Takashi Iwai [Thu, 6 Aug 2026 13:59:53 +0000 (15:59 +0200)]
ASoC: tlv320aic31xx: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-22-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:51 +0000 (15:59 +0200)]
ASoC: tas2781: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup.
Only the code refactoring, no functional changes.
Cc: Shenghao Ding <shenghao-ding@ti.com> Cc: Kevin Lu <kevin-lu@ti.com> Cc: Baojun Xu <baojun.xu@ti.com> Cc: Sen Wang <sen@ti.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260806140006.1412298-20-tiwai@suse.de Signed-off-by: Mark Brown <broonie@kernel.org>
Takashi Iwai [Thu, 6 Aug 2026 13:59:48 +0000 (15:59 +0200)]
ASoC: rt722-sdca: Use auto-cleanup for firmware loading
Simplify the code to manage the firmware loading with __free(firmware)
auto-cleanup, as well as the firmware file name being released with
__free(kfree).
This series removes the modem-specific voice call support implementation
from the cpcap codec driver and moves the DAI configuration towards the
standard ASoC DAI link configuration model.
The previous implementation added a cpcap-specific .set_tdm_slot()
callback and relied on a client driver to locate and configure the codec
DAI directly using snd_soc_dai_set_*() APIs. This couples the codec
driver to a particular client implementation and bypasses the normal ASoC
configuration flow.
Instead, the voice DAI configuration can be described by the DAI link and
DT, allowing the ASoC core to apply the required format configuration.
The series:
- removes the old modem-specific voice call support implementation;
- makes the cpcap voice DAI format follow the configuration specified by
DT.
Patch 1 removes the obsolete implementation.
Patch 2 updates cpcap to apply the DAI format from the runtime DAI link.
The reverted implementation was added to support a modem driver that
directly locates and configures the codec DAI using snd_soc_find_dai()
together with snd_soc_dai_set_sysclk(), snd_soc_dai_set_fmt() and
snd_soc_dai_set_tdm_slot().
The DAI configuration should instead be provided by the ASoC DAI link,
allowing the machine driver or DT to describe the interface rather than
having a client driver configure the codec directly.
Peter Ujfalusi [Wed, 5 Aug 2026 12:27:13 +0000 (15:27 +0300)]
ASoC: adau1761: sort the register default table
reg_defaults must be sorted by ascending register address, as
regcache_lookup_reg() locates entries in it with bsearch(). See commit fd80df352ba1 ("regcache: Add support for sorting defaults arrays").
The table lists the ADAU1761 specific registers (0x4008 and up) before
the block shared with the ADAU1381/ADAU1781, which starts at
ADAU17X1_CLOCK_CONTROL (0x4000), so bsearch() descends into the wrong
half and 28 of the 52 entries are unreachable.
regcache_reg_needs_sync() then cannot compare them against their default
and reports that a sync is needed, so they are written to the device on
every regcache_sync() even when they were never touched.
Sort the table by register address.
Fixes: dab464b60b24 ("ASoC: Add ADAU1361/ADAU1761 audio CODEC support") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Acked-by: Nuno Sá <nuno.sa@analog.com> Link: https://patch.msgid.link/20260805122713.11376-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
firmware: cs_dsp: Fix mock register default typo in KUnit test
Correct the address of the HALO_SCRATCH4 entry in halo_register_defaults[].
This doesn't affect the validity of the KUnit testing because none of the
tests rely on this value. It's only defaulted because cs_dsp will read it
when the DSP state changes from running to stopped - this would only have
logged a warning about failure to read the register but it doesn't cause
anything to fail.
Cezary Rojewski [Wed, 5 Aug 2026 06:44:35 +0000 (08:44 +0200)]
ASoC: Intel: Remove obsolete UAPI headers
Both target Intel's skylake-driver, previously found in sound/soc/intel
which has been removed few years ago and succeeded by the avs-driver.
snd_sst_tokens.h is succeeded by uapi/sound/intel/avs/tokens.h
skl-tplg-interface.h to the best of my knowledge has no users. Its types
are reflected in sound/soc/intel/avs/messages.h and are not intended for
public use. Closest public equivalent would be the firmware's
processing modules but in such case a user has to compile against
Intel's AudioDSP headers, not Linux ones.
ASoC: soc-topology-test: use snd_soc_register_component()
It is calling snd_soc_component_initialize() / snd_soc_add_component().
We can now use snd_soc_register_component() instead.
It is using container_of() to get kunit_soc_component from component, but
will not be able to use it when capsuling has done.
We can use snd_soc_component_to_priv() instead.
ASoC: soc-generic-dmaengine-pcm: use snd_soc_register_component()
it is calling snd_soc_component_initialize() / snd_soc_add_component().
We can now use snd_soc_register_component() instead.
It is using container_of() to get dmaengine_pcm from component, but
will not be able to use it when capsuling has done.
We can now use snd_soc_component_to_priv() instead.
ASoC: intel: avs: use snd_soc_register_component()
It is calling snd_soc_component_initialize() / snd_soc_add_component().
We can now use snd_soc_register_component() instead.
It is using container_of() to get avs_soc_component from component, but
will not be able to use it when capsuling has done.
We can now use snd_soc_component_to_priv() instead.
We have snd_soc_register_component() (A), but we can't setup component
specific setting, like name, etc from driver, because component
itself is allocated in that function (x).
(A) int snd_soc_register_component(...)
{
...
(x) component = devm_kzalloc(...);
if (!component)
return -ENOMEM;
(B) ret = snd_soc_component_initialize(...);
if (ret < 0)
return ret;
(C) return snd_soc_add_component(...);
}
So each driver needs to use snd_soc_component_{initialize/add}() (= B/C)
instead of using snd_soc_register_component() (A), but it looks
unbalanced with its paired unregiser function.
Let's merge (B) and (C) into new register function, and allows component
as parameter. We can use both
snd_soc_register_component(dev, ...); // already exists
snd_soc_register_component(component, ...); // new function
Julia Lawall [Sat, 1 Aug 2026 19:09:57 +0000 (21:09 +0200)]
ASoC: wm8940: drop unneeded semicolon
When a function-like macro expands to an expression, that expression
doesn't need a semicolon after it. All uses have been verified to
have their own semicolons.
This was found using the following Coccinelle semantic patch:
@r@
identifier i : script:ocaml() { String.lowercase_ascii i = i };
expression e;
@@
Shenghao Ding [Tue, 4 Aug 2026 11:14:33 +0000 (19:14 +0800)]
ASoC: tas2781: add capture_profile_id field and update the tuning_switch function
Currently, the TAS2781 SmartAMP driver uses the same profile ID for both
playback and capture scenarios (e.g., PDM microphone recording or IV data
capture). This makes it impossible to apply different DSP configurations
for capture and playback, which is required in real-world tuning and
production use cases. With these changes, capture and playback paths now
use their own DSP profiles, improving tuning flexibility and avoiding
unintended profile conflicts between SmartAMP capture and playback
scenarios.
Add AudioReach support for LPASS Audio IF based TDM backends and wire it
up for the sc8280xp machine driver.
The series first adds topology-driven Audio IF source/sink handling so
the DSP interface parameters can be described by topology while runtime
media format and slot configuration still come from the machine driver.
It then adds TDM DAI operations for q6apm-lpass-dais, exposes the Audio
IF clock IDs through the q6dsp-lpass-ports binding and q6prm clock
tables, and introduces common QCOM helpers for parsing standard
dai-tdm-slot-* properties from backend CPU and codec endpoints.
Finally, sc8280xp uses the common helpers during hw_params to program
CPU and codec TDM slots, derive the backend bit clock from the active
PCM parameters, and request the CPU and codec clocks before the stream is
started.
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:07 +0000 (12:33 +0530)]
ASoC: qcom: sc8280xp: add TDM hw_params support
Add TDM backend handling to the sc8280xp machine driver.
Use the common QCOM DAI-node TDM helper to parse the standard
DAI TDM slot properties from backend CPU and codec endpoints. Reuse the
parsed configuration when programming DAIs so hw_params does not need a
second DT traversal.
Derive the LPASS backend bit clock from the runtime TDM parameters and
request it through the backend child-clock path using LPAIF_MI2S_BCLK.
Program codec sysclk in hw_params so codec PLL setup happens before the
stream is triggered.
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:06 +0000 (12:33 +0530)]
ASoC: qcom: common: add DAI-node TDM slot helpers
Add common helpers to parse standard dai-tdm-slot-* properties from the
CPU and codec child nodes of a backend DAI link and apply the result to
the active DAIs.
QCOM machine drivers already use qcom_snd_parse_of() to build links from
DT, but they lacked a shared helper to translate endpoint TDM properties
into snd_soc_dai_set_tdm_slot() calls. Boards therefore had to carry ad
hoc parsing or rely on non-standard DT properties.
The helpers parse endpoint masks, validate the shared slot count and
slot width, and program CPU and codec DAIs with the resulting slot
configuration. A cfg-based apply helper is provided for callers that
already parsed the DT data and want to avoid a second DT traversal.
Allow standard dai-tdm-slot-* properties in the CPU and codec child
nodes of a DAI link.
The QCOM machine driver parses these child nodes to configure TDM slots
on the active CPU and codec DAIs. The properties are already defined by
the common tdm-slot binding, but qcom,sm8250.yaml currently rejects them
because the CPU and codec child nodes set additionalProperties: false.
Permit dai-tdm-slot-num, dai-tdm-slot-width and dai-tdm-slot-[rt]x-mask
there so boards using TDM backends can describe the slot layout without
schema warnings.
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:04 +0000 (12:33 +0530)]
ASoC: qcom: q6prm: add Audio IF clock IDs
Add the q6prm clock table entries and internal DSP clock IDs for LPASS
Audio IF backend clocks.
The public binding IDs map to q6prm DSP clock IDs starting at 0x500 for
Audio IF0 IBIT/EBIT. Add the internal definitions and register all Audio
IF IBIT and EBIT clocks so machine drivers can request them through the
APM clock controller.
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:03 +0000 (12:33 +0530)]
dt-bindings: sound: qcom,q6dsp-lpass-ports: add Audio IF clocks
Add the LPASS Audio IF clock IDs used by newer backend interfaces.
Platforms using Audio IF module backends request the interface bit
clocks through q6prm. Add the Audio IF IBIT and EBIT IDs to the binding
header so these clocks can be referenced from device trees.
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260804070307.117119-4-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:02 +0000 (12:33 +0530)]
ASoC: qcom: q6apm-lpass-dais: add TDM DAI operations
Add TDM DAI operations to q6apm-lpass-dais so AudioReach TDM
backends can be configured through the normal ASoC hw_params and DAI
setup flow.
The TDM set_tdm_slot() callback validates the supported slot width and
slot count, stores the active slot mask in the AudioReach module
configuration, and leaves existing DMA, I2S and HDMI paths unchanged.
Reuse the existing LPASS child-clock handling for TDM nodes as well as
MI2S nodes, since TDM backends also request optional backend clocks
through the machine driver set_sysclk() path.
Prasad Kumpatla [Tue, 4 Aug 2026 07:03:01 +0000 (12:33 +0530)]
ASoC: qcom: qdsp6: add topology-driven Audio IF support
Add topology parsing and media-format programming for Audio IF source and
sink modules.
Add the Audio IF module IDs, the required topology tokens, and a dedicated
topology loader that stores the parsed interface configuration in the
AudioReach module state. Also add the Audio IF media-format path that
sends the interface configuration, hardware endpoint media format, and
frame-duration parameters for Audio IF modules.
This keeps the serial-interface configuration topology-driven while still
allowing the machine driver to provide runtime slot and media format
settings. The same Audio IF path can then be reused for TDM, PCM, and I2S
style backends.
The new UAPI tokens (AR_TKN_U16_MODULE_SYNC_SRC=262 through
AR_TKN_U8_MODULE_INV_EXT_BIT_CLK=276) are added, together with the value
defines used by the sync source, sync mode, data delay, interface mode,
bit clock type, and polarity tokens.
MODULE_ID_AUDIO_IF_SINK (0x0700117C) and MODULE_ID_AUDIO_IF_SOURCE
(0x0700117D) are introduced in this patch.
This Module is validated on Hawi and Shikra platforms.
Peter Ujfalusi <peter.ujfalusi@linux.intel.com> says:
Improve handling of some corner cases that are not used by current topology
designs, but can be crafted within the rules of a topology file.
For example branching topologies, where a single input routed to multiple
output endpoints. The already configured part of the graph places constraint
on how the new branch can be configured.
Handling of process modules also updated to be able to 'guess' what
parameters can be changed by the module and allow flexible operation.
Peter Ujfalusi [Thu, 30 Jul 2026 12:17:29 +0000 (15:17 +0300)]
ASoC: SOF: ipc4-topology: Update the pipeline_params of prepared modules
If the module in path has been already prepared on a branch type of
topology, where the branching happens downstream:
A1--> A2 ---> B1 --> B2 ... B-branch
|-> C1 --> C2 ... C-branch
In this case if B-branch is started then A1/A2 is prepared, but when
C-branch starts we still need to refine the parameters up to C1 to arrive
with a correct params to configure C1.
This branching can happen with copiers process modules.
Peter Ujfalusi [Thu, 30 Jul 2026 12:17:28 +0000 (15:17 +0300)]
ASoC: SOF: ipc4-topology: Correct the process module's output lookup
The process module can change different parameters in the audio path and
this change has to be properly evaluated and applied.
In case of playback we are converting from multiple input formats to a
single format (or just passing through without change), the output format
lookup must be based on the input format.
In case of capture, we are converting from a single input format to a
format which is to be passed to the FE, we need to use the input parameters
and the FE parameters to be able to find the correct format:
for those parameters that are modified by the module instance we need to
use the FE parameter while for the rest we use the input parameters.
Peter Ujfalusi [Thu, 30 Jul 2026 12:17:27 +0000 (15:17 +0300)]
ASoC: SOF: ipc4-topology: Store the params change between input/output of a module
Based on the input and output formats we can evaluate what param might be
changed by the module instance.
If there is a difference between the input rate/channels/format and the
output rate/channels/format it means that the module can change one or
multiple of the params.
Linus Torvalds [Sun, 2 Aug 2026 19:12:21 +0000 (12:12 -0700)]
Merge tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Fix swiotlb initialization on systems where DRAM is located above
4GiB (such as the Tenstorrent Blackhole cards)
- Fix an out-of-bounds access in the memory hot-remove code that can
occur on Sv39 and Sv48 systems
- Avoid oopsing during boot if the SBI component of the unaligned
access performance checking code loses a race against __init function
freeing
- Avoid attempting to install the debug-enabled vDSO when it shouldn't
be built due to !CONFIG_MMU
- Avoid some sparse warnings by adding missing __iomem notations in
get_cycles{,_hi}()
- Drop an unnecessary runtime warning in the SiFive errata handler
* tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: vdso: Only try to install vDSO when present
riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GB
riscv/sifive: remove warning in errata
riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()
Linus Torvalds [Sun, 2 Aug 2026 18:55:49 +0000 (11:55 -0700)]
Merge tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 updates from Vasily Gorbik:
- Fix PCI MMIO write syscall falsely reporting success for mappings not
valid for MMIO when MIO is unavailable by returning -EFAULT
- Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC
private key conversion by rejecting oversized key tokens
- Fix buffer overreads and length underflow in pkey and zcrypt CCA
token validation by checking length fields against actual buffer
sizes
- Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB
filtering on custom device nodes by using AP_DOMAINS as the limit
- Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin
CPRB handling by sanitizing user controlled domain indexes
- Fix sensitive key material left in zcrypt CCA clear key import
buffers by scrubbing CPRB and temporary buffers after use
* tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
s390/zcrypt: Close speculative mem read possibility
s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
s390/zcrypt: Validate length for CCA ECC private key requests
s390/zcrypt: Validate length for CCA AES cipher key requests
s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
Linus Torvalds [Sun, 2 Aug 2026 18:44:12 +0000 (11:44 -0700)]
Merge tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull misc x86 fixes from Ingo Molnar:
- Fix the boot-time memcmp() asm implementation's constraints
and optimization properties (Mauricio Faria de Oliveira)
- Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
range where it mistakenly ended up (Pratik Vishwakarma)
* tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/CPU/AMD: Carve out a Zen5 models range
x86/boot: Add volatile, clobbers and zero-length test in memcmp()
Linus Torvalds [Sun, 2 Aug 2026 18:39:10 +0000 (11:39 -0700)]
Merge tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fix from Ingo Molnar:
- Fix wakeups of deferred DL servers to be actually deferred (Gabriele
Monaco)
* tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/deadline: Use revised wakeup rule only for running dl_server
Linus Torvalds [Sun, 2 Aug 2026 17:12:21 +0000 (10:12 -0700)]
Merge tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"binfmt_misc:
- Don't let an 'F' entry pin its own instance.
An entry registered with 'F' opens its interpreter at registration
time and holds that file until the entry is freed, so an entry
nobody removes by hand is only closed once the binfmt_misc
superblock is shut down.
If the interpreter lives on a mount that keeps that superblock
alive the two pin each other and the file is never closed. That's
reachable by pointing the interpreter at the instance itself or by
using the instance as an overlayfs lower layer, and once the mount
namespace is gone there's nothing left to unregister through
either.
- Restore write access when removing an entry.
Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
via open_exec() which denies write access for as long as the entry
exists, but removal only did filp_close() and never restored it.
The inode's i_writecount stayed permanently negative and opening
the interpreter for writing kept failing with ETXTBSY long after
the entry was gone.
- Use exe_file_deny_write_access() for the interpreter clone so both
sides base their decision on the same mode.
- Reject a flag character as the field delimiter. create_entry() pads
the buffer with the delimiter so the field parsers terminate even
on a truncated string, but check_special_flags() consumes flag
characters instead of scanning for the delimiter.
If the delimiter is itself a flag character the padding stops
acting as a terminator and the scan keeps reading past the end of
the allocation. Such a registration was always rejected, just only
after the out of bounds read has already happened.
- Don't leak the user namespace when the mount fails.
bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
moves it into sb->s_fs_info, but generic_shutdown_super() only
calls ->put_super() from inside the if (sb->s_root) branch and
bm_fill_super() can fail before either s_root or s_op is in place.
Drop the reference in ->kill_sb() instead, which runs
unconditionally.
netfs:
- Clear PG_private_2 on a copy-to-cache append failure.
- Handle a rolling buffer allocation failure in single-object
writeback and drop the extra folio reference
netfs_write_folio_single() took before the append.
- Release the previously batched readahead folios when
rolling_buffer_load_from_ra() fails in
netfs_prepare_read_iterator()
- Fix the folio_queue ENOMEM in writeback by adding a mempool and
passing gfp flags into the rolling buffer helpers.
iomap:
- Add a separate bio_set for iomap_split_ioend(). It can split bios
that already come from iomap_ioend_bioset and deadlock once that
bioset is exhausted.
afs:
- Set call->async for an asynchronous afs_fs_fetch_data() the way
afs_fs_fetch_data64() already does.
- Subtract subreq->transferred from subreq->len in
afs_fs_fetch_data() rather than adding it.
- Fix a UAF when sending a message"
* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
iomap: add a separate bio_set for iomap_split_ioend
binfmt_misc: don't leak the user namespace when the mount fails
binfmt_misc: reject a flag character as the field delimiter
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
binfmt_misc: restore write access when removing an entry
binfmt_misc: don't let an 'F' entry pin its own instance
netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
netfs: release readahead folios on iterator preparation failure
netfs: handle single writeback rolling buffer allocation failure
netfs: clear PG_private_2 on copy-to-cache append failure
afs: Fix UAF when sending a message
afs: Fix afs_fs_fetch_data() to subtract transferred from len
afs: Fix afs_fs_fetch_data() to set call->async
Linus Torvalds [Sun, 2 Aug 2026 16:32:07 +0000 (09:32 -0700)]
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley"
"No core changes. The largest driver fix is the reversion of threaded
interrupt handlers in UFS and the next is the resume deadlock fix in
hisi_sas which extends into libsas"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
scsi: target: Clear cmd_cnt when initial counter enrollment fails
scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
scsi: ufs: core: Cancel RTC work in active-active suspend
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
Linus Torvalds [Sun, 2 Aug 2026 16:19:40 +0000 (09:19 -0700)]
Merge tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine fixes from Vinod Koul:
- switchtec fix for register programming
- sun6i descriptor reclaim fix
- Intel idxd fixes for double free in error and setup failure
- Qualcomm bam dma command element fix
* tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
dmaengine: idxd: fix double free of wq, engine, and group structs
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold
Linus Torvalds [Sat, 1 Aug 2026 16:02:45 +0000 (09:02 -0700)]
Merge tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti:
"A set of fixes across several host controller drivers. The largest
part addresses three issues in the i.MX driver, while the remaining
changes fix probe ordering, power management, timeout recovery and
error handling.
amd-mp2:
- unregister callback if adapter registration fails
designware:
- defer probe until child GPIO controllers are bound
imx:
- mark adapter suspended while hardware is powered down
- fix stale slave pointer and shared IRQ registration race
- stop slave timer before clearing slave pointer
iproc:
- reset controller if START_BUSY remains set after timeout
jz4780:
- cache clock rate to avoid clk_get_rate() deadlock
qcom-cci:
- rely on runtime PM helpers for system sleep
spacemit:
- request interrupt after clock initialization"
* tag 'i2c-fixes-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
i2c: imx: Cancel hrtimer before clearing slave pointer
i2c: imx: Fix slave registration race and error handling
i2c: iproc: reset bus after timeout if START_BUSY is stuck
i2c: imx: mark I2C adapter when hardware is powered down
i2c: designware: defer probe if child GpioInt controllers are not bound
i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
i2c: amd-mp2: Unregister callback on adapter add failure
i2c: spacemit: request IRQ after controller initialization
Linus Torvalds [Sat, 1 Aug 2026 03:45:28 +0000 (20:45 -0700)]
Merge tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild fixes from Nathan Chancellor:
- Fix regression with MO= when building out of tree kernel modules due
to incorrectly overwriting build tree's Makefile
- Avoid stripping .BTF sections from modules when building debug .rpm
packages
* tag 'kbuild-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
kbuild: rpm-pkg: Preserve BTF sections in kernel modules during debuginfo stripping
kbuild: Stop modifying $(objtree)/Makefile when building oot-kmods oos
Linus Torvalds [Sat, 1 Aug 2026 03:24:11 +0000 (20:24 -0700)]
Merge tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Reset dropped_count in mmio_reset_data()
When mmio_reset_data() is called, it does not reset the dropped_count
so that subsequent runs will have incorrect reporting.
- Add NULL check for mmio_trace_array in logging functions
The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may
have the 'tr' variable passed to it as NULL. But they both
dereference it without checking if it is NULL first.
- Check return value of __register_event() in trace_module_add_events()
If __register_event() fails, the __add_event_to_tracers() call after
it will create a file for it. If the module fails to load and its
memory is freed, the file will still point to it and it will not be
removed as the registering of the event did not complete.
Only call __add_event_to_tracers() if the __register_event() was
successful.
- Fix false positive match in regex_match_full()
The regex full matching uses a strncmp() to test against the match
string and the value. It should not match if value is a prefix of the
string to match. Check to make sure the length of the strings match
before comparing.
- Fix reader page read offset for remote buffers
A page swapped in by __rb_get_reader_page_from_remote() retains its
stale read offset, causing subsequent reads to skip events or read
past valid data.
- Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer()
Remote buffers allocate a subbuf_ids array. If the allocator function
fails after it is allocated, it does not free it, resulting in a
memory leak.
* tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
ring-buffer: Fix reader page read offset for remote buffers
tracing/filters: Fix false positive match in regex_match_full()
tracing: Check return value of __register_event() in trace_module_add_events()
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
Mark Brown [Sat, 1 Aug 2026 01:41:18 +0000 (02:41 +0100)]
ASoC: spear: Update the SPDIF drivers for current ASoC APIs
bui duc phuc <phucduc.bui@gmail.com> says:
While cleaning up the SPEAr SPDIF driver probe path by removing
redundant error messages, build testing revealed several compilation
failures caused by outdated ASoC APIs.
The series first removes the redundant error messages, then updates the
driver to match the current ASoC APIs by replacing the removed
capture_dma_data field usage with the corresponding helper API, and
moving the DAI probe callback to struct snd_soc_dai_ops.
ASoC: spear: spdif_out: Move DAI probe callback to snd_soc_dai_ops
The .probe callback is no longer part of struct snd_soc_dai_driver
and is now provided through struct snd_soc_dai_ops.
Move spdif_soc_dai_probe() accordingly so the driver follows the current
ASoC API and builds correctly on modern kernels.
ASoC: spear: spdif_in: Move DAI probe callback to snd_soc_dai_ops
The .probe callback is no longer part of struct snd_soc_dai_driver
and is now provided through struct snd_soc_dai_ops.
Move spdif_in_dai_probe() accordingly so the driver follows the current
ASoC API and builds correctly on modern kernels.
ASoC: spear: spdif_in: Switch to snd_soc_dai_dma_data_set_capture()
Replace the legacy direct access to dai->capture_dma_data with
snd_soc_dai_dma_data_set_capture().
The capture_dma_data field no longer exists in struct snd_soc_dai,
making the previous implementation incompatible with current ASoC APIs.
This is v3 of "ASoC: use .auto_selectable_formats", but separated into
small blocks. It is Step1, and it will be Step4 in total.
x: this patch-set
[x] Step1: ASoC: a to b
[ ] Step2: ASoC: codec: ...
[ ] Step3: ASoC: d to r
[ ] Step4: ASoC: r to x
Current ASoC supports snd_soc_daifmt_parse_format() which can specify DAI
format by "dai-format" property from DT.
But strictly speaking, it is SW settings, so doesn't match to DT's policy.
Current ASoC is supporting auto format select via
snd_soc_dai_ops :: .auto_selectable_formats.
But the user is very few today.
DT doesn't need to specify the DAI format via "dai-format", if both CPU
and Codec drivers were supporting .auto_selectable_formats. It will be
automatically selected from .auto_selectable_formats.
One note is that auto select might not find best format on some CPU/Codec
combination. So "dai-format" is necessary anyway.
This series adds sound support for the Monaco/Monza (VENTUNO-Q)
platform on the QCS8275 board, which uses a MAX98091 codec on an
LPI MI2S link.
Patch 2 (from Neil) registers the LPASS MCLK1..MCLK5 clock IDs in
q6prm-clocks.c. Without these entries the DT clock reference
"clocks = <&q6prmcc LPASS_CLK_ID_MCLK_3 ...>" that the MAX98091
node uses cannot resolve at probe, and the codec silently runs
without MCLK.
Note: this patch has been posted to the list more than once from Oct
2025 and does not appear to be actively pursued by anyone. I
am picking it up here because the rest of this series depends on
it to get sound working on QCS8275, and it makes little sense to
send the machine-driver changes without the clock IDs they rely
on.
With these patches now we have full audio working on Arduino VENTUNO-Q.
Linus Torvalds [Sat, 1 Aug 2026 00:47:48 +0000 (17:47 -0700)]
Merge tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- Keep RECALL_ON_OPEN in inode flags when reloading them from
$FILE_NAME
- Check runlist reallocation sizes for negative values and overflow
- Drop stale page cache after shrinking non-resident attributes to
prevent writeback failures and data loss
* tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
ntfs: drop stale page-cache when shrinking a non-resident attr
ntfs: harden runlist realloc size calculations
ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
Linus Torvalds [Sat, 1 Aug 2026 00:35:17 +0000 (17:35 -0700)]
Merge tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
- Use memcmp() when comparing fixed-size binary ClientGUIDs, so
embedded NUL bytes are handled correctly
- Reject repeated SMB2 NEGOTIATE requests after dialect selection
This prevents preauth_info leaks, enforces the SMB2 protocol
requirements, and serializes negotiation state updates.
- Fix a use-after-free in __close_file_table_ids() by removing the
volatile file ID from the owning IDR before dropping the IDR
reference
* tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: use memcmp() to compare ClientGUIDs
ksmbd: reject repeated SMB2 NEGOTIATE requests
ksmbd: fix use-after-free in __close_file_table_ids()
- Fix libata header file to remove a kernel doc compilation warning
(Randy)
- Increase the timeout for the STANDBY IMMEDIATE command to avoid
suspend failures with drives that are slow to respond to this command
(Matt)
- Fixes for the handling of timed out commands in the presence of
deferred non-NCQ commands, to avoid excessive delays in executing the
error handler (me)
- Disable link power management for a couple of WD drives that have
been identified as not functioning properly when power management is
used (Niklas)
- Fix the device iteration loop when checking for link power management
support to correctly handle port multiplier setups (Niklas)
* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-sata: fix ata_scsi_lpm_supported() iteration
ata: libata-core: Disable LPM on WD Green 2.5 480GB
ata: libata-core: Disable LPM on some WD drives
scsi: libsas: terminate deferred commands on time out
ata: libata-scsi: schedule deferred atapi command
ata: libata-scsi: terminate deferred commands on time out
ata: libata-eh: Increase STANDBY IMMEDIATE timeout
ata: libata: avoid kernel-doc warnings
ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
ata: sata_mv: accept 1 or 2 resources in platform probe
Both drivers access enumerated controls through value.integer.value[0]
instead of value.enumerated.item[0]. The same bug was fixed in rx-macro
and va-macro in 2022 (bcfe5f76cc40, 0ea5eff7c606); tx-macro and
wsa-macro were missed.
On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check, and every read of the affected controls fails with
-EINVAL.
Reproduced and fixed on a Xiaomi Mi Pad 5 Pro (SM8250) for tx-macro.
wsa-macro is compile-tested only — that codec is not instantiated on
this hardware.
EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated,
but their get and put callbacks access the value through
ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but wsa-macro was missed.
On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value
sanity check and every read of these controls fails with -EINVAL.
Fixes: 809bcbcecebf ("ASoC: codecs: lpass-wsa-macro: Add support to WSA Macro") Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route") Assisted-by: Claude:claude-fable-5 Cc: stable@vger.kernel.org Signed-off-by: Dawid Wróbel <me@dawidwrobel.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-2-6d091c736116@dawidwrobel.com Signed-off-by: Mark Brown <broonie@kernel.org>
The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but
tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their
value through ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but tx-macro was missed.
On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value
sanity check catches the 4 bytes written past the enumerated item
and every read of these controls fails with -EINVAL:
snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") Assisted-by: Claude:claude-fable-5 Cc: stable@vger.kernel.org Signed-off-by: Dawid Wróbel <me@dawidwrobel.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-1-6d091c736116@dawidwrobel.com Signed-off-by: Mark Brown <broonie@kernel.org>
ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
fails), execution jumps to fail_free_reader.
While __free(kfree) automatically frees the outer cpu_buffer structure
at scope exit, kfree(cpu_buffer) does not recursively free nested heap
pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.
Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
fail_free_reader error unwinding path when cpu_buffer->remote is set.
ASoC: qcom: sc8280xp: rename snd_soc_common to qcom_snd_soc_common
The driver-local structure was named 'snd_soc_common', which occupies
the generic snd_soc_ ASoC namespace even though it is specific to the
Qualcomm sc8280xp machine driver.
Rename the type to qcom_snd_soc_common so the identifier is properly
scoped to this driver, and rename the pointer field in
sc8280xp_snd_data from 'snd_soc_common_priv' to 'priv' so the shorter
name doesn't repeat the type name at every use.
projects / linux / log