rpms/kernel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kernel-7.0.10-101

Browse source 
* Wed May 27 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.10-1]
- ata: libata-scsi: do not needlessly defer commands when using PMP with FBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT (Niklas Cassel)
- ata: libata-scsi: improve readability of ata_scsi_qc_issue() (Niklas Cassel)
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)
- ksmbd: close durable scavenger races against m_fp_list lookups (DaeMyung Kang)
- iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (Eder Zulian)
- iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs (Guanghui Feng)
- drm/i915/cx0: Rename intel_clear_response_ready flag (Suraj Kandpal)
- drm/i915/cx0: Clear response ready & error bit (Suraj Kandpal)
- drm/i915/pps: Enable panel power earlier (Mika Kahola)
Resolves:

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
This commit is contained in:
Justin M. Forbes 2026-05-27 07:40:30 -06:00
commit a2cce583a9
No known key found for this signature in database
GPG key ID: B8FA7924A4B1C140
6 changed files with 871 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Makefile.rhelver
View file

@ -12,7 +12,7 @@ RHEL_MINOR = 99
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 0
RHEL_RELEASE = 1
#
# RHEL_REBASE_NUM

33
Patchlist.changelog
View file

@ -1,3 +1,36 @@
https://gitlab.com/cki-project/kernel-ark/-/commit/d82d5fbd2b0d6b36f3e2eb180bec55ebee49f64a
d82d5fbd2b0d6b36f3e2eb180bec55ebee49f64a ata: libata-scsi: do not needlessly defer commands when using PMP with FBS
https://gitlab.com/cki-project/kernel-ark/-/commit/5b3693b70165664ce941249fec8e005a5b093264
5b3693b70165664ce941249fec8e005a5b093264 ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS
https://gitlab.com/cki-project/kernel-ark/-/commit/3214dc5ecbb2743ef43dd00b76dce3b3714328f6
3214dc5ecbb2743ef43dd00b76dce3b3714328f6 ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT
https://gitlab.com/cki-project/kernel-ark/-/commit/8be710d3949bd63939d269ba8083eb408b5366f8
8be710d3949bd63939d269ba8083eb408b5366f8 ata: libata-scsi: improve readability of ata_scsi_qc_issue()
https://gitlab.com/cki-project/kernel-ark/-/commit/889538e346244d6596349bc7b2248cfed20b3661
889538e346244d6596349bc7b2248cfed20b3661 smb: client: reject userspace cifs.spnego descriptions
https://gitlab.com/cki-project/kernel-ark/-/commit/9e32b643f570a31ca38e4d09db93a43e0c59173c
9e32b643f570a31ca38e4d09db93a43e0c59173c ksmbd: close durable scavenger races against m_fp_list lookups
https://gitlab.com/cki-project/kernel-ark/-/commit/5bc92df226d9dd13446919ea2840119c105d48d9
5bc92df226d9dd13446919ea2840119c105d48d9 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
https://gitlab.com/cki-project/kernel-ark/-/commit/ad844ac8ba8a30ae974c57e0f140cd9088f50983
ad844ac8ba8a30ae974c57e0f140cd9088f50983 iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
https://gitlab.com/cki-project/kernel-ark/-/commit/a63bd8dc4b346de2b7c204787ed29e56db84a711
a63bd8dc4b346de2b7c204787ed29e56db84a711 drm/i915/cx0: Rename intel_clear_response_ready flag
https://gitlab.com/cki-project/kernel-ark/-/commit/be87cc2732d4e6e651fac2004da0c84f6b1a80d5
be87cc2732d4e6e651fac2004da0c84f6b1a80d5 drm/i915/cx0: Clear response ready & error bit
https://gitlab.com/cki-project/kernel-ark/-/commit/401ee756f0ef11595447f673aba5f858f4dcb85d
401ee756f0ef11595447f673aba5f858f4dcb85d drm/i915/pps: Enable panel power earlier
https://gitlab.com/cki-project/kernel-ark/-/commit/2dd4102a953ba3020914a47e6984d2f462deebc4
2dd4102a953ba3020914a47e6984d2f462deebc4 net: skbuff: preserve shared-frag marker during coalescing

14
kernel.changelog
View file

@ -1,3 +1,17 @@
* Wed May 27 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.10-1]
- ata: libata-scsi: do not needlessly defer commands when using PMP with FBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT (Niklas Cassel)
- ata: libata-scsi: improve readability of ata_scsi_qc_issue() (Niklas Cassel)
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)
- ksmbd: close durable scavenger races against m_fp_list lookups (DaeMyung Kang)
- iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (Eder Zulian)
- iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs (Guanghui Feng)
- drm/i915/cx0: Rename intel_clear_response_ready flag (Suraj Kandpal)
- drm/i915/cx0: Clear response ready & error bit (Suraj Kandpal)
- drm/i915/pps: Enable panel power earlier (Mika Kahola)
Resolves:
* Sat May 23 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.10-0]
- Linux v7.0.10
Resolves:

17
kernel.spec
View file

@ -190,13 +190,13 @@ Summary: The Linux kernel
%define specrpmversion 7.0.10
%define specversion 7.0.10
%define patchversion 7.0
%define pkgrelease 100
%define pkgrelease 101
%define kversion 7
%define tarfile_release 7.0.10
# This is needed to do merge window version magic
%define patchlevel 0
# This allows pkg_release to have configurable %%{?dist} tag
%define specrelease 100%{?buildid}%{?dist}
%define specrelease 101%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 7.0.10
@ -4825,6 +4825,19 @@ fi\
#
#
%changelog
* Wed May 27 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.10-1]
- ata: libata-scsi: do not needlessly defer commands when using PMP with FBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS (Niklas Cassel)
- ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT (Niklas Cassel)
- ata: libata-scsi: improve readability of ata_scsi_qc_issue() (Niklas Cassel)
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)
- ksmbd: close durable scavenger races against m_fp_list lookups (DaeMyung Kang)
- iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs (Eder Zulian)
- iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs (Guanghui Feng)
- drm/i915/cx0: Rename intel_clear_response_ready flag (Suraj Kandpal)
- drm/i915/cx0: Clear response ready & error bit (Suraj Kandpal)
- drm/i915/pps: Enable panel power earlier (Mika Kahola)
* Sat May 23 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.10-0]
- Linux v7.0.10

807
patch-7.0-redhat.patch
View file

@ -25,6 +25,11 @@
drivers/acpi/irq.c | 17 +-
drivers/acpi/scan.c | 9 +
drivers/ata/libahci.c | 18 +
drivers/ata/libata-core.c | 9 +-
drivers/ata/libata-eh.c | 8 +-
drivers/ata/libata-pmp.c | 18 +-
drivers/ata/libata-scsi.c | 100 +-
drivers/ata/sata_sil24.c | 6 +-
drivers/char/ipmi/ipmi_dmi.c | 15 +
drivers/char/ipmi/ipmi_msghandler.c | 16 +-
drivers/firmware/efi/Makefile | 1 +
@ -32,10 +37,16 @@
drivers/firmware/efi/libstub/fdt.c | 5 +
drivers/firmware/efi/libstub/secureboot.c | 14 +-
drivers/firmware/efi/secureboot.c | 38 +
drivers/gpu/drm/i915/display/intel_cx0_phy.c | 14 +-
drivers/gpu/drm/i915/display/intel_cx0_phy.h | 4 +-
drivers/gpu/drm/i915/display/intel_ddi.c | 6 +-
drivers/gpu/drm/i915/display/intel_dp_tunnel.c | 11 +-
drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 5 +
drivers/gpu/drm/i915/display/intel_lt_phy.c | 2 +-
drivers/hid/hid-rmi.c | 66 --
drivers/hwtracing/coresight/coresight-etm4x-core.c | 19 +
drivers/input/rmi4/rmi_driver.c | 124 ++-
drivers/iommu/amd/debugfs.c | 43 +-
drivers/iommu/iommu.c | 22 +
drivers/media/platform/Kconfig | 1 +
drivers/media/platform/Makefile | 1 +
@ -61,8 +72,11 @@
drivers/nfc/nxp-nci/i2c.c | 21 +-
drivers/pci/quirks.c | 24 +
drivers/usb/core/hub.c | 7 +
fs/smb/client/cifs_spnego.c | 16 +
fs/smb/server/vfs_cache.c | 102 +-
include/crypto/krb5.h | 9 +-
include/linux/efi.h | 22 +-
include/linux/libata.h | 7 +-
include/linux/lsm_hook_defs.h | 1 +
include/linux/mfd/bcm2835-pm.h | 7 +
include/linux/rmi.h | 1 +
@ -93,7 +107,7 @@
sound/soc/codecs/rt722-sdca.h | 4 +
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 -
95 files changed, 5872 insertions(+), 888 deletions(-)
109 files changed, 6097 insertions(+), 1003 deletions(-)
diff --git a/Documentation/admin-guide/media/amdisp4-1.rst b/Documentation/admin-guide/media/amdisp4-1.rst
new file mode 100644
@ -1081,6 +1095,326 @@ index c79abdfcd7a9..e23bfb7f94c7 100644
/* wait for engine to stop. This could be as long as 500 msec */
tmp = ata_wait_register(ap, port_mmio + PORT_CMD,
PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 374993031895..f8c2e3192a70 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5579,6 +5579,7 @@ void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp)
link->pmp = pmp;
link->active_tag = ATA_TAG_POISON;
link->hw_sata_spd_limit = UINT_MAX;
+ INIT_WORK(&link->deferred_qc_work, ata_scsi_deferred_qc_work);
/* can't use iterator, ap isn't initialized yet */
for (i = 0; i < ATA_MAX_DEVICES; i++) {
@@ -5661,7 +5662,6 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
mutex_init(&ap->scsi_scan_mutex);
INIT_DELAYED_WORK(&ap->hotplug_task, ata_scsi_hotplug);
INIT_DELAYED_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
- INIT_WORK(&ap->deferred_qc_work, ata_scsi_deferred_qc_work);
INIT_LIST_HEAD(&ap->eh_done_q);
init_waitqueue_head(&ap->eh_wait_q);
init_completion(&ap->park_req_pending);
@@ -6286,12 +6286,15 @@ static void ata_port_detach(struct ata_port *ap)
/* It better be dead now and not have any remaining deferred qc. */
WARN_ON(!(ap->pflags & ATA_PFLAG_UNLOADED));
- WARN_ON(ap->deferred_qc);
- cancel_work_sync(&ap->deferred_qc_work);
cancel_delayed_work_sync(&ap->hotplug_task);
cancel_delayed_work_sync(&ap->scsi_rescan_task);
+ ata_for_each_link(link, ap, PMP_FIRST) {
+ WARN_ON(link->deferred_qc);
+ cancel_work_sync(&link->deferred_qc_work);
+ }
+
/* Delete port multiplier link transport devices */
if (ap->pmp_link) {
int i;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 23be85418b3b..5e8a63206108 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -643,11 +643,11 @@ void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap,
if (qc->scsicmd != scmd)
continue;
if ((qc->flags & ATA_QCFLAG_ACTIVE) ||
- qc == ap->deferred_qc)
+ qc == qc->dev->link->deferred_qc)
break;
}
- if (i < ATA_MAX_QUEUE && qc == ap->deferred_qc) {
+ if (i < ATA_MAX_QUEUE && qc == qc->dev->link->deferred_qc) {
/*
* This is a deferred command that timed out while
* waiting for the command queue to drain. Since the qc
@@ -658,8 +658,8 @@ void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap,
* deferred qc work from issuing this qc.
*/
WARN_ON_ONCE(qc->flags & ATA_QCFLAG_ACTIVE);
- ap->deferred_qc = NULL;
- cancel_work(&ap->deferred_qc_work);
+ qc->dev->link->deferred_qc = NULL;
+ cancel_work(&qc->dev->link->deferred_qc_work);
set_host_byte(scmd, DID_TIME_OUT);
scsi_eh_finish_cmd(scmd, &ap->eh_done_q);
} else if (i < ATA_MAX_QUEUE) {
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index e3adc008fed1..e8540931b4a1 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -110,13 +110,24 @@ int sata_pmp_qc_defer_cmd_switch(struct ata_queued_cmd *qc)
{
struct ata_link *link = qc->dev->link;
struct ata_port *ap = link->ap;
+ int ret;
if (ap->excl_link == NULL || ap->excl_link == link) {
if (ap->nr_active_links == 0 || ata_link_active(link)) {
qc->flags |= ATA_QCFLAG_CLEAR_EXCL;
- return ata_std_qc_defer(qc);
+ ret = ata_std_qc_defer(qc);
+ if (ret == ATA_DEFER_LINK)
+ return ATA_DEFER_LINK_EXCL;
+ return ret;
}
+ /*
+ * Note: ap->excl_link contains the link that is next in line,
+ * i.e. implicit round robin. If there is only one link
+ * dispatching, ap->excl_link will be left unclaimed, allowing
+ * other links to set ap->excl_link, ensuring that the currently
+ * active link cannot queue any more.
+ */
ap->excl_link = link;
}
@@ -571,8 +582,11 @@ static void sata_pmp_detach(struct ata_device *dev)
if (ap->ops->pmp_detach)
ap->ops->pmp_detach(ap);
- ata_for_each_link(tlink, ap, EDGE)
+ ata_for_each_link(tlink, ap, EDGE) {
+ WARN_ON(tlink->deferred_qc);
+ cancel_work_sync(&tlink->deferred_qc_work);
ata_eh_detach_dev(tlink->device);
+ }
spin_lock_irqsave(ap->lock, flags);
ap->nr_pmp_links = 0;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index cd607911d724..0b4adfc8dc84 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1660,8 +1660,9 @@ static void ata_qc_done(struct ata_queued_cmd *qc)
void ata_scsi_deferred_qc_work(struct work_struct *work)
{
- struct ata_port *ap =
- container_of(work, struct ata_port, deferred_qc_work);
+ struct ata_link *link =
+ container_of(work, struct ata_link, deferred_qc_work);
+ struct ata_port *ap = link->ap;
struct ata_queued_cmd *qc;
unsigned long flags;
@@ -1672,10 +1673,10 @@ void ata_scsi_deferred_qc_work(struct work_struct *work)
* such case, we should not need any more deferring the qc, so warn if
* qc_defer() says otherwise.
*/
- qc = ap->deferred_qc;
+ qc = link->deferred_qc;
if (qc && !ata_port_eh_scheduled(ap)) {
WARN_ON_ONCE(ap->ops->qc_defer(qc));
- ap->deferred_qc = NULL;
+ link->deferred_qc = NULL;
ata_qc_issue(qc);
}
@@ -1684,8 +1685,7 @@ void ata_scsi_deferred_qc_work(struct work_struct *work)
void ata_scsi_requeue_deferred_qc(struct ata_port *ap)
{
- struct ata_queued_cmd *qc = ap->deferred_qc;
- struct scsi_cmnd *scmd;
+ struct ata_link *link;
lockdep_assert_held(ap->lock);
@@ -1694,20 +1694,25 @@ void ata_scsi_requeue_deferred_qc(struct ata_port *ap)
* do not try to be smart about what to do with this deferred command
* and simply requeue it by completing it with DID_REQUEUE.
*/
- if (!qc)
- return;
-
- scmd = qc->scsicmd;
- ap->deferred_qc = NULL;
- cancel_work(&ap->deferred_qc_work);
- ata_qc_free(qc);
- scmd->result = (DID_REQUEUE << 16);
- scsi_done(scmd);
+ ata_for_each_link(link, ap, PMP_FIRST) {
+ struct ata_queued_cmd *qc = link->deferred_qc;
+ struct scsi_cmnd *scmd;
+
+ if (qc) {
+ scmd = qc->scsicmd;
+ link->deferred_qc = NULL;
+ cancel_work(&link->deferred_qc_work);
+ ata_qc_free(qc);
+ scmd->result = (DID_REQUEUE << 16);
+ scsi_done(scmd);
+ }
+ }
}
-static void ata_scsi_schedule_deferred_qc(struct ata_port *ap)
+static void ata_scsi_schedule_deferred_qc(struct ata_link *link)
{
- struct ata_queued_cmd *qc = ap->deferred_qc;
+ struct ata_queued_cmd *qc = link->deferred_qc;
+ struct ata_port *ap = link->ap;
lockdep_assert_held(ap->lock);
@@ -1724,12 +1729,12 @@ static void ata_scsi_schedule_deferred_qc(struct ata_port *ap)
return;
}
if (!ap->ops->qc_defer(qc))
- queue_work(system_highpri_wq, &ap->deferred_qc_work);
+ queue_work(system_highpri_wq, &link->deferred_qc_work);
}
static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
{
- struct ata_port *ap = qc->ap;
+ struct ata_link *link = qc->dev->link;
struct scsi_cmnd *cmd = qc->scsicmd;
u8 *cdb = cmd->cmnd;
bool have_sense = qc->flags & ATA_QCFLAG_SENSE_VALID;
@@ -1760,22 +1765,23 @@ static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
ata_qc_done(qc);
- ata_scsi_schedule_deferred_qc(ap);
+ ata_scsi_schedule_deferred_qc(link);
}
static int ata_scsi_qc_issue(struct ata_port *ap, struct ata_queued_cmd *qc)
{
+ struct ata_link *link = qc->dev->link;
int ret;
if (!ap->ops->qc_defer)
- goto issue;
+ goto issue_qc;
/*
* If we already have a deferred qc, then rely on the SCSI layer to
* requeue and defer all incoming commands until the deferred qc is
* processed, once all on-going commands complete.
*/
- if (ap->deferred_qc) {
+ if (link->deferred_qc) {
ata_qc_free(qc);
return SCSI_MLQUEUE_DEVICE_BUSY;
}
@@ -1787,38 +1793,46 @@ static int ata_scsi_qc_issue(struct ata_port *ap, struct ata_queued_cmd *qc)
break;
case ATA_DEFER_LINK:
ret = SCSI_MLQUEUE_DEVICE_BUSY;
- break;
+ goto defer_qc;
+ case ATA_DEFER_LINK_EXCL:
+ /*
+ * Drivers making use of ap->excl_link cannot store the QC in
+ * link->deferred_qc, because the ap->excl_link handling is
+ * incompatible with the link->deferred_qc workqueue handling.
+ */
+ ret = SCSI_MLQUEUE_DEVICE_BUSY;
+ goto free_qc;
case ATA_DEFER_PORT:
ret = SCSI_MLQUEUE_HOST_BUSY;
- break;
+ goto free_qc;
default:
WARN_ON_ONCE(1);
ret = SCSI_MLQUEUE_HOST_BUSY;
- break;
+ goto free_qc;
}
- if (ret) {
- /*
- * We must defer this qc: if this is not an NCQ command, keep
- * this qc as a deferred one and report to the SCSI layer that
- * we issued it so that it is not requeued. The deferred qc will
- * be issued with the port deferred_qc_work once all on-going
- * commands complete.
- */
- if (!ata_is_ncq(qc->tf.protocol)) {
- ap->deferred_qc = qc;
- return 0;
- }
+issue_qc:
+ ata_qc_issue(qc);
+ return 0;
- /* Force a requeue of the command to defer its execution. */
- ata_qc_free(qc);
- return ret;
+defer_qc:
+ /*
+ * We must defer this qc: if this is not an NCQ command, keep
+ * this qc as a deferred one and report to the SCSI layer that
+ * we issued it so that it is not requeued. The deferred qc will
+ * be issued with the port deferred_qc_work once all on-going
+ * commands complete.
+ */
+ if (!ata_is_ncq(qc->tf.protocol)) {
+ link->deferred_qc = qc;
+ return 0;
}
-issue:
- ata_qc_issue(qc);
+free_qc:
+ /* Force a requeue of the command to defer its execution. */
+ ata_qc_free(qc);
- return 0;
+ return ret;
}
/**
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index d642ece9f07a..57f1081b86db 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -789,6 +789,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
struct ata_link *link = qc->dev->link;
struct ata_port *ap = link->ap;
u8 prot = qc->tf.protocol;
+ int ret;
/*
* There is a bug in the chip:
@@ -826,7 +827,10 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
qc->flags |= ATA_QCFLAG_CLEAR_EXCL;
}
- return ata_std_qc_defer(qc);
+ ret = ata_std_qc_defer(qc);
+ if (ret == ATA_DEFER_LINK)
+ return ATA_DEFER_LINK_EXCL;
+ return ret;
}
static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc)
diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
index 505e32911c34..26f7ee0ccf40 100644
--- a/drivers/char/ipmi/ipmi_dmi.c
@ -1395,6 +1729,98 @@ index 000000000000..de0a3714a5d4
+ }
+ }
+}
diff --git a/drivers/gpu/drm/i915/display/intel_cx0_phy.c b/drivers/gpu/drm/i915/display/intel_cx0_phy.c
index 7288065d2461..3ef25c942f44 100644
--- a/drivers/gpu/drm/i915/display/intel_cx0_phy.c
+++ b/drivers/gpu/drm/i915/display/intel_cx0_phy.c
@@ -127,8 +127,8 @@ static void intel_cx0_phy_transaction_end(struct intel_encoder *encoder, struct
intel_display_power_put(display, POWER_DOMAIN_DC_OFF, wakeref);
}
-void intel_clear_response_ready_flag(struct intel_encoder *encoder,
- int lane)
+void intel_cx0_clear_response_ready_flag(struct intel_encoder *encoder,
+ int lane)
{
struct intel_display *display = to_intel_display(encoder);
@@ -155,7 +155,7 @@ void intel_cx0_bus_reset(struct intel_encoder *encoder, int lane)
return;
}
- intel_clear_response_ready_flag(encoder, lane);
+ intel_cx0_clear_response_ready_flag(encoder, lane);
}
int intel_cx0_wait_for_ack(struct intel_encoder *encoder,
@@ -222,6 +222,8 @@ static int __intel_cx0_read_once(struct intel_encoder *encoder,
return -ETIMEDOUT;
}
+ intel_cx0_clear_response_ready_flag(encoder, lane);
+
intel_de_write(display, XELPDP_PORT_M2P_MSGBUS_CTL(display, port, lane),
XELPDP_PORT_M2P_TRANSACTION_PENDING |
XELPDP_PORT_M2P_COMMAND_READ |
@@ -231,7 +233,7 @@ static int __intel_cx0_read_once(struct intel_encoder *encoder,
if (ack < 0)
return ack;
- intel_clear_response_ready_flag(encoder, lane);
+ intel_cx0_clear_response_ready_flag(encoder, lane);
/*
* FIXME: Workaround to let HW to settle
@@ -293,6 +295,8 @@ static int __intel_cx0_write_once(struct intel_encoder *encoder,
return -ETIMEDOUT;
}
+ intel_cx0_clear_response_ready_flag(encoder, lane);
+
intel_de_write(display, XELPDP_PORT_M2P_MSGBUS_CTL(display, port, lane),
XELPDP_PORT_M2P_TRANSACTION_PENDING |
(committed ? XELPDP_PORT_M2P_COMMAND_WRITE_COMMITTED :
@@ -321,7 +325,7 @@ static int __intel_cx0_write_once(struct intel_encoder *encoder,
return -EINVAL;
}
- intel_clear_response_ready_flag(encoder, lane);
+ intel_cx0_clear_response_ready_flag(encoder, lane);
/*
* FIXME: Workaround to let HW to settle
diff --git a/drivers/gpu/drm/i915/display/intel_cx0_phy.h b/drivers/gpu/drm/i915/display/intel_cx0_phy.h
index ae98ac23ea22..87d3bdaca3ec 100644
--- a/drivers/gpu/drm/i915/display/intel_cx0_phy.h
+++ b/drivers/gpu/drm/i915/display/intel_cx0_phy.h
@@ -25,8 +25,8 @@ struct intel_dpll_hw_state;
struct intel_encoder;
struct intel_hdmi;
-void intel_clear_response_ready_flag(struct intel_encoder *encoder,
- int lane);
+void intel_cx0_clear_response_ready_flag(struct intel_encoder *encoder,
+ int lane);
bool intel_encoder_is_c10phy(struct intel_encoder *encoder);
void intel_mtl_pll_enable(struct intel_encoder *encoder,
struct intel_dpll *pll,
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index cb91d07cdaa6..1784fa687c03 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -2653,8 +2653,10 @@ static void mtl_ddi_pre_enable_dp(struct intel_atomic_state *state,
/* 3. Select Thunderbolt */
mtl_port_buf_ctl_io_selection(encoder);
- /* 4. Enable Panel Power if PPS is required */
- intel_pps_on(intel_dp);
+ /*
+ * 4. Enable Panel Power if PPS is required
+ * moved to intel_dpll_mgr .enable hook
+ */
/* 5. Enable the port PLL */
intel_ddi_enable_clock(encoder, crtc_state);
diff --git a/drivers/gpu/drm/i915/display/intel_dp_tunnel.c b/drivers/gpu/drm/i915/display/intel_dp_tunnel.c
index 55b423fd6b6f..7894ae25e2a7 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_tunnel.c
@ -1428,6 +1854,42 @@ index 55b423fd6b6f..7894ae25e2a7 100644
}
/**
diff --git a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
index 9aa84a430f09..b5655c734c53 100644
--- a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c
@@ -40,6 +40,7 @@
#include "intel_hti.h"
#include "intel_mg_phy_regs.h"
#include "intel_pch_refclk.h"
+#include "intel_pps.h"
#include "intel_step.h"
#include "intel_tc.h"
@@ -4401,6 +4402,10 @@ static void mtl_pll_enable(struct intel_display *display,
if (drm_WARN_ON(display->drm, !encoder))
return;
+ /* Enable Panel Power if PPS is required */
+ if (intel_encoder_is_dp(encoder))
+ intel_pps_on(enc_to_intel_dp(encoder));
+
intel_mtl_pll_enable(encoder, pll, dpll_hw_state);
}
diff --git a/drivers/gpu/drm/i915/display/intel_lt_phy.c b/drivers/gpu/drm/i915/display/intel_lt_phy.c
index 6cdae03ee172..e174ca011d50 100644
--- a/drivers/gpu/drm/i915/display/intel_lt_phy.c
+++ b/drivers/gpu/drm/i915/display/intel_lt_phy.c
@@ -1106,7 +1106,7 @@ static int __intel_lt_phy_p2p_write_once(struct intel_encoder *encoder,
* This is the time PHY takes to settle down after programming the PHY.
*/
udelay(150);
- intel_clear_response_ready_flag(encoder, lane);
+ intel_cx0_clear_response_ready_flag(encoder, lane);
intel_lt_phy_clear_status_p2p(encoder, lane);
return 0;
diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
index d4af17fdba46..154f0403cbf4 100644
--- a/drivers/hid/hid-rmi.c
@ -1773,6 +2235,114 @@ index ccd9338a44db..5c54e522e8a4 100644
if (data->f01_container->dev.driver) {
/* Driver already bound, so enable ATTN now. */
diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c
index 20b04996441d..3909a1fb218e 100644
--- a/drivers/iommu/amd/debugfs.c
+++ b/drivers/iommu/amd/debugfs.c
@@ -26,22 +26,20 @@ static ssize_t iommu_mmio_write(struct file *filp, const char __user *ubuf,
{
struct seq_file *m = filp->private_data;
struct amd_iommu *iommu = m->private;
- int ret;
-
- iommu->dbg_mmio_offset = -1;
+ int ret, dbg_mmio_offset = iommu->dbg_mmio_offset = -1;
if (cnt > OFS_IN_SZ)
return -EINVAL;
- ret = kstrtou32_from_user(ubuf, cnt, 0, &iommu->dbg_mmio_offset);
+ ret = kstrtos32_from_user(ubuf, cnt, 0, &dbg_mmio_offset);
if (ret)
return ret;
- if (iommu->dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) {
- iommu->dbg_mmio_offset = -1;
- return -EINVAL;
- }
+ if (dbg_mmio_offset < 0 || dbg_mmio_offset >
+ iommu->mmio_phys_end - sizeof(u64))
+ return -EINVAL;
+ iommu->dbg_mmio_offset = dbg_mmio_offset;
return cnt;
}
@@ -49,14 +47,16 @@ static int iommu_mmio_show(struct seq_file *m, void *unused)
{
struct amd_iommu *iommu = m->private;
u64 value;
+ int dbg_mmio_offset = iommu->dbg_mmio_offset;
- if (iommu->dbg_mmio_offset < 0) {
+ if (dbg_mmio_offset < 0 || dbg_mmio_offset >
+ iommu->mmio_phys_end - sizeof(u64)) {
seq_puts(m, "Please provide mmio register's offset\n");
return 0;
}
- value = readq(iommu->mmio_base + iommu->dbg_mmio_offset);
- seq_printf(m, "Offset:0x%x Value:0x%016llx\n", iommu->dbg_mmio_offset, value);
+ value = readq(iommu->mmio_base + dbg_mmio_offset);
+ seq_printf(m, "Offset:0x%x Value:0x%016llx\n", dbg_mmio_offset, value);
return 0;
}
@@ -67,23 +67,20 @@ static ssize_t iommu_capability_write(struct file *filp, const char __user *ubuf
{
struct seq_file *m = filp->private_data;
struct amd_iommu *iommu = m->private;
- int ret;
-
- iommu->dbg_cap_offset = -1;
+ int ret, dbg_cap_offset = iommu->dbg_cap_offset = -1;
if (cnt > OFS_IN_SZ)
return -EINVAL;
- ret = kstrtou32_from_user(ubuf, cnt, 0, &iommu->dbg_cap_offset);
+ ret = kstrtos32_from_user(ubuf, cnt, 0, &dbg_cap_offset);
if (ret)
return ret;
/* Capability register at offset 0x14 is the last IOMMU capability register. */
- if (iommu->dbg_cap_offset > 0x14) {
- iommu->dbg_cap_offset = -1;
+ if (dbg_cap_offset < 0 || dbg_cap_offset > 0x14)
return -EINVAL;
- }
+ iommu->dbg_cap_offset = dbg_cap_offset;
return cnt;
}
@@ -91,21 +88,21 @@ static int iommu_capability_show(struct seq_file *m, void *unused)
{
struct amd_iommu *iommu = m->private;
u32 value;
- int err;
+ int err, dbg_cap_offset = iommu->dbg_cap_offset;
- if (iommu->dbg_cap_offset < 0) {
+ if (dbg_cap_offset < 0 || dbg_cap_offset > 0x14) {
seq_puts(m, "Please provide capability register's offset in the range [0x00 - 0x14]\n");
return 0;
}
- err = pci_read_config_dword(iommu->dev, iommu->cap_ptr + iommu->dbg_cap_offset, &value);
+ err = pci_read_config_dword(iommu->dev, iommu->cap_ptr + dbg_cap_offset, &value);
if (err) {
seq_printf(m, "Not able to read capability register at 0x%x\n",
- iommu->dbg_cap_offset);
+ dbg_cap_offset);
return 0;
}
- seq_printf(m, "Offset:0x%x Value:0x%08x\n", iommu->dbg_cap_offset, value);
+ seq_printf(m, "Offset:0x%x Value:0x%08x\n", dbg_cap_offset, value);
return 0;
}
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index ef08c2c4ec95..c22d02658ea4 100644
--- a/drivers/iommu/iommu.c
@ -7490,6 +8060,209 @@ index 24960ba9caa9..32597cdb72ef 100644
/* Lock the device, then check to see if we were
* disconnected while waiting for the lock to succeed. */
usb_lock_device(hdev);
diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c
index 3a41bbada04c..44c407275680 100644
--- a/fs/smb/client/cifs_spnego.c
+++ b/fs/smb/client/cifs_spnego.c
@@ -8,6 +8,7 @@
*/
#include <linux/list.h>
+#include <linux/cred.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <keys/user-type.h>
@@ -40,12 +41,27 @@ cifs_spnego_key_destroy(struct key *key)
kfree(key->payload.data[0]);
}
+static int
+cifs_spnego_key_vet_description(const char *description)
+{
+ /*
+ * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall.
+ * They are only valid when produced by CIFS while using the private
+ * spnego_cred installed below. Do not let userspace create this type
+ * of key through request_key(2)/add_key(2), since the helper treats
+ * pid/uid/creduid/upcall_target as kernel-originating fields.
+ */
+ if (current_cred() != spnego_cred)
+ return -EPERM;
+ return 0;
+}
/*
* keytype for CIFS spnego keys
*/
struct key_type cifs_spnego_key_type = {
.name = "cifs.spnego",
+ .vet_description = cifs_spnego_key_vet_description,
.instantiate = cifs_spnego_key_instantiate,
.destroy = cifs_spnego_key_destroy,
.describe = user_describe,
diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index 3551f01a3fa0..60b7a2d60238 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -418,6 +418,14 @@ static void __ksmbd_remove_durable_fd(struct ksmbd_file *fp)
return;
idr_remove(global_ft.idr, fp->persistent_id);
+ /*
+ * Clear persistent_id so a later __ksmbd_close_fd() that runs from a
+ * delayed putter (e.g. when a concurrent ksmbd_lookup_fd_inode()
+ * walker held the final reference) does not re-issue idr_remove() on
+ * an id that idr_alloc_cyclic() may have already handed out to a new
+ * durable handle.
+ */
+ fp->persistent_id = KSMBD_NO_FID;
}
static void ksmbd_remove_durable_fd(struct ksmbd_file *fp)
@@ -510,6 +518,20 @@ static struct ksmbd_file *__ksmbd_lookup_fd(struct ksmbd_file_table *ft,
static void __put_fd_final(struct ksmbd_work *work, struct ksmbd_file *fp)
{
+ /*
+ * Detached durable fp -- session_fd_check() cleared fp->conn at
+ * preserve, so this fp is no longer tracked by any conn's
+ * stats.open_files_count. This happens when
+ * ksmbd_scavenger_dispose_dh() hands the final close off to an
+ * m_fp_list walker (e.g. ksmbd_lookup_fd_inode()) whose work->conn
+ * is unrelated to the conn that originally opened the handle; close
+ * via the NULL-ft path so we do not underflow that unrelated
+ * counter.
+ */
+ if (!fp->conn) {
+ __ksmbd_close_fd(NULL, fp);
+ return;
+ }
__ksmbd_close_fd(&work->sess->file_table, fp);
atomic_dec(&work->conn->stats.open_files_count);
}
@@ -881,24 +903,37 @@ static bool ksmbd_durable_scavenger_alive(void)
return true;
}
-static void ksmbd_scavenger_dispose_dh(struct list_head *head)
+static void ksmbd_scavenger_dispose_dh(struct ksmbd_file *fp)
{
- while (!list_empty(head)) {
- struct ksmbd_file *fp;
+ /*
+ * Durable-preserved fp can remain linked on f_ci->m_fp_list for
+ * share-mode checks. Unlink it before final close; fp->node is not
+ * available as a scavenger-private list node because re-adding it to
+ * another list corrupts m_fp_list.
+ */
+ down_write(&fp->f_ci->m_lock);
+ list_del_init(&fp->node);
+ up_write(&fp->f_ci->m_lock);
- fp = list_first_entry(head, struct ksmbd_file, node);
- list_del_init(&fp->node);
+ /*
+ * Drop both the durable lifetime reference and the transient reference
+ * taken by the scavenger under global_ft.lock. If a concurrent
+ * ksmbd_lookup_fd_inode() (or any other m_fp_list walker) snatched fp
+ * before the unlink above, that holder owns the final close via
+ * ksmbd_fd_put() -> __ksmbd_close_fd(). Otherwise the scavenger is
+ * the last putter and finalises fp here.
+ */
+ if (atomic_sub_and_test(2, &fp->refcount))
__ksmbd_close_fd(NULL, fp);
- }
}
static int ksmbd_durable_scavenger(void *dummy)
{
struct ksmbd_file *fp = NULL;
+ struct ksmbd_file *expired_fp;
unsigned int id;
unsigned int min_timeout = 1;
bool found_fp_timeout;
- LIST_HEAD(scavenger_list);
unsigned long remaining_jiffies;
__module_get(THIS_MODULE);
@@ -908,8 +943,6 @@ static int ksmbd_durable_scavenger(void *dummy)
if (try_to_freeze())
continue;
- found_fp_timeout = false;
-
remaining_jiffies = wait_event_timeout(dh_wq,
ksmbd_durable_scavenger_alive() == false,
__msecs_to_jiffies(min_timeout));
@@ -918,23 +951,39 @@ static int ksmbd_durable_scavenger(void *dummy)
else
min_timeout = DURABLE_HANDLE_MAX_TIMEOUT;
- write_lock(&global_ft.lock);
- idr_for_each_entry(global_ft.idr, fp, id) {
- if (!fp->durable_timeout)
- continue;
+ do {
+ expired_fp = NULL;
+ found_fp_timeout = false;
- if (atomic_read(&fp->refcount) > 1 ||
- fp->conn)
- continue;
-
- found_fp_timeout = true;
- if (fp->durable_scavenger_timeout <=
- jiffies_to_msecs(jiffies)) {
- __ksmbd_remove_durable_fd(fp);
- list_add(&fp->node, &scavenger_list);
- } else {
+ write_lock(&global_ft.lock);
+ idr_for_each_entry(global_ft.idr, fp, id) {
unsigned long durable_timeout;
+ if (!fp->durable_timeout)
+ continue;
+
+ if (atomic_read(&fp->refcount) > 1 ||
+ fp->conn)
+ continue;
+
+ found_fp_timeout = true;
+ if (fp->durable_scavenger_timeout <=
+ jiffies_to_msecs(jiffies)) {
+ __ksmbd_remove_durable_fd(fp);
+ /*
+ * Take a transient reference so fp
+ * cannot be freed by an in-flight
+ * ksmbd_lookup_fd_inode() that found
+ * it through f_ci->m_fp_list while we
+ * drop global_ft.lock and reach the
+ * m_fp_list unlink in
+ * ksmbd_scavenger_dispose_dh().
+ */
+ atomic_inc(&fp->refcount);
+ expired_fp = fp;
+ break;
+ }
+
durable_timeout =
fp->durable_scavenger_timeout -
jiffies_to_msecs(jiffies);
@@ -942,10 +991,11 @@ static int ksmbd_durable_scavenger(void *dummy)
if (min_timeout > durable_timeout)
min_timeout = durable_timeout;
}
- }
- write_unlock(&global_ft.lock);
+ write_unlock(&global_ft.lock);
- ksmbd_scavenger_dispose_dh(&scavenger_list);
+ if (expired_fp)
+ ksmbd_scavenger_dispose_dh(expired_fp);
+ } while (expired_fp);
if (found_fp_timeout == false)
break;
diff --git a/include/crypto/krb5.h b/include/crypto/krb5.h
index 71dd38f59be1..aac3ecf88467 100644
--- a/include/crypto/krb5.h
@ -7578,6 +8351,38 @@ index 664898d09ff5..34f476d02181 100644
static inline
enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)
{
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 00346ce3af5e..93ab3595c640 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -371,6 +371,7 @@ enum {
/* return values for ->qc_defer */
ATA_DEFER_LINK = 1,
ATA_DEFER_PORT = 2,
+ ATA_DEFER_LINK_EXCL = 3,
/* desc_len for ata_eh_info and context */
ATA_EH_DESC_LEN = 80,
@@ -854,6 +855,9 @@ struct ata_link {
unsigned int sata_spd; /* current SATA PHY speed */
enum ata_lpm_policy lpm_policy;
+ struct work_struct deferred_qc_work;
+ struct ata_queued_cmd *deferred_qc;
+
/* record runtime error info, protected by host_set lock */
struct ata_eh_info eh_info;
/* EH context */
@@ -899,9 +903,6 @@ struct ata_port {
u64 qc_active;
int nr_active_links; /* #links with active qcs */
- struct work_struct deferred_qc_work;
- struct ata_queued_cmd *deferred_qc;
-
struct ata_link link; /* host default link */
struct ata_link *slave_link; /* see ata_slave_link_init() */
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index b4958167e381..64ffe8c2dacd 100644
--- a/include/linux/lsm_hook_defs.h

4
sources
View file

@ -1,3 +1,3 @@
SHA512 (linux-7.0.10.tar.xz) = e4ffb6e3e742b1db74e40c135ef74baff36a62e925c6c541a0c38db40fbf0d95c173ab4405c394b28ac2cc917ca16cbe84e359920a336b03a05b444464b53f25
SHA512 (kernel-abi-stablelists-7.0.10.tar.xz) = 03fbe767098a556ac9e246adb3a05bef323c4b298508a803d6d87166f37f271527019910229cf9c36fd97505845606c255f9af728a014d5bc26c76cd47fdabf9
SHA512 (kernel-kabi-dw-7.0.10.tar.xz) = 5eb64c1f239e952da1a19c5ca2e2af0c6614d5543ee927bd9df156cb55fe0b72573e8f58967ed317d38a61d936811a646ba7009774c5b195096b33b5556187df
SHA512 (kernel-abi-stablelists-7.0.10.tar.xz) = d1cccf128fed89118a3075ca2a656860946f4376ed86ef3cf253e1dfb2753e843643ec023f39c490888e4cbac3cfe7da46c165dbc1333c3dab31f220cb77181c
SHA512 (kernel-kabi-dw-7.0.10.tar.xz) = 34c87e6334c5ba4e840f0300a8f71bb9f100bb7c52eeb75983ea6e2aee14da2de8672c59f7060c683e400782ec2587218fe8456a3ddd8d557d1a2bf2ba6f1e64