summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-09-03nvme-tcp: defer TLS inline send to io_workXixin Liu1-0/+5
blk_mq holds set->srcu while queuing and running requests. The kTLS software send path takes ctx->tx_lock. lockdep knows that tx_lock nests under elevator_lock which then waits on srcu, so an inline send from that path under TLS triggers circular locking. Skip the inline send optimization for TLS queues so the send runs from the workqueue instead. The same workqueue already retries TLS sends on write-space notifications. Plain TCP keeps the inline path. Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvmet-tcp: fix out-of-bounds write when receiving an over-long PDUShivam Kumar1-0/+2
nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever bounding the result against sizeof(queue->pdu). A struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the union. Once a header digest has been negotiated (hdgst = 4), a second ICReq passes the hlen == nvmet_tcp_pdu_size() check but yields queue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the 128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and queue->data_digest. Those bytes are attacker-controlled (an ICReq carries no digest), and the duplicate ICReq is only rejected later, after the overflow. A remote unauthenticated host can thus corrupt kernel memory adjacent to the receive buffer. Reject any PDU whose declared length would read past the end of queue->pdu before the second recv. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com> Cc: stable@vger.kernel.org Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvme-tcp: return -EPROTO for a C2HData on a writeYehyeong Lee1-1/+1
The direction check in nvme_tcp_handle_c2h_data() returns -EIO. A C2HData PDU naming a command that did not ask for data is a protocol violation, and the check that rejects a PDU on those grounds a few lines below it - SUCCESS set without LAST - returns -EPROTO. No caller distinguishes the two, so this changes the error code alone. Suggested-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvmet: print namespace IDs as unsigned 32bit valueMohamed Khalfella3-4/+4
struct nvmet_ns.nsid is a u32, but a few messages print it with %d. An NSID larger than 0x7fffffff is rendered as a negative number, which is misleading in general and particularly so for the configfs messages that echo back the NSID the user just asked for. For example: [ T200] nvmet: adding nsid -16 to subsystem mysubsystem Print them with %u. The invalid-NSID error in nvmet_ns_make() keeps its %#x because the two values it rejects, 0 and NVME_NSID_ALL, are more readable in hex format. No functional change other than how the NSID is formatted. Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Fixes: c6925093d0b2 ("nvmet: Optionally use PCI P2P memory") Fixes: 5a47c2080a73 ("nvmet: support reservation feature") Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvme: print namespace IDs as unsigned 32bit valueMohamed Khalfella3-12/+12
NSIDs are 32-bit unsigned values, but a number of log messages print them with %d. An NSID larger than 0x7fffffff is rendered as a negative number, which is confusing in the kernel log and makes the message hard to correlate with the namespace it talks about. Sparse NSID spaces where high NSIDs are common are the most likely to hit this. The nsid sysfs attribute has the same problem, and there it is worse because userspace parses the value. For example: $ grep . /sys/class/block/nvme0*/nsid /sys/class/block/nvme0c0n1/nsid:10 /sys/class/block/nvme0c0n2/nsid:-16 /sys/class/block/nvme0c0n3/nsid:11 /sys/class/block/nvme0c0n4/nsid:-2000000016 /sys/class/block/nvme0n1/nsid:10 /sys/class/block/nvme0n2/nsid:-16 /sys/class/block/nvme0n3/nsid:11 /sys/class/block/nvme0n4/nsid:-2000000016 $ Print all of them with %u. Several messages in these files, including two in zns.c right next to the ones being changed, already use %u, so this only makes the rest consistent with them. No functional change other than how the NSID is formatted. Fixes: 2b9b6e86bca7 ("NVMe: Export namespace attributes to sysfs") Fixes: 1d5df6af8c74 ("nvme: don't blindly overwrite identifiers on disk revalidate") Fixes: ed754e5deeb1 ("nvme: track shared namespaces") Fixes: 9ad1927a3bc2 ("nvme: always search for namespace head") Fixes: 71010c309454 ("nvme: implement multiple I/O Command Set support") Fixes: 2f4c9ba23b88 ("nvme: export zoned namespaces without Zone Append support read-only") Fixes: 0ec84df4953b ("nvme-core: check ctrl css before setting up zns") Fixes: 2079f41ec6ff ("nvme: check that EUI/GUID/UUID are globally unique") Fixes: ce8d78616a6b ("nvme: warn about shared namespaces without CONFIG_NVME_MULTIPATH") Fixes: ac522fc6c316 ("nvme: don't reject probe due to duplicate IDs for single-ported PCIe devices") Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvme: remove stale namespaces by NSID range during scanMohamed Khalfella1-9/+9
nvme_scan_ns_list() drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvme_find_get_ns() to look the namespace up and removes it if it is present. The loop runs once per NSID in the gap rather than once per namespace actually present. NSIDs are 32-bit, so a target with a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove. watchdog: BUG: soft lockup - CPU#4 stuck for 26s! Workqueue: nvme-wq nvme_scan_work [nvme_core] RIP: 0010:__srcu_read_unlock+0xb/0x20 Call Trace: nvme_find_get_ns+0x7d/0xb0 [nvme_core] nvme_scan_ns_list+0xe8/0x280 [nvme_core] nvme_scan_work+0x18a/0x280 [nvme_core] process_one_work+0x197/0x380 worker_thread+0x2fe/0x410 kthread+0xe0/0x100 Rename nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() and give it an open (start, end) NSID range. ctrl->namespaces is sorted by NSID, so the whole gap is dropped in a single walk that stops once end is reached. This bounds the work by the namespaces that are present instead of by the size of the gap. Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning") Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: Randy Jennings <randyj@purestorage.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvme: add missing SRCU grace period in error pathTristan Madani1-0/+3
nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path. Fixes: ed754e5deeb1 ("nvme: track shared namespaces") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Reviewed-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03nvme-fabrics: fix DHCHAP secret leak on parse failureXu Rao1-0/+2
nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret with match_strdup() before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL before the temporary string in p is assigned to opts->dhchap_secret or opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts, but nvmf_free_options() cannot release the unassigned temporary string. Each rejected option therefore leaks one allocation. This is easy to miss because valid secrets transfer ownership to opts and are freed normally, while the malformed-secret path still returns the expected -EINVAL to userspace. With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the required-option checks and transport lookup. No NVMe-oF target or working transport connection is required; for example, repeatedly writing dhchap_secret=BAD or dhchap_ctrl_secret=BAD to /dev/nvme-fabrics deterministically takes the leaking parse path. Free the temporary string before leaving both validation error paths. Use kfree_sensitive() because the copied option may contain secret material even when its representation is rejected, matching the sensitive cleanup used for stored DHCHAP secrets. Fixes: f50fff73d620 ("nvme: implement In-Band authentication") Cc: stable@vger.kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Xu Rao <raoxu@uniontech.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-09-03drm/xe/vram: report FLAT_CCS base misalignmentMatthew Auld1-0/+3
So we can easily check if a machine had the CCS bug, when looking back over bug reports where we have the same machine with newer kernel. Example print for a machine with the CCS bug: FLAT_CCS base:27bbff800, aligned:no v2 (Matt B): - Unconditionally print the base + alignment Fixes: 37173392741c ("drm/xe/vram: fix ccs offset calculation") Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: stable@kernel.org Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260902124117.918018-9-matthew.auld@intel.com (cherry picked from commit d00b7f4f03bbeb2efad872f1686130e18c2b4141) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-03Merge tag 'acpi-7.3-rc2' of ↵Linus Torvalds1-4/+0
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Drop two structure fields that have no more users after recent changes" * tag 'acpi-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: Drop two fields from struct acpi_device_pnp
2026-09-03Merge tag 's390-7.3-2' of ↵Linus Torvalds2-1/+15
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Use jiffies instead of jiffies_64 to address a data-race reported by KCSAN - Unpoison cpacf instruction results to address KMSAN reports - Drop unused member from ap_device_id - Fix potential NULL pointer dereferences in IPL code - Add missing length check to SCLP error report handling - Add missing length check to zcrypt CCA code - Fix return code handling in diag324 code - Handle multiple PMU stop callback invocations in perf pai code correctly - Reduce excessive debug feature size in perf pai code from 32 MiB to 4KiB - Switch to common CPU capacity code in topology code to get rid of few lines of code - Address various bugs in corner cases in boot code - Simplify/Rework crst_table_upgrade() to address a potential NULL pointer dereference in case of an allocation failure - Initialize padding bytes in CRT key structure in zcrypt code * tag 's390-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix uninitialized padding in CRT key structure s390/mm: Simplify crst_table_upgrade() s390/boot: Bound command line facility ranges s390/boot: Avoid IPL parameter append past command line s390/boot: Fix physical memory search range s390/topology: Switch to common cpu capacity code s390/pai: Reduce excessive debug feature size s390/pai: Handle multiple PMU stop callback invocations s390/diag324: Preserve -EBUSY return code s390/zcrypt: Validate length in reply before using it s390/pci: Fix leak of uninitialized kernel data in SCLP report s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block s390/ipl: Fix NULL deref in kdump without re-IPL parm block s390/ap: Drop unused member from ap_device_id s390/cpacf: Unpoison instruction results s390/time: Use jiffies instead of jiffies_64
2026-09-03Merge tag 'net-7.3-rc2' of ↵Linus Torvalds24-310/+405
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth. Previous releases - regressions: - page_pool: keep frag_offset aligned for odd-sized requests - sched: fix u32 duplicate handle when node ID pool is exhausted - udp: create exceptions before socket matching - igmp: convert struct ip_sf_list to RCU - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit - rds: acquire the fastpath locks in rds_conn_shutdown() - tipc: - protect node reset trace dump with node lock - fix NULL deref in tipc_named_node_up() on empty publication list - bluetooth: - L2CAP: fix out-of-bounds write in l2cap_ecred_connect - hci_core: fix race condition during device registration - eth: - mlx5e: prevent stale XSK buffer release on refill retries - bridge: don't truncate the port group walk on teardown Previous releases - always broken: - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list() - sched: fix skb sizing and action leak on reoffload delete - tcp: fix use-after-free in do_tcp_getsockopt() - af_packet: don't cast tpacket_hdr.tp_len to int in tpacket_parse_header() - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration - iptunnel: fix stale transport header during tunnel decapsulation - eth: - vxlan: fix use-after-free in vxlan_mdb_remote_src_del() - bonding: fix uninitialized transport header access in alb_determine_nd()" * tag 'net-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits) net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset net: airoha: enable RX_DONE interrupt for RX queue 31 net/rds: don't let rds_conn_shutdown() consume a concurrent drop net/rds: acquire the fastpath locks in rds_conn_shutdown() net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown net/rds: clear cp_flags bits individually in rds_conn_path_reset() net/rds: use clear_bit_unlock() in release_refill() net/rds: use wq_has_sleeper() in release_in_xmit() net: usb: qmi_wwan: add Compal EXM-G1x support net: macb: exclude software FCS from TX byte statistics net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). net: bridge: mcast: don't truncate the port group walk on teardown bonding: do not clear curr_active_slave prematurely when releasing all slaves net: qrtr: Send HELLO message on endpoint register octeontx2-af: Fix limiting SRIOV VF count logic bonding: alb: fix uninitialized transport header access in alb_determine_nd() s390/ctcm: Prevent XID null dereference net: psp: do not inherit the Rx association on clone ...
2026-09-03Merge tag 'for-7.3/dm-fixes' of ↵Linus Torvalds4-34/+44
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - fix a dm-crypt race condition that could make errors not being reported - dm-cache: - fix rwsem being locked and unlocked from different processes - fix demotion statistics - dm-integrity: - set the 'stable writes' flag - fix a buffer overflow introduced in this merge window - fix an infinite loop if tag size is greater than 64 - fix NULL pointer dereference in dm-integrity data-recovery mode - remove a bogus restriction on the dm-ebs starting sector offset * tag 'for-7.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-ebs: fix incorrect device offset check in ebs_ctr() dm-integrity: fix NULL pointer dereference when the 'R' flag is used dm cache: fix demotion stats in passthrough mode dm-integrity: fix infinite loop on discard with large tag size dm-integrity: fix buffer overflow with keyed discard dm-integrity: require stable writes for internal hash modes dm cache: fix issue with background work locking dm-crypt: fix a tiny race condition in crypt_dec_pending
2026-09-03ata: libata-scsi: do not raise UA for storage element depopulation and ↵Damien Le Moal1-24/+0
restoration The libata command completion for the ATA commands REMOVE ELEMENT AND TRUNCATE and RESTORE ELEMENTS AND REBUILD is handled using the function ata_scsi_depop_ua_cap_changed_complete(). This completion function raises a UNIT ATTENTION with the additional sense code CAPACITY DATA HAS CHANGED. But doing so, the scsi layer seeing the UNIT ATTENTION sense key ends up failing the command, even if the command result is in fact OK. The SAT specifications do provide more details about the capacity change should be notified, and that relies on the ACCESSIBLE CAPACITY field of the IDENTIFY DATA retrieved before or after the command is issued, and then raising a UNIT ATTENTION if the capacity has really changed. However, we do not have any simple mean to raise a unit attention from libata-scsi. So rather than seeing the REMOVE ELEMENT AND TRUNCATE and RESTORE ELEMENTS AND REBUILD commands failing, remove the function ata_scsi_depop_ua_cap_changed_complete() and rely on the regular completion callback. Since for now these commands can only be issued as passthrough commands, the user is responsible for revalidating the device capacity after executing these commands. Fixes: db496721cb0d ("ata: libata-scsi: add support for the REMOVE ELEMENT AND TRUNCATE command") Fixes: 1e307ca61a9c ("ata: libata-scsi: add support for the RESTORE ELEMENTS AND REBUILD command") Signed-off-by: Damien Le Moal <dlemoal@kernel.org> Link: https://lore.kernel.org/r/20260902020828.1436048-1-dlemoal@kernel.org Signed-off-by: Niklas Cassel <cassel@kernel.org>
2026-09-03net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after resetLorenzo Bianconi1-0/+8
The core software reset issued in stmmac_init_dma_engine() during ndo_open() callback clears the MTL RX packet parser registers, but stmmac_rxp_config() is only invoked from the cls_u32 add/delete paths. After an ifdown/ifup cycle the hardware therefore runs with the default all-pass table while priv->tc_entries still reports the filters as installed. Re-apply the RX packet parser table from priv->tc_entries in stmmac_hw_setup(), right after the software reset, so the filters are restored when the interface is brought up again. Fixes: 4dbbe8dde848 ("net: stmmac: Add support for U32 TC filter using Flexible RX Parser") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@oss.qualcomm.com> Link: https://patch.msgid.link/20260831-stmmac_tc_cls32_reconfigure-v1-1-21cb459e64ae@oss.qualcomm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-03net: airoha: enable RX_DONE interrupt for RX queue 31Lorenzo Bianconi1-1/+1
RX queue 31 has always been allocated and filled by airoha_qdma_init_rx() since RX_DONE_INT_MASK spans queues 0-31, but none of the RX_IRQ* _BANK_PIN_MASK values covered BIT(31). As a consequence the RX_DONE interrupt for queue 31 was never enabled, airoha_qdma_rx_process() never ran on that queue and its buffers were never reaped. Route RX queue 31's RX_DONE interrupt to IRQ bank 1 so that the queue is drained and its buffers returned to the page pool. Fixes: f252493e1835 ("net: airoha: Enable multiple IRQ lines support in airoha_eth driver.") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260830-airoha-rxdone-rxq31-v1-1-830a91503f2f@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-03drm/amd/display: use plane color_mgmt_changed to track colorop changesMelissa Wen1-1/+5
This is a resubmission of commit d79716401a95 ("drm/amd/display: use plane color_mgmt_changed to track colorop changes") whose change was reverted by commit 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") during a merge conflict resolution. Original commit message: ``` Ensure the driver tracks changes in any colorop property of a plane color pipeline by using the same mechanism of CRTC color management and update plane color blocks when any colorop property changes. It fixes an issue observed on gamescope settings for night mode which is done via shaper/3D-LUT updates. ``` Fixes: 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260807115712.22423-1-mwen@igalia.com
2026-09-02net: usb: qmi_wwan: add Compal EXM-G1x supportIan Lin1-0/+1
The Compal EXM-G1x is a Qualcomm SDX12-based LTE modem. Add support for its QMI WWAN interface 8 using the DTR quirk. Tested on a Compal EXM-G1x modem. Signed-off-by: Ian Lin <jisayme@gmail.com> Link: https://patch.msgid.link/20260831084124.65074-1-jisayme@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-02net: macb: exclude software FCS from TX byte statisticsNicolai Buchwitz2-8/+16
Frames for which macb_pad_and_fcs() supplies the FCS have four FCS bytes appended, and TX completion then accounts the grown skb->len. tx_bytes is defined to exclude the FCS, so these frames are reported four bytes too large. Track only the number of FCS bytes appended in software, 0 or ETH_FCS_LEN, and subtract that from skb->len at completion. skb->len already reflects the padded length by then, so there is nothing else to store. macb_pad_and_fcs() already returns 0 on every non-error path. Return the FCS length from there instead, rather than recomputing the same check in the caller. BQL stays on the padded skb->len that netdev_tx_sent_queue() saw. Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") Signed-off-by: Nicolai Buchwitz <nb@tipi-net.de> Link: https://patch.msgid.link/20260831113128.1678674-1-nb@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-02bonding: do not clear curr_active_slave prematurely when releasing all slavesEric Dumazet1-3/+1
When releasing all slaves during bond destruction (all == true), __bond_release_one() unconditionally clears bond->curr_active_slave to NULL in every iteration. If a backup slave is released before the active slave, bond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(), which increments the active slave dev promiscuity counter and sets bond_info->primary_is_promisc = 1. Because bond->curr_active_slave was prematurely cleared to NULL when releasing the backup slave, the subsequent iteration releasing the active slave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL) is skipped. Consequently, bond_alb_handle_active_change() is never called to decrement the promiscuity counter, permanently leaking promiscuous mode on the physical device after bond teardown. When oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets bond->curr_active_slave to NULL. We only need to avoid selecting a new active slave when all == true. Replace the if (all) branch with if (!all && oldcurrent == slave). Fixes: 0896341a44bf ("bonding: fix bond_release_all inconsistencies") Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Jay Vosburgh <jv@jvosburgh.net> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260831203042.164466-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-02drm/amd/display: Fix cursor disable with horizontally split planesYuling Li1-1/+6
[WHY] resource_can_pipe_disable_cursor() disables the hardware cursor on a pipe when a higher layer fully covers that pipe's recout, to avoid double-cursor and scaling artifacts. When merging pipe-split halves of the same overlay layer, the inner loop walks every pipe above the current one and looks for siblings sharing test_pipe's layer_index. Because test_pipe itself satisfies that condition, it can be treated as its own split partner. That incorrectly doubles r2.width and makes the covering check succeed even when the overlay does not fully contain the underlying pipe. On horizontally split or multi-quadrant layouts this causes the cursor to disappear over overlay regions while input/coordinate mapping remains correct. [HOW] Skip test_pipe when searching for a pipe-split sibling on the same layer, so only the other half of the split plane is merged into r2. Signed-off-by: Yuling Li <yulingli@amd.com> Reviewed-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 85ccd2c39cca9351d4db393e24acea8bf943d350)
2026-09-02drm/amdgpu/userq: dont overwrite the error of subsequent map callSunil Khatri1-2/+3
If a queue fails to map that we need to return the error code back to the caller and not overwrite with a success specifically. Accumulate the failure and return that. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 42a0197d10039e9518c0324c43331eb22b44d5f8)
2026-09-02drm/amdgpu: Skip accessing psp rum time db for APUsKanala Ramalingeswara Reddy1-0/+6
Psp runtime DB is for dGPUs only. Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit dce8195027f146467c9378efb2bb1b0859cb735e) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: update the fw version for gfx12 userqueuesSunil Khatri1-4/+4
Update to the latest stable fw versions where userqueues is working as it is expected with major fixes. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 69fa36e3ac92f2544ee7a1b719ec212b8247a2da) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: update the fw version for gfx11 userqueuesSunil Khatri1-4/+4
Update to the latest stable fw versions where userqueues is working as it is expected with major fixes. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d50201b891604ab97f305d4a20d888ba93305b48) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: fix byte/dword unit mismatch in coredump IB dumpSunil Khatri1-3/+3
In amdgpu_devcoredump_print_ibs(), the NO_CPU_ACCESS VRAM path passed cursor.start/4 and cursor.size/4 to amdgpu_device_mm_access(), but that function's pos/size parameters are byte offsets/lengths (confirmed by amdgpu_ttm_vram_mm_access() and leading to wrong size calculation. Similarly with that change the off index needs to be calculated based on dword since that is a u32 type. Fixes: 7b15fc2d1f1a ("drm/amdgpu: dump job ibs in the devcoredump") Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1bd613b0ed98a23575b18674c94b8b3392614681) Cc: stable@vger.kernel.org
2026-09-02drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqdsMario Limonciello1-6/+6
Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqd_mgr->debugfs_show_mqd() is incorrectly placed outside the if (pqn->q) block that initializes mqd_mgr. The queue list can contain entries where pqn->q is NULL (kernel queues where only pqn->kq is valid). In the original code: if (pqn->q) { ... mqd_mgr = q->device->dqm->mqd_mgrs[mqd_type]; size = mqd_mgr->mqd_stride(...); } for (xcc = 0; xcc < num_xccs; xcc++) { // WRONG: outside if block mqd = q->mqd + size * xcc; r = mqd_mgr->debugfs_show_mqd(m, mqd); } When iterating over a queue node where pqn->q is NULL: 1. The if (pqn->q) block is skipped 2. mqd_mgr remains uninitialized (NULL from declaration) 3. The for loop executes anyway 4. mqd_mgr->debugfs_show_mqd(m, mqd) dereferences NULL The crash manifests as: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode RIP: 0010:0x0 Call Trace: pqm_debugfs_mqds+0x10c/0x1d0 [amdgpu] kfd_debugfs_mqds_by_process+0x9b/0x110 [amdgpu] seq_read_iter+0x132/0x4b0 ... Fix by moving the for loop inside the if (pqn->q) block, so mqd_mgr and related variables are only used when properly initialized. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5689 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260831130051.2031435-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8bfe29d5c798940f797aa24135d2734c3ffce9de) Cc: stable@vger.kernel.org
2026-09-02drm/amd/display: fix division by zero in get_estimated_bw()Hari Mishal1-0/+5
get_estimated_bw() divides by link->dpia_bw_alloc_config.bw_granularity, which is zeroed by reset_bw_alloc_struct() and only populated once DP_TUNNELING_BW_ALLOC_CAP_CHANGED has been handled. link_dp_dpia_handle_bw_alloc_status(), the DPCD interrupt handler, calls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED is set, independently of whether DP_TUNNELING_BW_ALLOC_CAP_CHANGED has ever fired for that link. A connected USB4/DPIA tunneling device that reports an estimated-bandwidth change before ever reporting a capability change drives a division by zero in this IRQ path. link_dpia_send_bw_alloc_request() already guards the same bw_granularity division; add the identical guard here rather than introducing a new pattern. Fixes: 8e5cfe547bf3 ("drm/amd/display: upstream link_dp_dpia_bw.c") Reviewed-by: Alex Hung <alex.hung@amd.com> Assisted-by: gkh_clanker_t1000 Signed-off-by: Hari Mishal <harimishal1@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3) Cc: stable@vger.kernel.org
2026-09-02drm/amd/display: use halving distribution for all encode-to-linear curvesMelissa Wen1-24/+10
In encode-to-linear conversions, LUT entries should be uniformly distributed across the input range: non-linear encodings are already approximately perceptually uniform, so every input code carries the same weight. A fixed count per region does the opposite, concentrating entries on the darker values and leaving few for the bright end, whereas halving distribution spaces all 256 entries uniformly. This holds for any encoded input, so remove the PQ/sRGB condition from commit "drm/amd/display: use halving distribution for PQ/sRGB linearizing LUT" and apply halving to all encode-to-linear operations (pre-defined TF or user LUTs). It fixes the following IGT kms_colorop subtests: - plane-XR30-XR30-srgb_inv_eotf_lut-srgb_eotf_lut - plane-XR30-XR30-gamma_2_2-gamma_2_2_inv-gamma_2_2 Fixes: a71d2b051f33 ("drm/amd/display: use halving distribution for PQ/sRGB linearizing LUT") Reviewed-by: Alex Hung <alex.hung@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6df7c9c307e72e7f13829e94edc89134f0764775)
2026-09-02drm/amd/display: Fix backlight control for luminance-capable OLEDRoman Li1-2/+6
[WHY] For some eDP panels VESA aux backlight control is necessary, otherwise they stay black. [HOW] When AUX backlight control is used, select BACKLIGHT_CONTROL_VESA_AUX for panels that advertise panel_luminance_control. Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com> Signed-off-by: Roman Li <Roman.Li@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 42f698bd061d76d5f4c84a195e465cfbeec775e4)
2026-09-02drm/amd/display: Remove const Qualifier From Non-Pointer FieldsAustin Zheng1-2/+2
[WHY/HOW] Integer values for dml2_core_calcs_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport_params should not have the const qualifier. This prevents using different values of the inputs when the function is called again. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 342280aae4f33816e8d07c15cb538a3b375a7f8f) Cc: stable@vger.kernel.org
2026-09-02drm/amd/display: Set gpuvm min page size to 4K on dcn35/36Roman Li1-0/+1
[WHY] Splash screen corruption on some 8K monitors. [HOW] Set GPUVM min page size to 4K for DCN35/36 to use the correct DML2 calculations, avoiding the corruption path observed during splash. Fixes: 115009d11ccf ("drm/amd/display: Add DCN35 DML2 support") Cc: Mario Limonciello <mario.limonciello@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Roman Li <Roman.Li@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 2cbfb03dead5088a7bdfe2ce392a5caa3d1b3719) Cc: stable@vger.kernel.org
2026-09-02drm/amd/display: Fix DCN5/6 DML2 compilation warningsIvan Lipski2-3/+3
[WHY] A kernel compilation warning was reported caused by upstream of DCN5/6. [HOW] Using plain integer as NULL pointer. Assign NULL to the VActiveLatencyHidingMargin/VActiveLatencyHidingUs pointer members in dml2_core_dcn5_funcs_mode_programming.c, and pass NULL for the pointer arguments to calculate_first_second_splitting() in dml2_pmo_dcn6_stage_optimizers.c. Fixes: 7f7d7ea1fa51 ("drm/amd/display: Add new sources for DCN6") Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d96880560e9f35ba7f8de1b3f90032c8c3eaea88)
2026-09-02drm/amdgpu: fix Idle BOs list in VM debugfs status infoSunil Khatri1-1/+1
amdgpu_debugfs_vm_bo_status_info() prints the "Idle BOs" section by iterating lists->needs_update, the same list already printed just above under "Moved BOs". struct amdgpu_vm_bo_status has a dedicated idle list, populated whenever a BO's state machine settles, but it was never read here, so genuinely idle BOs never show up in the debugfs output and the "Idle BOs" section duplicates "Moved BOs" instead. Iterate lists->idle for the "Idle BOs" section. Fixes: 4cdbba5a16aa ("drm/amdgpu: restructure VM state machine v4") Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 451bfc778a8c364841837def00ba15936f72762b) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFTSunil Khatri1-1/+1
For different address types the variable PAGE_SHIFT might not work well and it's better to use the GPU specific one Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 3494b77d10375e0f9ab784e9b20763339844b55b) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: Update queue reset support versionAmber Lin1-1/+1
Update queue reset required MES version for MES 12.1 to 0x7b since we change the implementation from detect-and-reset method to per-queue-reset method. Signed-off-by: Amber Lin <amber.lin@amd.com> Reviewed-by: Michael Chen <michael.chen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 2160a5cbf0b7917adce4b55421306b614b4a2c8f)
2026-09-02drm/amdgpu/gfx8: only apply compute quantums to KCQsAlex Deucher1-3/+5
Don't apply to KIQ. Seems to cause problems on KIQ on some ARM platforms. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5658 Fixes: 91cf34bc5a55 ("drm/amdgpu/gfx8: align mqd settings with KFD") Reviewed-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6aae7bab029cdccae9a7157facfe36bfc35fc940) Cc: stable@vger.kernel.org
2026-09-02drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs onlyMario Limonciello1-0/+3
The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only SR-IOV VFs where it's needed. Reported-by: gloveless@jqluv.com Fixes: cba4928cdffa ("drm/amdgpu: reduce early full GPU access during SR-IOV init") Acked-by: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260826185102.2269511-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d8a0affd207c813bd063fa2c27786f449eaf92b8)
2026-09-02drm/amdkfd: Add TLB flush after MES queue eviction/suspensionPriya Hosur1-1/+12
MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race condition where in-flight DMA descriptors can access memory that has been unmapped, leading to page faults and GPU queue hangs during SVM page migration. The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU compute queue hangs with packets submitted but never consumed. Add kfd_flush_tlb() calls after MES queue removal in two locations: - evict_process_queues_cpsch(): after all queues removed during eviction - suspend_queues(): after debug/criu queue suspension (with mem_fence barrier) This ensures all in-flight memory accesses from unmapped queues are flushed before memory is freed or migrated. Signed-off-by: Priya Hosur <Priya.Hosur@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77) Cc: stable@vger.kernel.org
2026-09-02drm/pagemap: Fix folio allocation fallback and use-after-putMatthew Brost1-25/+103
drm_pagemap_migrate_populate_ram_pfn() had two issues when populating RAM PFNs with higher-order folios: 1. The higher-order vma_alloc_folio()/folio_alloc() calls did not pass __GFP_NOWARN, so a THP allocation failure under memory pressure would spam the kernel log, and there was no fallback path despite a TODO comment stating one was needed. Add __GFP_NOWARN to the higher-order allocation and, on failure, fall back to order-0 allocations for the entire range originally covered by the failed higher-order allocation, leaving MIGRATE_PFN_COMPOUND unset for those PFNs. 2. In the free_pages error path, order was computed via folio_order(page_folio(page)) *after* put_page(page) had already dropped the reference, resulting in a use-after-free/put when that was the last reference on the page. Compute order before releasing the page. Introducing the fallback in 1. also requires the source page array handed to ->copy_to_ram() to be built differently. Both callers only populated the entry at the head of each source folio, relying on the copy callback to derive the rest of the folio from the order recorded in the matching drm_pagemap_addr. Once the destination has been demoted to order-0 folios the drm_pagemap_addr entries are per-page, so a source page is needed for every one of them; leaving them NULL makes the copy callback stop after the first page and the remainder of the range is never copied. The source folio is only split later, by migrate_vma_pages() / migrate_device_pages(), so its order cannot be used to detect the demotion - test the destination for MIGRATE_PFN_COMPOUND instead. Factor the array population out into drm_pagemap_migrate_populate_src_pages() and use it from both drm_pagemap_evict_to_ram() and __drm_pagemap_migrate_to_ram(). Fixes: ddeda6136038 ("drm/pagemap: Allocate folios when possible") Cc: stable@vger.kernel.org Assisted-by: GitHub_Copilot:claude-opus-5 Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260902063504.3024362-2-matthew.brost@intel.com
2026-09-02drm/pagemap: dma-unmap pages before handling migration errorsMatthew Brost1-6/+6
drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page information if it is called afterward. Call drm_pagemap_migrate_unmap_pages() before drm_pagemap_migration_unlock_put_pages() so the pages array remains valid during DMA unmapping. Reported-by: Sashiko <sashiko-bot@kernel.org> Fixes: f86ad0ed620c ("drm/gpusvm, drm/pagemap: Move migration functionality to drm_pagemap") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260902063504.3024362-1-matthew.brost@intel.com
2026-09-02drm/amd/display: advertise PIXEL_NONE and PREMULTI blend mode for DCEMelissa Wen1-7/+17
DCE can support PREMULTI and COVERAGE blend mode depending on its generation, however current driver implementation either doesn't expose more than primary and cursor plane, or doesn't program registers for any blend mode other than PIXEL_NONE. To fix the missing-blend-mode-prop warning according to current DCE plane caps, create blend mode property with PIXEL_NONE and PREMULTI for primary planes. As long as the background is black and there is no overlay plane, PIXEL_NONE and PREMULTI are equivalent, and PREMULTI has been the mandatory/default mode for years, so keep it to avoid regressions. Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> #v3 Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Reviewed-by: Leandro Ribeiro <leandro.ribeiro@collabora.com> #v2 Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260826104143.39077-4-mwen@igalia.com
2026-09-02drm/amd/display: fix missing blend-mode-prop warning for DCNMelissa Wen1-3/+18
validate_blend_mode_for_alpha_formats() warns when a plane supports formats with alpha but doesn't expose the blend mode property. Fix this by adding the same overlay plane blend modes to primary plane, since they are all universal planes in DCN-generation. Cursor planes support ARGB8888 format and CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA is set by default (other color formats are not implemented), so only expose support to PREMULTI, which is the default blend mode on DRM. Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Reviewed-by: Leandro Ribeiro <leandro.ribeiro@collabora.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260826104143.39077-3-mwen@igalia.com
2026-09-02drm/atomic-state-helper: set pixel_blend_mode to prop default on resetMelissa Wen1-0/+7
In __drm_atomic_helper_plane_state_init(), pixel_blend_mode is always reset to DRM_MODE_BLEND_PREMULTI. That was consistent while drm_plane_create_blend_mode_property() required PREMULTI in the supported modes, but it now falls back to COVERAGE or PIXEL_NONE when the driver doesn't support PREMULTI. The hardcoded default may therefore not be a blend mode the hardware can do, nor one the property advertises. Initialize pixel_blend_mode from the blend mode property default instead, keeping DRM_MODE_BLEND_PREMULTI for planes without the property. Fixes: 9813e158d13d ("drm/drm_blend: allow blend mode property without PREMULTI") Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Reviewed-by: Leandro Ribeiro <leandro.ribeiro@collabora.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260826104143.39077-2-mwen@igalia.com
2026-09-02scsi: megaraid_sas: Limit NVMe request size to the PRP chain frameThomas Lamprecht1-1/+12
megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus one per page of the buffer for the chain pointer. The loop runs until the transfer is described and never checks the buffer bound. max_hw_sectors comes straight from the MDTS the firmware reports for the drive. On drives with a large MDTS the only thing keeping the list inside the buffer was the block layer default of 1280 KiB, which needs 320 entries, which fit into a 4 KiB frame as that holds 512. But since commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") that default is 4 MiB, and such a transfer needs 1025 entries, so the list runs a full page past the end of the frame: sd 1:0:1:0: [sdb] tag#630 page boundary ptr_sgl: 0x00000000ba62d13f BUG: unable to handle page fault for address: ff663bcb81e7c000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] If the page after the frame happens to be mapped, the overrun does not fault but silently corrupts the neighbouring pool entry, which is another in-flight command's PRP list. Cap max_hw_sectors at what the chain frame can describe, less one page for transfers that do not start on a page boundary and so need one entry more. This is the megaraid_sas counterpart of commit 04631f55afc5 ("scsi: mpt3sas: Limit NVMe request size to 2 MiB"), but derives the limit from max_chain_frame_sz rather than hardcoding it. Cc: stable@vger.kernel.org Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Reported-by: Lukasz Magiera <me@magik.net> Closes: https://lore.kernel.org/all/GPhsSM0vkgyIrs0DIZ62qeUZX7X4RxwQXVKiuvMx-lHQVSPDxpztUyQOGS0xikqvJ-Z94hMV-dW_5KN_0CX2hsfV7kTf_t0MTf6vdAAaSEc=@magik.net/ Reported-by: Mira Limbeck <m.limbeck@proxmox.com> Closes: https://lore.kernel.org/all/d171cc76-bf25-48ce-b482-d344669dfc24@proxmox.com/ Suggested-by: Martin K. Petersen <martin.petersen@oracle.com> Link: https://lore.kernel.org/all/yq17bmzd5jr.fsf@ca-mkp.ca.oracle.com/ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> Closes: https://lore.kernel.org/linux-scsi/20260827182106.535D61F000E9@smtp.kernel.org Link: https://patch.msgid.link/20260827175743.734593-1-t.lamprecht@proxmox.com Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-09-02dm-ebs: fix incorrect device offset check in ebs_ctr()Genjian Zhang1-2/+1
<offset> is a backing-device sector offset; ti->len is the virtual target length. Comparing them rejects valid tables, e.g.: dmsetup create ebs0 --table "0 1048576 ebs /dev/sda 2097152 1 8" -> ebs: Invalid device offset sector (-EINVAL) Drop the check. Bounds against the backing device are already enforced later by device_area_is_invalid() via ebs_iterate_devices(). Cc: stable@vger.kernel.org Fixes: d3c7b35c20d6 ("dm: add emulated block size target") Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-09-02scsi: bsg: Fix TOCTOU in io_uring passthrough command setupRahul Chandelkar1-14/+25
scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user(). READ_ONCE() the SQE fields we check or use into locals before use. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260527105931.3950913-1-rc@rexion.ai Signed-off-by: Rahul Chandelkar <rc@rexion.ai> Co-developed-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Link: https://patch.msgid.link/20260817080730.967879-3-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-09-02scsi: bsg: Cap io_uring sense copy to max_response_lenYang Xiuwei1-4/+4
Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun. Fixes: 7b6d3255e7f8 ("scsi: bsg: add io_uring passthrough handler") Cc: stable@vger.kernel.org Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Link: https://patch.msgid.link/20260817080730.967879-2-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
2026-09-02dm-integrity: fix NULL pointer dereference when the 'R' flag is usedMikulas Patocka1-0/+5
If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attempts to read the journal containing the bitmap. This patch makes dm-integrity skip any writes to the device in dm_integrity_resume if the device is activated in the 'R' mode. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode") Cc: stable@vger.kernel.org
2026-09-02octeontx2-af: Fix limiting SRIOV VF count logicSunil Goutham1-14/+19
When RVU PF0/AF's VFs are SDP instead of LBK, limiting the VF count based on the LBK channel count is incorrect. Apply LBK channel-based VF limits only when the VF device ID matches the LBK RVU AFVF device. Fixes: 9bd6caf33567 ("octeontx2-af: Enable sriov on AF to create VFs") Signed-off-by: Sunil Goutham <sgoutham@marvell.com> Signed-off-by: Nitin Shetty J <nshettyj@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit (git 2.54.0.dirty) at 2026-09-20 12:53:03 +0000