From: Greg Kroah-Hartman Date: Thu, 9 Jul 2026 17:42:56 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f66abd2ee48dd4ba645b56e8f11c5a21f5cd71d5;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch acpi-nfit-core-fix-possible-null-pointer-dereference.patch loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch rust-block-fix-gendisk-cleanup-paths.patch rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch rust-doctest-fix-incorrect-pattern-in-replacement.patch rust-kasan-kasan-rust-requires-clang.patch rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch --- diff --git a/queue-7.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch b/queue-7.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch new file mode 100644 index 0000000000..93dd264c4b --- /dev/null +++ b/queue-7.1/acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch @@ -0,0 +1,81 @@ +From 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Mon, 1 Jun 2026 18:58:08 -0500 +Subject: ACPI: CPPC: Suppress UBSAN warning caused by field misuse + +From: Jeremy Linton + +commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream. + +The definition of reg->access_width changes depending on the +reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses +access_width to indicate the PCC region, which can result in a UBSAN +if the value is greater than 4. + +For example: + + UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9 + shift exponent 32 is too large for 32-bit type 'int' + CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy) + Hardware name: To be filled by O.E.M. + Call trace: + ...(trimming) + ubsan_epilogue+0x10/0x48 + __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0 + cpc_write+0x4d0/0x670 + cppc_set_perf+0x18c/0x490 + cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq] + ... (trimming) + +Lets fix this by validating the region type, as well as whether +access_width has a value. Then since we are returning bit_width +directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting +the size. + +Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses") +Signed-off-by: Jeremy Linton +Tested-by: Jarred White +Reviewed-by: Jarred White +Reviewed-by: Easwar Hariharan +Cc: All applicable +Link: https://patch.msgid.link/20260601235808.1113137-1-jeremy.linton@arm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/cppc_acpi.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -185,8 +185,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_ + + show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time); + +-/* Check for valid access_width, otherwise, fallback to using bit_width */ +-#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width) ++/* ++ * PCC reuses the access_width field as the subspace id, so only decode access ++ * size for non-PCC registers. Otherwise, use the bit_width. ++ */ ++#define GET_BIT_WIDTH(reg) (((reg)->access_width && \ ++ (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \ ++ (8 << ((reg)->access_width - 1)) : (reg)->bit_width) + + /* Shift and apply the mask for CPC reads/writes */ + #define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) & \ +@@ -1045,7 +1050,6 @@ static int cpc_read(int cpu, struct cpc_ + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) +@@ -1118,7 +1122,6 @@ static int cpc_write(int cpu, struct cpc + * by the bit width field; the access size is used to indicate + * the PCC subspace id. + */ +- size = reg->bit_width; + vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id); + } + else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) diff --git a/queue-7.1/acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch b/queue-7.1/acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch new file mode 100644 index 0000000000..15b317c6b8 --- /dev/null +++ b/queue-7.1/acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch @@ -0,0 +1,106 @@ +From 38bf27511ef41bffebd157ec3eba41fc89ba59cd Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 3 Jun 2026 19:57:02 +0200 +Subject: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup + +From: Rafael J. Wysocki + +commit 38bf27511ef41bffebd157ec3eba41fc89ba59cd upstream. + +If acpi_nfit_init() fails after adding the acpi_desc object to the +acpi_descs list, that object is never removed from that list because +the acpi_nfit_shutdown() devm action is not added for the NFIT device +in that case. Next, the acpi_nfit_init() failure causes +acpi_nfit_probe() to fail, the acpi_desc object is freed, and a +dangling pointer is left behind in the acpi_descs. Any subsequent +ACPI Machine Check Exception will trigger nfit_handle_mce() which +iterates over acpi_descs and so a use-after-free will occur. + +Moreover, if acpi_nfit_probe() returns 0 after installing a notify +handler for the NFIT device and without allocating the acpi_desc +object and setting the NFIT device's driver data pointer, the +acpi_desc object will be allocated by acpi_nfit_update_notify() +and acpi_nfit_init() will be called to initialize it. Regardless +of whether or not acpi_nfit_init() fails in that case, the +acpi_nfit_shutdown() devm action is not added for the NFIT device +and acpi_desc is never removed from the acpi_descs list. If the +acpi_desc object is freed subsequently on driver removal, any +subsequent ACPI MCE will lead to a use-after-free like in the +previous case. + +To address the first issue mentioned above, make acpi_nfit_probe() +call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and +to address the other one, add a remove callback to the driver and +make it call acpi_nfit_shutdown(). Also, since it is now possible to +pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it +may not have been initialized, add checks against NULL for acpi_desc and +its nvdimm_bus field to that function and make acpi_nfit_unregister() +clear the latter after unregistering the NVDIMM bus. + +Fixes: a61fe6f7902e ("nfit, tools/testing/nvdimm: unify common init for acpi_nfit_desc") +Fixes: fbabd829fe76 ("acpi, nfit: fix module unload vs workqueue shutdown race") +Signed-off-by: Rafael J. Wysocki +Cc: All applicable +Reviewed-by: Dave Jiang +Link: https://patch.msgid.link/1963615.tdWV9SEqCh@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3069,6 +3069,8 @@ static void acpi_nfit_unregister(void *d + struct acpi_nfit_desc *acpi_desc = data; + + nvdimm_bus_unregister(acpi_desc->nvdimm_bus); ++ /* The nvdimm_bus object may have been freed, so clear the pointer. */ ++ acpi_desc->nvdimm_bus = NULL; + } + + int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *data, acpi_size sz) +@@ -3309,7 +3311,10 @@ static void acpi_nfit_remove_notify_hand + void acpi_nfit_shutdown(void *data) + { + struct acpi_nfit_desc *acpi_desc = data; +- struct device *bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus); ++ struct device *bus_dev; ++ ++ if (!acpi_desc || !acpi_desc->nvdimm_bus) ++ return; + + /* + * Destruct under acpi_desc_lock so that nfit_handle_mce does not +@@ -3324,6 +3329,7 @@ void acpi_nfit_shutdown(void *data) + mutex_unlock(&acpi_desc->init_mutex); + cancel_delayed_work_sync(&acpi_desc->dwork); + ++ bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus); + /* + * Bounce the nvdimm bus lock to make sure any in-flight + * acpi_nfit_ars_rescan() submissions have had a chance to +@@ -3406,9 +3412,14 @@ static int acpi_nfit_probe(struct platfo + sz - sizeof(struct acpi_table_nfit)); + + if (rc) +- return rc; ++ acpi_nfit_shutdown(acpi_desc); + +- return devm_add_action_or_reset(dev, acpi_nfit_shutdown, acpi_desc); ++ return rc; ++} ++ ++static void acpi_nfit_remove(struct platform_device *pdev) ++{ ++ acpi_nfit_shutdown(platform_get_drvdata(pdev)); + } + + static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle) +@@ -3492,6 +3503,7 @@ MODULE_DEVICE_TABLE(acpi, acpi_nfit_ids) + + static struct platform_driver acpi_nfit_driver = { + .probe = acpi_nfit_probe, ++ .remove = acpi_nfit_remove, + .driver = { + .name = "acpi-nfit", + .acpi_match_table = acpi_nfit_ids, diff --git a/queue-7.1/acpi-nfit-core-fix-possible-null-pointer-dereference.patch b/queue-7.1/acpi-nfit-core-fix-possible-null-pointer-dereference.patch new file mode 100644 index 0000000000..2113688239 --- /dev/null +++ b/queue-7.1/acpi-nfit-core-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,43 @@ +From 027e128abb82788189d6d45b68e3e8e7329b67be Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 3 Jun 2026 19:56:21 +0200 +Subject: ACPI: NFIT: core: Fix possible NULL pointer dereference + +From: Rafael J. Wysocki + +commit 027e128abb82788189d6d45b68e3e8e7329b67be upstream. + +After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before +getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler +for the NFIT device before checking the presence of the NFIT table. If +that table is not there, 0 is returned without allocating the acpi_desc +object and setting the driver data pointer of the NFIT device. If the +platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification +on the NFIT device at that point, acpi_nfit_uc_error_notify() will +dereference a NULL pointer. + +Prevent that from occurring by adding an acpi_desc check against NULL +to acpi_nfit_uc_error_notify(). + +Fixes: 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table") +Signed-off-by: Rafael J. Wysocki +Cc: All applicable +Reviewed-by: Dave Jiang +Link: https://patch.msgid.link/2418508.ElGaqSPkdT@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/nfit/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3460,6 +3460,9 @@ static void acpi_nfit_uc_error_notify(st + { + struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev); + ++ if (!acpi_desc) ++ return; ++ + if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON) + acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG); + else diff --git a/queue-7.1/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch b/queue-7.1/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch new file mode 100644 index 0000000000..a00c6eb369 --- /dev/null +++ b/queue-7.1/loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch @@ -0,0 +1,107 @@ +From 6061e65f95713b01f4313cda6637dfe3aa5412b4 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Thu, 25 Jun 2026 13:03:47 +0800 +Subject: LoongArch: Add PIO for early access before ACPI PCI root register + +From: Huacai Chen + +commit 6061e65f95713b01f4313cda6637dfe3aa5412b4 upstream. + +For ACPI system we suppose the ISA/LPC PIO range is registered together +with PCI root bridge. But the fact is there may be some early access to +the ISA/LPC PIO range before ACPI PCI root register (most of them are +due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range +usually causes ACPI PCI root register fail because of the address range +confliction. So we add a pair of helpers: acpi_add_early_pio() to add +PIO for early access, and acpi_remove_early_pio() to remove PIO before +PCI root register. Since acpi_remove_early_pio() may be called multiple +times, we add an acpi_pio flag to ensure PIO be removed only once. + +Cc: +Tested-by: Yuanzhen Gan +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/acpi.h | 2 ++ + arch/loongarch/kernel/acpi.c | 28 ++++++++++++++++++++++++++++ + arch/loongarch/kernel/setup.c | 2 ++ + arch/loongarch/pci/acpi.c | 2 ++ + 4 files changed, 34 insertions(+) + +--- a/arch/loongarch/include/asm/acpi.h ++++ b/arch/loongarch/include/asm/acpi.h +@@ -38,6 +38,8 @@ static inline bool acpi_has_cpu_in_madt( + extern struct list_head acpi_wakeup_device_list; + extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC]; + ++extern void acpi_add_early_pio(void); ++extern void acpi_remove_early_pio(void); + extern int __init parse_acpi_topology(void); + + #endif /* !CONFIG_ACPI */ +--- a/arch/loongarch/kernel/acpi.c ++++ b/arch/loongarch/kernel/acpi.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -59,6 +60,33 @@ void __iomem *acpi_os_ioremap(acpi_physi + return ioremap_cache(phys, size); + } + ++#define PIO_BASE (unsigned long)PCI_IOBASE ++#define PIO_SIZE ALIGN(ISA_IOSIZE, PAGE_SIZE) ++ ++static bool acpi_pio; ++ ++/* Add PIO for early access */ ++void acpi_add_early_pio(void) ++{ ++ if (!acpi_disabled) { ++ acpi_pio = true; ++ vmap_page_range(PIO_BASE, PIO_BASE + PIO_SIZE, ++ LOONGSON_LIO_BASE, pgprot_device(PAGE_KERNEL)); ++ } ++} ++ ++/* Remove PIO for PCI register */ ++void acpi_remove_early_pio(void) ++{ ++ if (!acpi_pio) ++ return; ++ ++ if (!acpi_disabled) { ++ acpi_pio = false; ++ vunmap_range(PIO_BASE, PIO_BASE + PIO_SIZE); ++ } ++} ++ + #ifdef CONFIG_SMP + static int set_processor_mask(u32 id, u32 pass) + { +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -502,6 +502,8 @@ static __init int arch_reserve_pio_range + { + struct device_node *np; + ++ acpi_add_early_pio(); ++ + for_each_node_by_name(np, "isa") { + struct of_range range; + struct of_range_parser parser; +--- a/arch/loongarch/pci/acpi.c ++++ b/arch/loongarch/pci/acpi.c +@@ -65,6 +65,8 @@ static int acpi_prepare_root_resources(s + struct resource_entry *entry, *tmp; + struct acpi_device *device = ci->bridge; + ++ acpi_remove_early_pio(); ++ + status = acpi_pci_probe_root_resources(ci); + if (status > 0) { + acpi_evaluate_integer(device->handle, "PCIH", NULL, &pci_h); diff --git a/queue-7.1/platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch b/queue-7.1/platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch new file mode 100644 index 0000000000..a5ce9b9a72 --- /dev/null +++ b/queue-7.1/platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch @@ -0,0 +1,86 @@ +From c085d82613d5618814b84406c8b2d64f1bc305e7 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Sat, 6 Jun 2026 02:49:05 +0900 +Subject: platform/x86: intel-hid: Protect ACPI notify handler against recursion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HyeongJun An + +commit c085d82613d5618814b84406c8b2d64f1bc305e7 upstream. + +Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on +all CPUs") ACPI notify handlers like the intel-hid notify_handler() may +run on multiple CPU cores racing with themselves. + +On convertibles and detachables (matched by DMI chassis-type 31 and 32 in +dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered +lazily from notify_handler() on the first tablet-mode event, via +intel_hid_switches_setup(). When two such events race on different CPUs +both can pass the !priv->switches check and register the priv->switches +input device twice, resulting in a duplicate sysfs entry and a subsequent +NULL pointer dereference. + +This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86: +intel-vbtn: Protect ACPI notify handler against recursion") for the +sibling intel-vbtn driver. + +Protect intel-hid notify_handler() from racing with itself with a mutex +to fix this. + +Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs") +Cc: stable@vger.kernel.org +Signed-off-by: HyeongJun An +Link: https://patch.msgid.link/20260605174905.131095-1-sammiee5311@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel/hid.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -7,11 +7,13 @@ + */ + + #include ++#include + #include + #include + #include + #include + #include ++#include + #include + #include + #include +@@ -230,6 +232,7 @@ static const struct dmi_system_id dmi_au + }; + + struct intel_hid_priv { ++ struct mutex mutex; /* Avoid notify_handler() racing with itself */ + struct input_dev *input_dev; + struct input_dev *array; + struct input_dev *switches; +@@ -565,6 +568,8 @@ static void notify_handler(acpi_handle h + struct key_entry *ke; + int err; + ++ guard(mutex)(&priv->mutex); ++ + /* + * Some convertible have unreliable VGBS return which could cause incorrect + * SW_TABLET_MODE report, in these cases we enable support when receiving +@@ -720,6 +725,10 @@ static int intel_hid_probe(struct platfo + return -ENOMEM; + dev_set_drvdata(&device->dev, priv); + ++ err = devm_mutex_init(&device->dev, &priv->mutex); ++ if (err) ++ return err; ++ + /* See dual_accel_detect.h for more info on the dual_accel check. */ + if (enable_sw_tablet_mode == TABLET_SW_AUTO) { + if (dmi_check_system(dmi_vgbs_allow_list)) diff --git a/queue-7.1/rust-block-fix-gendisk-cleanup-paths.patch b/queue-7.1/rust-block-fix-gendisk-cleanup-paths.patch new file mode 100644 index 0000000000..3043fc2b8a --- /dev/null +++ b/queue-7.1/rust-block-fix-gendisk-cleanup-paths.patch @@ -0,0 +1,82 @@ +From 2957771379fa335103a4b539db57bb2271e12142 Mon Sep 17 00:00:00 2001 +From: Haoze Xie +Date: Sat, 30 May 2026 14:11:54 +0800 +Subject: rust: block: fix GenDisk cleanup paths + +From: Haoze Xie + +commit 2957771379fa335103a4b539db57bb2271e12142 upstream. + +GenDiskBuilder::build() still has fallible work after +__blk_mq_alloc_disk(), but its error path only recovers the +foreign queue data. That leaks the temporary gendisk and +request_queue until later teardown. If the caller moved the last +Arc> into build(), the leaked queue can retain blk-mq +state after the tag set is dropped. + +Fix the pre-registration failure path by dropping the temporary +gendisk reference with put_disk() before recovering queue_data, +so disk_release() can tear down the owned queue. + +Also pair GenDisk::drop() with put_disk() after del_gendisk(). +Once a Rust GenDisk has been added with device_add_disk(), +del_gendisk() only unregisters it; the final gendisk reference +still has to be dropped to complete the release path. + +Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module") +Cc: stable@kernel.org +Reported-by: Yuan Tan +Reported-by: Xin Liu +Reviewed-by: Andreas Hindborg +Signed-off-by: Haoze Xie +Signed-off-by: Ren Wei +Link: https://patch.msgid.link/b70aff9a920cc42110fe5cf454c3099561863519.1780063368.git.royenheart@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/block/mq/gen_disk.rs | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/rust/kernel/block/mq/gen_disk.rs ++++ b/rust/kernel/block/mq/gen_disk.rs +@@ -150,6 +150,19 @@ impl GenDiskBuilder { + // SAFETY: `gendisk` is a valid pointer as we initialized it above + unsafe { (*gendisk).fops = &TABLE }; + ++ let cleanup_failure = ScopeGuard::new_with_data((gendisk, data), |(gendisk, data)| { ++ // SAFETY: `gendisk` came from `__blk_mq_alloc_disk()` above and ++ // has not been added to the VFS on this cleanup path. ++ unsafe { bindings::put_disk(gendisk) }; ++ // SAFETY: `data` came from `into_foreign()` above and has not been ++ // converted back on this cleanup path. ++ drop(unsafe { T::QueueData::from_foreign(data) }); ++ }); ++ ++ // The failure guard now owns both pieces of cleanup; the early guard ++ // must not run on this path anymore. ++ recover_data.dismiss(); ++ + let mut writer = NullTerminatedFormatter::new( + // SAFETY: `gendisk` points to a valid and initialized instance. We + // have exclusive access, since the disk is not added to the VFS +@@ -172,7 +185,7 @@ impl GenDiskBuilder { + }, + )?; + +- recover_data.dismiss(); ++ cleanup_failure.dismiss(); + + // INVARIANT: `gendisk` was initialized above. + // INVARIANT: `gendisk` was added to the VFS via `device_add_disk` above. +@@ -215,6 +228,11 @@ impl Drop for GenDisk + // to the VFS. + unsafe { bindings::del_gendisk(self.gendisk) }; + ++ // SAFETY: By type invariant, `self.gendisk` was added to the VFS, so ++ // `put_disk()` must follow `del_gendisk()` to drop the final gendisk ++ // reference and trigger the remaining release path. ++ unsafe { bindings::put_disk(self.gendisk) }; ++ + // SAFETY: `queue.queuedata` was created by `GenDiskBuilder::build` with + // a call to `ForeignOwnable::into_foreign` to create `queuedata`. + // `ForeignOwnable::from_foreign` is only called here. diff --git a/queue-7.1/rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch b/queue-7.1/rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch new file mode 100644 index 0000000000..758bcefb0e --- /dev/null +++ b/queue-7.1/rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch @@ -0,0 +1,55 @@ +From 3473e0a219fdb2cb013da0a5d917e66fef052325 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Sat, 30 May 2026 11:58:09 +0200 +Subject: rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0 + +From: Miguel Ojeda + +commit 3473e0a219fdb2cb013da0a5d917e66fef052325 upstream. + +Starting with Rust 1.98.0 (expected 2026-08-20), Clippy is likely +introducing a new lint `clippy::map_or_identity` [1][2], which currently +triggers in a single case: + + warning: expression can be simplified using `Result::unwrap_or()` + --> rust/kernel/cpufreq.rs:1326:60 + | + 1326 | PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f)) + | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#map_or_identity + = note: `-W clippy::map-or-identity` implied by `-W clippy::all` + = help: to override `-W clippy::all` add `#[allow(clippy::map_or_identity)]` + help: consider using `unwrap_or` + | + 1326 - PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f)) + 1326 + PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).unwrap_or(0)) + | + +The suggestion is valid, thus clean it up. + +Cc: stable@vger.kernel.org # Needed in 6.18.y and later. +Link: https://github.com/rust-lang/rust-clippy/issues/15801 [1] +Link: https://github.com/rust-lang/rust-clippy/pull/16052 [2] +Reviewed-by: Zhongqiu Han +Reviewed-by: Gary Guo +Reviewed-by: Alexandre Courbot +Acked-by: Viresh Kumar +Link: https://patch.msgid.link/20260530095809.213611-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/cpufreq.rs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/rust/kernel/cpufreq.rs ++++ b/rust/kernel/cpufreq.rs +@@ -1323,7 +1323,7 @@ impl Registration { + // SAFETY: The C API guarantees that `cpu` refers to a valid CPU number. + let cpu_id = unsafe { CpuId::from_u32_unchecked(cpu) }; + +- PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f)) ++ PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).unwrap_or(0)) + } + + /// Driver's `update_limit` callback. diff --git a/queue-7.1/rust-doctest-fix-incorrect-pattern-in-replacement.patch b/queue-7.1/rust-doctest-fix-incorrect-pattern-in-replacement.patch new file mode 100644 index 0000000000..635a432f43 --- /dev/null +++ b/queue-7.1/rust-doctest-fix-incorrect-pattern-in-replacement.patch @@ -0,0 +1,62 @@ +From ac4d1caa82d487e7ed46d0597da1adc9c1a51c70 Mon Sep 17 00:00:00 2001 +From: Gary Guo +Date: Tue, 16 Jun 2026 14:25:56 +0100 +Subject: rust: doctest: fix incorrect pattern in replacement + +From: Gary Guo + +commit ac4d1caa82d487e7ed46d0597da1adc9c1a51c70 upstream. + +The `-> Result<(), impl core::fmt::Debug>` string is generated by rustdoc +and by adding "::" into the string it no longer finds anything, making +the line useless. + +Remove the "::" in the pattern. Omit it in the replacement too, for +consistency with upstream rustdoc. + +Fixes: de7cd3e4d638 ("rust: use absolute paths in macros referencing core and kernel") +Signed-off-by: Gary Guo +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616132559.2245814-1-gary@kernel.org +[ Added link in code comment to `rustdoc`'s 1.87 PR that fully qualified + it for context. Improved comments for consistency. Reworded to drop + changelog and to fix typo. - Miguel ] +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + scripts/rustdoc_test_builder.rs | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/scripts/rustdoc_test_builder.rs ++++ b/scripts/rustdoc_test_builder.rs +@@ -28,7 +28,7 @@ fn main() { + // + // ``` + // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_28_0() { +- // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_37_0() -> Result<(), impl ::core::fmt::Debug> { ++ // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_37_0() -> Result<(), impl core::fmt::Debug> { + // ``` + // + // It should be unlikely that doctest code matches such lines (when code is formatted properly). +@@ -47,12 +47,16 @@ fn main() { + }) + .expect("No test function found in `rustdoc`'s output."); + +- // Qualify `Result` to avoid the collision with our own `Result` coming from the prelude. ++ // Replicate `rustdoc` 1.87+ behaviour [1] by fully qualifying `Result` to avoid the collision ++ // with our own `Result` coming from the prelude. ++ // ++ // [1]: https://github.com/rust-lang/rust/pull/137807 ++ // ++ // TODO: Remove this when MSRV is bumped above 1.87. + let body = body.replace( +- &format!("{rustdoc_function_name}() -> Result<(), impl ::core::fmt::Debug> {{"), +- &format!( +- "{rustdoc_function_name}() -> ::core::result::Result<(), impl ::core::fmt::Debug> {{" +- ), ++ &format!("{rustdoc_function_name}() -> Result<(), impl core::fmt::Debug> {{"), ++ // This intentionally does not use absolute paths to match `rustdoc` 1.87 behaviour. ++ &format!("{rustdoc_function_name}() -> core::result::Result<(), impl core::fmt::Debug> {{"), + ); + + // For tests that get generated with `Result`, like above, `rustdoc` generates an `unwrap()` on diff --git a/queue-7.1/rust-kasan-kasan-rust-requires-clang.patch b/queue-7.1/rust-kasan-kasan-rust-requires-clang.patch new file mode 100644 index 0000000000..5d3b96b7dd --- /dev/null +++ b/queue-7.1/rust-kasan-kasan-rust-requires-clang.patch @@ -0,0 +1,35 @@ +From 5b271543d0f08e9733d4732721e960e285f6448f Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Wed, 8 Apr 2026 08:32:16 +0000 +Subject: rust: kasan: KASAN+RUST requires clang + +From: Alice Ryhl + +commit 5b271543d0f08e9733d4732721e960e285f6448f upstream. + +Kernel KASAN involves passing various llvm/gcc specific arguments to +the C and Rust compiler. Since these arguments differ between llvm and +gcc, it's not safe to mix an llvm-based rustc with a gcc build when +kasan is enabled. + +Signed-off-by: Alice Ryhl +Reviewed-by: Gary Guo +Cc: stable@vger.kernel.org +Fixes: e3117404b411 ("kbuild: rust: Enable KASAN support") +Link: https://patch.msgid.link/20260408-kasan-rust-sw-tags-v3-1-e07964d14363@google.com +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + init/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -2198,6 +2198,7 @@ config RUST + depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO) + depends on !CFI || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC + select CFI_ICALL_NORMALIZE_INTEGERS if CFI ++ depends on !KASAN || CC_IS_CLANG + depends on !KASAN_SW_TAGS + help + Enables Rust support in the kernel. diff --git a/queue-7.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch b/queue-7.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch new file mode 100644 index 0000000000..354add96a7 --- /dev/null +++ b/queue-7.1/rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch @@ -0,0 +1,54 @@ +From 191f49f1e38b1c10eb44b0f967c6175c884ef7db Mon Sep 17 00:00:00 2001 +From: Alice Ryhl +Date: Tue, 16 Jun 2026 12:30:38 +0000 +Subject: rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER + +From: Alice Ryhl + +commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream. + +Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the +frame-pointer annotation for functions, but not for the module. This +means that functions generated by the LLVM backend such as +'asan.module_ctor' do not receive the frame-pointer annotation. + +This is likely to lead to broken backtraces and may also cause issues +with ftrace if these features are used with functions generated by the +LLVM backend. + +Thus, use -Zllvm_module_flag to work around this rustc bug if using a +rustc without the fix. + +[ The fix [1] has landed for Rust 1.98.0 (expected release on + 2026-08-20). - Miguel ] + +Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs). +Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") +Link: https://github.com/rust-lang/rust/pull/156980 [1] +Signed-off-by: Alice Ryhl +Link: https://patch.msgid.link/20260616-frame-ptr-fix-v1-1-dc6b29a631d9@google.com +[ - Adjusted Cc: stable@ as discussed. +Signed-off-by: Greg Kroah-Hartman + + - Added comment with link to the PR, similar to what we did in commit + ac35b5580ace ("rust: arm64: set uwtable llvm module flag for + CONFIG_UNWIND_TABLES"). + + - Miguel ] +Signed-off-by: Miguel Ojeda +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/Makefile ++++ b/Makefile +@@ -959,6 +959,9 @@ KBUILD_CFLAGS += $(stackp-flags-y) + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y ++# Work around rustc bug on compilers without ++# https://github.com/rust-lang/rust/pull/156980. ++KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max) + else + # Some targets (ARM with Thumb2, for example), can't be built with frame + # pointers. For those, we don't have FUNCTION_TRACER automatically diff --git a/queue-7.1/rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch b/queue-7.1/rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch new file mode 100644 index 0000000000..c4f345d4eb --- /dev/null +++ b/queue-7.1/rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch @@ -0,0 +1,61 @@ +From e566a9e17f3774c962b6d2522750f227f027edc6 Mon Sep 17 00:00:00 2001 +From: Danilo Krummrich +Date: Mon, 25 May 2026 22:20:48 +0200 +Subject: rust: pci: use 'static lifetime for PCI BAR resource names + +From: Danilo Krummrich + +commit e566a9e17f3774c962b6d2522750f227f027edc6 upstream. + +pci_request_region() stores the name pointer directly in struct +resource; use &'static CStr to ensure the pointer remains valid even if +the Bar is leaked. + +Cc: stable@vger.kernel.org +Reported-by: Sashiko +Closes: https://lore.kernel.org/all/20260522004943.CDA7C1F000E9@smtp.kernel.org/ +Fixes: 3c2e31d717ac ("rust: pci: move I/O infrastructure to separate file") +Reviewed-by: Alexandre Courbot +Reviewed-by: Eliot Courtney +Reviewed-by: Gary Guo +Link: https://patch.msgid.link/20260525202921.124698-2-dakr@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/pci/io.rs | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/rust/kernel/pci/io.rs b/rust/kernel/pci/io.rs +index ae78676c927f..3ce21482b079 100644 +--- a/rust/kernel/pci/io.rs ++++ b/rust/kernel/pci/io.rs +@@ -153,7 +153,7 @@ pub struct Bar { + } + + impl Bar { +- pub(super) fn new(pdev: &Device, num: u32, name: &CStr) -> Result { ++ pub(super) fn new(pdev: &Device, num: u32, name: &'static CStr) -> Result { + let len = pdev.resource_len(num)?; + if len == 0 { + return Err(ENOMEM); +@@ -252,7 +252,7 @@ impl Device { + pub fn iomap_region_sized<'a, const SIZE: usize>( + &'a self, + bar: u32, +- name: &'a CStr, ++ name: &'static CStr, + ) -> impl PinInit>, Error> + 'a { + Devres::new(self.as_ref(), Bar::::new(self, bar, name)) + } +@@ -261,7 +261,7 @@ pub fn iomap_region_sized<'a, const SIZE: usize>( + pub fn iomap_region<'a>( + &'a self, + bar: u32, +- name: &'a CStr, ++ name: &'static CStr, + ) -> impl PinInit, Error> + 'a { + self.iomap_region_sized::<0>(bar, name) + } +-- +2.55.0 + diff --git a/queue-7.1/series b/queue-7.1/series index 2eb3bfe206..382bd00b8d 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -8,3 +8,14 @@ perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch kvm-x86-move-update_cr8_intercept-to-lapic.c.patch kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch kvm-x86-unconditionally-recompute-cr8-intercept-on-ppr-update.patch +acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch +acpi-nfit-core-fix-possible-null-pointer-dereference.patch +acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch +platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch +loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch +rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch +rust-kasan-kasan-rust-requires-clang.patch +rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch +rust-block-fix-gendisk-cleanup-paths.patch +rust-doctest-fix-incorrect-pattern-in-replacement.patch +rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch