs-tsm-reports interface for passing larger
attestation evidence blobs for "Device Identifier Composition
Engine" (DICE) and Post Quantum Crypto (PQC)
- Update the tdx-guest driver for DICE evidence (larger certificate
chains and the CBOR Web Token schema)"
* tag 'tsm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:
configfs-tsm-report: tdx_guest: Increase Quote buffer size to 128KB
configfs-tsm-report: Increase TSM_REPORT_OUTBLOB_MAX to 16MB
configfs-tsm-report: Document size limits for outblob attributes
Linus Torvalds [Sun, 15 Feb 2026 16:29:26 +0000 (08:29 -0800)]
Merge tag 'i2c-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c updates from Wolfram Sang:
- core: cleaner fwnode usage
- tegra: timing improvements and Tegra264 support
- lpi2c: fix SMBus block read NACK after byte count
- amd-mp2, designware, mlxbf, rtl9300, spacemit, tegra: cleanups
- designware:
- use a dedicated algorithm for AMD Navi
- replace magic numbers with named constants
- replace min_t() with min() to avoid u8 truncation
- refactor core to enable mode switching
- imx-lpi2c: add runtime PM support for IRQ and clock handling
- lan9691-i2c: add new driver
- rtl9300: use OF helpers directly and avoid fwnode handling
- spacemit: add bus reset support
- units: add HZ_PER_GHZ and use it in several i2c drivers
- at24 i2c eeprom:
- add a set of new compatibles to DT bindings
- use dev_err_probe() consistently in the driver
* tag 'i2c-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (46 commits)
i2c: imx-lpi2c: fix SMBus block read NACK after byte count
i2c: designware: Remove an unnecessary condition
i2c: designware: Enable mode swapping
i2c: designware: Combine the init functions
i2c: designware: Combine some of the common functions
i2c: designware: Use device_is_compatible() instead of custom approach
dt-bindings: eeprom: at24: Add compatible for Puya P24C128F
drivers/i2c/busses: use min() instead of min_t()
i2c: imx-lpi2c: Add runtime PM support for IRQ and clock management on i.MX8QXP/8QM
i2c: amd-mp2: clean up amd_mp2_find_device()
i2c: designware: Replace magic numbers with named constants
i2c: rtl9300: use of instead of fwnode
i2c: rtl9300: remove const cast
i2c: tegra: remove unused rst
i2c: designware: Remove not-going-to-be-supported code for Baikal SoC
i2c: spacemit: drop useless spaces
i2c: mlxbf: Use HZ_PER_KHZ in the driver
i2c: mlxbf: Remove unused bus speed definitions
i2c: core: Use dev_fwnode()
i2c: core: Replace custom implementation of device_match_fwnode()
...
Linus Torvalds [Sun, 15 Feb 2026 16:24:19 +0000 (08:24 -0800)]
Merge tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- support for FocalTech FT8112 added to i2c-hid driver
- support for FocalTech FT3518 added to edt-ft5x06 driver
- support for power buttons in TWL603x chips added to twl4030-pwrbutton
driver
- an update to gpio-decoder driver to make it usable on non-OF
platforms and to clean up the code
- an update to synaptics_i2c driver switching it to use managed
resources and a fix to restarting polling after resume
- an update to gpio-keys driver to fall back to getting IRQ from
resources if not specified using other means
- an update to ili210x driver to support polling mode
- a number of input drivers switched to scnprintf() to suppress
truncation warnings
- a number of updates and conversions of device tree bindings to yaml
format
- fixes to spelling in comments and messages in several drivers
- other assorted fixups
* tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits)
dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU
dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038
Input: apbps2 - fix comment style and typos
Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys
Input: novatek-nvt-ts - drop wake_type check
dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells'
Input: ili210x - add support for polling mode
dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek
Input: appletouch - fix potential race between resume and open
HID: i2c-hid: Add FocalTech FT8112
dt-bindings: input: i2c-hid: Introduce FocalTech FT8112
Input: synaptics_i2c - switch to using managed resources
Input: synaptics_i2c - guard polling restart in resume
Input: gpio_decoder - don't use "proxy" headers
Input: gpio_decoder - make use of the macros from bits.h
Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep()
Input: gpio_decoder - unify messages with help of dev_err_probe()
Input: gpio_decoder - make use of device properties
Input: serio - complete sizeof(*pointer) conversions
Input: wdt87xx_i2c - switch to use dev_err_probe()
...
Linus Torvalds [Sun, 15 Feb 2026 16:18:57 +0000 (08:18 -0800)]
Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk updates from Stephen Boyd:
"Not much changed in the clk framework this time except the clk.h
consumer API moved the context saving APIs around to fix a build error
in certain configurations.
There was a change to the core framework for CLK_OPS_PARENT_ENABLE
behavior during registration, but it wrecked existing drivers that
didn't expect things to be turned off during clk registration so it
got reverted.
This cycle is really a large collection of new clk drivers, primarily
for Qualcomm SoCs but also for Amlogic, SpacemiT, Google, and Aspeed.
Another big change in here is support for automatic hardware clock
gating on Samsung SoCs where the clks turn on and off when needed.
Ideally more vendors move to this method for better power savings. The
highlights are in the updates section below.
Beyond all the new drivers we have a bunch of cleanups like converting
drivers from divider_round_rate() to divider_determine_rate() and
using scoped for each OF child loops. Otherwise it's the usual data
fixes and plugging reference leaks, etc. that's all pretty ordinary
but not critical enough to fix until the next release.
New Drivers:
- Qualcomm Kaanapali global, tcsr, rpmh, display, gpu, camera, and
video clk controllers
- Qualcomm SM8750 camera clk controllers
- Qualcomm MSM8940 and SDM439 global clk controllers
- Google GS101 Display Process Unit (DPU) clk controllers
- SpacemiT K3 clk controllers
- Amlogic t7 clk controllers
- Aspeed AST2700 clk controllers
Updates:
- Convert clock dividers from round_rate() to determine_rate()
- Fix sparse warnings, kernel-doc warnings, and plug leaked OF refs
- Automatic hardware clk gating on Google GS101 SoCs
- Amlogic s4 video clks
- CAN-FD clks and resets on Renesas RZ/T2H, RZ/N2H, RZ/V2H, and
RZ/V2N
- Expanded Serial Peripheral Interface (xSPI) clocks and resets on
Renesas RZ/T21H and RZ/N2H
- DMAC, interrupt controller (ICU), SPI, and thermal (TSU) clocks and
resets on Renesas RZ/V2N
- More serial (RSCI) clocks and resets on Renesas RZ/V2H and RZ/V2N
- CPU frequency scaling on T-HEAD TH1520"
* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (165 commits)
clk: aspeed: Add reset for HACE/VIDEO
dt-bindings: clock: aspeed: Add VIDEO reset definition
clk: aspeed: add AST2700 clock driver
MAINTAINERS: Add entry for ASPEED clock drivers.
clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory.
Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc"
clk: Disable KUNIT_UML_PCI
dt-bindings: clk: rs9: Fix DIF pattern match
clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS()
clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc
clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc
clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc
clk: mediatek: Fix error handling in runtime PM setup
clk: mediatek: don't select clk-mt8192 for all ARM64 builds
clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks
clk: mediatek: Refactor pllfh registration to pass device
clk: mediatek: Pass device to clk_hw_register for PLLs
clk: mediatek: Refactor pll registration to pass device
clk: Respect CLK_OPS_PARENT_ENABLE during recalc
...
projects / ceph-client.git / log