[Deepin-Kernel-SIG] [linux 6.18-y] [Upstream] Update kernel base to 6.18.22-p2

[opsiff]

Update kernel base to 6.18.22. #1613

git log --oneline v6.18.22177..v6.18.2277 | wc
100 922 7415

Summary by Sourcery

Update to upstream 6.18.22-p2 kernel base and pull in assorted subsystem fixes and small enhancements across SMB server, GPIO, IIO, DRM, USB, Bluetooth, hwmon, sched, architecture-specific code, and various drivers.

Bug Fixes:

• Harden ksmbd security descriptor handling and response pinning for SMB2 query and open operations to avoid overflows and invalid buffer use.
• Prevent races and use-after-free in the staging GPIB driver by reference-counting descriptors and blocking close while I/O is in progress.
• Fix GPIO descriptor-to-hardware offset handling by consistently using gpiod_hwgpio() in core, sysfs, cdev, and Aspeed GPIO code.
• Correct QAIC control path handling of deactivation and interrupted waits to avoid hangs and leaked DBC allocations.
• Fix efidrm framebuffer mapping and error handling for different EFI memory types.
• Prevent NULL and error handling mistakes in various IIO drivers (ti-adc161s626, ti-ads7950, ti-ads1119, ade9000, ad5770r, adxl313, adxl355, adxl380, adis16550, bno055, st_lsm6dsx, veml6070, vcnl4035, mpu3050).
• Resolve races, state handling, or cleanup issues in MEI, usbio, usbtmc, usbio GPIB, and usb serial drivers (io_edgeport, option).
• Fix multiple GPU driver issues in AMDGPU, amdkfd, AST, Intel i915, AMD display, QAIC accel, and Xe PXP, including reset locking, reserved VA sizes, clock/bounding-box updates, DSC timing adjustments, DP init, DMCUB FAMS gating, and PXP state transitions.
• Address architecture-specific bugs for MIPS, RISC-V, and x86, including cache init, TLB uniquify allocation context, __multi3 intrinsic gating, kgdb register mappings, tagged address control, ACPI RIMT IOMMU linking, KCOV instrumentation for kexec paths, and physaddr.

[sourcery-ai]

Reviewer's Guide

Upstream rebase to Linux 6.18.22-p2 incorporating a wide set of bug fixes and small feature updates across subsystems (ksmbd, GPIO, IIO, hwmon, DRM/AMD, USB, Bluetooth, MIPS/RISCV arch code, etc.), with notable focus on correctness, race fixes, bounds checks, and ABI/behavioral compat improvements.

Class diagram for updated GPIB descriptor and IO paths

classDiagram
    class gpib_descriptor {
        +unsigned_int pad
        +int sad
        +atomic_t io_in_progress
        +atomic_t descriptor_busy
        +unsigned is_board
        +unsigned autopoll_enabled
    }

    class gpib_file_private {
        +struct_mutex descriptors_mutex
        +gpib_descriptor* descriptors[GPIB_MAX_NUM_DESCRIPTORS]
    }

    class gpib_board {
        +wait_queue_head_t wait
        +struct_list_head device_list
    }

    class read_ioctl {
        +int read_ioctl(gpib_file_private* file_priv, gpib_board* board, unsigned_long arg)
    }

    class write_ioctl {
        +int write_ioctl(gpib_file_private* file_priv, gpib_board* board, unsigned_long arg)
    }

    class command_ioctl {
        +int command_ioctl(gpib_file_private* file_priv, gpib_board* board, unsigned_long arg)
    }

    class wait_ioctl {
        +int wait_ioctl(gpib_file_private* file_priv, gpib_board* board, unsigned_long arg)
    }

    class close_dev_ioctl {
        +int close_dev_ioctl(file* filep, gpib_board* board, unsigned_long arg)
    }

    class init_gpib_descriptor {
        +void init_gpib_descriptor(gpib_descriptor* desc)
    }

    gpib_file_private "1" --> "*" gpib_descriptor : owns_descriptors
    gpib_descriptor "*" --> "1" gpib_board : associated_device

    read_ioctl --> gpib_file_private : locks_descriptors_mutex
    write_ioctl --> gpib_file_private : locks_descriptors_mutex
    command_ioctl --> gpib_file_private : locks_descriptors_mutex
    wait_ioctl --> gpib_file_private : locks_descriptors_mutex
    close_dev_ioctl --> gpib_file_private : locks_descriptors_mutex

    read_ioctl --> gpib_descriptor : atomic_inc descriptor_busy
    write_ioctl --> gpib_descriptor : atomic_inc descriptor_busy
    command_ioctl --> gpib_descriptor : atomic_inc descriptor_busy
    wait_ioctl --> gpib_descriptor : atomic_inc descriptor_busy
    read_ioctl --> gpib_descriptor : atomic_set io_in_progress
    write_ioctl --> gpib_descriptor : atomic_set io_in_progress
    command_ioctl --> gpib_descriptor : atomic_set io_in_progress

    read_ioctl --> gpib_board : wake_up_interruptible
    write_ioctl --> gpib_board : wake_up_interruptible
    command_ioctl --> gpib_board : wake_up_interruptible
    wait_ioctl --> gpib_board : ibwait

    close_dev_ioctl --> gpib_descriptor : checks descriptor_busy
    close_dev_ioctl --> gpib_board : decrement_open_device_count

    init_gpib_descriptor --> gpib_descriptor : initialize_fields

Loading

Class diagram for dev_rot_state quaternion scan buffer alignment and ABI compatibility

classDiagram
    class dev_rot_state {
        +struct_hid_sensor_hub_device* hsdev
        +struct_hid_sensor_common common_attributes
        +hid_sensor_hub_attribute_info quaternion
        +scan_struct scan
        +int scale_pre_decml
        +int scale_post_decml
        +int scale_precision
        +int value_offset
        +s64 timestamp
    }

    class scan_struct {
        +IIO_QUATERNION_s32 sampled_vals
        +aligned_s64 timestamp[2]
    }

    class IIO_QUATERNION_s32 {
        +s32 data[4]
    }

    class dev_rot_proc_event {
        +int dev_rot_proc_event(hid_sensor_hub_device* hsdev, unsigned_usage_id, void* buf, int size)
    }

    class iio_interfaces {
        +void iio_push_to_buffers(iio_dev* indio_dev, void* data)
        +s64 iio_get_time_ns(iio_dev* indio_dev)
    }

    dev_rot_state --> scan_struct : has
    scan_struct --> IIO_QUATERNION_s32 : contains

    dev_rot_proc_event --> dev_rot_state : updates_scan
    dev_rot_proc_event --> iio_interfaces : pushes_data

    dev_rot_proc_event : on_event()
    dev_rot_proc_event : step1 fill scan.sampled_vals
    dev_rot_proc_event : step2 if timestamp == 0 set from iio_get_time_ns
    dev_rot_proc_event : step3 scan.timestamp[0] = timestamp
    dev_rot_proc_event : step4 scan.timestamp[1] = timestamp
    dev_rot_proc_event : step5 iio_push_to_buffers(indio_dev, &scan)

Loading

File-Level Changes

Change	Details	Files
Harden ksmbd SMB2 security descriptor handling and IOV pinning to avoid buffer overflows and ensure correct response pinning.	Replace manual ACE counting and kmalloc with smb_acl_sec_desc_scratch_len() + kvzalloc() for sizing security descriptors. Add new helper smb_acl_sec_desc_scratch_len() that computes safe scratch buffer length with overflow checks. Refactor smb2_get_info_file/filesystem/sec to always pin responses via ksmbd_iov_pin_rsp/ksmbd_iov_pin_rsp_read and to validate max output length. Ensure errors in smb2_query_info map -EINVAL to STATUS_INVALID_PARAMETER when no status is set and consistently initialize StructureSize/OutputBufferOffset.	fs/smb/server/smb2pdu.c fs/smb/server/smbacl.c fs/smb/server/smbacl.h
Fix race conditions and lifetime issues in staging GPIB driver by protecting descriptors with a busy counter and mutex.	Move descriptor lookup under descriptors_mutex in read/command/write/wait ioctls and increment a new descriptor_busy refcount while I/O is in progress. Decrement descriptor_busy after I/O completion or error paths and wake waiters appropriately. Update close_dev_ioctl to fail with -EBUSY when descriptor_busy is non-zero, remove descriptor from table under lock, then free after adjusting device counts. Initialize descriptor_busy in init_gpib_descriptor and clarify semantics in gpib_types.h comments.	drivers/staging/gpib/common/gpib_os.c drivers/staging/gpib/include/gpib_types.h
Standardize use of gpiod_hwgpio() instead of gpio_chip_hwgpio() and harden GPIO core/cdev/sysfs paths.	Introduce gpiod_hwgpio() inline helper and replace gpio_chip_hwgpio() callers in core gpiolib, gpiolib-cdev, gpiolib-sysfs, and drivers that need hardware offsets. Fix error paths in gpiod_request_commit/export to clear REQUESTED flag on invalid line and improve debug messages. Ensure interrupts/IRQs use gpiod_hwgpio() consistently, including sysfs and cdev event reporting.	drivers/gpio/gpiolib.c drivers/gpio/gpiolib-sysfs.c drivers/gpio/gpiolib-cdev.c drivers/gpio/gpio-aspeed.c drivers/gpio/gpiolib.h
Multiple IIO driver fixes: alignment/endianness, buffer layout, IRQ handling, and error paths.	ti-adc161s626: use a small unaligned buffer and get_unaligned_be16/be24, and push properly structured scan data with timestamp. mpu3050: fix trigger probe/cleanup error paths, ensure IRQ freed with correct dev_id and iio_device_register ordered after trigger setup. hid-sensor-rotation: introduce IIO_DECLARE_QUATERNION and duplicate timestamp field to preserve buggy ABI while pushing via iio_push_to_buffers(). vcnl4035: switch to struct with aligned timestamp, use IIO_CPU endianness for ALS/prox channels, and fix regmap_read + buffer population. ade9000: fix IRQ thread error handling, correct AWATT vs AWATTOS register selection, and probe ordering (mutex before IRQs). ads1119: reinit completion only when IRQ is present and request IRQ with IRQF_NO_THREAD. bmi160: validate pin enum and simplify error logging using pin_name set in switch. adxl313/adxl355/adxl380/veml6070: small logic/return-value fixes (FIFO disable path, sign bit, FIFO samples high bit, and veml6070_read return).	drivers/iio/adc/ti-adc161s626.c drivers/iio/gyro/mpu3050-core.c drivers/iio/orientation/hid-sensor-rotation.c drivers/iio/light/vcnl4035.c drivers/iio/adc/ade9000.c drivers/iio/adc/ti-ads1119.c drivers/iio/imu/bmi160/bmi160_core.c drivers/iio/accel/adxl313_core.c drivers/iio/accel/adxl355_core.c drivers/iio/accel/adxl380.c drivers/iio/light/veml6070.c
USB and serial subsystem fixes: resource cleanup, quirks, and new device IDs.	usbio: on probe failure, free URB explicitly and propagate error; on success, keep behavior unchanged. usbtmc: in release, flush anchored URBs via usbtmc_draw_down() before dropping final ref. usb core quirks: add delayed-init quirk for another Silicon Motion flash ID and NO_LPM quirk for Razer Kiyo Pro. usb serial option/io_edgeport: add new MeiG Smart SRM825WN and Rolling RW135R-GL IDs, plus BlackBox IC135A OEM device; hook them into combined tables and product handling. lpvo_usb_gpib: drop extraneous usb_get_dev() refcounting when matching device paths.	drivers/usb/misc/usbio.c drivers/usb/class/usbtmc.c drivers/usb/core/quirks.c drivers/usb/serial/option.c drivers/usb/serial/io_edgeport.c drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c drivers/usb/serial/io_usbvend.h
DRM / GPU driver updates (AMD, Intel, AST, XE, sysfb, fb cleanup, etc.) for robustness and behavior fixes.	AMD amdgpu: guard ASIC reset in pmops_freeze with reset_domain lock; validate doorbell_offset against BO size in userq; adjust reserved VA sizes and trap area; tweak SMU fw-version logging to be less noisy; in psp_v11, treat S4 like S3 for TOS unloading; avoid unexpected error on PXP suspend state; fix PASID idr allocation to use GFP_ATOMIC. AMD display: in dcn401_init_hw, recompute dchub_ref_freq_changed and call update_bw_bounding_box only when needed and when clk_mgr/bw_params are available. AMD KFD: tie CWSR TBA/TMA sizes to AMDGPU_GPU_PAGE_SIZE instead of PAGE_SIZE. Intel i915: in g4x_dp, only enable enhanced framing based on pipe_state.enhanced_framing; in icl_dsi, only scale link timings by DSC bpp in video mode; fix drm_ioc32 compat ioctl to use array_index_nospec. AST: correct SCU write for analog init to use proper offset. DRM sysfb/efidrm: remap framebuffer with appropriate API per memory attribute, check for errors for each path, and store into iosys_map; handle invalid mem_flags with -EINVAL. DRM core: in drm_mode_config_cleanup, always log leaked framebuffers and free them via refcount. DRM xe: fix PXP start state handling (restart init) and ensure termination completion is signaled on failure.	drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h drivers/gpu/drm/amd/amdgpu/psp_v11_0.c drivers/gpu/drm/amd/amdkfd/kfd_priv.h drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c drivers/gpu/drm/i915/display/g4x_dp.c drivers/gpu/drm/i915/display/icl_dsi.c drivers/gpu/drm/drm_mode_config.c drivers/gpu/drm/drm_ioc32.c drivers/gpu/drm/ast/ast_dp501.c drivers/gpu/drm/xe/xe_pxp.c drivers/gpu/drm/sysfb/efidrm.c
Networking and Bluetooth/security fixes (SMP, SMP MITM, io_uring, hci, WiFi).	Bluetooth SMP: derive STK auth flag from MITM flag rather than sec level, ensure MITM bit is set in auth_req when required, and reject pairing if only Just Works/Confirm is possible while requiring MITM. io_uring: validate sendmsg/recvmsg sqe->len is non-negative and treat zero-length fixed-buffer import specially by initializing an empty iterator. hci_sync: limit BIG create sync bis count to HCI_MAX_ISO_BIS to avoid overrun. iwlwifi: validate scan match info length against matches_len before processing to avoid OOB access. wilc1000: fix scan request buffer sizing by using u32 valuesize so large SSID lists are handled correctly.	net/bluetooth/smp.c io_uring/net.c io_uring/rsrc.c net/bluetooth/hci_sync.c drivers/net/wireless/intel/iwlwifi/mvm/d3.c drivers/net/wireless/microchip/wilc1000/hif.c
Arch and low-level scheduler/debugger fixes for MIPS and RISC-V (cache, TLB, kgdb, process tagging, multi3).	MIPS: extend __multi3 implementation workaround to GCC < 10; ensure r4k cache init also covers SB1 with 4k cache; allocate tlb_vpns with GFP_ATOMIC after boot; adjust clk_cpu idx for several SoCs; disable KCOV for machine_kexec_64 and physaddr.o to avoid crashes during kexec. RISC-V: fix dbg_reg_def and sleeping_thread_to_gdb_regs mappings for S-registers in kgdb; in set_tagged_addr_ctrl, ensure PMM PMA length is reset to PMLEN_0 and proper pmm when disabling tagged addresses; in ACPI RIMT iommu xlate, add DL_FLAG_AUTOREMOVE_CONSUMER device_link to preserve teardown ordering. process.c: tagged address control updated with proper pmlen/pmm when disabling PR_TAGGED_ADDR_ENABLE.	arch/mips/lib/multi3.c arch/mips/mm/cache.c arch/mips/mm/tlb-r4k.c arch/mips/ralink/clk.c arch/x86/kernel/Makefile arch/x86/mm/Makefile arch/riscv/kernel/kgdb.c arch/riscv/kernel/process.c drivers/acpi/riscv/rimt.c
Scheduler and BPF/tracing fixes for correctness and security.	CFS: move avg_vruntime() call from entity_tick() into update_deadline() so zero_vruntime advances on slice expiration instead of each tick; in yield_task_fair(), reuse update_deadline() rather than ad-hoc deadline increment. sched_ext: use scx_cpu_node_if_enabled() when locating waker node in scx_select_cpu_dfl to honor SCX node disabling. BPF verifier: disallow PTR_TO_BUF accesses when the type is nullable to avoid NULL dereference in helper memory accesses. bpf_kprobe_multi: reject sleepable programs for kprobe_multi links, enforcing non-sleepable constraint.	kernel/sched/fair.c kernel/sched/ext_idle.c kernel/bpf/verifier.c kernel/trace/bpf_trace.c
Misc driver fixes across input, HDA, hwmon/pmbus, SPI, SPI-NAND ECC, Android binder, MEI, AMD OCC, ADE, sensors, etc.	Input bcm5974: add a workqueue to reset "wellspring" mode when HID packets indicate we're out of mode; track last reset time to limit frequency and hook work into probe/disconnect. i8042: add DMI quirk for board X6KK45xU_X6SP45xU with standard serio quirks. xpad: add IDs for new Razer Wolverine V3 Pro variants and BETOP Xinput dongles. Realtek ALC codecs: add quirks for specific HP and ASUS boards to set appropriate mute LED and pin configs. hwmon OCC: refactor occ_get_powr_avg, fix power averaging to handle samples=0 safely, and ensure sensor_id extended attribute emits newline. pmbus tps53679/tps53676/pxe1610: harden IC_DEVICE_ID reading and logging, validate length and content; import PMBUS namespace in ltc4286; ensure PXE1610 sets page 0 with error handling. SPI: stm32-ospi cleanup (ensure reset_control_release on error; simpler remove path), spi-amlogic-spifc-a4 adds devm action to unregister ECC engine on teardown. Android binder Rust: wrap vm_ops in AssertSync and use it when comparing vm_ops; adjust comment to reflect use for C binding types. mei: change hw-ready interrupt handling to force link reset only in MEI_DEV_ENABLED state; otherwise, wake waiters to start device. sound: ctxfi add SPDIFI1 handling for SB0880, caiaq fix potential overflow of card->id when copying shortname, realtek alc269 new quirks. IIO BNO055: fix scan count macro to include final register; adc/aspeed: clear ref voltage bits before setting; hwmon/occ extended attribute prints newline; asus-ec-sensors add alternate T_Sensor definition. AMD PM SMU v11/12/14: keep debug log but drop info message about mismatched SMU driver IF version to reduce log spam. USB ulpi: on register_interface failure, return ERR_PTR directly without kfree to keep devm semantics intact.	drivers/input/mouse/bcm5974.c drivers/input/serio/i8042-acpipnpio.h drivers/input/joystick/xpad.c sound/hda/codecs/realtek/alc269.c drivers/hwmon/occ/common.c drivers/hwmon/pmbus/tps53679.c drivers/hwmon/pmbus/pxe1610.c drivers/hwmon/pmbus/ltc4286.c drivers/spi/spi-stm32-ospi.c drivers/spi/spi-amlogic-spifc-a4.c drivers/android/binder/page_range.rs drivers/android/binder/rust_binder_main.rs drivers/misc/mei/hw-me.c drivers/hwmon/asus-ec-sensors.c drivers/iio/imu/bno055/bno055.c drivers/iio/adc/aspeed_adc.c sound/usb/caiaq/device.c sound/pci/ctxfi/ctdaio.c

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[Copilot]

Pull request overview

Updates the Deepin-Kernel-SIG kernel base to upstream 6.18.22-p2, pulling in a broad set of upstream fixes across networking (SMB/Bluetooth), scheduling, crypto, DRM/GPU, USB, IIO, hwmon, GPIO, and multiple architecture-specific areas.

Changes:

• Pulls in upstream bugfixes/hardening for SMB server (ksmbd), Bluetooth SMP/HCI, io_uring, and various drivers/subsystems.
• Improves robustness/cleanup in several drivers (USB misc/class, SPI, staging GPIB, IIO sensors).
• Includes arch-specific correctness fixes (x86 KCOV/kexec handling, RISC-V tagged addressing/kgdb, MIPS cache/TLB/libgcc intrinsic gating) and DT binding updates.

Reviewed changes

Copilot reviewed 94 out of 94 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sound/usb/caiaq/device.c	Avoid card ID overflow (leave NUL)
sound/pci/ctxfi/ctdaio.c	Add missing SPDIFI1 device index
sound/hda/codecs/realtek/alc269.c	Add new ALC269/HP/ASUS quirks
net/bluetooth/smp.c	MITM/auth handling adjustments
net/bluetooth/hci_sync.c	Fix BIG create flex allocation sizing
lib/crypto/chacha-block-generic.c	Zeroize permuted state after use
kernel/trace/bpf_trace.c	Reject sleepable kprobe_multi programs
kernel/sched/fair.c	EEVDF deadline/avg_vruntime adjustments
kernel/sched/ext_idle.c	Use scx_cpu_node_if_enabled()
kernel/bpf/verifier.c	Refine PTR_TO_BUF access checks
io_uring/rsrc.c	Handle zero-length fixed import
io_uring/net.c	Reject negative send/recv lengths
include/linux/iio/iio.h	Add quaternion declaration helper macro
fs/smb/server/smbacl.h	Declare secdesc scratch sizing helper
fs/smb/server/smbacl.c	Add bounded scratch length computation
fs/smb/server/smb2pdu.c	ksmbd secdesc sizing + rsp pinning fixes
drivers/usb/serial/option.c	Add new modem device IDs
drivers/usb/serial/io_usbvend.h	Add ION Blackbox product ID
drivers/usb/serial/io_edgeport.c	Support new Edgeport rebrand ID
drivers/usb/misc/usbio.c	Fix URB submit error cleanup
drivers/usb/core/quirks.c	Add quirk entries (delay init / no LPM)
drivers/usb/common/ulpi.c	Adjust ULPI interface registration error path
drivers/usb/class/usbtmc.c	Flush anchored URBs on release
drivers/staging/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c	Avoid usb_get_dev refcount misuse
drivers/staging/gpib/include/gpib_types.h	Add descriptor busy refcount
drivers/staging/gpib/common/gpib_os.c	Close-vs-IO race hardening
drivers/spi/spi-stm32-ospi.c	Fix probe/remove/reset+PM cleanup paths
drivers/spi/spi-amlogic-spifc-a4.c	Add devm action to unregister ECC engine
drivers/net/wireless/microchip/wilc1000/hif.c	Widen scan value size type
drivers/net/wireless/intel/iwlwifi/mvm/d3.c	Fix net-detect notif length validation
drivers/misc/mei/hw-me.c	IRQ-thread state handling adjustment
drivers/input/serio/i8042-acpipnpio.h	Add DMI quirk entry
drivers/input/rmi4/rmi_f54.c	Fix locking order in work handler
drivers/input/mouse/bcm5974.c	Add mode reset work for HID packet issue
drivers/input/joystick/xpad.c	Add new controller/dongle IDs
drivers/iio/orientation/hid-sensor-rotation.c	Quaternion alignment + ABI timestamp workaround
drivers/iio/light/veml6070.c	Return sensor value correctly
drivers/iio/light/vcnl4035.c	Fix trigger buffer handling + endianness
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c	Guard FIFO ODR config for external sensors
drivers/iio/imu/bno055/bno055.c	Fix scan channel count
drivers/iio/imu/bmi160/bmi160_core.c	Pin config validation + clearer errors
drivers/iio/imu/adis16550.c	Fix gyro/accel filter mapping
drivers/iio/gyro/mpu3050-core.c	Fix trigger IRQ cleanup + register ordering
drivers/iio/dac/ad5770r.c	Propagate read error correctly
drivers/iio/adc/ti-ads7950.c	Fix GPIO get return semantics
drivers/iio/adc/ti-ads1119.c	IRQ handling + conversion completion init
drivers/iio/adc/ti-adc161s626.c	Use unaligned helpers + correct scan push
drivers/iio/adc/aspeed_adc.c	Clear ref voltage bits before config
drivers/iio/adc/ade9000.c	Fix return codes + register selection + init ordering
drivers/iio/accel/adxl380.c	Fix FIFO sample bit setting
drivers/iio/accel/adxl355_core.c	Fix scan_type sign for channel
drivers/iio/accel/adxl313_core.c	Check FIFO_CTL write errors
drivers/hwmon/pmbus/tps53679.c	Harden ID reads + improved error output
drivers/hwmon/pmbus/pxe1610.c	Check PMBUS page select result
drivers/hwmon/pmbus/ltc4286.c	Add PMBUS import namespace
drivers/hwmon/occ/common.c	Fix formatting + reuse power avg helper
drivers/hwmon/asus-ec-sensors.c	Add alternate T_Sensor address support
drivers/gpu/drm/xe/xe_pxp.c	PXP start/termination state fixes
drivers/gpu/drm/sysfb/efidrm.c	Fix EFI fb mapping + error handling
drivers/gpu/drm/i915/display/icl_dsi.c	Gate DSC timing logic to video mode
drivers/gpu/drm/i915/display/g4x_dp.c	Use enhanced_framing from pipe config
drivers/gpu/drm/drm_mode_config.c	Adjust leaked framebuffer reporting/freeing
drivers/gpu/drm/drm_ioc32.c	Add nospec mitigation for compat ioctl index
drivers/gpu/drm/drm_file.c	Simplify modeset cleanup in file free
drivers/gpu/drm/ast/ast_dp501.c	Fix register write address
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c	Remove noisy fw mismatch log
drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c	Remove noisy fw mismatch log
drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c	Remove noisy fw mismatch log
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c	Safer bounding-box update conditions
drivers/gpu/drm/amd/amdkfd/kfd_priv.h	Use AMDGPU GPU page size constants
drivers/gpu/drm/amd/amdgpu/psp_v11_0.c	Handle S4 alongside S3 reset case
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h	Adjust reserved trap VA size
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c	Validate doorbell offset bounds
drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c	Use GFP_ATOMIC under spinlock
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c	Serialize reset in freeze path
drivers/gpio/gpiolib.h	Rename helper to gpiod_hwgpio()
drivers/gpio/gpiolib.c	Use gpiod_hwgpio() + fix request error unwind
drivers/gpio/gpiolib-sysfs.c	Use gpiod_hwgpio() consistently
drivers/gpio/gpiolib-cdev.c	Use gpiod_hwgpio() consistently
drivers/gpio/gpio-aspeed.c	Use gpiod_hwgpio() consistently
drivers/android/binder/rust_binder_main.rs	Clarify Sync safety comment
drivers/android/binder/page_range.rs	Use AssertSync for static vm_ops
drivers/acpi/riscv/rimt.c	Add device link for shutdown removal ordering
drivers/accel/qaic/qaic_control.c	Fix deactivate/status handling and response parsing
arch/x86/mm/Makefile	Disable KCOV for physaddr.o
arch/x86/kernel/Makefile	Disable KCOV for machine_kexec_64.o
arch/x86/events/intel/core.c	Guard sibling ACR constr update for x86 events
arch/riscv/kernel/process.c	Fix disabling tagged addr control state
arch/riscv/kernel/kgdb.c	Fix register mapping/offsets
arch/mips/ralink/clk.c	Fix sysc node index selection
arch/mips/mm/tlb-r4k.c	Use GFP_ATOMIC for kmalloc in uniquify
arch/mips/mm/cache.c	Include SB1 in r4k_cache_init condition
arch/mips/lib/multi3.c	Update GCC gating for __multi3 workaround
Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml	Fix interrupt-cells value + example

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

ulpi_register_interface() allocates ulpi with kzalloc(), but if ulpi_register() fails the function returns ERR_PTR(ret) without freeing the allocated ulpi, leaking memory on the error path. Free the ulpi struct (and any other locally-owned resources, if added later) before returning the error.

[Copilot]

stm32_ospi_remove() now ignores the return value of pm_runtime_resume_and_get(). If that call fails, the runtime PM usage count won't be incremented (pm_runtime_resume_and_get() undoes the get on error), but the function will still run cleanup and later call pm_runtime_put_sync_suspend(), which can unbalance the PM usage count and potentially suspend an already-suspended device. Handle ret < 0 explicitly (e.g., skip the matching pm_runtime_put_sync_suspend() / use a boolean to track whether the get succeeded).

[Copilot]

resp_worker() parses device-provided message contents by advancing len with trans_hdr->len, but it doesn't validate that trans_hdr->len is non-zero/minimum-sized or that len + trans_len stays within msg_len. A malformed message (e.g., trans_hdr->len == 0 or too small) can cause an infinite loop and/or out-of-bounds reads. Add bounds checks (e.g., require trans_len >= sizeof(*trans_hdr) and len + trans_len <= msg_len; break or drop the packet on violation).

Suggested change

	trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
	if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
	if (decode_deactivate(qdev, trans_hdr, &len, NULL))
	len += le32_to_cpu(trans_hdr->len);
	} else {
	len += le32_to_cpu(trans_hdr->len);
	u32 trans_len;
	if (msg_len - len < sizeof(*trans_hdr))
	break;
	trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
	trans_len = le32_to_cpu(trans_hdr->len);
	if (trans_len < sizeof(*trans_hdr) || trans_len > msg_len - len)
	break;
	if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
	if (decode_deactivate(qdev, trans_hdr, &len, NULL))
	len += trans_len;
	} else {
	len += trans_len;