Skip to content

Commit ddb562a

Browse files
frank-wfrank-w
committed
Merge tag 'v6.6.111' into 6.6-main
This is the 6.6.111 stable release # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjriVsACgkQONu9yGCS # aT5OHA/+IepScDxgTalRjHUeA+vxvmJKazgXNlYAgmieHpKFjpmRRxajeQ5PEEqh # UPPUa4zduHE7t1ZX4vl+GG3ZUGauc4s9eAYR2AJIaiwI2kcTTtHTNHX7fenHjI6j # ltaYlQ+IkCcpLNP41Ma5FsxhoyrmPABvvyd8QXKJAvAD0IGvZ0Vkq83egifZOib8 # FyN2guVYehZEv+uDXU6ALO18m0lMcqjkJQh1LvJjC0ksfw/08QpBphlMsoTIx7yG # 4eziwkJXzOWA6b5Mn0knKynpTrYr7nc0GscDMlBxuSqWj87Cxj5YRBC/Um78BHxg # xr8FQ6oAjAw4X/x2sN5Ik7ZoYCTWt0JkJfTGh4oAFgw8ski54/Fr8ygm3g8WgIfA # hpi5FdlNytL1b9wi+j35hAVOGj506m9twfr0BBWz5X9wAdDm4u6TWo4WOsL9F9T+ # bmgsQOjtQUIHsvBJ9w9Arl+ILB0QLAh0b7rNl5Dw+sZfbPGoEIEVNs3TH0r/b005 # 3swu9P7ybcEC/9SSs4MVb5maFAeGrBWnH+DbUeawI/wSzrBKch6sQfR45Fr2AC1E # SZkDGBm2vsb5VUj6yeEz5vu+CC9FWx8IE23djVGBOunzOswJlZBmJIxIpqhCMn8Y # Dd6nWOUHBM738x1LCslXiaSYKcQLWT3NvUrprCgF9zz+hCpYGxQ= # =TIYK # -----END PGP SIGNATURE----- # gpg: Signature made Sun Oct 12 12:56:27 2025 CEST # gpg: using RSA key 647F28654894E3BD457199BE38DBBDC86092693E # gpg: Can't check signature: No public key
2 parents e8f00be + 655054d commit ddb562a

25 files changed

Lines changed: 165 additions & 148 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 6
4-
SUBLEVEL = 110
4+
SUBLEVEL = 111
55
EXTRAVERSION =
66
NAME = Pinguïn Aangedreven
77

‎arch/arm64/kernel/fpsimd.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1873,13 +1873,17 @@ static void fpsimd_flush_cpu_state(void)
18731873
*/
18741874
void fpsimd_save_and_flush_cpu_state(void)
18751875
{
1876+
unsigned long flags;
1877+
18761878
if (!system_supports_fpsimd())
18771879
return;
18781880
WARN_ON(preemptible());
1879-
get_cpu_fpsimd_context();
1881+
local_irq_save(flags);
1882+
__get_cpu_fpsimd_context();
18801883
fpsimd_save();
18811884
fpsimd_flush_cpu_state();
1882-
put_cpu_fpsimd_context();
1885+
__put_cpu_fpsimd_context();
1886+
local_irq_restore(flags);
18831887
}
18841888

18851889
#ifdef CONFIG_KERNEL_MODE_NEON

‎arch/riscv/include/asm/processor.h‎

Lines changed: 5 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -13,42 +13,19 @@
1313

1414
#include <asm/ptrace.h>
1515

16-
#ifdef CONFIG_64BIT
17-
#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1))
18-
#define STACK_TOP_MAX TASK_SIZE
19-
2016
#define arch_get_mmap_end(addr, len, flags) \
2117
({ \
22-
unsigned long mmap_end; \
23-
typeof(addr) _addr = (addr); \
24-
if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \
25-
mmap_end = STACK_TOP_MAX; \
26-
else if ((_addr) >= VA_USER_SV57) \
27-
mmap_end = STACK_TOP_MAX; \
28-
else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \
29-
mmap_end = VA_USER_SV48; \
30-
else \
31-
mmap_end = VA_USER_SV39; \
32-
mmap_end; \
18+
STACK_TOP_MAX; \
3319
})
3420

3521
#define arch_get_mmap_base(addr, base) \
3622
({ \
37-
unsigned long mmap_base; \
38-
typeof(addr) _addr = (addr); \
39-
typeof(base) _base = (base); \
40-
unsigned long rnd_gap = DEFAULT_MAP_WINDOW - (_base); \
41-
if ((_addr) == 0 || (IS_ENABLED(CONFIG_COMPAT) && is_compat_task())) \
42-
mmap_base = (_base); \
43-
else if (((_addr) >= VA_USER_SV57) && (VA_BITS >= VA_BITS_SV57)) \
44-
mmap_base = VA_USER_SV57 - rnd_gap; \
45-
else if ((((_addr) >= VA_USER_SV48)) && (VA_BITS >= VA_BITS_SV48)) \
46-
mmap_base = VA_USER_SV48 - rnd_gap; \
47-
else \
48-
mmap_base = VA_USER_SV39 - rnd_gap; \
49-
mmap_base; \
23+
base; \
5024
})
5125

26+
#ifdef CONFIG_64BIT
27+
#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1))
28+
#define STACK_TOP_MAX TASK_SIZE
5229
#else
5330
#define DEFAULT_MAP_WINDOW TASK_SIZE
5431
#define STACK_TOP_MAX TASK_SIZE

‎arch/x86/kvm/emulate.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5134,12 +5134,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt)
51345134
ctxt->mem_read.end = 0;
51355135
}
51365136

5137-
int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
5137+
int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts)
51385138
{
51395139
const struct x86_emulate_ops *ops = ctxt->ops;
51405140
int rc = X86EMUL_CONTINUE;
51415141
int saved_dst_type = ctxt->dst.type;
5142-
bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt);
51435142

51445143
ctxt->mem_read.pos = 0;
51455144

@@ -5187,7 +5186,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
51875186
fetch_possible_mmx_operand(&ctxt->dst);
51885187
}
51895188

5190-
if (unlikely(is_guest_mode) && ctxt->intercept) {
5189+
if (unlikely(check_intercepts) && ctxt->intercept) {
51915190
rc = emulator_check_intercept(ctxt, ctxt->intercept,
51925191
X86_ICPT_PRE_EXCEPT);
51935192
if (rc != X86EMUL_CONTINUE)
@@ -5216,7 +5215,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
52165215
goto done;
52175216
}
52185217

5219-
if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) {
5218+
if (unlikely(check_intercepts) && (ctxt->d & Intercept)) {
52205219
rc = emulator_check_intercept(ctxt, ctxt->intercept,
52215220
X86_ICPT_POST_EXCEPT);
52225221
if (rc != X86EMUL_CONTINUE)
@@ -5270,7 +5269,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
52705269

52715270
special_insn:
52725271

5273-
if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) {
5272+
if (unlikely(check_intercepts) && (ctxt->d & Intercept)) {
52745273
rc = emulator_check_intercept(ctxt, ctxt->intercept,
52755274
X86_ICPT_POST_MEMACCESS);
52765275
if (rc != X86EMUL_CONTINUE)

‎arch/x86/kvm/kvm_emulate.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,6 @@ struct x86_emulate_ops {
220220
void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked);
221221

222222
bool (*is_smm)(struct x86_emulate_ctxt *ctxt);
223-
bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt);
224223
int (*leave_smm)(struct x86_emulate_ctxt *ctxt);
225224
void (*triple_fault)(struct x86_emulate_ctxt *ctxt);
226225
int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr);
@@ -498,7 +497,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt);
498497
#define EMULATION_RESTART 1
499498
#define EMULATION_INTERCEPTED 2
500499
void init_decode_cache(struct x86_emulate_ctxt *ctxt);
501-
int x86_emulate_insn(struct x86_emulate_ctxt *ctxt);
500+
int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts);
502501
int emulator_task_switch(struct x86_emulate_ctxt *ctxt,
503502
u16 tss_selector, int idt_index, int reason,
504503
bool has_error_code, u32 error_code);

‎arch/x86/kvm/x86.c‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8308,11 +8308,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt)
83088308
return is_smm(emul_to_vcpu(ctxt));
83098309
}
83108310

8311-
static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt)
8312-
{
8313-
return is_guest_mode(emul_to_vcpu(ctxt));
8314-
}
8315-
83168311
#ifndef CONFIG_KVM_SMM
83178312
static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt)
83188313
{
@@ -8379,7 +8374,6 @@ static const struct x86_emulate_ops emulate_ops = {
83798374
.guest_has_rdpid = emulator_guest_has_rdpid,
83808375
.set_nmi_mask = emulator_set_nmi_mask,
83818376
.is_smm = emulator_is_smm,
8382-
.is_guest_mode = emulator_is_guest_mode,
83838377
.leave_smm = emulator_leave_smm,
83848378
.triple_fault = emulator_triple_fault,
83858379
.set_xcr = emulator_set_xcr,
@@ -8999,7 +8993,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
89998993
ctxt->exception.address = 0;
90008994
}
90018995

9002-
r = x86_emulate_insn(ctxt);
8996+
/*
8997+
* Check L1's instruction intercepts when emulating instructions for
8998+
* L2, unless KVM is re-emulating a previously decoded instruction,
8999+
* e.g. to complete userspace I/O, in which case KVM has already
9000+
* checked the intercepts.
9001+
*/
9002+
r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) &&
9003+
!(emulation_type & EMULTYPE_NO_DECODE));
90039004

90049005
if (r == EMULATION_INTERCEPTED)
90059006
return 1;

‎crypto/rng.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,11 @@ int crypto_del_default_rng(void)
197197
EXPORT_SYMBOL_GPL(crypto_del_default_rng);
198198
#endif
199199

200+
static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data,
201+
unsigned int len)
202+
{
203+
}
204+
200205
int crypto_register_rng(struct rng_alg *alg)
201206
{
202207
struct crypto_istat_rng *istat = rng_get_stat(alg);
@@ -212,6 +217,9 @@ int crypto_register_rng(struct rng_alg *alg)
212217
if (IS_ENABLED(CONFIG_CRYPTO_STATS))
213218
memset(istat, 0, sizeof(*istat));
214219

220+
if (!alg->set_ent)
221+
alg->set_ent = rng_default_set_ent;
222+
215223
return crypto_register_alg(base);
216224
}
217225
EXPORT_SYMBOL_GPL(crypto_register_rng);

‎drivers/hid/hid-mcp2221.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -814,6 +814,10 @@ static int mcp2221_raw_event(struct hid_device *hdev,
814814
}
815815
if (data[2] == MCP2221_I2C_READ_COMPL ||
816816
data[2] == MCP2221_I2C_READ_PARTIAL) {
817+
if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) {
818+
mcp->status = -EINVAL;
819+
break;
820+
}
817821
buf = mcp->rxbuf;
818822
memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]);
819823
mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];

‎drivers/md/dm-integrity.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ struct journal_sector {
129129
commit_id_t commit_id;
130130
};
131131

132-
#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
132+
#define MAX_TAG_SIZE 255
133133

134134
#define METADATA_PADDING_SECTORS 8
135135

‎drivers/media/i2c/tc358743.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2180,10 +2180,10 @@ static int tc358743_probe(struct i2c_client *client)
21802180
err_work_queues:
21812181
cec_unregister_adapter(state->cec_adap);
21822182
if (!state->i2c_client->irq) {
2183-
del_timer(&state->timer);
2183+
timer_delete_sync(&state->timer);
21842184
flush_work(&state->work_i2c_poll);
21852185
}
2186-
cancel_delayed_work(&state->delayed_work_enable_hotplug);
2186+
cancel_delayed_work_sync(&state->delayed_work_enable_hotplug);
21872187
mutex_destroy(&state->confctl_mutex);
21882188
err_hdl:
21892189
media_entity_cleanup(&sd->entity);

0 commit comments

Comments
 (0)