)]}' { "log": [ { "commit": "65ba8f34ec886ec72b2c07ddc8cf3d815c32869d", "tree": "a776cc51ebd4091803760e0b46e6a70339b10b60", "parents": [ "857c32a3b82c4f4abb7addee394c4dbfc79ac6db", "28722ed2527aa63ac1454013defe718c56032886" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:09:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:09:02 2026 -1000" }, "message": "Merge tag \u0027xtensa-20261027\u0027 of https://github.com/jcmvbkbc/linux-xtensa\n\nPull xtensa updates from Max Filippov:\n\n - fix clk reference leak in calibrate_ccount\n\n - small fixes in comments\n\n* tag \u0027xtensa-20261027\u0027 of https://github.com/jcmvbkbc/linux-xtensa:\n xtensa: time: Fix clk reference leak in calibrate_ccount()\n xtensa: fix typos in comments\n xtensa: atomics: drop kernel-doc comments\n" }, { "commit": "857c32a3b82c4f4abb7addee394c4dbfc79ac6db", "tree": "443d21389ee5e6edf6599410533aee87dd1b1f5a", "parents": [ "59a02493f3b68fd0ad68c661393f680bcca5a85b", "cffad6e71539bc00d5a76c0c1057dc067d42715c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:06:53 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:06:53 2026 -1000" }, "message": "Merge tag \u0027m68knommu-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu\n\nPull m68knommu updates from Greg Ungerer:\n \"Platform code added for the ColdFire 54418 RNG hardware block. Also\n PWM address definitions for the 54418. A fix for seccomp filter\n processing during system call entry and a fix for compiling the\n Cleopatra board target. A config update for the stmark board, and\n lastly a couple of typo fixes\"\n\n* tag \u0027m68knommu-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:\n m68k: coldfire: Add RNG support for MCF54418\n m68k: mcf5441x: add PWM defines\n m68knommu: fix compile breakage for 5407 cleopatra board\n m68k: defconfig: update stmark2 defconfig\n m68k: Fix seccomp filtering on ColdFire and 68000\n m68k: remove unused \u003casm/quicc_simple.h\u003e header\n m68k: fix typo \"eanble\" in comment\n m68k: coldfire: fix typos in reset.c comment\n" }, { "commit": "59a02493f3b68fd0ad68c661393f680bcca5a85b", "tree": "c5f6641a4330f1b23888dcfebb40726a15aed97f", "parents": [ "8a36f53fd5ec3eff01f1b637d42cbdc3821d0493", "1fdc4164e488916402badddbb1f51e9380dabb91" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:01:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 15:01:12 2026 -1000" }, "message": "Merge tag \u0027trace-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing updates from Steven Rostedt:\n\n - Add \"within\" to filter logic\n\n Add a way to trace events by what function they fall in.\n\n\techo \u0027within \u003d\u003d \"vfs_read\" \u003e events/sched/sched_switch/filter\n\n Will only trigger sched_switch events that happen within the vfs_read\n function. It uses a stacktrace at the event and checks if any entry\n is within the specified function and if so, it prints the event.\n\n - Remove a duplicate definition of ftrace_set_clr_event() from the\n header\n\n - Do not have ftrace_set_clr_event() modify its input buffer\n\n Have the buffer passed into ftrace_set_clr_event() to be const char *\n and not allow modifications to it that might cause side effects.\n\n - Add kunit tests for ftrace_parse_event_string()\n\n - Add filter argument to __ftrace_set_clr_event()\n\n Make it possible to set a filter on an event at the same time it is\n enabled.\n\n - Add event filtering logic to the kernel command line\n\n To allow filtering events on boot, allow filtering to be specified on\n the kernel command line when enabling events.\n\n - Rename \"ring_buffer_size()\" to \"ring_buffer_capacity()\"\n\n \"size\" refers to how much is allocated whereas the actual return\n value is the amount of available data in the ring buffer minus its\n meta data.\n\n - Rename \"trace_array_entries\" to \"trace_array_capacity\"\n\n There\u0027s several functions that use \"entries\" and returns the amount\n of data that that is usable. \"entries\" should be only for the number\n of events, not the amount of data.\n\n - Print the histogram \"bucket\" size as unsigned.\n\n If a bucket size is LONG_MAX, then it shows up as a negative number.\n\n - Show bucket size in output of histograms\n\n The output of what the histogram is shown doesn\u0027t show the size of\n the buckets when buckets are used. The output should be the same as\n the input and since specifying buckets without a size is an invalid\n command, the output to display what was entered should also show the\n size.\n\n - Fix stacktrace modifier output\n\n Only show the stacktrace modifier when it was specified in creation.\n\n - Unregister filed variable histograms when the command fails\n\n If one histogram references a variable of another histogram it\n registers that other histogram. But if the first histogram fails in\n setup after it registered the other histogram it doesn\u0027t unregister\n it. Have the first histogram add the reference to the other histogram\n so the failure clean up will unregister the second histogram too.\n\n - Fix 64-bit signed histogram fields on 32-bit kernels\n\n A fix to convert char * to u64 with added casting also incorrectly\n added an intermediate cast to convert a long value to u64 which ended\n up truncating the upper 32 bits for 32-bit kernels. Remove the\n intermediate typecast.\n\n - Print signed histogram keys as signed\n\n Histogram keys were being printed as unsigned and with signed keys it\n was giving the wrong output.\n\n - Use copy_from_user() and not __copy_from_user() in syscall tracing\n\n The syscall tracing incorrectly was using __copy_from_user() which\n could be an issue if the system trusts perf doing the trace.\n\n - Take trace_types_lock when recording a new module in persistent\n buffer\n\n When a new module is loaded, the persistent ring buffer saves it in\n its persistent memory. All the trace_arrays are iterated looking for\n any persistent buffer to add the module to. But it did not hold the\n trace_types_lock meaning a trace_array could be added or removed\n while iterating the list.\n\n - Only create tracepoint guest_halt_poll_ns when it is used\n\n The tracepoint guest_halt_poll_ns is defined in the power management\n code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is\n enabled. This wastes memory when that config isn\u0027t enabled so wrap\n the tracepoint around that as well.\n\n - Handle empty fields for events in trace_event_get_offsets()\n\n The user events could have empty fields and this causes\n trace_event_get_offsets() to crash as it expects events to always\n have fields. Make the function handle events with no fields.\n\n - Reject incomplete event filter expressions\n\n If a filter has an incomplete expression (common_pid \u003d\u003d 1111 || ), it\n will cause a out-of-bounds bug. Have the predicate_parse() only\n process the expression if it is complete.\n\n* tag \u0027trace-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (27 commits)\n tracing: Reject incomplete event filter expressions\n tracing: Guard trace_event_get_offsets() against an empty fields list\n cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used\n tracing/osnoise: Add __printf attribute to osnoise_print()\n tracing/histograms: Verify event_call identity when updating synth_event refcount\n tracing: Save the event file instead of the compatible histogram\n tracing: Hold trace_types_lock when resetting last boot data from readers\n tracing: Hold trace_types_lock when updating modules in persistent instances\n tracing/syscalls: Use copy_from_user for the faultable syscall buffer\n tracing: Print a signed histogram key as signed\n tracing: Fix 64-bit and signed histogram fields on 32-bit kernels\n tracing: Clamp the printed end of a histogram bucket at U64_MAX\n tracing: Unregister field variable histograms when the command fails\n tracing: Only report the stacktrace modifier on a real field\n tracing: Add the bucket size to expr_field_str()\n tracing: Print the bucket size as unsigned\n tracing: Rename tracing_entries_fops to tracing_capacity_fops\n tracing: Rename trace_array::entries to capacity\n ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity()\n tracing: Parse filter from boot event string\n ...\n" }, { "commit": "8a36f53fd5ec3eff01f1b637d42cbdc3821d0493", "tree": "4813a0736eeb40ee58db667445d6770eaa47ca52", "parents": [ "7d1f84f1b94e79cb95d974ab3ec54cb3a4d64f5b", "183895979c441e52dbd651b388553b09eaa35cfa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 12:23:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 12:23:17 2026 -1000" }, "message": "Merge tag \u0027mm-stable-2026-10-25-19-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull more MM updates from Andrew Morton:\n\n - \"mm: make VMA flag semantics explicit, eliminate VM_SPECIAL\" (Lorenzo\n Stoakes):\n\n Replace VM_SPECIAL with helpers describing mapping ownership and\n behavior. Enforce the mmap flag rules and convert affected drivers,\n removing ambiguous tests shared by driver mappings and ordinary\n memory.\n\n - \"support kselftest on nommu platform\" (Hajime Tazaki):\n\n Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner\n to avoid its fork-dependent timeout command and document the build\n and runtime requirements.\n\n - \"mm/collapse: separate a collapse from its callers\" (Kiryl\n Shutsemau):\n\n Separate huge-page collapse from caller policy. Replace khugepaged\n identity checks with explicit permissions, and separate scanning from\n collapse with the mmap_lock drop in one place.\n\n - \"mm: implement and use vma_has_anon_rmap(), silence KCSAN\" (Lorenzo\n Stoakes):\n\n Provide a common helper for testing whether a VMA has anonymous\n reverse mappings. Document the locking rules, annotate intentional\n concurrent reads for KCSAN, and convert the core MM callers.\n\n - \"mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups\"\n (David Hildenbrand):\n\n Remove SECTION_MARKED_PRESENT in favor of the early-section flag.\n Simplify sparse memory initialization, section metadata handling and\n related PFN validity checks.\n\n - \"sh: remove NUMA and SPARSEMEM support\" (Mike Rapoport):\n\n Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have\n been unusable since the NO_BOOTMEM conversion, leaving only the code\n and data overhead.\n\n - \"mm: Unify device DAX and HugeTLB vmemmap population paths\" (Muchun\n Song):\n\n Unify the generic device DAX and HugeTLB vmemmap population paths and\n shared tail-page handling. Remove the duplicate DAX machinery while\n retaining the powerpc radix implementation.\n\n - \"kselftest: mm: fix some failure of split_huge_page_test\" (Yeoreum\n Yun):\n\n Fix huge-page split tests racing with khugepaged recollapse. Use\n pagemap and page flags instead of VMA-boundary assumptions which fail\n when glibc has already enabled THP.\n\n - \"memcg: move memcgid refcount to objcg to unpin dying memcgs\"\n (Bingfang Guo):\n\n Let dying memcgs be freed while swapped-out shmem still holds their\n IDs. Move ID references to reparentable objcgs, with the necessary\n swap accounting and RCU lifetime changes.\n\n - \"mm/truncate: fix data loss when truncating straddling large folios\"\n (Zhang Yi):\n\n Preserve out-of-range data when truncating straddling large folios.\n Fix a lookup race and split-failure handling, and handle minimum\n folio orders for the forthcoming ext4 iomap buffered I/O path.\n\n - \"mm/damon: introduce damos quota goal target metric complement flag\"\n (SJ Park):\n\n Let DAMOS quota goals use a metric\u0027s complement, so utilization can\n also express free-memory goals without adding separate metrics. Add\n the sysfs interface, documentation and tests.\n\n - \"arm64/mm: Standardize printing for pgtable entries\" (Anshuman\n Khandual):\n\n Use the generic formatter for arm64 page-table entries, ready for\n future wider entries. Move the safe-PTE-update check out of the\n header to avoid an include cycle.\n\n - \"mm: kmsan: fix iounmap metadata teardown\" (Dima Koziuk):\n\n Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.\n Free backing pages before removing their mappings, and share the\n teardown with partial-allocation cleanup.\n\n - \"mm/damon/core: preserve quota state when constructing schemes\" (Karl\n Mehltretter):\n\n Preserve running DAMOS quota state while validating parameter\n updates. Even rejected updates could reset accounting and exceed the\n quota window; add tests for both accepted and rejected updates.\n\n - \"mm/vmalloc: fix vmalloc_dump_obj VA lookup\" (Ye Liu):\n\n Fix vmalloc_dump_obj() lookups for last-page addresses and\n allocations spanning vmap zones. These allocations were being missed\n in diagnostic output.\n\n - \"mm: various (urgent?) fixes\" (David Hildenbrand):\n\n Fix mmap charge leaks and hugetlb use-after-free, wrong-address\n unmapping, stuck locks and endless faults. Also preserve reservations\n on failed mremap and handle stale userfaultfd bits.\n\n - \"maple_tree: fix maple_range_64 crashes in RCU mode\" (Dimitris\n Charisis):\n\n Fix pointer and metadata confusion during RCU destruction of\n maple_range_64 nodes, avoiding double frees and invalid accesses. Add\n a regression test; no in-tree user currently uses this combination.\n\n - \"mm: fix hugetlb NR_HUGETLB accounting on folio migration\" (Hongfu\n Li):\n\n Fix hugetlb migration and preallocation accounting so /proc/vmstat\n retains the correct count and memory.numa_stat follows the folio to\n its new node.\n\n - \"mm/damon: fix a minor bug, clean code, and add a test\" (SJ Park):\n\n Fix 32-bit DAMON age overflow which made old regions look young.\n Share hugetlb folio acquisition code and add a regression test for\n the previously fixed last-region skipping bug.\n\n - \"mm/damon/core: cleanup code, reduce stack usage, and add kunit\" (SJ\n Park):\n\n Reduce kdamond stack usage and remove unused enums. Add deterministic\n PSI quota-goal tests which do not depend on the machine\u0027s current\n memory pressure.\n\n - \"mm/damon: fix the temporal goal tuner\u0027s size quota conversion\"\n (Donggeun Yoo):\n\n Bound the temporal tuner\u0027s quota conversion to prevent overflow and\n zero effective quotas, which could stop schemes making progress. Add\n boundary tests.\n\n - \"Don\u0027t use GFP_DMA when calling dma_alloc_coherent\" (Baoquan He):\n\n Remove redundant GFP_DMA flags from coherent DMA allocation calls.\n The DMA API already selects the zone from device limits and ignores\n the caller\u0027s flag.\n\n - \"kselftest: mm: fix intermittent failure khugepaged test\" (Yeoreum\n Yun):\n\n Propagate child-process failures in the khugepaged tests and prevent\n background collapse from racing their checks. This removes false\n passes and intermittent failures.\n\n - \"MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM\"\n (Enze Li):\n\n Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds\n the right maintainers. Also label the closing hugetlb_cgroup.h\n include guard.\n\nSummary of the 65 singletons in this merge:\n\n The singletons include a few worthwhile performance fixes. Avoiding\n unnecessary reverse-map tree updates gave a reported 15.9% improvement\n in UnixBench\u0027s execl test on a 192-core x86 system. A reclaim retry\n fix stops defrag_mode from spinning under memory.low protection; a\n reported file-creation stress test ran 5.7 times faster, with far less\n memory pressure. Narrower hugetlb invalidations also spare KVM guests\n needless refaults: the reported Redis-in-VM P99 QPS penalty while\n punching holes fell from 7.09% to 1.45%.\n\n Several fixes prevent lost data or corrupted memory. Lazyfree\n huge-page races with mremap()/munmap() could lose data or access freed\n memory, and MADV_COLD could lose a concurrent write\u0027s dirty bit.\n Another fix prevents stale migration entries from outliving large\n folios. On filesystems with blocks smaller than a page, extending a\n file by 4 GiB or more could expose bytes written past the old EOF\n through mmap instead of zeroes. That is fixed, along with\n use-after-free races in PAGEMAP_SCAN during process exit and in\n memory-cgroup accounting on PREEMPT_RT kernels.\n\n Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,\n which could wedge other memory operations, and stop mremap() leaking\n commit charges until allocations fail under strict overcommit. A\n further fix keeps userfaultfd tracking intact on neighboring mappings.\n NUMA binding no longer prevents long-term pins when the chosen node\n has only movable memory, fixing QEMU/VFIO startup and io_uring buffer\n registration failures. MGLRU also gets a fix for early-boot crashes\n with memory cgroups disabled at boot, notably in small crash kernels.\n\n* tag \u0027mm-stable-2026-10-25-19-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)\n mm: multi-gen LRU: fix NULL lruvec-\u003epgdat deref with memcg disabled on cmdline\n mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root\n mm/memcontrol: publish null pointer before dropping css reference\n test_maple_tree: test maple_range_64 node in RCU mode\n maple_tree: fix maple_range_64 crashes in RCU mode\n mm/vma: avoid broken uffd merge on mremap\n tools/testing/shared: catch a failed posix_memalign()\n mm/damon/core: remove unreachable damos charge_{target,addr}_from\n mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache\n riscv: mm: exclude invalid THP PMDs from page table check\n mm/damon/core: filter out damos address filter-split failed region\n fs/proc/task_mmu: pin mm_users in do_pagemap_scan()\n mm/mempolicy: apply bind policies against the scoped allocation zone\n mm/vmscan: reclaim every zone in per-node proactive reclaim\n mm/mremap: correctly uncharge accountable VMAs in error path\n mm/mremap: populate calculated fields in vrm state correctly\n MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP\n mm: bdi: reset min_ratio after the sysfs attributes are gone\n mm/page_vma_mapped: continue past nonmatching huge PMDs\n selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers\n ...\n" }, { "commit": "7d1f84f1b94e79cb95d974ab3ec54cb3a4d64f5b", "tree": "1055fc0d54d44122acbff64e0752747a03722bf3", "parents": [ "83f32c773255720a661aa45d83e36278135f23f5", "b6232ca8d194c60ee603586e42b5ea584d4b7be9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 12:08:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 12:08:22 2026 -1000" }, "message": "Merge tag \u0027mm-nonmm-stable-2026-10-25-14-57\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull non-MM updates from Andrew Morton:\n\n - \"ocfs2: exit recovery thread on mount error path\" (Joseph Qi):\n\n Stop OCFS2 recovery before freeing failed-mount state and replay\n slots, closing use-after-free and double-free races. Defer\n suballocator reclaim to break a transaction-lock deadlock with\n dismount.\n\n - \"ocfs2: validate suballoc slot and bit of metadata blocks\" (Joseph\n Qi):\n\n Validate OCFS2 metadata suballocator slots, bits and directory index\n block locations. Reject corrupt metadata with filesystem errors\n instead of BUGs or out-of-bounds accesses.\n\n - \"ocfs2: deal with legacy signed name hash values\" (Joseph Qi):\n\n Restore OCFS2 lookups for non-ASCII names stored with legacy signed\n hashes. Use stored xattr hashes during bucket splits to avoid\n duplicate entries and spurious ENOSPC failures.\n\n - \"ocfs2: stabilize dentry names in file and setattr traces\" (Cen\n Zhang):\n\n Snapshot OCFS2 names during file and setattr tracing to prevent\n rename races using freed storage or mismatched names and lengths.\n Preserve trace formats and the locked release open-count sample.\n\n - \"panic: fix panic_force_cpu\u003d redirect races and NMI bypass\" (Bradley\n Morgan):\n\n Fix panic_force_cpu races and NMI redirection so crash-kernel CPU\n selection is honored. Preserve variable arguments on failed redirects\n and use a static message buffer.\n\n - \"fat: allocate multiple clusters in fallocate\" (Matheus Alves de\n Almeida):\n\n Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch\n FAT updates. This removes repeated single-cluster allocation\n overhead, particularly on synchronous mounts.\n\n - \"scripts/gdb: fix radix tree lookup and stack depot diagnostic\"\n (Ting-Han Hou):\n\n Fix GDB radix-tree lookup and its handling of XArray sibling, retry\n and zero entries. Also repair the stack-depot diagnostic for an\n out-of-range pool index.\n\n - \"hung_task: Improve warning budget handling and task reporting\"\n (Aaron Tomlin):\n\n Reset the hung-task warning budget after recovery so later hangs\n remain visible. Keep the configured limit intact and emit one summary\n per scan when detailed reports exhaust the budget.\n\n - \"bootconfig: Reject unexpected data after null character and\n cleanups\" (Masami Hiramatsu):\n\n Reject bootconfig data after an embedded null while accepting\n trailing padding. Validate the full input in the userspace tool, and\n retain internal tree sanity checks there rather than in the kernel.\n\n - \"kbuild: GCOV cleanups following the prefer-atomic fix\" (Konstantin\n Khorenko):\n\n Use the actual GCOV build flags in the prefer-atomic compiler probe.\n Move flag setup into scripts/Makefile.gcov and skip the probe when\n GCOV is disabled.\n\n - \"ocfs2: xattr bucket validation fixes\" (Joseph Qi):\n\n Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding\n false read-only remounts. Reject misaligned buckets and return errors\n instead of panicking on corrupt defrag metadata.\n\n - \"ocfs2: fix metadata reservation for xattr value trees\" (Joseph Qi):\n\n Reserve enough OCFS2 metadata for new and relocated xattr value\n trees. Fix shortfalls which could cause ENOSPC, dropped entries and\n leaked clusters on fragmented filesystems; remove duplicate\n reservations.\n\n - \"Introduce arch_do_panic\" (Mete Durlu):\n\n Add arch_do_panic() and move s390 and sparc handling out of generic\n panic code. The architecture-specific actions now follow the\n end-of-panic marker.\n\n - \"checkpatch: userspace improvements\" (Petr Vorel):\n\n Improve checkpatch\u0027s userspace detection and suppress kernel-only\n checks. Recognize standard inttypes macros and add explicit\n --userspace and --no-userspace overrides.\n\n - \"ocfs2: validate dr_fs_generation of dir index root blocks\" (Joseph\n Qi):\n\n Check OCFS2 directory index generations and leaf block numbers.\n Reject stale or misplaced blocks instead of using metadata left by a\n previously formatted filesystem.\n\n - \"selftests/membarrier: Skip an unregistered memory barrier test on\n Musl\" (Chris Gellermann):\n\n Skip the unregistered membarrier test when libc has already\n registered the command. Musl does this during thread creation,\n causing false failures in the multithreaded test.\n\n - \"init: fix array boundary bugs in boot parameter parsing\"\n (Wilson Felipe Pereira):\n\n Fix boot argument boundary cases which leave stale arguments in\n init\u0027s command line or panic when replacing the final environment\n variable. Clear the last slot and check duplicates before the limit.\n\nSummary of the 87 singletons in this merge:\n\n The OCFS2 singletons fix deadlocks between xattr updates and inline\n truncation, and during inode reclaim. Corrupt quota and extent\n metadata could also crash the kernel or corrupt memory; these paths\n now check the layout before using it. Other fixes close use-after-free\n and publication races around cluster reconfiguration, node failure,\n quota remount errors and shared refcount trees. New files now retain\n security labels from all stacked LSMs instead of silently dropping all\n but one. Valid xattr insertions also stop tripping FORTIFY on builds\n with counted arrays.\n\n Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck\n in unkillable sleep and block further I2C traffic. That is fixed, as\n are kernel memory leaks in POSIX message-queue notifications and tmpfs\n casefold setup which could grow until memory is exhausted. A driver\n removal race which could crash the kernel is fixed too. The\n hibernation command through reboot() also stops taking the same mutex\n twice, avoiding a deadlock before suspension.\n\n On the boot side, bzip2 decoding now accepts valid full blocks emitted\n by lbzip2, fixing failures to boot those compressed kernels. Malformed\n bzip2 streams can no longer overflow the decode buffer, and LZ4\n initrds are checked before the decoder can read past their end. FAT\n rejects geometry which overflows the data-area calculation on 32-bit\n systems, and rolls back entries when inode setup fails, preventing\n failed creations from reappearing after remount. The x86 XOR and RAID6\n AVX paths also avoid imposing a slowdown on subsequent SSE code.\n\n* tag \u0027mm-nonmm-stable-2026-10-25-14-57\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)\n scripts/gdb: fix stack depot out-of-bounds diagnostic\n scripts/gdb: fix radix tree lookup pointer handling\n ocfs2/cluster: remove zero-address nodes from IP tree on teardown\n ocfs2: snapshot the dentry name while tracing file release\n ocfs2: snapshot dentry names in file and setattr traces\n ocfs2/dlm: drain join handlers before releasing module text\n MAINTAINERS: update Markus\u0027s e-mail address\n mailmap: add entries for Andrew Jones\n stackdepot: stop preallocating after the final pool\n ocfs2: drain quorum work before removing the cluster\n watchdog: force console verbose when reporting lockups\n profiling: fix sampling step on 64-bit big-endian systems\n kernel/reboot: avoid potential deadlocks during suspension\n compat: avoid double rounding in times()\n ocfs2: pin owning modules for open debugfs files\n ocfs2/cluster: initialize heartbeat regions before publishing them\n selftests/proc: proc-pid-vm: fix unused variable warning on non-x86\n ocfs2: pin refcount trees before dropping the lookup lock\n ocfs2: validate the xattr tree root of an indexed xattr block\n ocfs2/dlm: hold the lookup reference across convert AST enqueue\n ...\n" }, { "commit": "83f32c773255720a661aa45d83e36278135f23f5", "tree": "66272c094d323ab5acf086d4a3706de9b2bdd07f", "parents": [ "92fcf151766d7406a36f2ba363dc811024146212", "209108a5456171ab430e25b54b2dfe083455bfb6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 09:20:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 09:20:30 2026 -1000" }, "message": "Merge tag \u0027erofs-for-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fixes from Gao Xiang:\n \"These patches address several new reported issues related to page\n cache sharing, the new superblock_share feature, and recent metadata\n path changes for file-backed mounts:\n\n - Hold real inodes to fix mmap usage with page cache sharing\n\n - Fix metadata reads at the end of file-backed images with sub-page\n block sizes\n\n - Ensure disallowing superblock_share when device\u003d is specified\n\n - Drop unnecessary .read_folio() checks for file-backed mounts to\n allow tmpfs as a backing fs\"\n\n* tag \u0027erofs-for-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: drop unnecessary .read_folio() checks for file-backed mounts\n erofs: fix disallowing superblock_share if device\u003d is set\n erofs: fix metadata reads at the end of file-backed images\n erofs: hold real inodes for shared files\n" }, { "commit": "92fcf151766d7406a36f2ba363dc811024146212", "tree": "30c5b75332a263d440f44986c4d0c8cacd295c08", "parents": [ "03973f7f3556b769a3dd5104f166614d446351c9", "ee17c0cd763b622012bc725253015b6a721b48f8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 09:06:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 09:06:00 2026 -1000" }, "message": "Merge tag \u0027f2fs-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs\n\nPull f2fs updates from Jaegeuk Kim:\n \"In this round, key enhancements focus on introducing a dedicated\n metadata cache infrastructure and dynamically parameterizing on-disk\n block layouts and geometry macros.\n\n Moving meta, node, and compress blocks out of the VFS page cache\n removes the page \u003d\u003d block size assumption for metadata, which along\n with dynamic block layout descriptions paves the way for large folio\n and page !\u003d block support in the future.\n\n We also opt in to multigrain timestamps, add bio entry-count\n throttling for asynchronous write_end_io completion, and expose the\n resizable_tail feature via sysfs.\n\n Alongside these features, critical bug fixes resolve race conditions\n across compression, mmap write faults, checkpoint/shutdown, and\n filesystem freeze, prevent write bio splitting and GC holes on\n sequential zoned devices, and strengthen on-disk sanity checks for\n SIT/NAT bitmaps, read-only curseg entries, and device aliasing.\n\n Additional stability patches address online resize, roll-forward\n recovery, atomic file operations, quota handling, and dirty inode\n syncing livelocks.\n\n Enhancements:\n - implement dedicated metadata cache for meta, node, and compress\n blocks to decouple metadata from page cache for large folio and\n page !\u003d block support\n - dynamically describe SIT, NAT, orphan, dentry, node, and xattr\n block layouts and parameterize block/sector/node conversion macros\n - opt in to multigrain timestamps\n - introduce max_atc_write_bio_entry_cnt sysfs node\n - expose resizable_tail feature via sysfs\n - avoid unnecessary reads in f2fs_update_meta_block()\n\nBug fixes:\n - compress: force out-place update for all writes, allow pinning\n empty compressed files, and fix truncate/writeback and cache\n population races\n - zone: avoid bio split and GC target block grab failure on\n sequential zones\n - quota: convert inline quota files on quotaon, fix flush failure\n during freeze, and restore empty string mount options\n - atomic/mmap: disallow mmap write and data-modifying fallocate on\n atomic files, avoid truncate_inode_pages_final() on live inodes,\n and fix races in f2fs_vm_page_mkwrite()\n - resize/alias: refresh pinned allocation boundary and flush SIT\n journal during resize, and drop pending discards before reserving\n device alias\n - sanity check: bound SIT/NAT bitmaps by checkpoint pack, check all\n cur_*_segno[] on readonly images, and validate multi-device on\n device alias\n - recovery/cp: release removed xattr node in roll-forward recovery,\n invalidate curseg on change_curseg() failure, and return -EIO for\n lost inode block after cp_error\n - fix livelock in syncing dirty inodes and preserve APPEND/UPDATE ino\n entries\n - use bio_in_atomic() in f2fs_{read,write}_end_io()\n - fix 32-bit shift truncation in mount option bitmasks and defragment\n range\n\n And a number of minor bug fixes\"\n\n* tag \u0027f2fs-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (79 commits)\n f2fs: compress: don\u0027t overwrite populated compress cache entry\n f2fs: fix to update superblock crc in sanity_check_area_boundary()\n f2fs: fix to fetch ino via ino_of_node() under cache lock\n f2fs: zone: fix to don\u0027t fail to grab GC target block on zoned device\n f2fs: don\u0027t use truncate_inode_pages_final() on live inodes\n f2fs: expose resizable_tail feature via sysfs\n f2fs: use BIT_ULL for mount option bitmasks\n f2fs: fix submit accounting for IPU writeback\n f2fs: fix to avoid potential reference count leak in do_garbage_collect()\n f2fs: refresh pinned allocation boundary after resize\n f2fs: flush SIT journal during filesystem resize\n f2fs: release a removed xattr node in roll-forward recovery\n f2fs: quota: fix quota flush failure during filesystem freeze\n f2fs: return -EIO for a lost inode block after cp_error\n f2fs: avoid unnecessary reads in f2fs_update_meta_block()\n f2fs: bound the SIT/NAT bitmaps by the checkpoint pack\n f2fs: opt in to multigrain timestamps\n f2fs: fix to use bio_in_atomic() in f2fs_read_end_io()\n f2fs: fix to use bio_in_atomic() in f2fs_write_end_io()\n f2fs: fix to invalidate curseg if change_curseg() fails\n ...\n" }, { "commit": "03973f7f3556b769a3dd5104f166614d446351c9", "tree": "8cded27382330583f048913793a24c6f71d29c08", "parents": [ "62c457528529cdcfa32bc52b331ceca10f3937b6", "bf56861216337c839dce3c8bb1c4be96d30ca716" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 08:09:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 08:09:58 2026 -1000" }, "message": "Merge tag \u0027fuse-update-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse\n\nPull fuse updates from Miklos Szeredi:\n\n - Add dax backing and extent map support for famfs (John Groves,\n Miklos)\n\n - Support large folios (Joanne)\n\n - Add selftests and documentation of caching behavior (Luis Henriques)\n\n - Add FUSE_SYNCFS request (Jimmy Zuber)\n\n - Convert readdir cache to use folios (Tal Zussman)\n\n - Lots of bug fixes\n\n* tag \u0027fuse-update-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (53 commits)\n fuse: handle extent map files in fuse_passthrough_fadvise()\n fuse: resolve extent maps in O(1) when possible\n fuse: add support for striped backing\n fuse: add extent map I/O support\n fuse: add extent map data structure\n fuse: add support for opening dax device as backing\n fuse: support opening 64 bit backing ID\n fuse: support 64 bit, server allocated backing ID\n fuse: add helpers for EIO return value with kernel message\n dax: use READ_ONCE() in dax_holder()\n dax: add fsdev_dax_from_file()\n fuse: fix copy_file_range reply handling race\n virtiofs: validate fixed-output response length\n fuse: don\u0027t d_drop() before d_splice_alias()\n virtio_fs: read the vring size under virtio_fs_mutex in -\u003eget_tree\n fuse: validate folio state before pipe_buf_try_steal() in fuse_try_move_folio()\n fuse: rename fuse_direct_io() to fuse_do_direct_io()\n fuse: Forward vfs_fadvise to backing_file in passthrough mode\n selftests/fuse: add the missing FUSE_HAS_SYNCFS privilege test\n fuse: don\u0027t launder folios of a bad inode\n ...\n" }, { "commit": "62c457528529cdcfa32bc52b331ceca10f3937b6", "tree": "996f24181b89b02cbc2afcbe74888590877e9639", "parents": [ "c60ebc3208b9ce1d8915318347962f7ce1dbd07d", "503b65da9a7e5447d91222f62399522f2f62a0fa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 08:01:30 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 08:01:30 2026 -1000" }, "message": "Merge tag \u0027vfs-7.4-rc1.keyring\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs keyring updates from Christian Brauner:\n \"The kernel has two keyrings that userspace fills with X.509\n certificates at boot: .fs-verity for fs-verity built-in signatures\n and .dm-verity for dm-verity root hash signatures.\n\n Neither is linked into any process keyring. Hence, request_key() and\n KEYCTL_SEARCH can\u0027t find them. The only way for userspace to identify\n them is to read their serial number out of /proc/keys. That is not\n just a large file often the names can also be reused and appear\n multiple times which allows forging these keyrings.\n\n This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and\n KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter\n went in through bpf-next this merge window.\n\n lookup_user_key() resolves the fixed key ids to the two keyrings. So\n userspace can add a dm-verity (fixed keyring id: -10) certificate with\n\n\tkeyctl padd asymmetric \"\" -10 \u003c cert.der\n\n and seal the keyring with\n\n\tkeyctl restrict_keyring -10\n\n without looking anything up first\"\n\n* tag \u0027vfs-7.4-rc1.keyring\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY\n keys: add KEY_SPEC_FS_VERITY_KEYRING\n keys: add KEY_SPEC_DM_VERITY_KEYRING\n" }, { "commit": "c60ebc3208b9ce1d8915318347962f7ce1dbd07d", "tree": "ec6d7f1bd3d4721aef51ed7df71a2e755746b52d", "parents": [ "ed02f4f7ad9b5dabae2118e642cbbafe7dc9bb62", "9b036546a02c6c9a5133f9c1e93503896595c6ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 07:53:11 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 07:53:11 2026 -1000" }, "message": "Merge tag \u0027libnvdimm-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm\n\nPull NVDIMM and DAX updates from Alison Schofield:\n \"A small set of fixes: error handling corrections in the DAX core\n and bus code, a fix to the DAX file range comparison helpers, and\n two libnvdimm/pmem fixes for error and probe failure paths\"\n\n* tag \u0027libnvdimm-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:\n dax: fix wrong error code returned from dax_dedupe_file_range_compare()\n dax/bus: Return errors for invalid mapping targets\n dax: fix dax_range_compare_iter() to use correct size and address offset\n dax: Return errors from dax_core_init()\n libnvdimm: Handle negative return from nvdimm_clear_poison() in nsio_rw_bytes()\n nvdimm/pmem: Release gendisk on probe failure\n" }, { "commit": "ed02f4f7ad9b5dabae2118e642cbbafe7dc9bb62", "tree": "297a798f9c58025b40247523470f5050faf08b2c", "parents": [ "d135ab453a7400a34930bdda1ef4bdc8acfac80e", "45b716456dd99488a0cef58482120dc0474aa696" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 07:46:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 27 07:46:05 2026 -1000" }, "message": "Merge tag \u0027for-7.4/io_uring-dmabuf-20261023\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring dma-buf support from Jens Axboe:\n \"This adds native dma-buf support to the I/O path, exposed through\n io_uring. It\u0027s been in development for a while and should be ready to\n go now.\n\n - dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a\n new -\u003einit_dma_buf_io_ctx file operation, and a dma_buf_io_map\n holding the device DMA mapping. The two are split so a mapping can\n be invalidated and re-established underneath a live context, with\n the map counting in-flight requests so it can be torn down safely.\n\n - A new iov_iter type for dmabuf maps, and a dma map backed bio type\n for the block layer, with raw block device support on top.\n\n - nvme-pci backend implementing dma-buf backed requests, including\n SGL support.\n\n - io_uring dmabuf backed registered buffers, built on a reworked\n buffer registration structure with an extended update path, regbuf\n import flags, an uncloneable flag for buffer types that can\u0027t be\n cloned, and cloning support for registered dma-bufs\"\n\n* tag \u0027for-7.4/io_uring-dmabuf-20261023\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/dma-buf: don\u0027t fail fixed buffers without dma-buf support\n nvme-pci: detach dma-bufs only on removal\n block: reject dma-bufs larger than 4GiB\n io_uring/dma-buf: allow cloning registered dma-bufs\n dma-buf-io: document dma_buf_io_init_map\n dma-buf-io: fix typos in kernel docs\n block: fix indention for dma-buf checks\n io_uring/rsrc: add dmabuf backed registered buffers\n io_uring/rsrc: add regbuf import flags\n io_uring/rsrc: add uncloneable regbuf flag\n io_uring/rsrc: extend buffer update\n io_uring/rsrc: introduce buf registration structure\n nvme-pci: add SGL support for the dmabuf path\n nvme-pci: implement dma-buf backed requests\n nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl\n block: add dma-buf support for raw bdev\n block: introduce dma map backed bio type\n block: always adjust bi_offset on bio_advance_iter\n iov_iter: add iterator type for dmabuf maps\n dma-buf: introduce initial file I/O infrastructure\n" }, { "commit": "209108a5456171ab430e25b54b2dfe083455bfb6", "tree": "fec14ee196d1e8ddf7e65e5c7fa9f8328931a8a4", "parents": [ "aafea970fb04633e22c7ad74cba4caf563c6d6a9" ], "author": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Tue Oct 27 09:07:46 2026 +0100" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Tue Oct 27 09:15:19 2026 +0100" }, "message": "erofs: drop unnecessary .read_folio() checks for file-backed mounts\n\nSince currently dedicated EROFS-owned meta inodes are used for\nfile-backed mounts, .read_folio() checks are now redundant.\n\nAs a result, EROFS file-back mounts can now apply to tmpfs too.\n\nFixes: e587a984d332 (\"erofs: use dedicated meta inodes for file-backed mounts\")\nSigned-off-by: Gao Xiang (Docker) \u003cxiang@kernel.org\u003e\n" }, { "commit": "d135ab453a7400a34930bdda1ef4bdc8acfac80e", "tree": "8b85af32b68130f97d342b09505aae1c881e6745", "parents": [ "5b93dc1c0c61fd0fe575cb473e9e25f929fda509", "eacfbe6f9716d00536edc229a58895405e73c2e4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 09:10:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 09:10:43 2026 -1000" }, "message": "Merge tag \u0027backlight-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight\n\nPull backlight updates from Lee Jones:\n \"Improvements \u0026 Fixes:\n - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by\n setting platform driver data in `wled_probe()`\n - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent\n consecutive string writes from overlapping\n - Qualcomm WLED: Read back the hardware-programmed brightness at\n probe, expose it via\n `get_brightness()`, and prevent unbalanced OVP IRQ enabling\n - TI LM3630A: Cancel delayed work synchronously after freeing the IRQ\n and before destroying the workqueue in `lm3630a_remove()`\n\n Cleanups \u0026 Refactoring:\n - Ilitek ILI9320 / Kinetic KTD253: Fix spelling typos in comments\"\n\n* tag \u0027backlight-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:\n backlight: qcom-wled: Read back the programmed brightness at probe\n backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe\n backlight: qcom-wled: Fix WLED3 brightness register stride\n backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()\n backlight: lm3630a: Cancel delayed work before destroying workqueue\n backlight: ili9320/ktd253: Fix typos in comments\n" }, { "commit": "5b93dc1c0c61fd0fe575cb473e9e25f929fda509", "tree": "e9405ab03dda86826201dca3a7731924825bb982", "parents": [ "d857e1f3faf998f2614dcdb52a90a27bc83bd71d", "59cf91cf87abb67a49b1bb7b9d3b06486abde8cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 08:55:14 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 08:55:14 2026 -1000" }, "message": "Merge tag \u0027leds-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds\n\nPull LED updates from Lee Jones:\n \"New Support \u0026 Features:\n - Core: Add `led_trigger_notify_hw_control_changed()` to allow\n drivers to notify the core of autonomous hardware control\n transitions\n - Core: Add the `hw_offloaded()` trigger callback and\n `trigger_may_offload_to_hw` sysfs attribute to expose\n hardware-offloaded triggers\n - Netdev Trigger: Implement the `hw_offloaded()` callback to report\n hardware control state to the LED core\n - Analog Devices LTC3208: Add support for the LTC3208 7-channel\n multi-display I2C LED driver\n - ChromeOS EC: Implement the `hw_offloaded()` callback for the\n `chromeos-auto` trigger\n - CZ.NIC Turris Omnia: Implement the `hw_offloaded()` callback and\n declare `omnia-mcu` as a hardware control trigger\n - STMicroelectronics ST1202: Add hardware-accelerated blink support\n via `blink_set()`\n\n Improvements \u0026 Fixes:\n - Class: Always hold the `led_access` mutex in `brightness_show()` to\n avoid exposing transient registration states\n - Class: Deactivate active hardware control triggers when writing to\n the `brightness` sysfs attribute\n - Core: Enforce strict validation in `led_trigger_is_hw_controlled()`\n and warn on legacy fallback paths\n - Flash Class: Initialize the fault variable in `flash_fault_show()`\n to prevent undefined behavior when callbacks perform bitwise ORs\n - Kinetic KTD2692: Pass the driver context directly to\n `regulator_disable_action()` to prevent a NULL pointer dereference\n during error unwinding\n - Maxim MAX77705: Use `fwnode_for_each_child_node_scoped()` in\n `max77705_add_led()` to prevent child node reference leaks on error\n paths\n - NXP PCA9532: Check the return value of `i2c_smbus_read_byte_data()`\n in `pca9532_getled()` to avoid integer underflow on read errors\n - Qualcomm WLED: Fix a NULL pointer dereference in `wled_remove()` by\n setting platform driver data in `wled_probe()`\n - Qualcomm WLED: Fix the WLED3 brightness register stride to prevent\n consecutive string writes from overlapping\n - Qualcomm WLED: Read back the hardware-programmed brightness at\n probe, expose it via `get_brightness()`, and prevent unbalanced OVP\n IRQ enabling\n - STMicroelectronics ST1202: Clear unused PWM pattern slots in\n `pattern_set()` and `blink_set()` to prevent unintended output when\n sharing the global sequencer\n - STMicroelectronics ST1202: Program and cap the channel current\n according to `max_brightness` across brightness, blink, and\n hardware pattern modes, and scale pattern brightness to the 12-bit\n PWM range\n - STMicroelectronics ST1202: Retain a reference to each child LED\n firmware node for the lifetime of the device\n - STMicroelectronics ST1202: Use only the blocking\n `brightness_set_blocking()` callback to avoid sleeping in atomic\n context during I2C transfers\n - TI LM3692x: Check the final register write in\n `lm3692x_leds_enable()` to prevent regulator/GPIO leaks and an\n inconsistent enabled state\n - TI LP8860: Fix a `device_node` reference leak in `lp8860_probe()`\n using `__free(device_node)`\n\n Cleanups \u0026 Refactoring:\n - Core: Move `led_trigger_is_hw_controlled()` and `led_trigger_group`\n from `led-class.c` into `led-triggers.c`\n - Core: Replace conditional `set_bit()`/`clear_bit()` patterns with\n `assign_bit()` and `__assign_bit()`\n - Flash Class: Simplify `flash_fault_show()` using `sysfs_emit_at()`\n and omit the trailing space\n - Maintainers: Add Griffin Kroah-Hartman as an LED subsystem reviewer\n - Intel SS4200: Fix a spelling typo in a comment\n - ISSI IS31FL32xx: Convert DT-specific parsing helpers to generic\n device and fwnode property APIs\n - NXP PCA955x: Drop redundant intermediate platform data and allocate\n the LED array using a flexible array member\n - Qualcomm LPG: Convert LED and channel parsing to fwnode APIs and\n avoid leaving `default_trigger` uninitialized\n - Skyworks AAT1290: Use `ARRAY_SIZE()` when allocating\n `mm_current_scale` to match the target pointer type for type-aware\n allocators\n - STMicroelectronics ST1202: Introduce a `st1202_iled_max()` helper\n to unify channel current ceiling calculations\n - STMicroelectronics ST1202: Standardize variable and macro naming,\n fix helper spelling, and use `u8` consistently instead of `uint8_t`\n - Syscon: Convert from OF-specific property helpers to the generic\n device property and fwnode APIs\n\n Device Tree Binding Updates:\n - Core: Allow PHY RX triggers (`phy[0-9]+rx`) in\n `linux,default-trigger`\n - Core: Standardize example indentation across multiple LED and\n backlight binding schemas\n - Analog Devices LTC3208: Document the LTC3208 multi-display LED\n driver\n - LaCie netxbig: Convert LED bindings to DT schema\n - Motorola CPCAP: Convert LED bindings to DT schemaLEDs for v7.4\"\n\n* tag \u0027leds-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (49 commits)\n dt-bindings: leds: lacie,netxbig-leds: Convert to DT schema\n leds: pca955x: Drop platform data and allocate LEDs with the device\n dt-bindings: leds: Use consistent indentation in the example\n backlight: qcom-wled: Read back the programmed brightness at probe\n backlight: qcom-wled: Fix unbalanced OVP IRQ enable at probe\n backlight: qcom-wled: Fix WLED3 brightness register stride\n backlight: qcom-wled: Fix NULL pointer dereference in wled_remove()\n dt-bindings: leds: Allow PHY RX triggers\n MAINTAINERS: Add myself as a LED SUBSYSTEM reviewer\n leds: trigger: Add led_trigger_notify_hw_control_changed() interface\n leds: trigger: Enforce strict checks in led_trigger_is_hw_controlled()\n leds: trigger: netdev: Implement hw_offloaded() callback\n leds: turris-omnia: Implement hw_offloaded() trigger callback and declare hw_control_trigger\n leds: cros_ec: Implement hw_offloaded() trigger callback\n leds: trigger: Add hw_offloaded() callback and provide trigger_may_offload_to_hw attribute\n leds: trigger: Move led_trigger_group to the right place\n leds: class: Remove hardware control trigger when writing brightness\n leds: trigger: Move led_trigger_is_hw_controlled() to the right place\n leds: class: Always protect brightness_show() with led_access\n dt-bindings: leds: leds-cpcap: Convert to DT schema\n ...\n" }, { "commit": "d857e1f3faf998f2614dcdb52a90a27bc83bd71d", "tree": "cb8bcdc792c62a8542e7d48ecc8198e4d69f0922", "parents": [ "fb2c3f44a7e14627b9dca8e6b568e6cdc234b40b", "c8132247fe4df52e9982d74c986bb199d792b85b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 08:38:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 08:38:17 2026 -1000" }, "message": "Merge tag \u0027mfd-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd\n\nPull MFD updates from Lee Jones:\n \"New Support \u0026 Features:\n - Cirrus Logic CS42L43: Add support for the CS42L44 variant\n - Khadas MCU: Add support for the VIM4 MCU variant along with\n per-variant fan duty-cycle levels and optional fan supply regulator\n support\n - Maxim MAX77705: Add support for the PASS2 hardware revision\n - MediaTek MT6397: Add AUXADC sub-device support for MT6397\n - Motorola CPCAP: Support per-board sub-device compositions and add\n the Tegra20 Mot composition\n - ROHM BD73800: Add support for the BD73800 PMIC core, regulator,\n RTC, clock gate, and GPIO sub-devices\n - TI LM3533: Add VIN regulator supply support, configure initial\n backlight mapping mode from Device Tree, and implement the\n `backlight_scale` property\n - X-Powers AC200: Add support for the AC200 I2C mixed-signal companion IC\n\n Improvements \u0026 Fixes:\n - Cirrus Logic CS42L43: Synchronize SoundWire enumeration work in\n `remove()` before devres cleanup begins\n - Dialog DA903x: Manage IRQ work cancellation and sub-device removal\n via devres to prevent use-after-free during teardown\n - Dialog DA9150: Balance `enable_irq_wake()` with\n `disable_irq_wake()` during probe failure and driver removal\n - Intel LPSS: Add DMI quirks for Dell Latitude 5285 and 7275 to\n ignore ACPI resource conflicts on the I2C4 controller\n - Intel Quark I2C/GPIO: Manage the fixed-rate clock and its clkdev\n lookup with devres to fix a resource leak on unbind\n - Maxim MAX77705: Select `REGMAP_I2C` and `REGMAP_IRQ` in Kconfig to\n fix build errors\n - Qualcomm WCD934x: Initialize the parent DMA mask to suppress \"DMA\n mask not set\" warnings on child devices\n - Qualcomm WCD934x: Pass the valid device pointer to\n `dev_err_probe()` on IRQ lookup failure to avoid a NULL pointer\n dereference\n - Rockchip RK8xx: Register the poweroff handler in the atomic\n `SYS_OFF_MODE_POWER_OFF` phase so polling I2C transfers complete\n during shutdown\n - ST-Ericsson AB8500: Use `devm_mfd_add_devices()` to prevent leaking\n child devices on probe failure\n - TI BQ257xx: Mark self-modifying BQ25792 configuration registers as\n volatile\n - TI LM3533: Set `coherent_dma_mask` to zero to suppress \"DMA mask\n not set\" warnings\n - TI TPS65217: Check for errors during IRQ initialization and\n masking, and manage IRQ domain and wake teardown with devres\n - TI TWL: Unregister the auxiliary platform device via a devres\n action on probe failure and driver unbind\n\n Cleanups \u0026 Refactoring\n - Core: Convert drivers from deprecated `SIMPLE_DEV_PM_OPS()` to\n `DEFINE_SIMPLE_DEV_PM_OPS()` and `pm_sleep_ptr()`\n - Core: Fix spelling mistakes in comments across various MFD drivers\n and headers\n - Maintainers: Add ROHM BD73800 PMIC files under the ROHM PMIC entry\n - Maintainers: Specify the `for-mfd-next` branch for the MFD and\n Syscon git trees\n - Dialog DA9062: Use `DEFINE_RES_IRQ_NAMED()` for IRQ resource\n definitions\n - Intel LPSS: Simplify DebugFS handling by dropping redundant error\n checks and intermediate dentry variables, using octal permissions,\n and switching to\n `debugfs_remove()`\n - Khadas MCU: Convert MFD cell arrays to `const` and use\n `MFD_CELL_NAME()`\n - ST-Ericsson AB8500: Fix a spelling typo in a comment\n - TI LM3533: Convert from platform data to Device Tree bindings and\n pass only regmap and light sensor presence to child devices\n - TI LM3533: Remove driver-specific regmap wrappers, redundant pdata\n helpers, and unnecessary `extern` qualifiers, and use `dev_groups`\n for sysfs attributes\n - Wolfson WM831x: Fix a spelling typo in a comment\n\n Device Tree Binding Updates\n - HiSilicon Hi6421 SPMI: Fix the compatible string to match\n `hisilicon,hi6421-spmi`\n - MediaTek MT6357: Allow an `adc` child node\n - MediaTek MT6360: Allow two-cell interrupt specifiers with trigger\n flags\n - MediaTek MT6397: Document the `#sound-dai-cells` property\n - MediaTek MT6397: Document the battery-backed NVMEM layout under the\n RTC child node\n - MediaTek MT6397: Document the MT6323 PMIC EFUSE child node\n - Motorola CPCAP: Convert MFD and power button bindings to DT schema\n and document the Mapphone and Mot compositions\n - Qualcomm SPMI PMIC: Document the PM4125 audio codec compatible\n - Qualcomm SPMI PMIC: Document the PMAU0102 PMIC compatible\n - Qualcomm TCSR: Document the MSM8952 TCSR compatible\n - Rockchip RK805: Fold the pin controller binding into the RK805 PMIC\n DT schema\n - ROHM BD73800: Document the BD73800 PMIC and its regulators\n - ROHM PMIC: Factor out common pin properties into\n `rohm,pmic-pins.yaml` and reference them across BD71815, BD71828,\n and BD72720 bindings\n - ST-Ericsson AB8500: Document AB8500 and AB8505 buck converter\n regulators\n - ST-Ericsson AB8500: Document codec audio graph ports, sound DAI\n cells, and analog microphone wiring properties\n - ST-Ericsson DB8500 PRCMU: Deprecate the `db8500-prcmu-regulators`\n child node and make it optional\n - Syscon: Document the Ambarella CV75 secure scratchpad compatible\n - TI BQ25703A: Add the BQ25798 compatible with fallback to BQ25792\n - TI Keystone: Convert Device State Control bindings to DT schema\n - TI LM3533: Document the LM3533 LED controller, backlight, and\n indicator LED bindings\n - TI LP3943: Convert MFD and PWM bindings to DT schema\n - TI TPS61050: Convert bindings to DT schema\n - TI TPS65086: Make the `regulators` child node optional\n - TI TPS65910: Document `wakeup-source` and GPIO hog child nodes\n - TI TWL6040: Convert bindings to DT schema and align property names\n with the driver\n - X-Powers AC200: Document the AC200 mixed-signal companion IC\"\n\n* tag \u0027mfd-next-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (74 commits)\n dt-bindings: mfd: db8500-prcmu: Deprecate EPOD regulators\n dt-bindings: mfd: syscon: Add Ambarella CV75 secure scratchpad\n dt-bindings: mfd: rockchip,rk805: Convert pinctrl to DT schema\n mfd: intel-lpss: Add Dell Latitude 7275 to the resource conflict quirk\n mfd: intel-lpss: Add resource conflict quirk for Dell Latitude 5285\n mfd: tps65217: Use devres for IRQ domain and wake teardown\n mfd: tps65217: Check return value when masking interrupt sources\n mfd: tps65217: Fix NULL pointer dereference on IRQ init failure\n dt-bindings: mfd: qcom,spmi-pmic: Add compatibles for pm4125-codec\n mfd: bq257xx: Mark self-modifying BQ25792 registers volatile\n dt-bindings: mfd: mediatek: mt6397: describe the RTC\u0027s nvmem layout\n mfd: mt6397-core: Add mt6397 AUXADC support\n mfd: max77705: Mark PASS2 revision as supported\n mfd: ab8500: Fix child device leaks on probe failure\n dt-bindings: mfd: Add MT6397 sound DAI cells\n dt-bindings: mfd: mediatek: mt6397: Add mt6323 PMIC EFUSE\n dt-bindings: mfd: hisilicon: Fix Hi6421 SPMI compatible\n dt-bindings: mfd: ti,bq25703a: Expand to include BQ25798\n dt-bindings: mfd: Allow MT6360 interrupt flags\n dt-bindings: mfd: mediatek: Allow MT6357 ADC\n ...\n" }, { "commit": "fb2c3f44a7e14627b9dca8e6b568e6cdc234b40b", "tree": "30711a073e5c2df6a4d8a7349e7627ff63998540", "parents": [ "25e7ab89f4774b0f842cee0e8a20c11f755924d5", "69be770908ae57354a41d7e1cc99ab46278d2e86" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:21:18 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:21:18 2026 -1000" }, "message": "Merge tag \u0027ata-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata updates from Niklas Cassel:\n\n - Make ata_generic refuse to bind to non-IDE devices (me)\n\n - Add missing \u003clinux/pm_runtime.h\u003e includes (Vladimir)\n\n - Add pata_cswarp driver for the Amiga CS-Lab Warp card (Paolo)\n\n - Fix a use-after-free and a parport attach bug in pata_parport (Pei)\n\n - Switch ahci_da850 to DEFINE_SIMPLE_DEV_PM_OPS() (Li)\n\n - Documentation and kernel-doc fixes (Karl, Bart, me)\n\n - Remove the broken sata_inic162x driver (Ethan)\n\n - Fix probe() error paths in libata, libahci and several drivers (me)\n\n - Fail probe in sata_dwc_460ex if host activation fails (Nikolay)\n\n - Use the standard DMA engine API in pata_arasan_cf (Frank)\n\n - Abort multi-sector pass-through commands when multi_count is 0 (Hui)\n\n - Replace kmap_atomic() with kmap_local_page() in libata-sff (Danish)\n\n - Revert the no longer needed JMB582/JMB585 32-bit DMA quirk (Mario)\n\n - Enable SATA LED presence indication in sata_mv (Carlos)\n\n - Re-enable FBS after error handling on a port multiplier (Kyrylo)\n\n - Fix NO_FUA quirks shadowed by earlier quirk entries (me)\n\n - Do not overwrite the Marvell PATA quirk port mask in ahci (zhoumin)\n\n - Ignore libata.force transfer modes the host does not support (Rand)\n\n - Fix a race between IRQ deferral and ata_sff_flush_pio_task() (me)\n\n* tag \u0027ata-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (26 commits)\n ata: libata-sff: fix race between IRQ deferral and ata_sff_flush_pio_task()\n ata: libata-core: Ignore forced transfer modes the host does not support\n ata: ahci: preserve preset port masks\n ata: libata-core: Fix NO_FUA quirks shadowed by earlier quirk entries\n ata: libahci: re-enable FBS after error handling on a port multiplier\n ata: sata_mv: enable SoC SATA LED presence indication\n ata: libata: Fix scsi_done() documentation\n Revert \"ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585\"\n ata: pata_parport: fix parport attach idr_alloc for\n ata: libata-sff: replace kmap_atomic() with kmap_local_page()\n ata: libata-scsi: abort multi-sector pass-through commands when multi_count is 0\n ata: pata_arasan_cf: use standard DMA engine API\n ata: sata_dwc_460ex: Don\u0027t enable interrupt if libATA core registration fails\n ata: libata-core: Fix the ata_host_register() kdoc\n ata: libata: Do not leave ata_host_stop() registered when activation fails\n ata: libahci: Free the IRQs when activating a multi-IRQ host fails\n ata: sata_fsl: Fix use-after-free of host_priv on probe() failure\n ata: ahci_st: Assert the power down reset in the probe() error path\n ata: ahci_st: Do not ignore errors when getting the reset controls\n ata: sata_inic162x: remove dangerous broken driver\n ...\n" }, { "commit": "bf56861216337c839dce3c8bb1c4be96d30ca716", "tree": "3423b17ca97b454dc08ada717d8f292ae50a2d6e", "parents": [ "5a9745611d621ea160854936eb6370e610887bfb" ], "author": { "name": "John Groves", "email": "john@groves.net", "time": "Thu Oct 22 18:47:47 2026 -0500" }, "committer": { "name": "Miklos Szeredi", "email": "mszeredi@redhat.com", "time": "Mon Oct 26 18:10:12 2026 +0100" }, "message": "fuse: handle extent map files in fuse_passthrough_fadvise()\n\nThis addresses a collision between the pending backing_file fadvise\npatch and the new extent-mapping code for famfs (which falls into the\npassthrough bucket.\n\nA file opened with FOPEN_PASSTHROUGH on an extent map backing has no\nbacking file: fuse_passthrough_open() returns before setting\nff-\u003epassthrough and ff-\u003ecred. fuse_file_fadvise() routes every\nFOPEN_PASSTHROUGH file to fuse_passthrough_fadvise(), which installed\nthe NULL ff-\u003ecred on the task with override_creds() and then passed the\nNULL backing file to vfs_fadvise(). Any posix_fadvise(), readahead()\nor madvise(MADV_WILLNEED) on such a file oopsed. fio triggers it at\nfile open with its default invalidate and fadvise_hint settings.\n\nFall back to generic_fadvise() when there is no backing file, as the\nother passthrough helpers fall back to their extent map or generic\nimplementations. generic_fadvise() already ignores advice on DAX\ninodes while keeping the EINVAL and ESPIPE checks.\n\nReported-by: Aravind Ramesh \u003carramesh@micron.com\u003e\nFixes: 69f77a06ffad (\"fuse: Forward vfs_fadvise to backing_file in passthrough mode\")\nTested-by: John Groves \u003cjohn@groves.net\u003e\nSigned-off-by: John Groves \u003cjohn@groves.net\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\n" }, { "commit": "25e7ab89f4774b0f842cee0e8a20c11f755924d5", "tree": "b4a86bacf6a33561091805f8e49ddb812fe5173c", "parents": [ "0cc3ad8f4d2e2009c2005278c754caf7c07fe0a4", "f7b70efba26963bf725f10574cc071f86cd5ee1d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:10:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:10:03 2026 -1000" }, "message": "Merge tag \u0027i2c-7.4-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull more i2c updates from Andi Shyti:\n \"This introduces dynamic transfer timeouts in the I2C core, already\n used by qcom-geni. Alongside some driver improvements and fixes, it\n also brings in the Rust I2C pull request.\n\n Core:\n - core, qcom-geni: add and use a dynamic timeout helper\n - acpi: fix adapter reference leak when creating I2C clients\n\n Drivers:\n - imx: support reversed address direction and no-start transfers\n - designware: queue block data reads once length is known\n - mt7621: skip the second data register for chunks up to 4 bytes\n - sh_mobile: ensure IRQs are freed before unmapping registers\n\n Rust:\n - Remove unsound device-to-client reference conversion\"\n\n* tag \u0027i2c-7.4-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: sh_mobile: request IRQs after mapping registers\n i2c: imx: add I2C_M_REV_DIR_ADDR and I2C_M_NOSTART\n i2c: mt7621: fix copying uninitialized kernel stack with reduced page_len\n i2c: designware: queue only one read command for block reads\n i2c: acpi: Fix adapter reference leak in i2c_acpi_new_device_by_fwnode()\n i2c: qcom-geni: Add dynamic transfer timeout based on transfer length and frequency\n i2c: core: Add i2c_update_timeout() helper for dynamic transfer timeouts\n rust: i2c: remove TryFrom\u003c\u0026Device\u003e implementation for \u0026I2cClient\n" }, { "commit": "0cc3ad8f4d2e2009c2005278c754caf7c07fe0a4", "tree": "06e66926022aadb527013fd19569597d2a2c12fe", "parents": [ "7313d94c67daf04bc1b6ee39b492d2795fe2f3da", "187a62f99da29b1a55602b0d401a783d8dc86161" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:04:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 07:04:41 2026 -1000" }, "message": "Merge tag \u0027driver-core-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Make parent-lock requirements per device type instead of per bus,\n fixing a use-after-free on USB disconnect by limiting the requirement\n to USB interfaces, which retain a reference to their parent\n\n - Honor parent-lock requirements during deferred and asynchronous\n probing, fixing USB interface probe races, including duplicate\n endpoint creation attempts in sysfs\n\n* tag \u0027driver-core-7.4-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n driver core: take parent lock in async device attach\n driver core: take parent lock on deferred probe\n driver core: fix parent lock use-after-free on USB disconnect\n" }, { "commit": "7313d94c67daf04bc1b6ee39b492d2795fe2f3da", "tree": "da907fd98adf55abef6fd8f480668aa1f1663abd", "parents": [ "b2c505e0ae0ba4b259cad56c87e630dfdf58dcb4", "e1b3c2630d5b8bc755fe4ba86d20d08c734eb504" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:59:21 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:59:21 2026 -1000" }, "message": "Merge tag \u0027hwmon-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon updates from Guenter Roeck:\n \"New drivers:\n - Axiado AX3000 and AX3005 PWM fan controller\n - AX3000/AX3005 TSADC\n - HONOR FMI-XX\n - Minisforum UM780 XTX EC monitoring and fan control\n - pmbus: MAX20826, MAX20855B, MAX20908, MAX20912, MAX20826, and\n MAX20916\n - pmbus: Infineon TDA38740/TDA38725\n\n Added support to existing drivers:\n - asus-ec-sensors: ROG STRIX X670E-A GAMING WIFI and ROG STRIX Z490-A\n GAMING\n - asus_rog_ryujin: ROG Ryujin III 360\n - dell-smm: Dell 16 DC16250, Dell OptiPlex 7090, Dell Precision 3650\n Tower, Add Latitude 5420\n - it87: IT8613E\n - k10temp: 1ah/80h devices. Drop support for Hygon devices (support\n to be re-added with separate patches later)\n - lm63: Sensylink CTF2301\n - nct6683: MSI MAG B550M MORTAR MAX WIFI, MSI MAG B650 TOMAHAWK WIFI,\n MSI MAG B650M MORTAR WIFI (MS-7D76), and MSI MAG B850M MORTAR WIFI\n - nct6775: NCT6122D and NCT6126D\n - pmbus/isl68137: Renesas RAA229639 and RAA229640\n - pmbus/max34440: ADPM12300\n - pmbus/tps25990: TPS1689\n - pmbus/tps53679: TPS53622, TPS53659 and TPS536C7\n - pmbus/xdpe1a2g7b: xdpe1a2g7c\n - sht4x: Sensirion STS4x\n - socfpga: Agilex 5\n - yogafan: Lenovo Yoga Pro 9 16IMH9, Yoga 14cACN 2021, IdeaPad 3\n 15ALC6 Ub, Yoga 740-15IML\n\n Core updates:\n - Support for currX_emergency and inX_[l]emergency attributes\n\n Notable bug fixes and changes:\n - Add missing locks to corsair-cpro, ftsteutates, nct7904, and\n npcm750-pwm-fan drivers\n - Fix jiffies wraparound in tmp102 and tmp108 drivers\n - Documentation updates (document missing chip support, typo fixes,\n clarifications)\n - pmbus/ltc4286: Add writable shunt_resistor sysfs attribute\n - coretemp: Document sysfs numbering and label meaning, fix handling\n of isolated SMT siblings, read TjMax only when refreshing the\n temperature, refresh the temperature on the first read, and return\n -ENODATA for invalid temperature readings\n - spd5118: Avoid probing when 16-bit addressing is enabled, and\n select page 0 unconditionally during probe\n - arctic_fan_controller: Default PWM cache to MCU 40%, Dual-license\n GPL-2.0-or-later OR BSD-2-Clause, and update maintainer address\n\n Various other minor bug fixes and improvements\"\n\n* tag \u0027hwmon-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (97 commits)\n hwmon: (npcm750-pwm-fan) serialize PWM register updates\n hwmon: (nct7904) serialise the watchdog and sensors\n hwmon: (ftsteutates) serialise the watchdog and sensors\n hwmon: (acpi_power_meter) Fix 18.45 TW bug\n hwmon: (sht3x) Return the consumed count for heater writes\n hwmon: (mcp9982) Update the interval cache only after successful writes\n hwmon: (gigabyte_waterforce) reject short input reports\n hwmon: (coretemp) Fix handling of isolated SMT siblings\n hwmon: (coretemp) Document sysfs numbering and label meaning\n hwmon: (asus_wmi_sensors) Reword BIOS upgrade advice\n hwmon: Replace __MODULE_STRING() with __stringify()\n hwmon:(pmbus/xdpe1a2g7b) Add support for xdpe1a2g7c controller\n dt-bindings: trivial-devices: Add support for XDPE1A2G7C\n hwmon: (pmbus/isl68137) Add Renesas RAA229639 and RAA229640\n dt-bindings: hwmon: pmbus/isl68137: Add Renesas RAA229639 and RAA229640\n hwmon: (coretemp) Read TjMax only when refreshing the temperature\n hwmon: (pmbus/ibm-cffps) Avoid format truncation warnings\n hwmon: (dell-smm) Add Dell 16 DC16250 to fan control whitelist\n hwmon: (nct6683) Add more MSI boards to list of tested boards\n hwmon: (nct6683) Add MSI B850M to list of tested boards\n ...\n" }, { "commit": "b2c505e0ae0ba4b259cad56c87e630dfdf58dcb4", "tree": "d9c9af095dc322e2b33fbf8d16570e17370c7119", "parents": [ "d6bbdb67a4b9f2366debd8b5b05b1822490982ef", "071aa806f00cf2948ce8082102d5f64515f53215" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:55:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:55:13 2026 -1000" }, "message": "Merge tag \u0027tpm-v7.4-rc1-rebased\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull TPM updates from Jarkko Sakkinen:\n \"Features and Improvements:\n\n - improve tpm_crb behaviour by putting the chip into an idle state\n for each transmission. This improves firmware behavior as the\n kernel now better cancels its state as if it had never touched it\n in the first place.\n\n - Drop a spurious (but harmless) wmb() from tpm_pm_resume().\n\n - tpm_tis_i2c now requests the optional reset control and deasserts\n it before communicating with the TPM.\n\n - replace SIMPLE_DEV_PM_OPS with DEFINE_SIMPLE_DEV_PM_OPS across the\n whole driver stack.\n\n - Validate during driver initialization that no duplicate banks are\n received. It\u0027s unlikely corruption but since it happening would\n cause oops I decided to retain it as a sanity check.\n\n Bug fixes:\n\n - tpm2_probe() misinterpreted a transport error on TPM2_GetCapability\n as the chip not being probed, and the chip was detected as a TPM 1\n chip.\n\n This can happen in reality only in the extremely rare case of bus\n corruption. Despite the odds, a fix was landed, as it is still\n technically a legit bug fix.\n\n - It is not really worth the time and energy to go into details as\n tpm_nsc is a somewhat legacy driver, but one null pointer\n dereference bug and another causing use-after-free were fixed.\n\n - read() of /dev/tpm{,rm}0 with zero size caused a pending response\n to be consumed. Just return immediately\"\n\n* tag \u0027tpm-v7.4-rc1-rebased\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation\n tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()\n char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management\n tpm: tis_i2c: Deassert optional reset line before probing\n tpm: Remove ineffective wmb() from tpm_pm_resume()\n tpm: Call cmd_ready/go_idle for each command transmission\n tpm: fix zero-length read discarding the pending response\n tpm: tpm_nsc: stop using the cleanup callback as dev.release\n tpm: tpm_nsc: fix NULL pointer dereference on init failure\n tpm: tpm2_probe: propagate transport errors\n" }, { "commit": "d6bbdb67a4b9f2366debd8b5b05b1822490982ef", "tree": "042a9432cce46aacfe9550ccc8cc9ae4cbfac8f0", "parents": [ "6b4b543fa18757297ac756a6fe6e64f506b7844a", "cf15f9f2361dd4002203716b7b878393c0eee4bf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:50:38 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Oct 26 06:50:38 2026 -1000" }, "message": "Merge tag \u0027cxl-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl\n\nPull CXL updates from Dave Jiang:\n \"The headline item is the first part of support for Dynamic Capacity\n Devices (DCD). It covers flagging DCD support in the mailbox, reading\n the dynamic capacity configuration from the device, gathering DSMAS\n data for the DCD partitions, and configuring the dynamic capacity\n interrupts. It also adds a documentation update and a cleanup that\n enforces partition ordering. DCD is not enabled yet with these code\n changes. Patches are applied to reduce the whole set in order to\n relief the burden of very large patch set review.\n\n Zero sized HDM decoders are now allowed, along with cxl_test support\n for them. There is also a set of decoder hardening patches for switch\n decoder enumeration. Latency calculations now account for link width\n and use consistent units. The GPF timeout programming has been\n reworked. The pull also has a number of misc patches.\n\n A large number of bug fixes against pre-existing issues make up the\n rest of the pull. Many of these were flagged by review of patches\n posted to the mailing list by sashiko.\n\n Also adding Richard Cheng as a reviewer (R) to the CXL sub-system\"\n\n* tag \u0027cxl-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (49 commits)\n cxl/events: Test CME counter expiry with equality, not bitwise AND\n Documentation/cxl: Document DPA partition layout and ordering rules\n cxl/core: Enforce partition order/simplify partition calls\n cxl/mem: Configure dynamic capacity interrupts\n cxl/pci: Factor out interrupt policy check\n cxl/events: Split event msgnum configuration from irq setup\n cxl/cdat: Gather DSMAS data for DCD partitions\n cxl/mem: Read dynamic capacity configuration from the device\n cxl/mbox: Flag support for Dynamic Capacity Devices (DCD)\n cxl/acpi: Convert QTG _DSM latencies to picoseconds\n cxl: Account for link width in latency calculation\n cxl/port: Convert PCIe link latency to nanoseconds\n cxl/pci: Update only the Port GPF timeout fields\n cxl/pci: Program the Port GPF timeouts before caching the DVSEC\n cxl/pci: Use the Device GPF DVSEC for restricted endpoints\n cxl/port: Attach endpoints to a dport under the lock that pins it\n cxl/core: Hold the dport host lock across dport lookup and use\n cxl/port: Clear cached dport pointers when a dport is removed\n cxl/region: Warn on user region position mismatch\n cxl/acpi: Check ACPI companion before use\n ...\n" }, { "commit": "ee17c0cd763b622012bc725253015b6a721b48f8", "tree": "8c908800faa1b034a1b0b2d640483415ceea6aee", "parents": [ "f8f956c7ec8c0285d7a80bed497d2f7adcbded15" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Wed Oct 21 11:05:38 2026 +0000" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Oct 26 15:34:50 2026 +0000" }, "message": "f2fs: compress: don\u0027t overwrite populated compress cache entry\n\nf2fs_cache_compressed_page() looks up the entry of blkaddr w/\nf2fs_find_cache(), and then grabs it w/ f2fs_grab_cache() and\nF2FS_CACHE_LOCK_CREATE. If another reader populates the entry in\nbetween, f2fs_grab_cache() returns that uptodate entry, and we will\noverwrite its ino and data.\n\nBefore the compress cache was converted to the generic cache,\nadd_to_page_cache_lru() failed w/ -EEXIST in this case, and the\nexisting page was left untouched.\n\nNormally, the racer is a reader of the same block of the same inode,\nso both copies are the same, let\u0027s just back off, as\nf2fs_ra_meta_caches() does.\n\nA block address can only be owned by one inode at a time, the block\ncan not be freed and reused by another inode during population, since\nthe reader holds the locks of the cluster\u0027s pagecache pages until\ndecompression completes, and truncation must lock these pages before\nfreeing blocks. So if the uptodate entry was cached by another inode,\nit\u0027s a bug, and one of the copies must be stale, let\u0027s report the bug,\nand drop the entry, then readers will load the block from disk.\n\nCc: stable@kernel.org\nFixes: 6a78d0488116 (\"f2fs: cache: use compress cache\")\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "f8f956c7ec8c0285d7a80bed497d2f7adcbded15", "tree": "c2df620ebbc2a7468c734b375c0b3a8483c2ef01", "parents": [ "cd6d8b1891395b681f2060916a4b83880b765698" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Oct 26 08:23:50 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Oct 26 15:33:26 2026 +0000" }, "message": "f2fs: fix to update superblock crc in sanity_check_area_boundary()\n\nThis patch fixes the bug reported by Sashiko:\n\nWe should update superblock crc along w/ raw_super-\u003esegment_count in\nsanity_check_area_boundary() if sb_checksum feature is enabled.\n\nCc: stable@kernel.org\nFixes: d440c52d3151 (\"f2fs: support superblock checksum\")\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "cd6d8b1891395b681f2060916a4b83880b765698", "tree": "8da93a4c1fd084988581faf15e0a123fa7d0edfe", "parents": [ "fd106ada4dee4b8adefec791ee9b9681b7b77501" ], "author": { "name": "Chao Yu", "email": "chao@kernel.org", "time": "Mon Oct 26 08:23:49 2026 +0800" }, "committer": { "name": "Jaegeuk Kim", "email": "jaegeuk@kernel.org", "time": "Mon Oct 26 15:33:18 2026 +0000" }, "message": "f2fs: fix to fetch ino via ino_of_node() under cache lock\n\nIn f2fs_writeback_node_caches(), it\u0027s better to fetch ino via ino_of_node()\nunder cache lock, otherwise, node cache content may become stale after cache\nis unlocked due to racing w/ truncation.\n\nCommit 493b9dc8b52c (\"f2fs: cache: use node cache\") fixes similar issue in\nf2fs_flush_inline_data() introduced in commit 34c061ad85a2 (\"f2fs: Avoid double\nlock for cp_rwsem during checkpoint\").\n\nCc: stable@kernel.org\nFixes: 2049d4fcb057 (\"f2fs: avoid multiple node page writes due to inline_data\")\nSigned-off-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\n" }, { "commit": "aafea970fb04633e22c7ad74cba4caf563c6d6a9", "tree": "93d4a542d43ed48389ee80c289f4984ef925af24", "parents": [ "52dceb88082b4c7983d1c8c7de1c181f018055ac" ], "author": { "name": "Zhan Xusheng", "email": "zhanxusheng@xiaomi.com", "time": "Mon Oct 26 17:22:17 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Mon Oct 26 11:51:05 2026 +0100" }, "message": "erofs: fix disallowing superblock_share if device\u003d is set\n\nsuperblock_share together with device\u003d is rejected in\nerofs_fc_fill_super():\n\n\tif (test_opt(\u0026sbi-\u003eopt, SUPERBLOCK_SHARE) \u0026\u0026\n\t sbi-\u003edevs-\u003eextra_devices)\n\t\treturn -EINVAL;\n\nbut extra_devices is kept in sbi-\u003edevs, not in sbi-\u003eopt, and\nerofs_sb_share_test_super() compares only the backing inode, the\nfsoffset and sbi-\u003eopt. So once the image is mounted with\nsuperblock_share, a second mount with superblock_share,device\u003d matches\nthat superblock and get_tree_super() reuses it without calling\nfill_super() at all.\n\nThe same command line therefore either fails with -EINVAL or succeeds\nwith device\u003d quietly dropped, depending on whether a compatible mount\nalready exists.\n\nRefuse to match a context that brought device\u003d options, so that it gets\na superblock of its own and fill_super() decides as it does today.\n\nOnly the incoming context can be tested: a shared superblock may have\nextra_devices set itself, because erofs_scan_devices() fills the device\ntable from the image when no device\u003d was given.\n\nFixes: cd4108319bb3 (\"erofs: reuse superblock for file-backed mounts\")\nSigned-off-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nReviewed-by: Gao Xiang \u003cxiang@kernel.org\u003e\nSigned-off-by: Gao Xiang (Docker) \u003cxiang@kernel.org\u003e\n" }, { "commit": "6b4b543fa18757297ac756a6fe6e64f506b7844a", "tree": "f13b99af8ebec110d485c502786eb77d7929c271", "parents": [ "44dc57ed1e77a23248ef28732486f4b7e9468cf7", "6219ffcc60a5b4a896b95e717c4affd6dead1bde" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 18:04:17 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 18:04:17 2026 -1000" }, "message": "Merge tag \u0027parisc-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc updates from Helge Deller:\n\n - fix out-of-bounds read in eisa_enumerator driver\n\n - drop redundant pte_xxx() macros and use common macros\n\n - code cleanup in eisa_enumerator driver\n\n - typo fixes in comments in various header files\n\n* tag \u0027parisc-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n parisc: eisa_enumerator: Code and whitespace cleanups\n parisc: eisa_enumerator: Fix out-of-bounds reads of the EEPROM buffer\n parisc: Drop redundant implementation of ptep_set_wrprotect()\n parisc: Drop redundant implementation of pte_same()\n parisc: Drop own implementations for ptep_get() and ptep_test_and_clear_young()\n parisc: fix typos in comments in parport.c\n parisc: fix typos in comments in sba_iommu.c\n parisc: fix typos in comments in pdc_stable.c\n parisc: fix typos in comments in dino.c\n parisc: fix typos in comments in ccio-dma.c\n parisc: fix typos in comments in memcpy.c\n parisc: fix typos in comments in mman.h\n parisc: fix typos in comments in special_insns.h\n parisc: fix typos in comments in pdcpat.h\n" }, { "commit": "44dc57ed1e77a23248ef28732486f4b7e9468cf7", "tree": "c2f61d5e11c0d9b0e553d475d13406e4ac136279", "parents": [ "2270aa5ed5f7981082e4fae4103b8930e0ba106f", "f45711b39e03ff5e80b60dcc1fd34b3fc7d3d36c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:58:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:58:48 2026 -1000" }, "message": "Merge tag \u0027sh-for-v7.4-tag1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux\n\nPull sh updates from John Paul Adrian Glaubitz:\n \"Fixes and improvements for various boards as well as the generic sh\n kernel:\n\n - help the mach-x3proto and ecovec24 boards get rid off the use of\n the old platform data API in the kernel. For the former board,\n software nodes are being used for gpio-keys now while for the\n latter board, static device properties are used to describe the\n touchscreen (Dmitry Torokhov)\n\n - a build fix when CONFIG_BUILTIN_DTB is enabled, and fix an issue\n with __get_user_u64() and __put_user_u64() using wrong memory\n operands which could cause the kernel build to fail with \"invalid\n \u0027asm\u0027\" or an internal compiler error in GCC\u0027s change_address_1\n (Florian Fuchs)\n\n - update various default configuration files of several boards to\n replace the removed CONFIG_USB_GADGET_M66592 with the new\n CONFIG_USB_M66592 Kconfig option (Pengpeng Hou)\n\n - fix two issues with the SH-7785LCR evaluation board: fix a kernel\n memory leak which occurred as a result of the prio and sense lists\n being sorted too early in register_intc_controller(), and fix the\n the registration of the PCA9564 controller so that the RTC works\n properly again (Karl Mehltretter)\n\n - fix missing cookies when calling free_irq() in the maple bus driver\n which ensures that IRQ handlers can be properly unregistered and\n the kernel does not emit a WARN message (Runyu Xiao)\n\n - select BINFMT_FLAT_NO_DATA_START_OFFSET for !MMU configurations\n such that there is no gap at the end of text and init runs which\n causes the GOT register to point below the real GOT, so every GOT\n load reads the neighbouring slot and gets a wrong pointer (Waldemar\n Brodkorb)\"\n\n* tag \u0027sh-for-v7.4-tag1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux:\n sh: Select BINFMT_FLAT_NO_DATA_START_OFFSET for !MMU\n sh: maple: Use the matching IRQ cookie when invoking free_irq()\n sh: sh7785lcr: Register the PCA9564 controller as I2C bus 0\n sh: intc: Sort the prio and sense lists after filling them\n sh: defconfig: Enable the current M66592 UDC symbol\n sh: uaccess: Require offsettable operands for 64-bit user access\n sh: Fix built-in DTB build with generic rule\n sh: ecovec24: Use static device properties to describe the touchscreen\n sh: mach-x3proto: Convert gpio-keys to software nodes\n sh: mach-x3proto: Add software node for GPIO controller\n" }, { "commit": "2270aa5ed5f7981082e4fae4103b8930e0ba106f", "tree": "b63db28392a0916b2c35c4aeccb0fa62bc0870a3", "parents": [ "7d37252fc49a939d005a7495b81d1bb337c29e45", "bfe97f12a0a64c3682be21a02404238e3b91e945" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:57:15 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:57:15 2026 -1000" }, "message": "Merge tag \u0027mips_7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS updates from Thomas Bogendoerfer:\n \"MM:\n - fix huge TLB handling\n\n OCTEON:\n - correct register access for CN6xxxx SOCs\n - provide DTs for platforms where U-Boot doesn\u0027t have a DT\n\n Decstation:\n - fix 64bit kernels\n - build cleanups\n\n Others:\n - cleanups and fixes\"\n\n* tag \u0027mips_7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits)\n MIPS: octeon: Add detection of UBNT Edgeroute Lite devices\n MIPS: octeon: Use MIPS_MACHINE for boards without provided device tree\n MIPS: GT64120: Remove duplicate GT_PCI1M1LD_OFS and GT_PCI1M1HD_OFS\n mips: dts: pic32: pic32mzda: Remove unused address-cells, size-cells property\n MIPS: generic: Remove undefined image \u0027ramdisk\u0027\n docs: ABI: lefi: drop \"ROM Size\" in sysfs file doc.\n docs: ABI: lefi: use literal blocks\n MIPS: dec: Reorder header inclusions in setup.c\n MIPS: Reword KBUILD_SYM32 documentation for clarity\n MIPS: Eliminate redundant KBUILD_SYM32 check\n MIPS: decstation_64_defconfig: Compile the kernel with warnings as errors\n MIPS: decstation_64_defconfig: Regenerate for 7.x\n MIPS: dec: Add missing \u003clinux/interrupt.h\u003e inclusion to reset.h\n MIPS: Only check -msym32 when need-compiler\n MIPS: remove unused \u003casm/cmp.h\u003e header\n MIPS: remove unused \u003casm/mips-boards/sead3-addr.h\u003e header\n MIPS: remove unused \u003casm/amon.h\u003e header\n MIPS: Octeon: offer the RedBoot parser when it is modular\n MIPS: Octeon: size the swiotlb for a modular OHCI platform driver\n MIPS: mm: do not write a huge TLB entry when the probe misses\n ...\n" }, { "commit": "7d37252fc49a939d005a7495b81d1bb337c29e45", "tree": "d158ae6f116de723559e012dbcc9cff85e13bfa5", "parents": [ "ed2bc044a7c8c9759bbe1165b8e487d07dd53b73", "108775fa28fe04a16f19a828a779689f3d0ea9f0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:55:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:55:00 2026 -1000" }, "message": "Merge tag \u0027x86-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Mark CPUID function 0x23 as being indexed - which bug could break\n VMs (Sean Christopherson)\n\n* tag \u0027x86-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/cpuid: Mark CPUID function 0x23 as being indexed\n" }, { "commit": "ed2bc044a7c8c9759bbe1165b8e487d07dd53b73", "tree": "cd6b916bcfcc9f5dae6b2586a312f31a34d84f78", "parents": [ "6e723c4f9417663c318d898fa113af211f48a6da", "6541fbc942f3b63bb8bd44e34eee6223e0abe719" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:54:02 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:54:02 2026 -1000" }, "message": "Merge tag \u0027timers-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Ingo Molnar:\n\n - Clear timer_base::pending_map on CPU hot-unplug, that can\n cause temporal timeout processing anomalous on the next\n hot-replug (Liang Hao)\n\n - Fix PID refcount leak in the posix-cpu-timers do_cpu_nanosleep()\n signal path (Cen Zhang)\n\n - Require (CAP_SYS_TIME) permission to set auxiliary clocks\n via aux_clock_set() (Daehyeon Ko)\n\n - Update offsets on sequence counter retry in\n ktime_get_update_offsets_now() (Thomas Weißschuh)\n\n* tag \u0027timers-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timekeeping: Update offsets on sequence counter retry in ktime_get_update_offsets_now()\n timekeeping: Require permission to set auxiliary clocks\n posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path\n timers: Clear pending_map on CPU hotplug\n" }, { "commit": "6e723c4f9417663c318d898fa113af211f48a6da", "tree": "8b2f6b1168efccc23eb9ad079fc80deddc2f7a54", "parents": [ "dc7be96c1cac85cc172b90a47f80e23d847c9203", "cac037a85c1971ec75c4d3edf5a28af9ec2a089c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:53:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:53:13 2026 -1000" }, "message": "Merge tag \u0027sched-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix MM CID affinity-triggered switch back to per-task mode\n (Hui Su)\n\n - Fix scheduling regression observed on AMD Ryzen\n AI HX 370 systems, caused by cache aware scheduling\n incorrectly overriding asym packing placement (Tim Chen)\n\n - Fix stale get_pref_llc() prototype for !CONFIG_SCHED_CACHE\n (Yafang Shao)\n\n* tag \u0027sched-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched: fix stale get_pref_llc() stub for !CONFIG_SCHED_CACHE\n sched/cache: Honor asym packing over cache aware scheduling on hybrid systems\n sched/mmcid: Fix affinity-triggered switch back to per-task mode\n" }, { "commit": "dc7be96c1cac85cc172b90a47f80e23d847c9203", "tree": "f2101e71dcfb5d96ff524f6a88d91f685f5f3a33", "parents": [ "2b19759b46aee85627b58f3722846424201f24a7", "d095321349222961813333277881b3c74f10b17b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:52:28 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:52:28 2026 -1000" }, "message": "Merge tag \u0027perf-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix Alpha build failure caused by a semantic conflict\n between perf and arch-alpha changes (Thomas Weißschuh)\n\n - Fix UAF in attach_task_ctx_data() (Lee Jia Jie)\n\n - Fix perf_remove_from_context() event scheduling (Peter Zijlstra)\n\n* tag \u0027perf-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Fix perf_remove_from_context() event scheduling\n perf: Fix UAF in attach_task_ctx_data()\n alpha: add simd_enabled argument to perf_reg_validate()\n" }, { "commit": "2b19759b46aee85627b58f3722846424201f24a7", "tree": "81f441f6c5b2ad5b9cbe3da86ac0cd3b46433a45", "parents": [ "126ad898a6e97fcb4c3fbe6d979829f72b8c348c", "717862eac6eff0eea8ac30a0c0de0bed84922aab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:51:25 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:51:25 2026 -1000" }, "message": "Merge tag \u0027irq-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull kexec / irq fix from Ingo Molnar:\n\n - Fix possible hang in machine_kexec_mask_interrupts(),\n which incorrectly assumes that irq_set_irqchip_state()\n will always be able to complete in a kexec crash path,\n triggered on RK3399 embedded boards (Igor Velkov)\n\n* tag \u0027irq-urgent-2026-10-25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path\n" }, { "commit": "126ad898a6e97fcb4c3fbe6d979829f72b8c348c", "tree": "8baf89e0793719bc8adc5672772814a185842237", "parents": [ "b3593aba315322d875f295eef8b1a19e24658ba6", "9a6a70aefe77f6fb9ff2b3037dcf87f6dff65c8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:42:42 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:42:42 2026 -1000" }, "message": "Merge tag \u0027liveupdate-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux\n\nPull liveupdate updates from Mike Rapoport:\n\n - Several small fixes to KHO and LiveUpdate selftest\n\n - A series that renames \"KHO scratch\" to \"KHO bootmem\" because this\n memory is way more important in kexec\u0027ed kernels rather than in the\n original cold boot kernel and the new name reflects it\n\n* tag \u0027liveupdate-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:\n kho: do not reserve empty per-node bootmem areas\n selftests/liveupdate: Prefer KVM and HVF over TCG in vmtest.sh\n kho: rename kho_scratch\u003d commandline parameter to kho_bootmem\u003d\n kho: rename KHO scratch to KHO bootmem\n memblock: rename KHO_SCRATCH to KHO_NOPRSRV\n memblock: get rid of CONFIG_MEMBLOCK_KHO_SCRATCH\n kho: docs: fix scratch_phys debugfs cross-reference\n kho: do not reserve scratch memory in the kdump kernel\n" }, { "commit": "b3593aba315322d875f295eef8b1a19e24658ba6", "tree": "3294c7ad1453b0fe3570f936f6eb0dc834fe82e6", "parents": [ "394023fbe34fccec5d4db2576169d21e14c8d3d4", "833d2b79ed9520e77c5d83eb11644e5239b2c5bb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:33:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:33:22 2026 -1000" }, "message": "Merge tag \u0027kexec-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux\n\nPull kexec updates from Mike Rapoport:\n\n - Fix probe error codes and error propagation:\n\n - make architecture functions that probe loaded image consistenly\n return -ENOEXEC when they do not recognize the image format\n\n - make kexec_image_probe_default() distinguish image format\n mismatches (-ENOEXEC) from real errors (e.g. -ENOMEM),\n propagating real errors immediately and only continuing to the\n next loader on -ENOEXEC\n\n - Make sure the next kernel does not land on hardware-poisoned pages\n\n - Remove unused arch_kexec_locate_mem_hole hook\n\n* tag \u0027kexec-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:\n kexec_file: remove unused arch_kexec_locate_mem_hole hook\n kexec: fix error propagation in kexec_image_probe_default()\n kexec: return -ENOEXEC from image probe functions on mismatch\n kexec: keep the next kernel off hardware-poisoned pages\n kexec_file: stop the top-down search before it underflows\n" }, { "commit": "394023fbe34fccec5d4db2576169d21e14c8d3d4", "tree": "c5ca434c2b35eb7c690365fa6455fa56a2deeae2", "parents": [ "390febb5805d3bb830402679f277f1d5f309e6bc", "7933ad3f669670ca5f5f13de2b5cb0f92b91abf5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:27:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 17:27:19 2026 -1000" }, "message": "Merge tag \u0027memblock-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock\n\nPull memblock updates from Mike Rapoport:\n \"Performance improvement:\n\n - Use binary search in memblock_add_range() and\n memblock_isolate_range()\n\n Cleanups:\n\n - Several simplifications in memblock and mm_init that remove\n redundant code\n\n - After rework of sparsemem buffer preallocation, memmap_alloc() does\n not require exact_nid parameter. Remove that parameter, drop now\n unused memblock_alloc_exact_nid_raw() and adjust memblock tests\n accordingly\n\n memblock test updates:\n\n - add coverage for lowmem allocations\n\n - fix 32-bit build warnings\"\n\n* tag \u0027memblock-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock:\n memblock: use binary search to locate candidate regions\n memblock: drop for_each_memblock_type() and open code its users\n memblock: Remove unused memblock_alloc_exact_nid_raw()\n memblock tests: Move exact nid tests to memblock_alloc_range_nid()\n mm: Remove unused exact_nid parameter from memmap_alloc()\n memblock: initialize the region merge end index\n tools: use __pa() in virt_to_phys()\n memblock tests: zero-extend simulated memory addresses\n memblock tests: use physical addresses for region removal\n memblock: reject non-page-aligned reserve_mem regions\n memblock tests: cover allocations below the low address limit\n memblock tests: model the low allocation limit within dummy memory\n mm/mm_init: remove zone_absent_pages_in_node()\n memblock: remove conditional return with no effect\n memblock: simplify reset_all_zones_managed_pages()\n" }, { "commit": "390febb5805d3bb830402679f277f1d5f309e6bc", "tree": "83f212821bc8f5f6c8627871d011494a407fe201", "parents": [ "ac5feaad48f0910b3db4047c298dd11157aef1f4", "293aae0123e1c178c7f76fd7a93bcced41e6663c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 16:15:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 16:15:22 2026 -1000" }, "message": "Merge tag \u0027for-7.4-part2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull more btrfs updates from David Sterba:\n \"This removes unused code of free space caching, disabled in 7.3\n (commit 545e560a5b0f: \"btrfs: disable v1 space cache\").\n\n It\u0027s been the original free space cache feature, superseded by free\n space tree (4.5) and mkfs default since 5.15. The grace period was\n sufficiently long, backward compatibility still exists with a\n performance impact, effectively as if mounted with \u0027-o nospace_cache\u0027\"\n\n* tag \u0027for-7.4-part2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: remove TRANS_JOIN_NOLOCK\n btrfs: stop reading free space inodes from the commit root\n btrfs: stop special-casing free space inodes in the delalloc accounting\n btrfs: remove the free space inode special cases from the COW paths\n btrfs: remove the free space inode ordered extent special cases\n btrfs: remove BTRFS_RESERVE_FLUSH_FREE_SPACE_INODE\n btrfs: remove the free space cache trimming ranges\n btrfs: replace btrfs_set_free_space_cache_v1_active() with a cleanup helper\n btrfs: remove the SPACE_CACHE mount option flag\n btrfs: remove btrfs_disk_cache_state\n btrfs: remove the v1 space cache load path\n btrfs: drop the transaction handle from the prealloc helpers\n btrfs: rename cache_write_mutex to dirty_bgs_update_mutex\n btrfs: remove the v1 space cache write path\n btrfs: remove the free space cache endio workqueue\n btrfs: remove the v1 space cache writeout from the transaction commit\n btrfs: stop enabling the v1 space cache from the on-disk state\n btrfs: update the inode item when removing a free space inode\n btrfs: drop the extent maps of the written part of a failed ordered extent\n btrfs: fix use-after-free on quota enable allocation failure\n" }, { "commit": "ac5feaad48f0910b3db4047c298dd11157aef1f4", "tree": "448511612c9459446266c427f8901dbb707b69c4", "parents": [ "12392d40a3be2d79bc168bdb9ae6d7227b1dd17e", "8c4f6e3376348fc3162eed86a05b933921c8f9ed" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 16:09:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 16:09:13 2026 -1000" }, "message": "Merge tag \u0027ext4_for_linus-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4\n\nPull ext4 updates from Ted Ts\u0027o:\n \"Add support for buffered iomap support in ext4. This is not enabled by\n default, but requires the buffered_iomap mount option, as this mode\n does not support online defragmentation, inline data, fsverify,\n fscrypt, non-extent inodes, and data\u003djournal mode. If buffered_iomap\n is enabled, ext4 will fall back to the original I/O code path\n automatically if necessary. Large writes show significant performance\n improvements when buffered iomap is enabled.\n\n There are also miscellaneous bug fixes and improvements, including for\n fast commit and avoiding deadlocks and out-of-bound reads when\n handling corner cases involving corrupted file systems\"\n\n* tag \u0027ext4_for_linus-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (41 commits)\n ext4: introduce a mount option for iomap buffered I/O path\n ext4: partially enable iomap for the buffered I/O path of regular files\n ext4: add tracepoints for EOF block zeroing and disksize-grow I/O\n ext4: add tracepoints for DISKSIZE_GROW_PENDING set, clear, and wait\n ext4: set DISKSIZE_GROW_PENDING after zeroing unaligned EOF block\n ext4: clear DISKSIZE_GROW_PENDING on truncate or error\n ext4: submit and wait for disksize-grow I/O in fallocate paths\n ext4: defer i_disksize update while DISKSIZE_GROW_PENDING is set\n ext4: advance i_disksize to i_size upon disksize-grow I/O completion\n ext4: submit and wait for pending disksize-grow I/O on writeback\n ext4: add EXT4_STATE_DISKSIZE_GROW_PENDING state bit and helpers\n ext4: disable online defrag when inode using iomap buffered I/O path\n ext4: add block mapping tracepoints for iomap buffered I/O path\n ext4: drain writeback before removing extents on the iomap path\n ext4: implement partial block zero range path using iomap\n ext4: implement mmap path using iomap\n ext4: implement writeback path using iomap\n ext4: rework handle credit accounting for unwritten extent conversion\n ext4: implement buffered write path using iomap\n ext4: do not use data\u003dordered mode for inodes using buffered iomap path\n ...\n" }, { "commit": "12392d40a3be2d79bc168bdb9ae6d7227b1dd17e", "tree": "dcf1e3be56271c2a344df2aad44c7b47778e18c2", "parents": [ "42023dd0a294d8b5c05127dcf95987b70c2fb271", "5dffb7307023d909277cb5f5f3f18f32afa31e2f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:59:06 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:59:06 2026 -1000" }, "message": "Merge tag \u0027ntfs-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs updates from Namjae Jeon:\n \"New features:\n\n - Implement ioctls to list, read, write, and remove named streams on\n files and directories. Provide optional file:stream pathname access\n through streams_interface\u003dwindows, exposing streams as regular file\n descriptors with support for mmap, locking, truncation, and\n allocation.\n\n - Support file attribute queries and updates through FS_IOC_GETFLAGS\n and FS_IOC_SETFLAGS. Store immutable, append-only, nodump, and\n noatime settings in the private $LINUXFLAGS extended attribute and\n restore them when loading inodes. Also report compression,\n encryption, and the mount-wide case-folding policy as read-only\n attributes.\n\n Other changes:\n\n - Expose the existing NTFS volume serial number through FS_IOC_GETFSUUID\n by registering it as an eight-byte filesystem identifier.\n\n - Validate MFT I/O geometry and write MFT records and mirror data\n through mapped I/O units, keeping neighboring records intact when\n multiple records share a native 4Kn block. Track folio writeback\n until all BIOs complete, serialize raw record updates against\n writeback, and use the caller\u0027s requested completion mode.\n\n - Discard stale uninitialized cache data before extending initialized\n size, ensure shared mmap writes update initialized size after\n native 4Kn size extension, and synchronize attribute inode sizes\n after internal resizes. Keep VFS and NTFS sizes consistent when\n write-error rollback fails and record the volume error.\n\n - Wait for existing folio writeback before updating attribute data,\n require page alignment for full-page write optimizations, and\n include the final partial cluster in synchronous writes. Skip\n duplicate VFS page-cache truncation under the MFT record lock to\n avoid a truncate and writeback deadlock.\n\n - Restart allocation zone searches after failed hints and prevent\n contiguous allocation requests from returning additional disjoint\n runs that callers leave uninitialized. Allow fallocate after\n MFT-zone exhaustion and interrupt allocation loops only for fatal\n signals, avoiding spurious interruptions from io_uring task-work\n notifications.\n\n - Wait for the initial bitmap scan before extending the MFT bitmap,\n bound direct allocation candidates by the volume size, update\n free-space accounting, and undo only newly allocated clusters after\n run coalescing. Update attribute-list inode size before reserving\n additional space.\n\n - Hold runlist locks while expanding non-resident attributes, balance\n locks during MFT extension error handling, and avoid pointers\n invalidated by runlist reallocation. Keep source runlists available\n for rollback and allocate enough room for runlist markers and\n terminators.\n\n - Return errors for unmappable runlist fragments instead of treating\n them as holes or delayed allocation. Check non-resident attribute\n sizes against their allocation and fail mounts when $MFT needs\n extent records outside the decoded runlist to describe itself,\n preventing silent zero reads and mount hangs.\n\n - Load and validate $BadClus:$Bad at mount time and reserve known bad\n clusters before the free-space scan. Fall back to read-only\n operation when bad-cluster metadata cannot be validated and prevent\n subsequent read-write remounts.\n\n - Serialize volume flag updates and retain the dirty bit after\n metadata changes while the volume remains mounted read-write.\n Persist recorded errors after final metadata commits, fail ordinary\n read-only remounts on sync, commit, or flush errors, and retain the\n dirty bit on forced remounts.\n\n - Flush the device write cache when syncing directories and report\n flush failures from both file and directory fsync. Drain in-flight\n direct I/O before buffered write fallback and keep nonblocking\n requests from entering the blocking fallback path.\n\n - Mount hibernated volumes, or volumes whose hibernation state cannot\n be determined, read-only regardless of the errors\u003d policy. Prevent\n mount-time and dirty-state updates from modifying hibernated\n volumes.\n\n - Validate complete EA chains, link zero-terminated tails when\n appending entries, retain the EA presence flag, and distinguish\n empty values from removal. Propagate lookup, write, and truncate\n errors, restore both EA attributes after failed updates, and shut\n down the volume if restoration fails.\n\n - Restore the previous ACL xattr when a subsequent WSL mode update\n fails, including replacement and removal cases. Record rollback\n failures so an unsuccessful permission change cannot silently leave\n inconsistent ACL and mode state.\n\n - Apply MST fixups to individual index blocks on large-page systems\n and use fixed 512-byte VCN units when an index block is smaller\n than its cluster. Support lookup and removal of POSIX names\n containing Windows-invalid characters and identify directory\n symlinks and junctions during enumeration.\n\n - Report the stored creation time for symbolic links through statx()\n when querying the link itself with AT_SYMLINK_NOFOLLOW.\n\n - Use wider decompression offsets to avoid overflow on 64 KB pages,\n accept the standard sparse compression unit, and require the\n compressed-size field only on the first attribute extent. Block\n direct reads and skip readahead for encrypted files to prevent\n returning raw ciphertext.\n\n - Validate index entry offsets, logfile update sequence array counts,\n attribute-list sizes, and index collation key lengths to prevent\n out-of-bounds accesses, NULL pointer dereferences, and excessive\n allocations from corrupt volume metadata.\n\n - Derive FITRIM bitmap indexes from the page size and retain the full\n 64-bit minimum discard length. Balance highmem mappings in logfile\n and MFT mirror checks and propagate specific errors from extent,\n attribute, and reparse operations.\n\n - Compare streams_interface with the mounted volume\u0027s setting during\n remount, make named-stream UAPI padding explicit, document stream\n access and Linux file attributes, and add the NTFS UAPI header to\n MAINTAINERS\"\n\n* tag \u0027ntfs-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (93 commits)\n ntfs: handle a failed size rollback in the write error path\n ntfs: fix u16 truncation of the update sequence array count check\n ntfs: reject index blocks with a too small entries offset\n ntfs: support persistent noatime attribute\n ntfs: roll back the ACL xattr commit when the WSL mode update fails\n ntfs: report birth time for symbolic links\n ntfs: support FS_IOC_GETFSUUID\n ntfs: avoid unnecessary padding in uapi structure\n ntfs: flush the block device when syncing a directory\n ntfs: report block device flush failures from fsync\n ntfs: fix NULL dereference on index allocation open failure\n ntfs: compare streams_interface with mounted volume on remount\n ntfs: widen the sub-block offsets in ntfs_decompress()\n ntfs: reject direct I/O reads of encrypted files\n ntfs: do not read ahead encrypted files\n ntfs: persist nodump in the $LINUXFLAGS EA\n ntfs: persist append-only in the $LINUXFLAGS EA\n ntfs: persist immutable in the $LINUXFLAGS EA\n ntfs: add fileattr query support\n ntfs: restore EA attributes when an update fails\n ...\n" }, { "commit": "42023dd0a294d8b5c05127dcf95987b70c2fb271", "tree": "67e02680453b4e16ffd7bf9bbf9cbc28290c4353", "parents": [ "4e1b4fdf6113b4eb9564bdf3b76ee3c3132da7d4", "8534eb11ac056dc2ca08007cf76d3ae7cbe42684" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:54:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:54:05 2026 -1000" }, "message": "Merge tag \u0027exfat-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat\n\nPull exfat updates from Namjae Jeon:\n\n - Use the recalculated append position when advancing valid_size, dirty\n all pages involved in valid-data extension, and zero invalid tails on\n partial overwrites. Write-protect the folio spanning the old EOF and\n zero its post-EOF range when extending a file, ensuring subsequent\n mmap writes advance valid_size.\n\n - Make valid_size and zeroed_size atomic to prevent torn reads and lost\n updates. Hold the invalidate lock during truncation, and drain\n in-flight direct I/O before buffered writes, buffered fallback, and\n page-cache operations that extend valid_size.\n\n - Fall back to single-cluster allocation when a buffered write cannot\n allocate its entire range, allowing writes to consume the remaining\n free space and return a short count.\n\n - Free clusters allocated beyond EOF after failed or short writes to\n prevent leaked space and spurious ENOSPC errors on later writes or\n file extensions.\n\n - Clean block-device buffer aliases when allocating clusters so delayed\n directory metadata writeback cannot overwrite file data after cluster\n reuse.\n\n - Update used_clusters as each cluster is allocated so\n partial-allocation cleanup keeps free-space accounting consistent.\n Acquire bitmap_lock before checking available space to serialize the\n check with allocation.\n\n - Use swap-specific iomap operations to report allocated extents beyond\n valid_size as unwritten during swap activation, retaining\n byte-accurate SEEK_HOLE and SEEK_DATA reporting in regular I/O.\n\n - Check allocation flags, vendor GUIDs, cluster numbers, data lengths,\n and contiguous extents in Vendor Allocation directory entries. Read\n complete entry sets during lookup so malformed trailing entries\n cannot bypass validation.\n\n - Follow directory FAT chains to their actual end when the recorded\n size is too small, supporting devices that leave directory sizes\n stale. Handle reads after seeking past the directory end.\n\n - Clear the volume dirty flag during remount only when switching to\n read-only without SB_FORCE. Update percent_in_use when changing\n volume flags, reporting unknown usage while the volume is dirty or\n persistent flags prevent marking it clean.\n\n - Replace runtime division by powers of two with bit operations.\n\n - Document supported mount options, and exfatprogs, and add the\n documentation path to MAINTAINERS.\n\n* tag \u0027exfat-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:\n exfat: fix reading a directory whose FAT chain is longer than its size\n exfat: free clusters beyond EOF when a write fails or is short\n exfat: clean stale bdev buffers of newly allocated clusters\n exfat: mark straddling folio RO and zero the post-EOF range\n exfat: fix a large buffered write failing when the volume is nearly full\n exfat: zero invalid tail on partial overwrites\n exfat: drain in-flight DIO before buffered writes\n exfat: make valid_size and zeroed_size atomic\n exfat: dirty all new pages when extending valid_size\n exfat: hold the invalidate lock while truncating\n exfat: advance valid_size to EOF for append writes\n MAINTAINERS: add exFAT documentation\n exfat: remove runtime integer division\n exfat: update percent_in_use field when updating volume flags\n exfat: clear the volume dirty flag only when remounting read-only\n exfat: doc: add documentation\n exfat: validate vendor allocation directory entries\n exfat: take bitmap_lock at the start of exfat_alloc_cluster()\n exfat: fix used_clusters accounting during cluster allocation\n exfat: map allocated extents for swap activation\n" }, { "commit": "4e1b4fdf6113b4eb9564bdf3b76ee3c3132da7d4", "tree": "0f88f96f5977b697047fd793ed8f86a982a10252", "parents": [ "9e089e670e9ad1caf4a5b2b63e01b2dc076efbe3", "2c36c4a86104d763ee798d4a89e2d3384b4cd626" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:47:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:47:41 2026 -1000" }, "message": "Merge tag \u0027ksmbd-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server updates from Namjae Jeon:\n\n - Add extended SMB2 directory information support.\n\n Implement FileIdExtdDirectoryInformation, FileId64ExtdDirectoryInformation,\n FileId64ExtdBothDirectoryInformation, FileIdAllExtdDirectoryInformation,\n and FileIdAllExtdBothDirectoryInformation, including reparse tags, file\n attributes, and initialized response padding.\n\n - Track unsigned 64-bit lock ranges in the server lock index, with\n conflict detection, blocking waits, cancellation, rollback, and\n cleanup for ranges beyond the VFS signed-offset limit.\n\n - Add configurable per-connection session limits.\n\n Reserve slots for new sessions and multichannel bindings, release\n them during failure and cleanup, and expose the configured limit\n through procfs.\n\n - Validate POSIX negotiate and CREATE contexts, including payload\n lengths, extension tags, duplicate contexts, dialect\n requirements, and share eligibility. Require POSIX opens for\n POSIX file, directory, and filesystem information queries.\n\n - Apply requested POSIX create modes, including mode zero, and NFS\n mode ACEs with special permission bits. Enforce append-only\n writes and base byte-range lock checks on each open\u0027s POSIX\n state.\n\n - Complete POSIX metadata responses with filenames, file types,\n permission bits, and filesystem device identifiers. Query\n filesystem information through the requested open and report the\n filesystem fragment size and response length.\n\n - Validate SMB3 encryption transform flags and ensure decrypted\n compound requests use the session authenticated by the transform,\n including requests containing compressed payloads.\n\n - Serialize negotiation with receive processing, size CREATE\n responses for their contexts, reserve UTF-16 terminator space in\n stream information, and validate WRITE data against the active\n compound request to prevent buffer overruns and stale-data\n writes.\n\n - Validate security descriptor offsets before pointer arithmetic,\n handle DACL offset overflow on 32-bit systems, and propagate\n inode ACL lookup failures safely.\n\n - Deny access through empty DACLs while retaining the owner\u0027s\n implicit security-management rights. Add KUnit regression\n coverage for DACL walk boundaries and maximal-access\n calculations.\n\n - Validate RPC pipe ownership for IPC$ reads and writes, and fix\n FSCTL_PIPE_TRANSCEIVE handle lookup and response file IDs.\n\n - Fix durable reconnect path validation for symlinked share paths,\n shares exporting \"/\", and handles opened at the share root. Check\n path boundaries before comparisons to prevent out-of-bounds reads\n and cross-share confusion.\n\n - Rebind completed durable CREATE replays to surviving channels\n without draining unrelated requests on the old channel. Transfer\n open accounting with the binding and avoid consuming additional\n open-file budget during durable reconnects.\n\n - Scope AppInstanceId takeovers to the matching share, path,\n stream, and client identity. Check access and AppInstanceVersion\n before closing an existing open.\n\n - Retry oplock and lease break notifications through other live\n channels, track queued TCP delivery, serialize acknowledgment\n updates, and expire unacknowledged breaks while waking blocked\n requests.\n\n - Keep lease tables and byte-range lock indexes independent of\n their original connection so surviving channels and detached\n durable opens retain access to lease and lock state.\n\n - Reclaim ended sessions after logoff and expiration, hold\n connection references for session channels, and drain procfs\n readers before releasing session table references. Avoid\n deadlocks during previous-session teardown and connection\n scavenging.\n\n - Prevent file publication after tree disconnect and retain tree\n references until final file release. Take parent dentry\n references during directory enumeration and serialize directory\n emptiness checks with readdir.\n\n - Prevent share-root removal through empty removal paths and return\n appropriate errors for directory zero-data requests and temporary\n directory attributes.\n\n - Fix named-stream writes, EOF changes, end-of-file reads, and\n content copying into rename targets. Reuse existing xattr names,\n report sizes by exact xattr name, and avoid emptying streams\n after lookup or permission failures.\n\n - Round allocation requests to the advertised allocation unit and\n avoid allocation changes that leave on-disk EOF inconsistent with\n the in-memory size.\n\n - Inherit FileIds across related compound requests, including\n CHANGE_NOTIFY, and use the existing async request machinery for\n notify waiting and cancellation.\n\n - Restore share configuration and Kerberos authentication\n compatibility with released ksmbd-tools. Advertise extended\n session security for raw NTLMSSP when requested by the client.\n\n - Improve Windows chained-compression compatibility, synthesized\n AFP_AfpInfo headers, generated short names, and UTF-16 alignment\n in partial normalized-name responses.\n\n - Fix interface-query locking, response chaining, link-speed\n reporting, and independent IPv4/IPv6 address enumeration. Display\n native IPv6 client addresses accurately in procfs.\n\n - Improve SMB Direct socket cleanup by reclaiming failed pending\n connections, skipping failed sockets during accept, avoiding\n indefinite disconnect waits, and handling unexpected receive\n opcodes without triggering kernel warnings.\n\n - Select CRYPTO_AES for SMB3 encryption, replace deprecated system\n workqueues, and update feature status documentation and POSIX\n specification references.\n\n* tag \u0027ksmbd-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: (95 commits)\n ksmbd: select CRYPTO_AES\n ksmbd: prevent share root removal through empty paths\n ksmbd: serialize directory emptiness checks with readdir\n ksmbd: fix parent dentry lifetime in directory enumeration\n smb/server: prevent file publication after tree disconnect\n ksmbd: restore Kerberos logins with released ksmbd-tools\n smb/server: replace deprecated system workqueues\n ksmbd: reject FILE_ATTRIBUTE_TEMPORARY on directories\n ksmbd: deny access for an empty DACL instead of granting the request\n ksmbd: reject foreign RPC pipe handles on IPC$ read and write\n ksmbd: fix fd_limit accounting across durable reconnects\n ksmbd: drain session procfs readers before dropping table references\n ksmbd: reclaim ended sessions on logoff and expiration\n ksmbd: limit sessions on each connection\n ksmbd: hold a connection reference for each session channel\n ksmbd: defer connection scavenging while session locks are busy\n ksmbd: accept share config responses from ksmbd-tools before 3.5.3\n ksmbd: round SetAllocation to the advertised allocation unit\n ksmbd: avoid restoring only in-memory EOF after allocation change\n ksmbd: inherit FileIds in related compound requests\n ...\n" }, { "commit": "9e089e670e9ad1caf4a5b2b63e01b2dc076efbe3", "tree": "f3523bd659e35bd2dfae3c167ad336d0a612a8ea", "parents": [ "47439bb1635e8dd9245e876c2046b66a9b6f9400", "ef30b3efb7e8bae94d790a6503a595e1051323e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:42:16 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:42:16 2026 -1000" }, "message": "Merge tag \u0027nfs-for-7.4-1\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull nfs client updates from Anna Schumaker:\n \"New Features:\n - Modernize the direct I/O path\n - Size the LAYOUTGET reply buffer for wide flexfiles layouts\n - Flexfiles device notifications and caching for wide striped layouts\n - isolate mTLS client credentials by network namespace\n\n Bugfixes:\n - Various localio, flexfiles, xprtrdma, and TLS fixes\n - Merged bugfixes from Trond that he was unable to send during the 7.3-rc cycle\n\n Other Cleanups and Improvements:\n - Split up pNFS block layout and SCSI layout support\"\n\n* tag \u0027nfs-for-7.4-1\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs: (68 commits)\n nfs/localio: pin UUIDs during global invalidation\n NFSv4/flexfiles: fail I/O to the data server once a lock is lost\n pNFS/flexfiles: don\u0027t report an interrupted DS connect as a DS error\n pNFS/flexfiles: make pg_init retry loops killable\n nfsv4/pnfs: use the MDS authflavor for data server connections\n xprtrdma: trim head iovec when the payload arrives via a Write chunk\n nfs: set gencount on protocol-specific remove\n xprtrdma: prevent disconnect feedback during endpoint teardown\n NFS: add a key type that reveals the namespace .nfs keyring serial number\n NFS: name the namespace .nfs keyring in the x509 handshake\n SUNRPC: pass a keyring serial number to the TLS handshake\n NFS: allocate the .nfs keyring per network namespace\n NFS: name the init_nfs_fs() error labels\n NFS: return DENIED in decode_lock_denied if we cannot decode owner\n pNFS/flexfiles: don\u0027t reset to MDS for v4 error when previous layout forbid it\n pNFS/flexfiles: don\u0027t read through MDS when previous layout forbid it\n pNFS/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS over the mdsthreshold hint\n NFS/localio: report the stability a DIO WRITE actually has\n NFS/localio: detect a short read or write before the iterator has moved\n NFS/localio: fix nfs_local_dio_misaligned tracepoint\n ...\n" }, { "commit": "47439bb1635e8dd9245e876c2046b66a9b6f9400", "tree": "088897bd5ce1e1365f4cbd4c258cb8fd58862e1b", "parents": [ "9206d6c40b52fab9bd59e8a8f7dd2d9a68d71a21", "eafb6de800781f0a1be5cdd98d150620041d8b27" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:12:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:12:41 2026 -1000" }, "message": "Merge tag \u0027nfsd-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd updates from Chuck Lever:\n \"Jeff Layton extended the netlink listener-set operation so that\n a management daemon can register NFSD\u0027s programs with rpcbind\n itself. This prevents an unresponsive rpcbind from stalling NFSD\n administration for a minute at a time.\n\n Bulk delegation recall now adjusts the number of delegations it\n wants returned, based on memory pressure. The previous mechanism\n was spec-conformant, but it requested all delegations to be\n returned at once. Clients are free to return few or none in such\n cases, but requesting smaller batches of delegations is more\n neighborly.\n\n In preparation for handling TLS KeyUpdate, the server\u0027s TCP\n receive path has been reworked to handle control records. In the\n process, the use of sock_recvmsg was replaced with -\u003eread_sock,\n which contends less with other holders of the socket lock.\n\n NFSv2 XDR code is now generated by xdrgen, which mechanically\n generates the encoders and decoders from the RPC language\n specification for the protocol. Replacing hand-built XDR code\n makes prototyping new protocol elements faster, reduces errors,\n and improves memory safety. Replacement of XDR code for newer NFS\n versions will continue in subsequent releases of NFSD.\n\n The remaining bulk of changes in v7.4 is bug fixes, clean-ups, and\n small optimizations. Sincere thanks to all contributors,\n reviewers, testers, and bug reporters who participated in the v7.4\n NFSD development cycle\"\n\n* tag \u0027nfsd-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (184 commits)\n SUNRPC: use assign_bit() where applicable\n nfsd: Fix id-to-name cache entry leak in idtoname_parse()\n NFSD: Use xdrgen XDR functions for NFSv2 READDIR results\n NFSD: Refactor NFSv2 directory cookie encoding\n NFSD: Add a streaming directory reader\n NFSD: Use xdrgen XDR functions for NFSv2 READDIR arguments\n NFSD: Use xdrgen XDR functions for the NFSv2 STATFS procedure\n NFSD: Use xdrgen XDR functions for NFSv2 RMDIR procedure\n NFSD: Use xdrgen XDR functions for NFSv2 MKDIR procedure\n NFSD: Use xdrgen XDR functions for NFSv2 SYMLINK procedure\n NFSD: Use xdrgen XDR functions for the NFSv2 LINK procedure\n NFSD: Use xdrgen XDR functions for the NFSv2 RENAME procedure\n NFSD: Use xdrgen XDR functions for the NFSv2 REMOVE procedure\n NFSD: Use xdrgen XDR functions for NFSv2 CREATE procedure\n NFSD: Refactor nfsd_proc_create()\n NFSD: Use xdrgen XDR functions for NFSv2 WRITE procedure\n NFSD: Use xdrgen XDR functions for the NFSv2 WRITECACHE procedure\n NFSD: Use xdrgen XDR functions for NFSv2 READ procedure\n NFSD: Use xdrgen XDR functions for NFSv2 READLINK procedure\n NFSD: Use xdrgen XDR functions for the NFSv2 LOOKUP procedure\n ...\n" }, { "commit": "9206d6c40b52fab9bd59e8a8f7dd2d9a68d71a21", "tree": "2b575a8241bb39d1e0115fc33fc1759b140180e6", "parents": [ "21a7f44fd0765fcc5194130b28767786eba1d1e7", "2bc09cb0e9e44c7e622b956332ebfb9b638fd5f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:07:49 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 25 15:07:49 2026 -1000" }, "message": "Merge tag \u0027for-linus-7.4-ofs1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux\n\nPull orangefs updates from Mike Marshall:\n\n - Don\u0027t continue on to gpf if client dies on write.\n\n If the orangefs userspace client died while writeback was\n occurring it led to a gpf. This allows the kernel to finish\n the writeback. Reported by Farhad Alemi.\n\n - Don\u0027t wait on service operation on system shutdown\n\n This avoids waiting an already dead userspace to process an\n unmount operation if the system is shutdown while orangefs\n filesystems are still mounted.\n\n - Use ssize_t instead of size_t for error codes...\n\n This fixes a situation where an unsigned variable was being\n used to collect a string size, or possibly a negative error\n code. Reported by lkp@intel.com\n\n* tag \u0027for-linus-7.4-ofs1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:\n orangefs: don\u0027t continue on to gpf if client dies on write.\n orangefs_super: don\u0027t wait on service operation on system shutdown.\n orangefs: use ssize_t instead of size_t for error codes...\n" }, { "commit": "52dceb88082b4c7983d1c8c7de1c181f018055ac", "tree": "0b86fdaeea623aac6cd27e0d258bae41587c83d2", "parents": [ "7259fb011c14977661b7a4680886b466a3089ea7" ], "author": { "name": "Hengyu Liang", "email": "hengyul@cs.unc.edu", "time": "Fri Oct 23 15:00:51 2026 -0400" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Sun Oct 25 12:54:43 2026 +0100" }, "message": "erofs: fix metadata reads at the end of file-backed images\n\nCommit e587a984d332 (\"erofs: use dedicated meta inodes for file-backed\nmounts\") made erofs_read_meta_folio() read the metadata of a\nfile-backed mount one whole folio at a time.\n\nHowever, an image only has to be a multiple of its block size. With a\nblock size below the page size, it can end in the middle of a page. The\nread of that last page is then short, and erofs_fileio_ki_complete()\nfails it with -EIO. As of now, inodes in the last page of such an image\ncannot be read, and an image smaller than a page cannot be mounted.\n\nThe issue can be reproduced with util-linux 2.41, whose mount uses the\nimage file directly:\n\n mkdir src\n for i in $(seq 50); do echo $i \u003e src/$i; done\n mkfs.erofs -b512 test.erofs src\n mount -t erofs test.erofs /mnt\n ls -l /mnt\n\nBefore that commit, ls -l lists all 50 files. After it, ls -l reports\n\"Input/output error\" for 24 of them.\n\nThis patch reads the folio only up to the end of the backing file and\nzeroes the rest, as the page cache of the backing file did before. A\nfolio that lies wholly past the end is zeroed without a read.\n\nFixes: e587a984d332 (\"erofs: use dedicated meta inodes for file-backed mounts\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nReviewed-by: Gao Xiang \u003cxiang@kernel.org\u003e\nSigned-off-by: Gao Xiang (Docker) \u003cxiang@kernel.org\u003e\n" }, { "commit": "7259fb011c14977661b7a4680886b466a3089ea7", "tree": "f21ba9cc59d1221d013cb49a8102e3421f4b0219", "parents": [ "1137aa577a35e2684e8046c3e53f920e79c7cc60" ], "author": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Sat Oct 24 21:20:28 2026 +0200" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Sun Oct 25 12:54:28 2026 +0100" }, "message": "erofs: hold real inodes for shared files\n\nEROFS page cache sharing uses shared inodes. However, a mmaped VMA\nkeeps the shared file even after the corresponding fd is closed, while\ncurrently the real inode is never held by any reference associated\nwith the shared file.\n\nAs a result, the real inode could be evicted and removed from the\nshared inode\u0027s list while the page fault can still invoke on the\nshared inode\u0027s address space, which causes no candidate is\nsuccessfully acquired by erofs_real_inode().\n\nFix this by simply keeping the original inode in the shared backing\nfile\u0027s private data.\n\nAlso replace confusing \"realfile\"/\"rf\" names with \"sf\" (sharedfile)\nto unify the terms as well as nullify realinode in erofs_real_inode()\nto avoid returning an uninitialized pointer.\n\nFixes: 5ef3208e3be5 (\"erofs: introduce the page cache share feature\")\nReported-by: YoungWoo Rim \u003cxsapiens75@gmail.com\u003e\nCloses: https://lore.kernel.org/r/atzSVuvqYKgmvDmO@MacBookPro\nCc: stable@vger.kernel.org # 7.0+\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nSigned-off-by: Gao Xiang (Docker) \u003cxiang@kernel.org\u003e\n" }, { "commit": "21a7f44fd0765fcc5194130b28767786eba1d1e7", "tree": "fd0caac36e8ce4eb477f0d3aa37655fe94ba09e4", "parents": [ "89d2d7bf0698b7fdfc914bfd219e739e9308d332", "e8ff9af18e80279b80cf7063244db91b12f5e27e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:11:23 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:11:23 2026 -1000" }, "message": "Merge tag \u0027devicetree-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree updates from Rob Herring:\n\n - A bunch of improvements in dt-check-style. Fix various bindings based\n on these additional checks.\n\n - Convert hisilicon,hix5hd2-ir, hisilicon,hi6220-ade,\n hisilicon,hi6220-dsi, hisilicon,hip05-sas-v1, MediaTek RT5650 codecs,\n mediatek,g3dsys, mediatek,mt2701-scpsys, ti,omap-mpu, and\n ti,omap-ocp2scp to DT schema format\n\n - Add schemas for ST STM32MP2 DWC3 xHCI USB, ST STM32MP25 USB2-FEMTO\n PHY, spacemit,k1-gpu and spacemit,k3-gpu, HiSilicon local bus,\n HiSilicon HIP05 CPLD, SDMC DM2016, and QCom SM7250 and Kuno PDC\n\n - Various binding updates to fix schema warnings in .dts files\n\n - Drop obsolete .txt bindings for STM32(MP1) RCC, VExpress hwmon and\n regulator, and mailbox.txt\n\n - Remove the unused of_overlay_remove_all() function\n\n - Fixes for of_check_msi_parent()\n\n - Add \"i2c-parent\" tracking to fw_devlink\n\n* tag \u0027devicetree-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (72 commits)\n dt-bindings: usb: dwc3: Document ST STM32MP2 DWC3 xHCI USB controller\n dt-bindings: iommu: Describe MT8195 infra IRQs\n dt-bindings: clock: mediatek: Add MT8516 fallbacks\n dt-bindings: media: Convert hisilicon,hix5hd2-ir to DT schema\n dt-bindings: display: Convert hisilicon,hi6220-ade to DT schema\n dt-bindings: display: Convert hisilicon,hi6220-dsi to DT schema\n dt-bindings: phy: Document ST STM32MP25 USB2-FEMTO PHY\n of: overlay: remove unused of_overlay_remove_all()\n dt-bindings: power: Convert mediatek,mt2701-scpsys to DT schema\n dt-bindings: bus: Add HiSilicon local bus\n dt-bindings: gpu: img,powervr-rogue: add spacemit,k1-gpu and spacemit,k3-gpu\n dt-bindings: interrupt-controller: qcom,pdc: Document SM7250 PDC\n dt-bindings: vendor-prefixes: add Ambarella\n dt-bindings: reset: Drop obsolete STM32(MP1) RCC bindings\n dt-bindings: arm: keystone: ti,sci: Correct reg and mboxes constraints\n dt-bindings: ASoC: Convert MediaTek RT5650 codecs bindings to DT schema\n dt-bindings: scsi: Convert hisilicon,hip05-sas-v1 to DT schema\n of/irq: Stop the MSI walk at the first msi-parent\n of/irq: Fix device node refcount leak in of_check_msi_parent()\n dt-bindings: display: faraday,tve200: Use a level-high interrupt\n ...\n" }, { "commit": "89d2d7bf0698b7fdfc914bfd219e739e9308d332", "tree": "d568e43e3d67daccda400e6e4c720b65b1e1718a", "parents": [ "9628ee0c2219daaa6374b0c5f5a5c0d55e0e263b", "2c493ac8c347167eec9e4e985d2b58d5fa6fd420" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:07:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:07:00 2026 -1000" }, "message": "Merge tag \u0027efi-next-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI updates from Ard Biesheuvel:\n\n - Set the LoaderDevicePartUUID EFI variable from the stub to help\n systemd discover the file system layout when booting straight into\n Linux without GRUB or systemd-boot (Vincent Mailhol)\n\n - Some GUID deduplication work from Vincent\n\n - Remove pointless UTF16-\u003eUTF8 and vice versa conversions from the stub\n\n - Some kmap() -\u003e kmap_local_page() conversions in the capsule loader\n\n - Add a runtime control to en/disable EFI runtime services so that\n PREEMPT_RT systems can enable them as needed\n\n - Add a \u0027nostatfs\u0027 mount option to efivarfs so that the cost of\n querying the EFI variable store (which is already rate limited) can\n be avoided entirely on systems where it is disproportionately costly\n\n - Rework the EFI libstub Makefile to align x86 with other\n architectures, and inherit/adapt the global CFLAGS variable rather\n than reconstruct it from scratch\n\n - Constify attributes of statically allocated sysfs nodes\n\n - Avoid register x18 when building the arm64 EFI stub, in order to\n comply with the UEFI spec, and to permit it to execute in a context\n where x18 is special\n\n - Preserve the physical addresses of all EFI config tables that may be\n of interest to an incoming kexec kernel\n\n - Add some LKDTM tests for EFI runtime crashes where the faulting\n address is inside a EFI memory region\n\n - Other minor bug fixes and cosmetic cleanups\n\n* tag \u0027efi-next-for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (35 commits)\n lkdtm: Add more EFI runtime tests\n efi: Initialize all configuration table addresses to EFI_INVALID_TABLE_ADDR\n efi: Retain the address of the LINUX_EFI_MEMRESERVE table\n efi/libstub: Don\u0027t replace an existing LINUX_EFI_MEMRESERVE table\n efi/runtime-wrappers: Don\u0027t park the worker after a recovered firmware fault\n efi: Use sysfs_emit() not sprintf() to generate sysfs file contents\n efi: Constify sysfs attributes\n efi/libstub: Disable kernel stack erasing in the common flags\n efi/libstub: Build the x86 stub from KBUILD_CFLAGS\n efi/libstub: Declare the x86 stub\u0027s assembly entry points\n efi/libstub: arm64: Don\u0027t use the platform register x18\n efi/libstub: Free cmdline_ptr in efi_pe_entry\n efi/riscv: libstub: Don\u0027t set image_size in handle_kernel_image()\n efi/libstub: Fix error unwind freeing fdt in allocate_new_fdt_and_exit_boot()\n efivarfs: add nostatfs mount option to skip QueryVariableInfo()\n efi/libstub: add initial Boot Loader Interface support\n efi/libstub: Add efi_snprintf() to construct wide strings\n efi/libstub: Add support for printing human readable GUIDs\n efi/libstub: Output UTF-16 directly from vsnprintf()\n efi/libstub: Avoid efi_puts() for compile time constant strings\n ...\n" }, { "commit": "9628ee0c2219daaa6374b0c5f5a5c0d55e0e263b", "tree": "43c5168bdacd79bd2f2356d2902b82db4e5e877e", "parents": [ "44388c8f3e22b578c9089df53301ef7e53e7fb01", "dae739137441667d67fbfcc4d303a0ecc6618662" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:02:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 20:02:48 2026 -1000" }, "message": "Merge tag \u0027gpio-fixes-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - add ACPI quirks for Thinkpad L13 Gen 2a and Acer Nitro 16S AI to\n ignore a wrong GPIO interrupt declaration\n\n - add missing return value check of devm_gpiochip_add_data() to\n gpio-lpc32xx\n\n - don\u0027t set GPIOD_FLAG_IS_OUT from character device code as GPIO core\n already does it where needed and it can lead to providing invalid\n info to user-space on request errors\n\n - don\u0027t report a bogus -ENOMEM for a line requested without a label\n\n - propagate errors occurring when setting line values for pins for\n which we emulate open-drain or open-source drive settings\n\n - fix interrupt handling bugs in gpio-pca953x and gpio-davinci\n\n - fix more memory leaks in GPIO core\n\n - clear event clock flags from pins on GPIO release\n\n* tag \u0027gpio-fixes-for-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpiolib: don\u0027t report -ENOMEM for a requested line without a label\n gpiolib: Propagate emulated drive errors when setting arrays\n gpio: pca953x: Handle direction register read errors in IRQ paths\n gpio: pca953x: Preserve wakeup accounting on parent IRQ failure\n gpio: davinci: Clear interrupt status in every bank on suspend\n gpiolib: Free chip resources when allocating the label fails\n gpiolib: cdev: don\u0027t set GPIOD_FLAG_IS_OUT\n gpiolib: clear the event clock flags when a line is released\n gpiolib: fix memory leak in gpiod_set_array_value_complex() EPERM error path\n gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro 16S AI\n gpio: lpc32xx: check devm_gpiochip_add_data() return value\n gpiolib: acpi: Ignore GPIO 11 interrupt on ThinkPad L13 Gen 2a\n" }, { "commit": "44388c8f3e22b578c9089df53301ef7e53e7fb01", "tree": "77c4a6f6237cdb483cc471a01cc500406fdcd553", "parents": [ "a8c2facb7b2cef4d110e3b25037bc29703485c71", "0ef71adafaa9b36a06dd5b823aebcd2fa9b9b9c2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:49:58 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:49:58 2026 -1000" }, "message": "Merge tag \u0027mtd/for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull MTD updates from Miquel Raynal:\n \"Core MTD:\n - Fixes to the virt-concat driver\n - Added INT0800 firmware-flash map driver\n - mtdblock: prevent reclaim I/O during request processing\n - cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device\n\n Raw NAND:\n - Clean up the Qualcomm controller driver again\n - Improve / create Arasan and IBM\n - Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken\n timings feature on GD9FU2G8F3A\n - Drop platform data support from the lpc32xx drivers\n\n SPI NAND:\n - Heyangtek uses two bytes for the BBM like every other device\n - Winbond: Add support for W25N04LW and W25N08LW\n - Support for ISSI SPI NAND flashes\n\n SPI NOR:\n - Support for new Macronix and (lots of) Winbond flash devices\n - Rewrite the status register handling. There were many small helper\n functions to enable quad I/O mode in many different ways. That\u0027s\n now consolidated in one generic function.\n - Rework the SFPD handling. It used to be only parsed for flashes\n present in the in-kernel database which had any of the multi-I/O\n bit set - or with the addition of generic flash driver for any\n unknown flashes. This left a gap where SFDP wasn\u0027t handled and it\n turns out newer flashes (with SFDP support) will reused IDs of just\n these old flashed. With the rework, SFDP is tried to be parsed for\n any flashes and will amend the information which is already present\n in the in-kernel database.\n - Increase SFDP size limit to 16KiB. There are flashes which have\n some larger gaps between tables and thus exceeds the former 4KiB\n limit.\n - Flash fixups are getting more and more common. Due to this, the\n fixups are now a separate list (per manufacturer) instead of being\n attached to a specific flash. A new .match() callback makes them\n more flexible, when one is applied.\n - Support 1-1-8 and 1-8-8 modes with larger flashes which need 4byte\n addresses\n\n Then there is the load of API updates and misc AI fixes\"\n\n* tag \u0027mtd/for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (155 commits)\n mtd: spi-nor: sfdp: reduce stack usage in spi_nor_parse_sfdp()\n mtd: spi-nor: sfdp: fix missing kernel-doc\n mtd: parsers: qcom: fix offset/size overflow on large partitions\n mtd: spinand: heyangtek: Reserve both bad block marker bytes\n mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface()\n mtd: nand: use dmaengine_submit() instead of -\u003etx_submit()\n dt-bindings: mtd: convert IBM NDFC binding to YAML\n mtd: rawnand: fsl_ifc: allocate shared ctrl with devm_kzalloc\n mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()\n mtd: rawnand: qcom: move common code to the \u0027qpic_common\u0027 module\n mtd: rawnand: qcom: rename \u0027nand_stats\u0027 structure\n mtd: rawnand: qcom: make nandc_set_read_loc_last() more generic\n mtd: rawnand: qcom: make nandc_set_read_loc_first() more generic\n mtd: rawnand: qcom: make config_nand_cw_write() more generic\n mtd: rawnand: qcom: make config_nand_page_write() more generic\n mtd: rawnand: qcom: make config_nand_page_read() more generic\n mtd: rawnand: qcom: make check_flash_errors() more generic\n dt-bindings: mtd: arasan: Add \"power-domains\" for ZynqMP\n mtd: virt-concat: unlink discarded items before freeing\n mtd: virt-concat: unlink concat node before freeing it\n ...\n" }, { "commit": "a8c2facb7b2cef4d110e3b25037bc29703485c71", "tree": "7de712b46fddd7bddc14c3ee2a0425a22b38badc", "parents": [ "a32e63a613aa80dfdb9acc0a09efab940e96054f", "f33a24cc012d34f25bb9942681bd478a1757b806" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:44:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:44:48 2026 -1000" }, "message": "Merge tag \u0027pinctrl-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control updates from Linus Walleij:\n \"Nothing special really, some new drivers, the usual trickle of fixes.\n\n Oddly not even vary many LLM-assisted fixes, I guess they haven\u0027t\n found their way into this subsystem yet.\n\n Core changes:\n\n - Support input-debounce-ns pin config property.\n\n New drivers:\n\n - Qualcomm:\n - Hawi SoC TLMM and LPASS LPI TLMM\n - Kuno (ARM32!) SoC TLMM\n - MSM8952 SoC TLMM\n - PMAU0102 SPMIO GPIO\n\n - Starfive JHB100 SoC sys0, sys0h, sys1, sys2, per0, per1,\n per2 per2pok and per3 (apparently strongly modularized silicon)\n\n - Ambarella CV75\n\n - Apple T8140 SoC used in iPhone 16 [Pro] and MacBook Neo\n\n - Econet EN7528\n\n - Allwinner Sunxi A733\n\n - Mediatek MT6735\n\n Improvements:\n\n - Renesas RZ/3GL: SD channel PoC, I2C power source etc\n\n - The SCMI pin controller uses generic helpers for handling\n groups and functions\"\n\n* tag \u0027pinctrl-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (106 commits)\n pinctrl: stm32: program the EXTI mux from .alloc instead of .activate\n pinctrl: stm32: Fix the unit of the hwspinlock timeout\n pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()\n dt-bindings: pinctrl: brcm,nsp-gpio: Convert to DT schema\n pinctrl: mediatek: Add MT6735 pinctrl driver\n dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Add bindings for MT6735 pin controller\n dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Document MT6765 pin controller\n dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Add MT6795\n dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Improve pinctrl subnode and property descriptions\n dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Pull pinctrl node changes from MT6795 document\n pinctrl: tegra: xusb: free maps on DT map failure\n pinctrl: sprd: free maps on DT map failure\n pinctrl: kconfig: Select generic pinctrl helpers for scmi pinctrl\n pinctrl: scmi: Replace pinctrl ops get group info with generics\n pinctrl: scmi: Replace pinmux ops get function info with generics\n pinctrl: ambarella: fix NULL vs IS_ERR() bug in amb_pinctrl_register()\n pinctrl: starfive: fix missing CONFIG_OF dependencies\n pinctrl: ambarella: add CONFIG_OF dependency\n pinctrl: apple: Add t8140-pinctrl support\n dt-bindings: pinctrl: apple,pinctrl: Add t8140 compatible\n ...\n" }, { "commit": "a32e63a613aa80dfdb9acc0a09efab940e96054f", "tree": "67752eeb602e5fab1777df29b7d23f4191bd4635", "parents": [ "065af32bd4c4be5907ef45660cde59f13be08246", "f57202d55333f750a18e21c3b3f35f48ef14a61e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:42:04 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:42:04 2026 -1000" }, "message": "Merge tag \u0027input-for-v7.4-rc0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input updates from Dmitry Torokhov:\n\n - Updates to input core to reject parent device overrides on managed\n input devices so devres lifetime management is not split across\n different devices, along with fixes for da7280, drv2665, drv2667, and\n tps6507x-ts that were reparenting managed input devices, and removal\n of redundant parent assignments across multiple drivers\n\n - A fix in input core to always accept EV_SYN events in input_event()\n and input_inject_event() so events seeded before device registration\n are properly flushed by input_sync()\n\n - A fix in matrix-keymap helper to reject keycodes above KEY_MAX and\n prevent out-of-bounds bitmap writes\n\n - Fixes and cleanups for HP GSC PS/2 (gscps2) serio driver to resolve\n race conditions in port list management, ring buffer access, and\n interrupt handling, return IRQ_NONE for unhandled shared interrupts,\n and drop busy-waiting on transmit\n\n - Fixes for maple_keyb driver to correct inverted key press detection,\n implement open and close methods so polling only runs while the\n device is open, and clean up unused driver fields\n\n - Fixes for maplecontrol driver to emit EV_SYN after reporting events,\n only enable axes reported by the controller with corrected hat\n limits, and stop polling and clear the callback on close\n\n - Updates to maplemouse driver to stop polling and clear the callback\n on close and drop redundant driver data cleanup\n\n - Fixes for matrix_keypad driver reverting forced switching of row\n GPIOs to input mode that broke row interrupts on platforms with\n separate GPIO and interrupt pinmux functions, and propagating the\n actual error code from matrix_keypad_build_keymap()\n\n - A fix for st-keyscan driver to keep the interrupt disabled while the\n peripheral clock is gated off to prevent bus faults, along with probe\n error handling improvements\n\n - A fix for mms114 touchscreen driver to disable interrupts before\n synthesizing touch release events during suspend so concurrent\n interrupts do not leave stuck active touch slots\n\n - Updates to xpad driver to support GameSir Nova Lite controller\n\n - A number of updates to device tree bindings, including a new schema\n for Analog Devices AD7147 CapTouch controller, conversion of SiS 9200\n I2C touchscreen binding to DT schema format, and allowing the\n wakeup-source property on Dialog DA9062 onkey\n\n - Other assorted driver cleanups, style fixes, and conversions,\n including switching to named initializers for acpi_device_id tables\n and converting cyttsp5 to DEFINE_SIMPLE_DEV_PM_OPS.\n\n* tag \u0027input-for-v7.4-rc0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (94 commits)\n Revert \"Input: matrix_keypad - force switch rows to input mode\"\n Input: s6sy761 - drop duplicate axis initialization in s6sy761_probe()\n Input: always accept EV_SYN in input_event()\n dt-bindings: input: dlg,da9062-onkey: Allow wakeup-source property\n Input: xpad - add GameSir Nova Lite support\n Input: touchscreen - use named initializers for acpi_device_id\n Input: mouse - cyapa: use named initializers for acpi_device_id\n Input: misc - use named initializers for acpi_device_id\n Input: keyboard - use named initializers for acpi_device_id\n Input: reject parent overrides on managed input devices\n Input: tps6507x-ts - fix input device parent assignment\n Input: drv2667 - fix input device parent assignment\n Input: drv2665 - fix input device parent assignment\n Input: da7280 - fix input device parent assignment\n Input: maple_keyb - remove unused mdev-\u003edriver assignment\n Input: maplecontrol - remove unused mdev-\u003edriver assignment\n Input: maplemouse - remove unused mdev-\u003edriver assignment\n Input: maplecontrol - remove redundant drvdata resetting\n Input: maple_keyb - remove redundant drvdata resetting\n Input: maplemouse - remove redundant drvdata resetting\n ...\n" }, { "commit": "065af32bd4c4be5907ef45660cde59f13be08246", "tree": "538616b6376bb79c5f3da4c979e2a3d158d1c25b", "parents": [ "42e6549eafc66f3648319585680ba0c71c2461da", "06d410ba93d33a6c78e917d54e821355492e3ce4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:39:46 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:39:46 2026 -1000" }, "message": "Merge tag \u0027firewire-updates-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire updates from Takashi Sakamoto:\n\n - Guarantee asynchronous packet and transaction callbacks in process\n context\n\n Both the 1394 OHCI driver and the core transaction layer have been\n changed to guarantee that asynchronous packet and transaction\n callbacks are invoked in process context. In v6.17, the execution\n context depended on the transaction destination: callbacks for\n transactions destined for remote nodes were invoked from a workqueue,\n whereas callbacks for transactions destined for the local node or\n terminated due to internal errors were invoked in the transaction\n initiator\u0027s context.\n\n All such callbacks are now guaranteed to execute in process context,\n eliminating the need to account for different execution contexts when\n implementing callback functions.\n\n - Fill kerneldoc for transaction layer\n\n The above change guarantees a consistent execution context for packet\n and transaction callbacks, making it possible to document their\n execution context in kerneldoc.\n\n - Enable compiler-based context analysis for the transaction layer\n\n The core transaction layer is sufficiently complex that\n compiler-based context analysis can help detect invalid call paths.\n\n - Fix a reference count leak in the cdev layer\n\n A reference count leak was reported when a user space application\n delegated isochronous resource management. This issue has now been\n fixed.\n\n - Add KUnit tests for the configuration ROM parser and generator\n\n In recent years, questions have been raised about how the\n configuration ROM parser and generator handle boundary conditions and\n edge cases. KUnit tests have been added to verify their behavior in\n these situations. KUNIT_STATIC_STUB_REDIRECT is used to stub the\n transaction responder so that it returns the configuration ROM\n contents.\n\n - Misc fixes for kerneldoc and nosy-dump application\n\n* tag \u0027firewire-updates-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (88 commits)\n firewire: core: replace drain_workqueue() with flush_workqueue()\n firewire: core: adjust context_unsafe() usage for lockdep checks\n firewire: core: invoke packet callback from workqueue when removing card instance\n firewire: core: use designated initializer for dummy driver on card removal\n firewire: core: use context analysis to check lock state when scheduling error callbacks\n firewire: core: check precondition when scheduling error callbacks\n firewire: core: use workqueue to cancel all pending transactions on card removal\n firewire: core: reuse helper function for scheduling error callbacks\n firewire: core: don\u0027t disable error work for transaction\n firewire: core: use release/acquire pair when replacing underlying driver on card removal\n firewire: core: add kerneldoc for inbound transaction-related symbols\n firewire: core: add kerneldoc for outbound transaction-related symbols\n firewire: core: use appropriate spinlock variants for transaction-related locks\n firewire: core: narrow the card lock scope when accessing node_id\n firewire: core: use context analysis annotations and lockdep checks for topology map lock\n firewire: core: use context analysis annotations and lockdep checks for split timeout lock\n firewire: core: use context analysis annotations and lockdep checks for transactions lock\n firewire: core: enable context analysis for transaction layer\n firewire: core: add might_sleep() checks to transaction layer\n firewire: core: fulfill kerneldoc for fw_cancel_transaction()\n ...\n" }, { "commit": "42e6549eafc66f3648319585680ba0c71c2461da", "tree": "193b190eeffd9a74add00d8f0ff9e06f32fef8b3", "parents": [ "75c1cb8178fe84403fd95236ddf21754f0a4156c", "d7e7bca7169873b46e857c025c10f3336c1258d8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:27:32 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:27:32 2026 -1000" }, "message": "Merge tag \u0027media/v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media updates from Mauro Carvalho Chehab:\n\n - v4l2 core:\n - improve subdev and pixformat kAPI;\n - fix P010 format info and add Y12 format info;\n - add fwnode_graph_for_each_endpoint_scoped();\n\n - New sensor drivers:\n - Sony IMX576\n - OmniVision OS02G10, OV05C10 and OG0VA1B\n - Samsung S5KJN5\n - Himax HM1246\n\n - Maxim GMSL2/3: add support for MAX9296A, MAX96717, and MAX96724\n\n - Intel IPU6: add support for IPU7, IPU7.5 and IPU8\n\n - NXP: add support for i.MX95 CSI pixel formatter driver\n\n - ITE: add driver for IT6625/IT6626 HDMI bridge\n\n - Qualcomm: add CSI2 3ph DPHY driver\n\n - Rockchip: add rk3576 MIPI capture vicap driver\n\n - STM32 DCMIPP: Add STM32MP25 subdevices\n\n - Lots of driver fixes and cleanups\n\n* tag \u0027media/v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits)\n media: i2c: imx576: Fix line length register\n media: ov05c10: Remove duplicated writes to analogue gain register\n media: ov05c10: Power management fixes\n media: ov05c10: Set reset GPIO high when acquiring it\n media: ov05c10: Small cleanups\n media: maxim-serdes: Disable test pattern generator for now\n media: mc: Keep INTERNAL pad flags just for the kernel, for now\n media: i2c: imx576: select VIDEO_CCS_PLL to repair build error\n media: Documentation: mc: Fix Stream reference\n media: i2c: add imx576 image sensor driver\n dt-bindings: media: i2c: Add imx576 sensor\n media: i2c: maxim-serdes: add MAX9296A driver\n media: i2c: remove MAX96714 driver\n media: i2c: maxim-serdes: add MAX96724 driver\n staging: media: remove MAX96712 driver\n arm64: defconfig: disable deprecated MAX96712 driver\n media: i2c: maxim-serdes: add MAX96717 driver\n media: i2c: remove MAX96717 driver\n media: i2c: add Maxim GMSL2/3 deserializer framework\n media: i2c: add Maxim GMSL2/3 serializer framework\n ...\n" }, { "commit": "75c1cb8178fe84403fd95236ddf21754f0a4156c", "tree": "67ef192f2cd38b0254865ea2afea36a75e9f3e39", "parents": [ "0dfc0090b925243490b5b71bc9a229517cda499a", "ed7995e4ec3789a90e37eb826bfccf43cc85d2fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:16:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:16:20 2026 -1000" }, "message": "Merge tag \u0027sound-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound updates from Takashi Iwai:\n \"The AI flood continues, which brought us a fairly busy development\n cycle again with changes spread across the subsystem, ranging from\n (lots of) core hardening to new platforms and codecs.\n\n Here are some highlights.\n\n ALSA core:\n - PCM: race fixes around channel-map controls, draining/unlink, drop\n sync-stop handling, and DMA buffer delay sync\n - Compress-offload: state and geometry validations, buffer leak fix,\n and stream/card lifetime management\n - Jack: module pinning during debugfs access, control removal race\n fix, and early injection exposure\n - Timer \u0026 sequencer: module pinning for user timers, RCU grace period\n wait on port deletion, UMP bounds fixes\n - Mark OSS sequencer emulation as deprecated\n - RawMIDI: proper disconnect handling and input work drain cleanup\n - Control: fixes for vmaster racy setups and control callback\n serialization, UAF fix on card disconnect\n\n ASoC core:\n - Continued framework refactoring, deployment of\n auto_selectable_formats across codecs and platform DAIs\n - Generic card cleanup: free jack GPIOs on card remove for\n simple-card and audio-graph-card variants\n - SDCA improvements: SimpleJack function type support, library\n helpers, and non-ACPI build support\n - Conversion of deprecated DMA API calls\n\n ASoC SOF:\n - Support for compressed audio playback on SOF IPC4 with Intel TGL+\n - AMD ACP 7.B / 7.F SoundWire and PDM controller support, ASP\n carveout firmware loading\n - Function topology support for Intel I2S machines\n\n ASoC platforms \u0026 codecs:\n - Qualcomm: New QAIF driver for Shikra platform, WCD9378 SDCA codec,\n Nord Ride/RRD and Motorola Edge 30 boards, LPASS macro cache\n converted to maple tree\n - New codec drivers: ESS ES9039Q2M, Nuvoton NAU83G60 amplifier,\n Senary SN624x SoundWire SDCA codec\n - MediaTek / Airoha: New Airoha AN7581 AFE and WM8960 machine\n drivers, extensive clock and error-handling cleanups across\n MediaTek SoCs\n - NVIDIA Tegra: WM8994 machine driver and CS35L45 MDSYNC support\n - Realtek: RT766/RT767, RT721_U, RT718 variants, RT712 GPIO LED\n control\n - Cirrus Logic: CS35L45 MDSYNC support, CS35L56 regmap default tests\n - TI: TAS2573 DSP support in TAS2781, TAS2783 SoundWire fixes\n - Everest Semi: ES8326 standby / HPF controls, ES8389 / ES8375 resume\n fixes\n - Removal of obsolete ST-Ericsson Ux500 MOP500 machine driver\n\n HD-audio:\n - ACPI controller runtime PM suspend/resume support\n - Controller shutdown and unbind race fixes for unsol events and jack\n polling\n - HDMI: High Bit Rate (HBR) audio capability enabled, ELD proc and\n converter bounds checks\n - AW88399 side codec SSID-specific firmware naming and Lenovo Legion\n R9000P enablement\n - Realtek / Conexant / Cirrus / TI quirks for numerous laptops\n (Lenovo, ASUS, HP, Acer, HONOR, Minisforum, MSI, etc.)\n - Creative CA0132 Sound BlasterX AE-5 external RGB LED strip support\n\n USB-audio:\n - Dedicated mixer driver for Audient EVO4\n - Native Instruments Kore controller LCD support and keymap fix\n - Pioneer DJ DDJ-SZ and Roland (OCTA-CAPTURE / QUAD-CAPTURE\n multirate, TD-11) support\n - UAC2/3 mixer unit matrix evaluation and bounds checking\n - Hardening for LINE6 and caiaq drivers against malformed packets and\n races\n - Device-specific quirks for PreSonus, TASCAM, Logitech, Mayflower,\n MOONDROP, Yamaha, etc.\n\n Misc:\n - Auto-cleanup conversion for snd_card_free() and devres migration\n across dozens of legacy PCI, ISA, and Sparc drivers\n - ALSA loopback (aloop) timer lifecycle fixes and new aloop selftest\n - pcmtest driver fixes and kselftest updates\"\n\n* tag \u0027sound-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (924 commits)\n ALSA: hda/realtek: Add mute and mic-mute LEDs for HP ENVY 16 (103c:8be5)\n selftests: ALSA: pcmtest: Compare all captured bytes in ni_capture\n ALSA: usb-audio: Use strscpy() in append_ctl_name()\n ALSA: caiaq: Use strscpy() in snd_usb_caiaq_input_init()\n ALSA: hiface: Use scnprintf() in hiface_chip_create()\n selftests/alsa: Check the aloop PCM Slave controls for a matching playback\n ALSA: aloop: Update the PCM Slave controls for a matching playback\n selftests: ALSA: pcmtest: Make room for the longest fill pattern\n selftests: ALSA: pcmtest: Check the frame count of each transfer\n ALSA: hda/realtek: Fix speakers on COLORFUL L1 Plus\n ALSA: hda/realtek: enable AW88399 on Lenovo Legion R9000P AFR10\n ALSA: line6: Handle period elapsed calls outside the locks\n ALSA: emux: Stop voices before freeing zones in all cases\n ALSA: emux: Fix UAF of soundfont zones at note-on\n ALSA: mtpav: restore negation dropped in guard() conversion\n ALSA: compress: reject restarting an ACTIVE task via origin_seqno\n ALSA: compress: add missing OPEN-state gate to SET_METADATA\n ALSA: compress: reject buffer geometry change on gapless next_track\n ALSA: compress: fix buffer leak on failed SET_PARAMS\n ALSA: hda/realtek: Enable jack detection on Minisforum AI X1\n ...\n" }, { "commit": "0dfc0090b925243490b5b71bc9a229517cda499a", "tree": "5da880dd09d65579c35966af1b1191f79a8bb309", "parents": [ "330517c63aa9b48227b6ab45f01003effac77ae4", "61e1a43ca5825acb137a10ac7d52746632bfb124" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:11:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 19:11:27 2026 -1000" }, "message": "Merge tag \u0027fbdev-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev updates from Helge Deller:\n \"A whole lot of small fixes all over many drivers, but the majority of\n changes are related to code cleanups regarding the cursor handling in\n vt and fbcon.\n\n Fixes:\n - core: initialize modelist in framebuffer_alloc()\n - core: bitblit: fix glyph clipping when fbcon pans\n - fbcon: restore font geometry if font rotation fails\n - sh_mobile_lcdcfb: restore the per-overlay sysfs attributes\n - udlfb: don\u0027t rebuild the mode list while the framebuffer is in use\n - atmel_lcdfb: prevent FIFO work after removal\n\n Cleanups:\n - vt, fbcon, vgacon: cursor code rework \u0026 cleanups\n - MAINTAINERS: name the deller/linux-fbdev for-next branch\n - drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option\n - acornfb: remove unused code\n - atafb: fix sparse warnings and avoid casts\n - sstfb: use managed PCI device enable\n - gxt4500, kyro, nvidia: release write-combining handle on probe failure\n - various drivers: typo fixes in comments\n - various drivers: fix error path on fb_deferred_io_init() failure\n - various drivers: use FB blanking constants instead of VESA constants\"\n\n* tag \u0027fbdev-for-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits)\n fbdev: xilinxfb: Use FB blanking constants\n fbdev: platinumfb: Use FB blanking constants\n fbdev: sa1100fb: Remove comment on VESA DPMS modes\n fbdev: i810fb: Use FB blanking constants\n fbdev: au1100fb: Use FB blanking constants\n fbcon: Retry rotated font allocation after failure\n fbcon: Rebuild rotated font buffer on font change\n fbcon: Include font geometry in the rotated font cache\n fbdev: bitblit: Fix glyph clipping when fbcon pans\n fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()\n lib/fonts: Add font_glyph_cursor() helper\n vgacon: Use vt_cursor_{start,end}()\n vgacon: Remove trailing whitespaces\n vt: Add cursor-size helpers\n MAINTAINERS: name the deller/linux-fbdev for-next branch\n fbdev: atafb: avoid cast when assigning buffer address pointer\n fbdev: atafb: fix sparse warnings\n fbdev: atyfb_base: fix typos in comments\n fbdev: aty128fb: fix typos in comments\n fbdev: mach64: fix typos in comments\n ...\n" }, { "commit": "330517c63aa9b48227b6ab45f01003effac77ae4", "tree": "51b6e38214a50c0253eba6dc05eeed6ae0f5b995", "parents": [ "168151cdb0f93d26557f9f3c7aae659b8d6b1863", "985955d8e6b2b15cfd65b7ac6893e3a5a90c5870" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:44:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:44:26 2026 -1000" }, "message": "Merge tag \u0027char-misc-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull Char/Misc/IIO/others driver updates from Greg KH:\n \"Here is the big set of char/misc/android/iio and other small driver\n subsystem patches for 7.4-rc1. Loads of stuff in here, larger than\n normal. Highlights include:\n\n - removal of the C binder code, the rust version is stable and will\n be used going forward in a few billion devices. Great job by those\n developers\n\n - loads and loads of IIO driver updates and feature additions\n\n - speakup driver fixes and updates\n\n - mhi driver updates\n\n - mei driver updates\n\n - xillybus driver fixes\n\n - comedi driver fixes\n\n - lots of coresight driver updates\n\n - Interconnect driver updates\n\n - nvmem driver updates and fixes\n\n - slimbus driver updates and fixes\n\n - spmi driver updates and fixes\n\n - lots of tiny misc and char driver fixes based on people scanning\n for things\n\n All of these have been in linux-next for a while with no reported\n issues, other than a merge conflict with one of the rust tree files,\n which should be simple to resolve\"\n\n* tag \u0027char-misc-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)\n rust_binder: wake epoll on self-work queued to poll thread\n rust_binder: avoid overflow in get_node_debug_info()\n MAINTAINERS: Add Abel as SPMI co-maintainer\n spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()\n iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions\n iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()\n misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()\n phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()\n power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()\n nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()\n spmi: Add helper to get a parent SPMI device\n spmi: Implement spmi_subdevice_alloc_and_add() and devm variant\n spmi: Remove unneeded goto in spmi_device_add() error path\n spmi: Print error status with %pe format\n spmi: Remove redundant dev_name() print in spmi_device_add()\n spmi: Fix potential use-after-free by grabbing of_node reference\n spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation\n MAINTAINERS: Add Qualcomm SPMI controller entry\n spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success\n comedi: addi_apci_3xxx: fix subdevice count underallocation\n ...\n" }, { "commit": "168151cdb0f93d26557f9f3c7aae659b8d6b1863", "tree": "803156129b8f6098e07426b2e2105dd203be7485", "parents": [ "cb8fef4b07f71da01843457b66e579ad248a625e", "bdf12cde30830d46a8ef1ba93986356f1164b4f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:31:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:31:19 2026 -1000" }, "message": "Merge tag \u0027usb-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB / Thunderbolt update from Greg KH:\n \"Here is the big set of USB and Thunderbolt changes for 7.4-rc1.\n Included in here are:\n\n - thunderbolt driver updates and fixes\n\n - lots of dt schema conversions\n\n - usb gadget driver fixes (and a new maintainer!)\n\n - usb core fixups with some interactions with the driver core\n\n - usb serial updates and fixes for scan-found \"issues\"\n\n - xhci driver updates\n\n - typec driver updates\n\n - dwc3 driver updates\n\n - lots of usb gadget driver fixes for syzbot found \"problems\"\n\n - lots of other small USB driver fixes for randomly reported problems.\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027usb-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits)\n usb: gadget: dummy_hcd: prevent unbind via sysfs\n usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning\n usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus\n usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket\n usb: gadget: fix refcount underflow in gadgetfs_bind() error path\n USB: core: document purpose of interface parent reference\n MAINTAINERS: add Neill Kapron as USB Gadget maintainer\n USB: Documentation: Update description of completion callback context\n USB: serial: mxuport: support RS485 mode configuration\n USB: serial: mxuport: handle SEND_NEXT transmit flow control\n USB: serial: add generic write control callbacks\n USB: serial: mxuport: add MUX50U-based device support\n USB: serial: mxuport: clean up firmware version handling\n USB: serial: mxuport: clean up product ID definitions and device table\n USB: serial: sierra: fix urb leak on write completion\n usb: typec: ucsi_ccg: Add retry mechanism in ccg_read\n usb: host: xhci-tegra: Add Tegra264 XHCI support\n usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264\n dt-bindings: usb: Add Tegra264 XUSB host support\n usb: xhci-pci: Add TUSB73x0 definitions\n ...\n" }, { "commit": "cb8fef4b07f71da01843457b66e579ad248a625e", "tree": "3088f5ab48aadf079688cb0bb874196bc97b7a81", "parents": [ "e1cff82880d13f62c64f20c36172a76aba7d989c", "1184f87e2790e8af9be3116f608d2e86b4792d7d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:25:54 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:25:54 2026 -1000" }, "message": "Merge tag \u0027tty-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty / serial driver updates from Greg KH:\n \"Here is the \"big\" set of tty and serial driver updates for 7.4-rc1.\n\n It\u0027s not really all that big, it\u0027s been kind of quiet in this area of\n the tree this development cycle in relation to other parts of the\n tree. But still, included in here are:\n\n - 8250 port updates and fixes\n\n - 8250 driver cleanups by Jiri\n\n - deletion of the obsolete moxa driver (making this pull request\n remove more lines than added!)\n\n - different serial driver updates for dma and other reported issues\n\n All of these have been in linux-next with no reported problems\"\n\n* tag \u0027tty-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (91 commits)\n tty: hvc: dcc: Detect JTAG connection only on CPU core 0\n serial: earlycon: Use isdigit() in earlycon_init()\n serial: core: Use isdigit() in uart_parse_options()\n dt-bindings: serial: snps-dw-apb-uart: Add Synaptics sl2610 uart\n serial: amba-pl011: drive the bus during break in RS485 mode\n serial: mcf: update author email address\n serial: pmac_zilog: report received breaks\n serial: pmac_zilog: push received data to the port that received it\n serial: amba-pl011: keep transmitter enabled when disabling RS485\n serial: ma35d1: Do not force-enable an unselected console\n serial: amba-pl011: honour delay_rts_before_send for every write\n Revert \"serial: 8250_port: Drop duplicate NULL check\"\n serial: 8250: make port operations work on struct uart_8250_port\n serial: 8250_omap: set priv-\u003eline before enabling the IRQ\n serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()\n serial: 8250_exar: store the GPIO platform device in struct exar8250\n serial: 8250_exar: remove useless void * casts\n serial: 8250: drop err label from serial8250_register_8250_port()\n serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports\n serial: max310x: don\u0027t transmit while an RS485 reconfigure is pending\n ...\n" }, { "commit": "e1cff82880d13f62c64f20c36172a76aba7d989c", "tree": "08e7e31ca792be76a03e11a090e8bb124217003a", "parents": [ "6fba331225f5040e93d0947d1027e9712238291f", "4a177d5e688e8e82113f7a32d6f75f0bab9658c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:07:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 15:07:12 2026 -1000" }, "message": "Merge tag \u0027staging-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver updates from Greg KH:\n \"Here is the big set of staging driver updates for 7.4-rc1.\n\n The huge majority of changes in here were to the rtl8723bs driver,\n which ended up being deleted entirely through the wifi driver tree, so\n while the work here was nice to have done to get experience by people,\n the overall goal was achieved in that we have a solid working and sane\n driver in the real part of the tree now.\n\n Other than that, included in here are:\n - some greybus driver removal of broken drivers that no one ever used\n - minor coding style cleanups for other staging drivers\n\n All of these have been in linux-next with no reported issues, other\n than the merge conflict of the driver being removed, but that\u0027s an\n obvious one to resolve :)\"\n\n* tag \u0027staging-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (145 commits)\n staging: rtl8723bs: remove unnecessary parentheses\n rtl8723bs: Remove redundant macro in basic_types.h\n staging: rtl8723bs: remove spaces before tabs in hal_com_reg.h\n staging: greybus: Align function arguments\n staging: greybus: uart: fix argument alignment\n staging: greybus: Remove unused header declaration to_fw_mgmt_connection\n staging: most: fix typo in driver_usage.txt\n staging: vme_user: avoid iterator variable access outside list loop\n staging: greybus: Remove unused function \u0027to_fw_mgmt_connection\u0027\n staging: greybus: replace PTR_ERR() with %pe in error messages\n staging: octeon: fix misuse of kernel-doc comment\n staging: nvec: fix GPIO descriptor documentation\n staging: fbtft: update outdated struct fbtft_ops comment\n greybus: Discard pm_runtime_put_autosuspend() return value\n staging: rtl8723bs: remove unused defines in odm.h\n staging: rtl8723bs: remove commented out code in hal/ files\n staging: rtl8723bs: remove unused defines in HalBtcOutSrc.h\n staging: rtl8723bs: remove unused PCI ASPM OSC definitions\n staging: rtl8723bs: remove unused EEPROM definitions\n staging: rtl8723bs: return bool from check_pending_xmitbuf\n ...\n" }, { "commit": "6fba331225f5040e93d0947d1027e9712238291f", "tree": "43cbfcbd0d85c3a4774a86653692a1950cb5eafb", "parents": [ "b23545529c21737dd7939e86b6f649f06480796d", "2f4880c22e838d54eae9ab153b0f8dce60531bf1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 14:30:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 14:30:22 2026 -1000" }, "message": "Merge tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI updates from James Bottomley:\n \"Small number of driver updates (mpi3mr, ufs, scsi_debug).\n\n By far the biggest core change (at 4000+ lines) is the sense code\n rework to make our sense handling follow the 16 bit defines in the\n SCSI standard rather than our split ASC and ASCQ handling which ends\n up being confusing and difficult to grep.\n\n The changes should all be functionally equivalent and so far the bots\n and AI seem to agree; the code has been incubating in -next since 16\n September with one reported issue fixed.\n\n The remaining updates are minor\"\n\n* tag \u0027scsi-misc\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits)\n scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry\n scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init()\n scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init()\n scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer\n scsi: st: Relock the door after a reset\n scsi: st: Restore the drive buffering mode after reset\n scsi: st: Record the tape position after a successful MTLOAD\n scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN\n scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16)\n scsi: scsi_debug: Map the region written by WRITE ATOMIC (16)\n scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it\n scsi: scsi_debug: Advance the write pointer over the data written\n scsi: scsi_debug: Do not write a partial physical block to a zoned device\n scsi: scsi_debug: Enforce physical block alignment of zoned writes\n scsi: scsi_debug: Report the residual of a write\n scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets\n scsi: scsi_debug: Evaluate scsi_debug_lbp() only once\n scsi: scsi_debug: Take the zone metadata lock before the data lock\n scsi: scsi_debug: Refuse a negative physblk_exp\n scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive\n ...\n" }, { "commit": "b23545529c21737dd7939e86b6f649f06480796d", "tree": "9c681fa42d931f0a1662ec8bca9230237d79d547", "parents": [ "fa899d500a0e1eb1ebe25246eaa718f78768c308", "40d070cbb1906896d6fd65c39722d2411830ed9f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 14:14:00 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 14:14:00 2026 -1000" }, "message": "Merge tag \u0027for-7.4/block-20261021\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block updates from Jens Axboe:\n\n - NVMe updates via Keith:\n - Apple M4 (t8132) ANS2 NVMe support\n - nvme-multipath sysfs attributes for path_state, iopolicies, and\n fail_on_ctrl_loss, plus path state evaluation fixes\n - nvme-tcp parallelized I/O queue allocation and startup, and using\n the caller\u0027s network namespace\n - nvmet passthru UAF fix and rework, PR preempt use-after-free\n fixes, auth hardening, and traffic based keep alive support\n - DH-HMAC-CHAP secret attributes readable by root only\n - Various other fixes and cleanups\n\n - swim driver overhaul and fixes, plus floppy fixes, via a pull from\n Denis\n\n - Block device buffered and direct I/O rework from Tal: use\n iomap_dirty_folio, take i_rwsem for the write fallback and splice\n read, honor IOCB_NOWAIT in the buffered read path, and reject atomic\n write fallback to buffered I/O\n\n - Large zone revalidation rework: serialize revalidation, handle\n capacity changes by dropping and retrying zone write plugs, propagate\n read-only and offline conditions, and treat offline and read-only\n zones as dead\n\n - ublk robustness work around canceled FETCH rounds and going live over\n canceled io commands, dropping the default I/O scheduler, and a batch\n of selftest additions\n\n - blk-iocost flush cost support and zone append accounting\n\n - rust block fixes for Send/Sync bounds on GenDisk and TagSet, and\n import style cleanups\n\n - Atomic write fixes capping size by the PI buffer constraints and\n failing short atomic pins\n\n - Skip the redundant flush for O_DSYNC direct writes, and only use\n REQ_FUA when the device supports it\n\n - Store GPT attributes as a raw value\n\n - Remove support for swapping loop fds\n\n - Various other fixes and cleanups all over\n\n* tag \u0027for-7.4/block-20261021\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (144 commits)\n block: restore the iterator when rejecting a misaligned bio\n blk-mq: clear stale inactive flag on hctx reuse\n block, bfq: initialize active lists for all actuators\n zloop: print device that had errors\n ublk: pin module while release work is pending\n blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags\n blk-mq: share one tags_srcu instance across all tag sets\n blk-iocost: fix stale comment in ioc_rqos_throttle()\n blk-iocost: account zone append completions in latency stats\n blk-iocost: charge zone appends as writes\n blk-iocost: add flush cost support with the flushiops model parameter\n ublk: use global index for reported zones\n selftests: ublk: add test for going live over canceled io commands\n selftests: ublk: stop a batch thread when PREP_IO_CMDS fails\n selftests: ublk: move the control command helpers into ctrl.c\n ublk: refuse to go live after an io command was canceled\n ublk: let STOP_DEV cancel the server\u0027s commands before its release\n ublk: allow a NULL io-\u003ecmd in the cancel callback\n ublk: reset the FETCH round under ub-\u003emutex\n ublk: reset the FETCH round in release also without a disk\n ...\n" }, { "commit": "fa899d500a0e1eb1ebe25246eaa718f78768c308", "tree": "c2d0d9d0709d6553b82ddb2c5d49c24899ea3d28", "parents": [ "696e75b3a616649cf50a63b1d7b816c8e31b235c", "ecb6817b769fd7d71af2c9f446188649020b2e53" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 13:43:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 13:43:13 2026 -1000" }, "message": "Merge tag \u0027for-7.4/io_uring-20261021\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring updates from Jens Axboe:\n \"The bulk of this is a big robustness pass over cancelation, io-wq,\n timeouts, and poll. Outside of that:\n\n - Large series from Josef hardening the cancelation, io-wq, timeout,\n poll, and wait paths. Fixes for lost wakeups and lost cancels as\n io-wq arms poll/timeouts, work stranding on worker exit, CQE32\n resize handling, napi entry timeouts, and a pile of smaller\n correctness issues across the board\n\n - Rework of how io-wq posts completions, posting from the last\n request reference and dropping the request file before the\n completion, and running ring release cancelations synchronously -\n canceling and waiting for all in-flight requests and dropping\n registered files and buffers at release time\n\n - Don\u0027t charge the SQ/CQ rings or provided buffer rings to\n RLIMIT_MEMLOCK, which the region API conversion had started doing\n\n - Split io_uring_cmd_set_res() out from io_uring_cmd_done() so a\n command can set the result from its -\u003eend_io() handler, used by\n nvme\n\n - CQE32 ring fixes for the free entry check, aux CQE big_cqe zeroing,\n and the dummy skip CQE\n\n - Timeout fixes for sequence handling and multishot updates\n\n - net fixes for MSG_TRUNC buffer overconsumption and keeping recv\n buffer select length within MAX_RW_COUNT\n\n - Wake real-time waiters from hard interrupt context\n\n - Don\u0027t spin on local work an exiting task can\u0027t run, reachable by an\n unprivileged user\n\n - Various other fixes and cleanups\"\n\n* tag \u0027for-7.4/io_uring-20261021\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (75 commits)\n io_uring: end the drain when the drain request completes\n io_uring/futex: return a wait\u0027s data to the cache when it fails to arm\n io_uring/wait: wake real-time waiters from hard interrupt context\n io_uring/waitid: return -EAGAIN for a non-blocking pidfd\n io_uring/net: keep recv buffer select length within MAX_RW_COUNT\n io_uring/waitid: prevent cancel reference wrap\n io_uring/poll: don\u0027t loop on HUP with multiple references\n io_uring/timeout: don\u0027t lose a cancel as io-wq arms a timeout\n io_uring/timeout: don\u0027t flush with the sequence behind the last flush\n io_uring/timeout: don\u0027t put a sequence target behind the last flush\n io_uring/poll: avoid retry wakeup loss when dropping ownership\n io_uring: look up the file before queueing to io-wq\n io_uring/timeout: don\u0027t end a linked timeout with 1\n io_uring/timeout: no ABS update of multishot timeouts\n io_uring/net: don\u0027t retry recv on uncommitted buffers\n io_uring: don\u0027t pass restart error codes to userspace\n io_uring/openclose: keep the lock in io_pipe_fixed()\n io_uring/sqpoll: let the thread sleep on disabled rings\n io_uring/kbuf: handle index wrap in last buffer check\n io_uring/zcrx: fix buffer offsets in areas above 4GB\n ...\n" }, { "commit": "696e75b3a616649cf50a63b1d7b816c8e31b235c", "tree": "bfa8df82e9743a004a54cbeef00fb28b7a2be685", "parents": [ "5b0764a53235d3c77e1ed674e836e1b3fe1a4b1f", "334714e4bdf8868c17a7650a7502ba1c90a8721f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 13:40:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 24 13:40:26 2026 -1000" }, "message": "Merge tag \u0027for-7.4/dm-changes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper updates from Mikulas Patocka:\n \"dm:\n - fix a bug in dm_accept_partial_bio that broke dm-writecache\n in persistent-memory mode\n - use assign_bit()\n\n dm-vdo:\n - fix misbehavior on invalid metadata\n\n dm-crypt:\n - use memzero_explicit\n - reject malformed keys\n - allow sector size up to page size\n\n dm-delay:\n - advertise flush support if the user wants to delay flushes\n\n dm-writecache:\n - reduce per-block metadata overhead by 8 bytes\n - report I/O error when flush failed\n - fix a quirk in statistics\n - fix a crash if we attempt to use a non-dax device\n - fix uncommitted_blocks underflow\n - fix REQ_FUA processing\n\n dm-verity:\n - add the option DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE\n - clear LSM integrity state on suspend\n\n dm-thin:\n - remove unnecessary locking in pool_map\n\n dm-mpath:\n - small refactoring of the historical service time path selector\n\n dm-snapshot:\n - fix crash if dm_io_client_create fails\n - make the chunk list being sorted by the chunk number\n\n dm-bufio:\n - fix non-working memory limit\n - fix a race leading to an unsigned integer underflow\n - clean-up cache limit reading\"\n\n* tag \u0027for-7.4/dm-changes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits)\n dm-verity: clear LSM integrity state on suspend\n dm-bufio: clean-up cache size reading\n dm-bufio: fix a race leading to an unsigned integer underflow\n dm-bufio: fix non-working memory limit\n dm-snapshot: make the chunk list sorted by the chunk number\n dm-snapshot: fix crash if dm_io_client_create fails\n dm-crypt: allow encryption sector size up to PAGE_SIZE\n dm-mpath: check values in hst_status while holding spinlock\n dm-mpath: standardize repeat_count handling in the HST path selector\n dm-mpath: streamline setup work in the HST path selector\n dm-writecache: fix REQ_FUA processing\n dm-writecache: fix uncommitted_blocks underflow\n dm-writecache: fix a crash if we attempt to use non-dax device\n dm-writecache: fix a quirk in statistics\n dm-writecache: report I/O error if flush failed\n dm: fix a bug in dm_accept_partial_bio\n dm thin: Remove unnecessary locking from pool_map()\n dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE\n dm: use assign_bit() where applicable\n dm-writecache: Reduce metadata memory use by 8 bytes per cache block\n ...\n" }, { "commit": "183895979c441e52dbd651b388553b09eaa35cfa", "tree": "608b0492c04b81a6144f75d030801253c03d39ec", "parents": [ "51542d55bcd59d428896168fd5b99b0d32440765" ], "author": { "name": "Siddharth Chintamaneni", "email": "sidchintamaneni@gmail.com", "time": "Sat Oct 17 05:09:27 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:43 2026 -0700" }, "message": "mm: multi-gen LRU: fix NULL lruvec-\u003epgdat deref with memcg disabled on cmdline\n\nWhen CONFIG_MEMCG\u003dy, lruvec_pgdat() returns lruvec-\u003epgdat, which for the\nper-node pgdat-\u003e__lruvec is left NULL by lruvec_init() and only filled in\nlazily by mem_cgroup_lruvec(). Normally that happens early, e.g. on the\nfirst folio_add_lru().\n\nWith cgroup_disable\u003dmemory, lru_gen_shrink_node() passes \u0026pgdat-\u003e__lruvec\ndirectly to shrink_one(). If direct reclaim runs before anything has\ncalled mem_cgroup_lruvec() for the node, which can happen during early\nboot under memory pressure (e.g. a kdump kernel), get_swappiness() ends\nup dereferencing a NULL pgdat:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040\n pc : get_swappiness+0x68/0xb0\n lr : try_to_shrink_lruvec+0x54/0x2c0\n Call trace:\n get_swappiness+0x68/0xb0 (P)\n try_to_shrink_lruvec+0x54/0x2c0\n shrink_one+0x8c/0x240\n shrink_node+0xc6c/0xe08\n do_try_to_free_pages+0xdc/0x570\n try_to_free_pages+0x124/0x278\n __alloc_frozen_pages_noprof+0x6e8/0xf78\n alloc_pages_mpol+0xc4/0x1c0\n alloc_frozen_pages_noprof+0x54/0xe8\n alloc_pages_noprof+0x1c/0x40\n atomic_pool_expand+0x98/0x300\n __dma_atomic_pool_init+0x58/0xd8\n dma_atomic_pool_init+0x154/0x170\n do_one_initcall+0x64/0x350\n kernel_init_freeable+0x214/0x430\n kernel_init+0x2c/0x208\n ret_from_fork+0x10/0x20\n\nThe classic LRU path and MGLRU before per-node lru_gen_folio lists\nobtained the lruvec through mem_cgroup_lruvec(), which sets\nlruvec-\u003epgdat.\n\nThe above was hit on an arm64 kdump kernel (6.18-based) booted with\ncgroup_disable\u003dmemory nr_cpus\u003d4. It also reproduces on mainline on an\narm64 VM with CONFIG_ARM64_64K_PAGES\u003dy, CONFIG_MEMCG\u003dy,\nCONFIG_LRU_GEN_ENABLED\u003dy and:\n\n mem\u003d160M nr_cpus\u003d4 coherent_pool\u003d512M cgroup_disable\u003dmemory\n\nThese options only serve to force direct reclaim early in boot; with\n160M the boot eventually ends in OOM regardless. On mainline the first\nLRU reclaim happens while unpacking the initramfs, and faults the same\nway:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040\n pc : get_swappiness+0xd4/0x150\n Call trace:\n get_swappiness+0xd4/0x150 (P)\n try_to_shrink_lruvec+0x44/0x2b8\n shrink_one+0x80/0x1a0\n shrink_node+0xd98/0xea8\n do_try_to_free_pages+0xf4/0x4b0\n try_to_free_pages+0x110/0x360\n __alloc_frozen_pages_noprof+0x8b0/0x1718\n ...\n __filemap_get_folio_mpol+0x2ac/0x548\n simple_write_begin+0x44/0xf8\n page_symlink+0x178/0x198\n ...\n do_populate_rootfs+0x13c/0x200\n\nLink: https://lore.kernel.org/20261017050928.128582-1-sidchintamaneni@gmail.com\nFixes: e4dde56cd208 (\"mm: multi-gen LRU: per-node lru_gen_folio lists\")\nSigned-off-by: Siddharth Chintamaneni \u003csidchintamaneni@gmail.com\u003e\nSigned-off-by: Hardik Garg \u003chargar@linux.microsoft.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Barry Song \u003cbaohua@kernel.org\u003e\nReviewed-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nAssisted-by: LLM\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Yuanchu Xie \u003cyuanchu@google.com\u003e\nCc: Wei Xu \u003cweixugc@google.com\u003e\nCc: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: Yu Zhao \u003cyuzhao@google.com\u003e\nCc: \u003capais@microsoft.com\u003e\nCc: \u003crlmenge@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 6.3+\n" }, { "commit": "51542d55bcd59d428896168fd5b99b0d32440765", "tree": "d2e0082b83a7bfa5432c74b49e08dbeb703bca0e", "parents": [ "30a397468e10076969c8df128d09986d718d50b4" ], "author": { "name": "Shakeel Butt", "email": "shakeel.butt@linux.dev", "time": "Wed Oct 21 13:48:18 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:43 2026 -0700" }, "message": "mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root\n\npage_counter_calculate_protection() runs without locks. Several\nreclaimers can update the same counter\u0027s emin and elow at the same time,\nand readers such as mem_cgroup_below_min(), mem_cgroup_protection() and\nthe dmem eviction code load them with READ_ONCE().\n\nCommit b3a7822e5e75 (\"mm, memcg: prevent mem_cgroup_protected store\ntearing\") made the main path store emin and elow with WRITE_ONCE(), but it\nmissed the early return for a counter whose parent is the reclaim root. \nThose two stores are the only plain accesses to emin and elow left.\n\nWith CONFIG_KCSAN_STRICT\u003dy, a few tasks writing to the same cgroup\u0027s\nmemory.reclaim trigger reports like this within seconds:\n\n BUG: KCSAN: data-race in page_counter_calculate_protection / shrink_node\n\n read (marked) to 0xff1f91b146d40e40 of 8 bytes by task 163 on cpu 4:\n shrink_node+0x57a/0x1210\n do_try_to_free_pages+0x194/0x930\n try_to_free_mem_cgroup_pages+0x204/0x3f0\n user_proactive_reclaim+0x28a/0x4d0\n memory_reclaim+0x35/0x50\n ...\n\n write to 0xff1f91b146d40e40 of 8 bytes by task 167 on cpu 6:\n page_counter_calculate_protection+0x1fa/0x360\n mem_cgroup_calculate_protection+0x4e/0x70\n shrink_node+0x53e/0x1210\n ...\n\nThe default KCSAN config does not report it, because it treats aligned\nword-sized plain writes as atomic.\n\nUse WRITE_ONCE() for these two stores as well.\n\nThere is no functional change. Readers already accept stale values, and\ncompilers emit a single word-sized store either way: with GCC 14 the\nx86-64 object code is the same before and after this change.\n\nLink: https://lore.kernel.org/20261021204818.3431099-1-shakeel.butt@linux.dev\nFixes: b3a7822e5e75 (\"mm, memcg: prevent mem_cgroup_protected store tearing\")\nSigned-off-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nReviewed-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nReviewed-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: Chris Down \u003cchris@chrisdown.name\u003e\n" }, { "commit": "30a397468e10076969c8df128d09986d718d50b4", "tree": "fd0b460769ec4a2278edabd45238b9c66635901b", "parents": [ "0fd271230891ad741b8a2f9ea814d584032afac9" ], "author": { "name": "Joshua Hahn", "email": "joshua.hahnjy@gmail.com", "time": "Tue Oct 20 18:00:50 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:43 2026 -0700" }, "message": "mm/memcontrol: publish null pointer before dropping css reference\n\nstruct memcg_stock_pcp hold references to cgroups that it tracks to make\nsure that the memcg never gets freed with unaccounted charges still\nliving in the stock. When the cached stock goes to 0 for a memcg, its\nreference is dropped and the cached memcg pointer is set to NULL.\n\nIf that was the last reference, the css_put would free the associated\ncgroup before publishing the NULL pointer, which can be racy on \nPREEMPT_RT. To summarize Shakeel Butt\u0027s analysis in [2],\n\nCPU 1\t\t\t\t\tCPU 2\nlocal_trylock() takes a per-CPU\nspinlock, which is an rcu read\nlock along with migrate_disable\n\ndrain_stock\ncss_put drops the last reference\nrelease work is queued\n\nkworker runs css_release_work_fn()\ncall_rcu() starts grace period G\nwhich waits for the refill task.\n\n\u003cpreempt\u003e\n\t\t\t\t\tdrain_all_stock\n\t\t\t\t\tis_memcg_drain_needed()\n\t\t\t\t\tenters rcu_read_lock(), but\n\t\t\t\t\t grace period G does not wait\n\t\t\t\t\tsince it started after G did\n\n\t\t\t\t\t\u003cprempt\u003e\n\nstock-\u003ecached[i] is cleared and\nunlocks. Grace period G ends,\nold is freed\n\n\t\t\t\t\tmem_cgroup_is_descendant() reads\n\t\t\t\t\told-\u003ecss.cgroup which has just\n\t\t\t\t\tbeen freed.\n\nTo close this gap on PREEMPT_RT, switch the order of the referene drop\nand the publishing so that we publish the NULL pointer before dropping\nthe reference. Note that this can only happen from drain_stock who can\nhold the last reference, but not on consume_stock since another\nreference will always be held. But fix this in both sites to maintain\nconsistency. \n\nThis is based on a report from Sashiko, who found this pre-existing\nissue in my page_counter_stock series [1].\n\nLink: https://lore.kernel.org/20261021010051.1529261-1-joshua.hahnjy@gmail.com\nLink: https://sashiko.dev/#/patchset/20260928192349.3432886-1-joshua.hahnjy%40gmail.com [1]\nLink: https://lore.kernel.org/all/atfMngq7nyZpt4u-@linux.dev/ [2]\nFixes: e1a366be5cb4 (\"mm: memcontrol: switch to rcu protection in drain_all_stock()\")\nSigned-off-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\n" }, { "commit": "0fd271230891ad741b8a2f9ea814d584032afac9", "tree": "616074b162337b488fbcf3338db226948dcadd28", "parents": [ "baed735a956f2a7badb5436bef6810303034f920" ], "author": { "name": "Dimitris Charisis", "email": "dchar@cslab.ece.ntua.gr", "time": "Mon Oct 05 12:47:28 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:42 2026 -0700" }, "message": "test_maple_tree: test maple_range_64 node in RCU mode\n\nThis commit adds a test that builds two maple_range_64 trees in RCU\nmode. The first tree has a root that is a full maple_range_64 node and\nensures that the destruction under RCU does not misinterpret the last\nslot as metadata. 226 insertions produce such a root on a 64-bit build.\n\nThe second tree is a height 3 tree whose root holds 15 child pointers\nand metadata in its last slot, so every slot is non-zero and ensures\nthat the destruction under RCU does not descend into the metadata slot.\n3166 insertions produce such a tree on a 64-bit build.\n\nLink: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-2-ebe7fb278e20@cslab.ece.ntua.gr\nSigned-off-by: Dimitris Charisis \u003cdchar@cslab.ece.ntua.gr\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Liam R. Howlett (Google) \u003cliam@infradead.org\u003e\nCc: Alice Ryhl \u003caliceryhl@google.com\u003e\nCc: Andrew Ballance \u003candrewjballance@gmail.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Florian Schmaus \u003cflorian.schmaus@codasip.com\u003e\n" }, { "commit": "baed735a956f2a7badb5436bef6810303034f920", "tree": "dadd496909e20a0e048b5f44ed9ec551f6de561a", "parents": [ "68cb098eadda190783f8f8bdf9fe764df59f7d32" ], "author": { "name": "Dimitris Charisis", "email": "dchar@cslab.ece.ntua.gr", "time": "Mon Oct 05 12:47:27 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:42 2026 -0700" }, "message": "maple_tree: fix maple_range_64 crashes in RCU mode\n\nPatch series \"maple_tree: fix maple_range_64 crashes in RCU mode\", v3.\n\nThe patch series fixes two RCU destroy path issues on maple_range_64\nnodes. Both arising from the fact that a maple_range_64 node repurposes\nthe last slot to hold metadata when the node is not full. Patch 1\naddresses the issues, and patch 2 adds a test used to catch them.\n\nCurrently there is no in-tree user of maple_range_64 nodes in RCU mode. \nAll in-tree users of MT_FLAGS_USE_RCU also set MT_FLAGS_ALLOC_RANGE which\nmakes the internal nodes maple_arange_64.\n\nBelow is the minimal reproducer used during debugging:\n\nstatic DEFINE_MTREE(tree);\nstatic int __init maple_fix_init(void)\n{\n unsigned long i, j;\n\n for (i \u003d 10; i \u003c 4000; i++) {\n mt_init_flags(\u0026tree, MT_FLAGS_USE_RCU);\n\n for (j \u003d 0; j \u003c i; j++) {\n mtree_insert_range(\u0026tree, j * 10, j * 10 + 9,\n xa_mk_value(j), GFP_KERNEL);\n }\n\n mtree_destroy(\u0026tree);\n rcu_barrier();\n }\n return 0;\n}\n\nThe splat for the first issue addressed by the first patch is shown below.\nmt_clear_meta() runs after the slots have been rewritten with raw\npointers by mte_dead_leaves(), so it cannot recognize a valid last pointer\nbecause the type information is stripped. On my 64-bit LE machine, it\nclears bytes 248 and 249 of the maple_range_64 which are the two least\nsignificant bytes of the last pointer. The lowest byte is already zero,\nsince nodes are 256-byte aligned, but zeroing byte 249 corrupts the\npointer.\n\nKASAN catches it as a double-free, because that corrupted pointer happens\nto land on a node that was freed previously. The splat appears at 226\ninsertions in the reproducer. This is when the tree has a full root node\non a 64-bit build.\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: double-free in mt_free_walk+0x138/0x3a0\n Free of addr ffff0000f3d40000 by task swapper/2/0\n [...]\n Call trace:\n [...]\n kmem_cache_free_bulk+0x5b8/0xc18\n mt_free_walk+0x138/0x3a0\n rcu_core+0x5d0/0x1638\n rcu_core_si+0x18/0x30\n [...]\n\n Allocated by task 1218:\n [...]\n kmem_cache_alloc_from_sheaf_noprof+0xa8/0x2f0\n dst_setup+0x210/0x630\n mas_wr_split+0x568/0x26e0\n mas_wr_store_entry+0x98c/0x1de0\n mas_insert.isra.0+0x3d0/0x5d8\n mtree_insert_range+0xec/0x1c8\n maple_fix_init+0x94/0xff8 [maple_fix_obj]\n [...]\n\n Freed by task 0:\n [...]\n __kasan_slab_free+0x88/0xb8\n __rcu_free_sheaf_prepare+0x94/0x360\n rcu_free_sheaf+0x30/0x138\n rcu_core+0x5d0/0x1638\n rcu_core_si+0x18/0x30\n [...]\n\n The buggy address belongs to the object at ffff0000f3d40000\n which belongs to the cache maple_node of size 256\n The buggy address is located 0 bytes inside of\n 256-byte region [ffff0000f3d40000, ffff0000f3d40100)\n\n [...]\n Memory state around the buggy address:\n ffff0000f3d3ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff0000f3d3ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff0000f3d40000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff0000f3d40080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff0000f3d40100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe second issue fixed in the first patch is in the mt_free_walk().\nmt_free_walk() descends by checking if the corresponding slot[offset]\nentry is non-zero. In a maple_range_64 node that has\nMAPLE_RANGE64_SLOTS-1 valid pointers to child nodes, all slots will be\nnon-zero, since the last slot holds the metadata. Thus, mte_dead_walk()\ndereferences the metadata as if it were a node and hits the\nnull-ptr-deref as shown in the splat below.\n\nAfter fixing the first issue, the reproducer reaches this case at 3166\ninsertions. The affected node is the root on a tree with height 3 and it\nhas 15 valid child nodes on a 64-bit machine. The first fix does not\nintroduce this bug, but it exposes it for the root node because it no\nlonger clears the root metadata. On an unmodified kernel, the same bug\nexists and is reachable when such a maple_range_64 node appears below\nthe root, where mt_clear_meta() is not called.\n\nSecond KASAN splat:\n\n Unable to handle kernel paging request at virtual address dfff800000000006\n KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n [...]\n Call trace:\n mte_dead_walk+0x78/0x140 (P)\n mt_free_walk+0x1f8/0x3a0\n rcu_core+0x5d0/0x1638\n rcu_core_si+0x18/0x30\n [..]\n\nBoth splats are from an arm64 QEMU guest. The test_maple_tree and the\nuserspace suite pass after each patch in the series.\n\n\nThis patch (of 2):\n\nThis commit fixes two issues in maple_range_64 nodes under RCU mode. A\nmaple_range_64 node repurposes its last slot to hold metadata whenever\nthe node is not full. Both issues arise from mishandling that last slot.\n\nMore specifically the two fixes are:\n\n1. Remove mt_clear_meta() function. mt_clear_meta() decides whether the\n last slot of a maple_range_64 node holds a child pointer or a\n struct maple_metadata with the check\n\n if (unlikely((mte_to_node(next) \u0026\u0026\n mte_node_type(next))))\n return; /* no metadata, could be node */\n\n The check expects the pointer to be encoded. But the only callsite\n of mt_clear_meta() is mt_destroy_walk() on the RCU destroy path, and\n by the time it runs, mte_dead_leaves() has overwritten every slot on\n a full node with a raw pointer, stripping the type information. Thus,\n the check above never returns early for a full node as it should. It\n falls through and then:\n meta-\u003egap \u003d 0;\n meta-\u003eend \u003d 0;\n zeroes two bytes of a valid child pointer. Later, mt_free_walk()\n dereferences the corrupted pointer.\n\n Fix this by removing mt_clear_meta() along with its only callsite.\n mt_clear_meta() is only called for the root of each sub-tree destroyed\n under RCU. Descendant nodes retain their metadata until they are\n freed. RCU readers may use the metadata while traversing a node, but\n do not use cleared metadata to detect that a node has been removed.\n They detect a dead node via ma_dead_node().\n\n2. Fix invalid memory access in mt_free_walk(). mt_free_walk() descends\n to the left-most unvisited \"parent-of-a-leaf\" node by checking the\n condition:\n\n if ((offset \u003c mt_slots[type]) \u0026\u0026\n rcu_dereference_protected(slots[offset],\n lock_is_held(\u0026rcu_callback_map)))\n slots \u003d mte_dead_walk(\u0026enode, offset);\n\n On a maple_range_64 node with MAPLE_RANGE64_SLOTS-1 children *all*\n slots are non-NULL. The first MAPLE_RANGE64_SLOTS-1 hold valid\n pointers to child nodes, and the last slot contains metadata. The\n above check therefore passes for all offsets, and mte_dead_walk()\n dereferences the metadata as if it were a node.\n\n To trigger this, a node at least two levels above the leaves has to\n have exactly MAPLE_RANGE64_SLOTS-1 valid pointers to other nodes.\n maple_arange_64 nodes cannot hit this since they store the metadata\n in a separate field.\n\n Fix this by bounding the descent with slot_len which holds the number\n of children of a dead node.\n\nLink: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-0-ebe7fb278e20@cslab.ece.ntua.gr\nLink: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-1-ebe7fb278e20@cslab.ece.ntua.gr\nFixes: 54a611b60590 (\"Maple Tree: add new data structure\")\nFixes: 2e5b4921f8ef (\"maple_tree: fix freeing of nodes in rcu mode\")\nSigned-off-by: Dimitris Charisis \u003cdchar@cslab.ece.ntua.gr\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Liam R. Howlett (Google) \u003cliam@infradead.org\u003e\nReviewed-by: Florian Schmaus \u003cflorian.schmaus@codasip.com\u003e\nCc: Alice Ryhl \u003caliceryhl@google.com\u003e\nCc: Andrew Ballance \u003candrewjballance@gmail.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\n" }, { "commit": "68cb098eadda190783f8f8bdf9fe764df59f7d32", "tree": "fc05f4e433467cae0678ca1d3cc891adc734912f", "parents": [ "c9ed13789061af00d9239f9fab8e246adbed2076" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Tue Oct 20 15:55:30 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:42 2026 -0700" }, "message": "mm/vma: avoid broken uffd merge on mremap\n\nUserfaultfd often causes unexpected interactions within mm, and does so at\nthe intersection of uffd, mremap() and VMA merging.\n\nWhen an mremap of a VMA occurs, copy_vma_and_data() calls\nmremap_userfaultfd_prep() to notify uffd of this.\n\nHowever, mremap_userfaultfd_prep() simply drops the UFFD context for the\nVMA if the user did not register it for remap, i.e. didn\u0027t specify the\nUFFD_FEATURE_EVENT_REMAP flag.\n\nThis is OK for the VMA itself, as upon page table move, move_ptes() clears\nUFFD page table flags, using vma_has_uffd_without_event_remap() to\ndetermine whether to do so.\n\nHowever, this doesn\u0027t account for merging with adjacent VMAs, whose page\ntables won\u0027t have received this treatment, and thus latent UFFD markers\nwill be left around.\n\nWorse, it\u0027ll break UFFD for any VMAs it is merged with. This is very\nsurprising behaviour for a user, who will then simply not receive UFFD\nevents for VMAs they ought to.\n\nResolve the issue by explicitly checking for this case via\nvma_has_uffd_without_event_remap() in vma_merge_copied_range(), the merge\nfunction explicitly designated for mremap() operations.\n\nAlso update the userland VMA tests accordingly.\n\nLink: https://lore.kernel.org/20261020-uffd-remap-fix-v1-1-0f34fc181f0a@kernel.org\nFixes: 3cfd22be0ad6 (\"userfaultfd: clear flag if remap event not enabled\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: shaos \u003cshawnq1@163.com\u003e\nCloses: https://lore.kernel.org/all/20261020110748.959870-1-shawnq1@163.com/\nReviewed-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nReviewed-by: Xueyuan Chen \u003cxueyuan.chen21@gmail.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: Mike Rapoport \u003crppt@linux.vnet.ibm.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "c9ed13789061af00d9239f9fab8e246adbed2076", "tree": "0d3440aec5d8483cf31b405e8d40b18cbafcb538", "parents": [ "5695abc4e742b947f586bfb6a080a80ad9957e5d" ], "author": { "name": "Liam R. Howlett (Google)", "email": "liam@infradead.org", "time": "Mon Oct 19 23:31:28 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:42 2026 -0700" }, "message": "tools/testing/shared: catch a failed posix_memalign()\n\nposix_memalign() returns zero or a positive error number and never sets\nerrno, so the checks for a negative return in kmem_cache_alloc_lru() and\nkmem_cache_alloc_bulk() is not possible. A failed aligned allocation\ncarries on with the pointer unset, into the constructor or the memset().\n\nTest for any non-zero return.\n\nLink: https://lore.kernel.org/20261020033128.1934349-1-liam@infradead.org\nFixes: 8801c35c3672 (\"tools: fix -Wunused-result in linux.c\")\nSigned-off-by: Liam R. Howlett (Google) \u003cliam@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Vishal Moola (Fractile) \u003cvishal.moola@gmail.com\u003e\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\n" }, { "commit": "5695abc4e742b947f586bfb6a080a80ad9957e5d", "tree": "6537ec42f0113c098c0cb2ea41f6694efa253198", "parents": [ "faaf8b406c5178fc54662c91e7ce687c0c4cb4be" ], "author": { "name": "SJ Park", "email": "sj@kernel.org", "time": "Mon Oct 19 19:39:56 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:41 2026 -0700" }, "message": "mm/damon/core: remove unreachable damos charge_{target,addr}_from\n\ndamos_quota-\u003echarge_{target,addr}_from saves the target and region the\nscheme\u0027s quota limit is reached. damos_skip_charged_region() skips the\ntarget and regions before the point. The target that was assigned to\ncharge_target_from could be dynamically removed from the context by the\nruntime parameters update (aka commit) feature. In this case,\ndamos_skip_charged_region() cannot find if the point is passed or not,\nso the scheme is effectively disabled.\n\nSimilarly, the user could also remove all the regions of the target\nusing the runtime parameters update feature. It would be uncommon to do\nthat, but it is a supported feature. Because the skip pointer detection\nlogic (damos_skip_charged_region()) works for each region of targets,\nthis result in the logic is entirely skipped and the scheme is\neffectively disabled again.\n\nThe user impact is that the DAMOS scheme could suddenly stop working\nunder certain uses of the runtime parameters update feature. It could\nsurprise users. No crash or leak happens though. Users could also\nsimply work around by re-installing the scheme.\n\nCatch the corner cases in damos_adjust_quota() and reset the pointers.\n\nLink: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org\nFixes: da87878010e5 (\"mm/damon/sysfs: support online inputs update\")\nSigned-off-by: SJ Park \u003csj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCloses: https://sashiko.dev/#/bug/linux-cd0c55fc-0cc8-45d8-9637-3334811c49b8\nCc: \u003cstable@vger.kernel.org\u003e # 5.19.x\n" }, { "commit": "faaf8b406c5178fc54662c91e7ce687c0c4cb4be", "tree": "dd6f7d9b5819a968b522047cf8607df4efb41c0f", "parents": [ "bdda2887cbf3937c2d0f56589c2124c4167324e1" ], "author": { "name": "Konstantin Khorenko", "email": "khorenko@virtuozzo.com", "time": "Mon Oct 19 18:11:44 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:41 2026 -0700" }, "message": "mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache\n\nshrinker_info_unit holds BITS_PER_LONG atomic_long_t of deferred work plus\na one-word bitmap, 520 bytes on 64-bit. kzalloc_node() takes it from\nkmalloc-1k, so almost half of every unit is padding.\n\nAllocate the units from a cache of their own, sized to the unit. The\ncache is not cache-line aligned: the counters of a unit already share\ncache lines between shrinkers, and aligning the unit would only keep\nneighbouring units off each other\u0027s boundary line, at the cost of part of\nthe saving.\n\nLink: https://lore.kernel.org/20261019-vstor-144715-shrinker_info_unit-kmem_cache-v3-1-0fb061e09bf4@virtuozzo.com\nSigned-off-by: Konstantin Khorenko \u003ckhorenko@virtuozzo.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSuggested-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Harry Yoo (Meta) \u003charry@kernel.org\u003e\nReviewed-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nAssisted-by: LLM\nCc: Dave Chinner \u003cdavid@fromorbit.com\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\n" }, { "commit": "bdda2887cbf3937c2d0f56589c2124c4167324e1", "tree": "377972d62224a43fce99082d4a8dfa909f639eb4", "parents": [ "bbeec2d8324d7aac438bb12dd2d22b184e0a8d43" ], "author": { "name": "Yunhui Cui", "email": "cuiyunhui@bytedance.com", "time": "Sat May 23 12:20:52 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:41 2026 -0700" }, "message": "riscv: mm: exclude invalid THP PMDs from page table check\n\nRISC-V THP splitting uses a temporary invalid PMD state where\npmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves\n_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split\nin-progress entry.\n\nThat temporary state no longer describes a user-accessible mapping, but\npage_table_check currently treats it as one because the RISC-V PMD\nuser-accessibility test only checks whether the PMD is a leaf and has user\npermissions.\n\nAs a result, when a PMD-sized anonymous THP is split during a COW fault,\npage_table_check can account the invalid intermediate PMD as a live PMD\nmapping, and then account the replacement PTE mappings again when the\nsplit installs the PTE table. This leaves stale PMD accounting behind and\nlater triggers page_table_check failures such as a non-zero anon_map_count\nwhen the folio is freed.\n\nFix this by tightening pmd_user_accessible_page() so PMD page-table-check\naccounting only considers leaf PMDs that still carry either _PAGE_PRESENT\nor _PAGE_PROT_NONE. This preserves the THP split semantics required by\nthe MM code while preventing page_table_check from treating invalid split\nPMDs as live user mappings.\n\nWith CONFIG_PAGE_TABLE_CHECK\u003dy and CONFIG_PAGE_TABLE_CHECK_ENFORCED\u003dy,\ntools/testing/selftests/mm/cow completes successfully on RISC-V after this\nchange.\n\nLink: https://lore.kernel.org/20260523042052.35476-1-cuiyunhui@bytedance.com\nFixes: 3fee229a8eb9 (\"riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK\")\nSigned-off-by: Yunhui Cui \u003ccuiyunhui@bytedance.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Albert Ou \u003caou@eecs.berkeley.edu\u003e\nCc: Palmer Dabbelt \u003cpalmer@dabbelt.com\u003e\nCc: Pasha Tatashin \u003cpasha.tatashin@soleen.com\u003e\nCc: Paul Walmsley \u003cpaul.walmsley@sifive.com\u003e\nCc: tongtiangen \u003ctongtiangen@huawei.com\u003e\nCc: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nCc: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Vivian Wang \u003cwangruikang@iscas.ac.cn\u003e\nCc: Yaxing Guo \u003cguoyaxing@bosc.ac.cn\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "bbeec2d8324d7aac438bb12dd2d22b184e0a8d43", "tree": "7c20f7fb5a8b7011dc5c8b055d83f0470036c596", "parents": [ "4fb975471717c953f912776bb60301add1ffae11" ], "author": { "name": "SJ Park", "email": "sj@kernel.org", "time": "Mon Oct 19 17:41:18 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:40 2026 -0700" }, "message": "mm/damon/core: filter out damos address filter-split failed region\n\nWhen an address type DAMOS filter is configured, DAMOS tries to split the\nregion for the filter range, and apply DAMOS action to the filter-in\nregion. The split operation (damon_split_region_at()) could fail from\nallocation failure under extreme memory pressure. In the case, DAMOS\naction could be applied more or less than expected, ignoring the address\nfilter.\n\nThe issue only rarely happens under extreme memory pressure. No crash or\nleak happens. Occasionally not applying the action to a few regions\nshouldn\u0027t be a real problem. But applying the action to a region that the\nuser has excluded via address filter could be a surprise depending on the\nuse case. It is only theoretical. No such real case is found yet.\n\nFilter out the entire region if the split is failed. Update\ndamos_filter_match() signature to receive the error from split. Also\nupdate kunit tests for the updated signature.\n\nThe issue was discovered [1] by sashiko.\n\nLink: https://lore.kernel.org/20261020004119.106690-1-sj@kernel.org\nLink: https://lore.kernel.org/20260801203121.117449-1-sj@kernel.org [1]\nFixes: ab9bda001b68 (\"mm/damon/core: introduce address range type damos filter\")\nSigned-off-by: SJ Park \u003csj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 6.6.x\n" }, { "commit": "4fb975471717c953f912776bb60301add1ffae11", "tree": "ec31604874df522348a2193a271305cf153d5a8e", "parents": [ "d4ea410ce4b8aa46a316476ea2624a357bf31fa9" ], "author": { "name": "Ngoc Quy", "email": "ngocquy0700@gmail.com", "time": "Wed Oct 14 16:55:40 2026 +0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:40 2026 -0700" }, "message": "fs/proc/task_mmu: pin mm_users in do_pagemap_scan()\n\nThe PAGEMAP_SCAN ioctl takes mmap_read_lock() on an mm obtained from\n/proc/\u003cpid\u003e/pagemap without holding a reference to mm_users.\n\nproc_mem_open() deliberately grabs only mm_count, so a consumer that\ntouches the address space has to call mmget_not_zero() first. Every other\nconsumer in this file does -- m_start(), do_procmap_query(),\nshow_smaps_rollup() and pagemap_read() -- but do_pagemap_scan() does not.\n\nWithout that reference the target can reach exit_mmap() concurrently, and\nexit_mmap() calls unmap_vmas() while holding mmap_lock only for reading,\nwhich does not exclude the scanner. For ordinary VMAs this is harmless,\nas free_pgtables() and remove_vma() run afterwards under mmap_write_lock. \nA shared hugetlb VMA is different: __hugetlb_zap_end() frees the VMA\u0027s\nhugetlb_vma_lock inside the read-locked phase.\n\nwalk_hugetlb_range() can therefore load vma-\u003evm_private_data, have the\nlock freed underneath it, and then down_read() a freed rw_semaphore. The\nload happens before the freeing side clears the pointer, so this is a\nuse-after-free and not a NULL dereference. Any unprivileged user can\nreach it with no huge pages configured, as hugetlb_reserve_pages()\nallocates the lock before the VM_NORESERVE early return.\n\nPin mm_users across the scan, the way the other consumers do. mmput()\nfrom the exiting task can then no longer reach exit_mmap() while a walk is\nin progress.\n\n[akpm@linux-foundation.org: remove unneeded \u0026 undesirable test for !mm]\nLink: https://lore.kernel.org/20261014095540.3261469-1-ngocquy0700@gmail.com\nFixes: 52526ca7fdb9 (\"fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs\")\nSigned-off-by: Ngoc Quy \u003cngocquy0700@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAssisted-by: Claude:claude-opus-5\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: Muhammad Usama Anjum \u003cusama.anjum@arm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "d4ea410ce4b8aa46a316476ea2624a357bf31fa9", "tree": "7a488054acad95f94effc5c2ba44c2b82d6c900b", "parents": [ "d0a12d80d2f7e9f4ed2030b6f04c8a897956bf84" ], "author": { "name": "Gregory Price (Meta)", "email": "gourry@gourry.net", "time": "Sat Oct 17 22:33:49 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:40 2026 -0700" }, "message": "mm/mempolicy: apply bind policies against the scoped allocation zone\n\nQEMU fails to start a guest with a VFIO device when guest RAM comes\nfrom a memory backend bound to a movable-only node:\n\n vfio_container_dma_map(0x55b1b1317800, 0x0, 0x10000000,\n 0x7f39a2200000)\n \u003d -12 (Cannot allocate memory)\n\nVFIO pins guest RAM when the device is realized, and the pin faults\nthe pages in. io_uring fixed buffers fail the same way. Faulting the\nrange in before pinning lets the same pin succeed, since resident\npages are migrated off the node instead.\n\nA long-term pin faults under memalloc_pin_save(). PF_MEMALLOC_PIN makes\ncurrent_gfp_context() clear __GFP_MOVABLE, but policy_nodemask() tests\napply_policy_zone() against the caller\u0027s gfp.\n\nThe bind keeps its movable-only nodemask, and the allocation finds no\nusable zone:\n\n page allocation failure:\n order:0,\n mode:0x140dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_COMP),\n nodemask\u003d1,cpuset\u003d/,mems_allowed\u003d0-1\n\n Call Trace:\n warn_alloc+0x136/0x150\n __alloc_frozen_pages_noprof+0xed8/0x1720\n alloc_pages_mpol+0xaa/0x170\n vma_alloc_folio_noprof+0x65/0xd0\n __handle_mm_fault+0x137b/0x1ac0\n handle_mm_fault+0xa0/0x270\n __get_user_pages+0x250/0xfd0\n __gup_longterm_locked+0x116/0x870\n gup_fast_fallback+0xcfc/0xdf0\n pin_user_pages_fast+0x47/0x60\n io_pin_pages+0x9a/0x110\n\nBase page faults fail with -ENOMEM.\nhugetlb faults fail with -EFAULT.\n\nCheck the policy zone against current_gfp_context(gfp), so a pin-scoped\nfault falls back off the movable-only nodemask, like any other\nnon-movable allocation under the same bind.\n\nTested in qemu with a dax/kmem movable-only node 1. io_uring and VFIO\npins of unfaulted base pages and 2MB hugetlb pages now succeed and land\non node 0 (correct). QEMU now starts with the same backend binding.\n\nLink: https://lore.kernel.org/20261018023349.1697434-1-gourry@gourry.net\nFixes: 8e3560d963d2 (\"mm: honor PF_MEMALLOC_PIN for all movable pages\")\nSigned-off-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nCc: Rakie Kim \u003crakie.kim@sk.com\u003e\nCc: Ying Huang \u003cying.huang@linux.alibaba.com\u003e\nCc: Pasha Tatashin \u003cpasha.tatashin@soleen.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "d0a12d80d2f7e9f4ed2030b6f04c8a897956bf84", "tree": "9bc9bafb99b820e8ef147add2c17e082cfae19f0", "parents": [ "65e722a74df992719676ead85a9e93fb2b5a0983" ], "author": { "name": "Gregory Price (Meta)", "email": "gourry@gourry.net", "time": "Mon Oct 19 14:50:02 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:40 2026 -0700" }, "message": "mm/vmscan: reclaim every zone in per-node proactive reclaim\n\nuser_proactive_reclaim() limits per-node reclaim to\ngfp_zone(GFP_KERNEL), which is ZONE_NORMAL. Proactive reclaim serves no\nallocation, but that limit makes shrink_node() skip every ZONE_MOVABLE\nfolio, so writing to /sys/devices/system/node/nodeN/reclaim never\nreclaims a node\u0027s movable memory. A movable-only node, such as dax/kmem\nor hotplugged memory onlined movable, reclaims nothing and fails with\n-EAGAIN.\n\nTo reproduce, fill a movable-only node with clean page cache and write\n200M to its nodeN/reclaim: the write fails with -EAGAIN and the page\ncache stays. The same write to a ZONE_NORMAL node frees 200MB.\n\nScan every zone, as memory.reclaim does.\n\nLink: https://lore.kernel.org/20261019185002.3428594-1-gourry@gourry.net\nFixes: b980077899ea (\"mm: introduce per-node proactive reclaim interface\")\nSigned-off-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Barry Song \u003cbaohua@kernel.org\u003e\nReviewed-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReviewed-by: Harry Yoo (Meta) \u003charry@kernel.org\u003e\nAcked-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nReviewed-by: Yosry Ahmed \u003cyosry@kernel.org\u003e\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nReviewed-by: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nAcked-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nReviewed-by: Xueyuan Chen \u003cxueyuan.chen21@gmail.com\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nAcked-by: Vishal Moola (Fractile) \u003cvishal.moola@gmail.com\u003e\nCc: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Yuanchu Xie \u003cyuanchu@google.com\u003e\nCc: Wei Xu \u003cweixugc@google.com\u003e\nCc: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "65e722a74df992719676ead85a9e93fb2b5a0983", "tree": "232cf55d8c92856ab92e7b1375e91c75ef9d89e1", "parents": [ "34e753f8d927069785f6b675f5769da5da4ef78e" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Mon Oct 19 16:57:48 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:39 2026 -0700" }, "message": "mm/mremap: correctly uncharge accountable VMAs in error path\n\nThe mremap error path is a fragile and unwieldy beast - it reverses the\npage table move then updates vma_remap_struct state to swap VMA, length and\naddress between old and new VMAs in copy_vma_and_data().\n\nIf the mremap() operation didn\u0027t specify MREMAP_DONTUNMAP then its caller,\nmove_vma(), invokes unmap_source_vma(), which unmaps the new VMA rather\nthan the old one.\n\nFor accountable VMAs when MREMAP_DONTUNMAP is not specified,\nunmap_source_vma() unsets VMA_ACCOUNT_BIT during this unmap in order that\nonly the delta of a VMA expansion is charged (performed by\nvrm_calc_charge() earlier).\n\nTherefore nothing uncharges the expanded VMA size, and there is a permanent\nleak in global Committed_AS.\n\nResolve the issue by uncharging when MREMAP_DONTUNMAP is not specified.\n\nLink: https://lore.kernel.org/20261019-other-mremap-charge-leak-v1-1-d94477fe6545@kernel.org\nFixes: fdbef6149135 (\"mm/mremap: don\u0027t account pages in vma_to_resize()\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: Brian Geffon \u003cbgeffon@google.com\u003e\nCc: Dmitry Safonov \u003c0x7f454c46@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "34e753f8d927069785f6b675f5769da5da4ef78e", "tree": "4dc088ddb167e913d71a78e7186d6d79a1b2836e", "parents": [ "1caede5a55b7f0731a437aeb7157ce0f560b049f" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Mon Oct 19 15:28:27 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:39 2026 -0700" }, "message": "mm/mremap: populate calculated fields in vrm state correctly\n\nCommit d5c8aec0542e (\"mm/mremap: initial refactor of move_vma()\")\nintroduced the vma_remap_struct helper to pass state sanely through\nmremap() logic.\n\nPart of this state is vrm-\u003edelta - equal to the absolute difference between\nvrm-\u003eold_len and vrm-\u003enew_len (the old and new lengths of the VMA,\nrespectively).\n\nThis value is used to correctly charge accounted VMAs.\n\nWhen shrinking a VMA, mremap_to() sets vrm-\u003eold_len equal to vrm-\u003enew_len\nhaving performed the shrink of the VMA first, prior to any potential move\n(e.g. MREMAP_FIXED | MREMAP_MAYMOVE specified).\n\nHowever it does not recalculate vrm-\u003edelta, which results in incorrectly\novercharging the VMA when both moving and shrinking a VMA.\n\nThe charge leaks to Committed_AS globally, meaning a mischievous user can\ncause allocations to fail across the system in strict overcommit mode.\n\nResolve the issue by abstracting the update of vrm-\u003edelta to\nvrm_populate_calculated() and invoking this from mremap_to() when\nvrm-\u003eold_len is changed.\n\nAdditionally, update vrm-\u003eremap_type whose value depends on vrm-\u003edelta. \nThe field is not read again after the shrink, but it is the logically\ncorrect thing to do and protects against future changes which break this.\n\nLink: https://lore.kernel.org/20261019-mremap-fix-shrink-charge-v1-1-a3ce209e5360@kernel.org\nFixes: d5c8aec0542e (\"mm/mremap: initial refactor of move_vma()\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nCloses: https://lore.kernel.org/all/20261017233527.797191-1-nickolai@csail.mit.edu/\nReviewed-by: Xueyuan Chen \u003cxueyuan.chen21@gmail.com\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "1caede5a55b7f0731a437aeb7157ce0f560b049f", "tree": "bf68d314125743cb12d23e399d56e3f0f472cd7c", "parents": [ "b428f1966821cd285957fb41a621141b22622a7d" ], "author": { "name": "Mike Rapoport (Microsoft)", "email": "rppt@kernel.org", "time": "Mon Oct 19 14:34:26 2026 +0300" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:39 2026 -0700" }, "message": "MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP\n\nSplit out files related to SPARSE and SPARSE_VMEMMAP management from\nMEMORY MANAGEMENT - CORE into a dedicated entry.\n\nAlso include architecture specific sparsemem.h headers, pfn_to_page() and\npage_to_pfn() conversions and Documentation/mm/memory-model.rst.\n\nMuchun, who did a lot of work cleaning up SPARSE_VMEMMAP and extending\nvmemmap optimization, volunteered to help with the maintenance.\n\nDavid and I will continue to look after that part of the mm subsystem.\n\nLink: https://lore.kernel.org/20261019-memmap-maint-v1-1-80850871d0cc@kernel.org\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAcked-by: Harry Yoo (Meta) \u003charry@kernel.org\u003e\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nAcked-by: SJ Park \u003csj@kernel.org\u003e\n" }, { "commit": "b428f1966821cd285957fb41a621141b22622a7d", "tree": "862dda7b768ea4409c2887000d66a64033db0b79", "parents": [ "1a2993227e8a27fc4cdea305bbdae82d290bc885" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Fri Oct 16 23:06:20 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:39 2026 -0700" }, "message": "mm: bdi: reset min_ratio after the sysfs attributes are gone\n\nA write to /sys/class/bdi/\u003cdev\u003e/min_ratio (or min_ratio_fine or min_bytes)\nthat races with the removal of the device leaves the global sum of minimum\ndirty shares charged for a bdi that no longer exists. Until the next\nreboot, that share of the dirty threshold is withheld from every other bdi\n(__wb_calc_thresh() scales by 100 % minus the sum), and a later min_ratio\nstore on any bdi that would push the sum to 100 % fails with EINVAL\nalthough every bdi reads 0. Root privilege is needed for the store; the\nremoval is any del_gendisk() (a disk or loop device going away) or the\nunmount of a filesystem with its own bdi. On an x86_64 defconfig kernel\n(v7.3-rc7), 2000 rounds of LOOP_CTL_ADD/LOOP_CTL_REMOVE on one loop device\nwith a second thread writing 50 to its min_ratio leak the share on the\nfirst round the store lands in the window; afterwards `echo 99 \u003e\nmin_ratio` on another loop device fails with EINVAL. With the fix the\nsame run keeps the sum at 0 and the store succeeds. Affected since v5.16,\nwhen the reset in bdi_unregister() was added.\n\nbdi_unregister() gives the bdi\u0027s share back with bdi_set_min_ratio(bdi, 0)\nand only then calls device_unregister(), which removes the sysfs\nattributes. A min_ratio_store() that gets its kernfs active reference\nbefore the removal runs to completion after the reset:\n__bdi_set_min_ratio() takes bdi_lock, sees bdi-\u003emin_ratio \u003d\u003d 0, adds the\nnew value to bdi_min_ratio and stores it in the bdi, which bdi_put() then\nfrees. Nothing gives that share back.\n\nMove the reset after device_unregister(): once the attributes are gone no\nstore can run, and bdi_set_min_ratio() needs nothing from the device.\n\nFound while formally verifying bdi_unregister() against the kernel binary.\n\nLink: https://lore.kernel.org/20261017030620.793108-1-nickolai@csail.mit.edu\nFixes: 3c376dfafbf7 (\"mm: bdi: initialize bdi_min_ratio when bdi is unregistered\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nAssisted-by: LLM\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Manjong Lee \u003cmj0123.lee@samsung.com\u003e\n" }, { "commit": "1a2993227e8a27fc4cdea305bbdae82d290bc885", "tree": "046121aaece17b1f3e139151de6f8dce833b498b", "parents": [ "8730e622bfff3b9357ce537eb73f8649207c1ddb" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Thu Oct 15 18:15:49 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:38 2026 -0700" }, "message": "mm/page_vma_mapped: continue past nonmatching huge PMDs\n\nA PTE-mapped large folio can straddle PMD boundaries after an unaligned\nmremap(). If the first part is discarded and replaced with an unrelated\nhuge PMD, page_vma_mapped_walk() stops instead of looking for the rest of\nthe folio in subsequent PMDs.\n\nThis also affects migration entries. A walk that stops at an unrelated\nhuge PMD can leave migration PTEs behind when migration or an anonymous\nfolio split restores the mappings. Those entries do not hold mapping\nreferences and can outlive the source folio.\n\nThis issue can lead to memory corruption and I have a reproducer for\nit.\n\nSkip the current PMD rather than ending the walk on a flag or PFN\nmismatch. Do the same if the PMD became nonpresent before the locked\nrecheck. Release the PMD lock, clear the per-PMD state and advance with\nstep_forward(), so the existing range limit controls termination. This\ncovers present, migration and device-private huge PMDs while preserving\nthe matching-PMD and split-to-PTE paths.\n\nLink: https://lore.kernel.org/20261016011549.61146-1-kylebot@openai.com\nFixes: ace71a19cec5 (\"mm: introduce page_vma_mapped_walk()\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAssisted-by: LLM\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Harry Yoo \u003charry@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Lance Yang \u003clance.yang@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "8730e622bfff3b9357ce537eb73f8649207c1ddb", "tree": "e55a4fe5e8162550c3a127159fc3e870e229415d", "parents": [ "c82dba3183ac66ea282e817b12edf735235fc4ac" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Fri Oct 16 20:54:48 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:38 2026 -0700" }, "message": "selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers\n\nWith -cgroup-v2, charge_reserved_hugetlb.sh and\nhugetlb_reparenting_test.sh mount a cgroup2 hierarchy on a temporary\ndirectory when none is mounted and enable the hugetlb controller\n(hugetlb_reparenting_test.sh also enables memory) in its\ncgroup.subtree_control.\n\nOn a system that still binds these controllers to cgroup v1, they are not\navailable in the new hierarchy. Writing to cgroup.subtree_control fails\nwith ENOENT, \"set -e\" aborts the script, the test is reported as failed,\nand the temporary cgroup2 mount is left behind.\n\nCheck cgroup.controllers first, and skip the test when a controller is\nmissing, after unmounting the hierarchy and removing the directory the\nscript created.\n\nWith hugetlb and memory bound to cgroup v1, per script:\n\n before after\n result fail skip\n cgroup2 mounts left behind 1 0\n\nLink: https://lore.kernel.org/20261016-bug-selftests-mm-hugetlb-cgroup2-skip-v1-1-7c78883a67b4@gmail.com\nFixes: 29750f71a9b4 (\"hugetlb_cgroup: add hugetlb_cgroup reservation tests\")\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Mina Almasry \u003calmasrymina@google.com\u003e\nCc: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\n" }, { "commit": "c82dba3183ac66ea282e817b12edf735235fc4ac", "tree": "6cad334e8d9ddf0a1beb81d1e07e0b761e189d55", "parents": [ "d2f7bdfdeac8137e942b32e0badc40e181127d7b" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Fri Oct 16 21:13:34 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:38 2026 -0700" }, "message": "mm: warn on unaligned compound zone device ranges\n\nA compound page of order N must start at a PFN aligned to 2^N pages. \nTherefore, a range used to initialize compound pages must start on a\ncompound-page boundary and contain an integral number of compound pages.\n\nTwo recent Device DAX bugs were caused by ranges that violated this\ninvariant, but neither was detected by memmap_init_zone_device().\n\nWarn if the adjusted zone-device range violates this invariant so future\nviolations are reported when the compound pages are initialized.\n\nLink: https://lore.kernel.org/20261016131334.3419393-1-songmuchun@bytedance.com\nLink: https://lore.kernel.org/r/20261016053944.2579541-1-songmuchun@bytedance.com\nLink: https://lore.kernel.org/r/20261016054914.2601510-1-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAssisted-by: LLM\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Vishal Verma \u003cvishal.l.verma@intel.com\u003e\nCc: Dave Jiang \u003cdave.jiang@intel.com\u003e\nCc: Alison Schofield \u003calison.schofield@intel.com\u003e\nCc: Joao Martins \u003cjoao.m.martins@oracle.com\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\n" }, { "commit": "d2f7bdfdeac8137e942b32e0badc40e181127d7b", "tree": "2440a458eefc2f79504c656995bf25defe076a14", "parents": [ "8f9039840588dd618c72a726c192126bb7b98228" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Fri Oct 16 10:00:43 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:38 2026 -0700" }, "message": "resource: report a devm_request_resource() conflict under the lock\n\ndevm_request_resource() calls request_resource_conflict(), which takes\nresource_lock, tries to insert the new resource and returns a pointer to\nthe conflicting resource after dropping the lock. The error message is\nthen formatted from that pointer: conflict-\u003ename and the %pR argument\nread the name, start, end, flags and desc of a resource that nothing\npins any more. The owner of the conflicting resource may call\nrelease_resource() and free it the moment the lock is dropped.\n\nThe conflicting resource normally belongs to another device. With two\ndevices whose drivers claim overlapping regions (two PCI host bridges\nwhose \"ranges\" windows overlap, two instances of a controller on the\nsame aperture, or a stale claim an administrator is replacing), the\nfollowing interleaving reads freed memory:\n\n CPU 0: driver B probe CPU 1: driver A unbind\n devm_request_resource(devB, root, resB)\n request_resource_conflict()\n write_lock(\u0026resource_lock)\n __request_resource() -\u003e resA\n write_unlock(\u0026resource_lock)\n devres_release_all(devA)\n devm_resource_release()\n release_resource(resA)\n put_device() -\u003e kfree(resA)\n dev_err(..., resA-\u003ename, resA) use after free\n\nBoth halves are reachable from userspace on any kernel: a write to the\n\"unbind\" file of the driver that holds the region and a write to the\n\"bind\" file of the driver that wants it. One in-tree path is\ndrivers/pci/bus.c devm_request_pci_bus_resources(), called from host\nbridge probe for every bridge window; the windows are the embedded\nstruct resource of kzalloc\u0027ed resource_entry objects that\npci_free_resource_list() frees when the other bridge is released.\nIn the common case the \"resource collision\" message is garbled; with\nthe slab object poisoned (CONFIG_SLUB_DEBUG) or reused, formatting\nconflict-\u003ename oopses, and KASAN reports a slab-use-after-free read in\ndevm_request_resource(). All of this happens in a probe that is\nalready failing with -EBUSY. The window is a few hundred instructions\nwide and exists only when two devices actually collide, so the race\nhas not been observed outside of analysis.\n\nDo the same here: take resource_lock, insert with __request_resource()\nand print the diagnostic while the lock still keeps the conflicting\nresource in the tree, then drop the lock. The return values and the\ndevres handling are unchanged.\n\nThe change was built for x86_64 and RISC-V; the resource KUnit tests\npass on both.\n\nFound by formal verification of kernel/resource.c against the kernel\nbinary.\n\nLink: https://lore.kernel.org/20261016140043.790048-1-nickolai@csail.mit.edu\nFixes: 8d38821cbcf5 (\"resources: Add device-managed request/release_resource()\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nAssisted-by: LLM\nCc: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nCc: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nCc: Thierry Reding \u003ctreding@nvidia.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "8f9039840588dd618c72a726c192126bb7b98228", "tree": "de89af2eb97fc804af3ffcbd361c211d8d79fc7c", "parents": [ "1503710b3b0cec02b531978129c6c1eb70a7c490" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Fri Oct 16 18:27:21 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:37 2026 -0700" }, "message": "mm/truncate: fix the zeroing end of pagecache_isize_extended()\n\nA process that extends a file by 4 GiB or more past a dirty folio, on a\nfile system whose block size is smaller than the page size (ext4 with 1k\nblocks), reads back the bytes it wrote through a shared mapping beyond the\nold end of file instead of zeroes, and a later write into that block\ncarries them to the disk. With the example of commit 52aecaee1c26 (\"mm:\nzero range of eof folio exposed by inode size extension\") and the truncate\ntaken 4 GiB further (pwrite 2k at 0, mmap the first page and write \u0027X\u0027\nover [2k, 4k), truncate(2) to 4 GiB + 2k), the read of [2k, 4k) returns\nthe 2048 \u0027X\u0027 bytes, and a pwrite of 16 bytes at 3k followed by fsync() and\na remount leaves 1008 \u0027X\u0027 bytes on the disk in [3k+16, 4k). No privilege\nis needed, and every size extension of 4 GiB or more reaches it:\ntruncate(2)/ftruncate(2) through truncate_setsize(), writes beyond the end\nof file through generic_write_end(), ext4, iomap, btrfs, exfat, ntfs, afs\nand orangefs. Affected since v6.13.\n\npagecache_isize_extended() zeroes the part of the dirty folio straddling\nthe old end of file that the size extension exposes, from the old size to\nthe new size or the end of the folio, whichever comes first:\n\n\tend \u003d min_t(unsigned int, to - folio_pos(folio), folio_size(folio));\n\nmin_t() converts both operands to unsigned int before comparing, so the\nloff_t difference to - folio_pos(folio) is reduced modulo 2^32 first. \nWhen the file grows by 4 GiB or more past the folio, end is that residue\ninstead of folio_size(folio): below offset nothing is zeroed, above it\nonly [offset, end) is. The bytes beyond the old end of file stay in the\ndirty folio and, now inside i_size, are file data.\n\nCompare in loff_t; the result is at most folio_size(folio) and fits end.\n\nFound while formally verifying pagecache_isize_extended() against the\nkernel binary.\n\nLink: https://lore.kernel.org/20261016222721.791785-1-nickolai@csail.mit.edu\nFixes: 52aecaee1c26 (\"mm: zero range of eof folio exposed by inode size extension\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nAssisted-by: LLM\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Brian Foster \u003cbfoster@redhat.com\u003e\nCc: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "1503710b3b0cec02b531978129c6c1eb70a7c490", "tree": "3fc5756d1070e0e8ff20e8fbe8d97de6ca8ff1cc", "parents": [ "3d670c0dcea42afd021fe15c7438f7a48c63b552" ], "author": { "name": "Rik van Riel", "email": "riel@surriel.com", "time": "Fri Oct 16 12:23:04 2026 -0400" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:37 2026 -0700" }, "message": "mm/page_alloc: count guard pages as free again when their buddy merges\n\nWith debug_guardpage_minorder set, expand() turns the unused halves of a\nsplit into guard pages, which page_del_and_expand() leaves out of the free\ncounts. Freeing the allocated half credits only that half, and\n__free_one_page() then merges the guard buddy with clear_page_guard(),\nwhich no longer touches the counters.\n\nThe merged block goes on a free list with the guard pages never counted,\nso NR_FREE_PAGES falls behind the free lists by every guard that merges. \nBefore commit e0932b6c1f94 (\"mm: page_alloc: consolidate free page\naccounting\"), __set_page_guard() and __clear_page_guard() adjusted the\ncounts themselves; that commit dropped both adjustments but kept the\nsubtraction implicit in expand().\n\nCount the guard pages under the merged block\u0027s migratetype when the buddy\nis cleared. account_freepages() skips an isolated block as it does for\nevery other free page, and moving the block off the isolated list counts\nit then.\n\nBooting a 16GB VM with debug_pagealloc\u003don debug_guardpage_minorder\u003d1,\ncheck the difference in free pages reported between /proc/vmstat and\n/proc/buddyinfo.\n\nAt three points (idle, after a read and file-creation load, after a second\nload), check the difference between nr_free_pages and the buddyinfo\nnumbers in the normal zone, as a number of pages:\n\n idle after load after second load\n unpatched -130 79205 99121\n patched -16 45 0\n\nThe small remaining difference seems to be due to the numbers not being\nread at exactly the same time, and is also seen without guard pages.\n\nLink: https://lore.kernel.org/20261016122304.5b1eba8e@fangorn\nFixes: e0932b6c1f94 (\"mm: page_alloc: consolidate free page accounting\")\nSigned-off-by: Rik van Riel \u003criel@surriel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReviewed-by: Dev Jain \u003cdev.jain@arm.com\u003e\nReviewed-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nAssisted-by: LLM\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Brendan Jackman \u003cbrendan.jackman@linux.dev\u003e\nCc: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nCc: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Frank van der Linden \u003cfvdl@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "3d670c0dcea42afd021fe15c7438f7a48c63b552", "tree": "2e1a6af3f4df56b05b80218559d2932c55c8f123", "parents": [ "cc1fd8f4017f68597091b3dc6d8c5eba2a8c3afc" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:55 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:37 2026 -0700" }, "message": "mm/mm_init: add zone mismatch warning during page init\n\nFor vmemmap-optimized sections, tail struct pages may be backed by shared\nvmemmap pages. Those shared pages must carry the same page zone ID as the\nstruct pages initialized for the section.\n\nWarn in __init_single_page() if the shared tail page has a different\npage_zone_id(), which would indicate inconsistent initialization.\n\n[muchun.song@linux.dev: document ordering of shared and retained struct page initialization]\n Link: https://lore.kernel.org/20261010115523.4005071-1-songmuchun@bytedance.com\nLink: https://lore.kernel.org/20261010075755.83339-7-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "cc1fd8f4017f68597091b3dc6d8c5eba2a8c3afc", "tree": "cadf15b635c24ca64da8ac0f5fc3652cf9d13653", "parents": [ "2815c5d88f2a1255669cfa7ed260e7fd70532188" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:54 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:37 2026 -0700" }, "message": "mm/sparse-vmemmap: open-code vmemmap_populate_address()\n\nvmemmap_populate_address() no longer has any callers that need the\nreturned PTE. Its only remaining user, vmemmap_populate_range(), only\nchecks whether population succeeded.\n\nOpen-code vmemmap_populate_address() directly in\nvmemmap_populate_basepages(), remove the now-redundant range helper, and\nreturn -ENOMEM directly on failure.\n\nLink: https://lore.kernel.org/20261010075755.83339-6-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "2815c5d88f2a1255669cfa7ed260e7fd70532188", "tree": "4304f66596d9ff7af430f8988d857f7578c9f364", "parents": [ "bd0862382adb3373bf5cd79531fecd41fb4c25e4" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:53 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:36 2026 -0700" }, "message": "mm/sparse-vmemmap: remove the unused ptpfn argument\n\nvmemmap_pte_populate() no longer uses ptpfn as an input. Drop the\nargument to simplify the code.\n\nLink: https://lore.kernel.org/20261010075755.83339-5-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "bd0862382adb3373bf5cd79531fecd41fb4c25e4", "tree": "9de7206ad190bd8a41424c7840a94b5e3578e4cf", "parents": [ "a123cf7ac6cbcb127a24a825e82d9f7d2de84468" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:52 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:36 2026 -0700" }, "message": "mm/sparse-vmemmap: drop Device DAX-specific population path\n\nThe common vmemmap path selects the shared page for optimized mappings\nitself, so Device DAX no longer needs vmemmap_populate_compound_pages() to\nfind a shared tail page and pass its backing PFN through the generic\npopulation helpers.\n\nRemove the Device DAX-specific population path and let section memmap\npopulation always use vmemmap_populate(). The powerpc retains an\narchitecture-specific compound-page implementation, so select it directly\nfrom radix__vmemmap_populate() for optimizable sections.\n\nLink: https://lore.kernel.org/20261010075755.83339-4-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "a123cf7ac6cbcb127a24a825e82d9f7d2de84468", "tree": "72907af3b65ec4b54da1f605a22f8841c2a3ec8f", "parents": [ "4b77739fe7893bced405891233511310554871a7" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:51 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:36 2026 -0700" }, "message": "mm/sparse-vmemmap: support device DAX in common vmemmap path\n\nThe common vmemmap population path cannot yet handle optimized Device DAX\nmappings on its own. It uses pfn_to_zone() to find the shared tail page,\nbut Device DAX populates its vmemmap at runtime before the ZONE_DEVICE\nspan is initialized.\n\nTeach the common path to use device_zone() for runtime optimized vmemmap\npopulation while retaining pfn_to_zone() for early boot. This allows the\nsame path to support both early boot mappings and Device DAX.\n\nThe backing PFN supplied by the Device DAX-specific population path is no\nlonger used, allowing the redundant lookup and population code to be\nremoved later.\n\nLink: https://lore.kernel.org/20261010075755.83339-3-songmuchun@bytedance.com\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "4b77739fe7893bced405891233511310554871a7", "tree": "9682940917710bc3416b3c2c29d5d358726e86fc", "parents": [ "60f34fedf3a4c91ed631ed2f80713ab993cde5ee" ], "author": { "name": "Muchun Song", "email": "muchun.song@linux.dev", "time": "Sat Oct 10 15:57:50 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:36 2026 -0700" }, "message": "mm/sparse-vmemmap: drop VMEMMAP_POPULATE_DAX\n\nPatch series \"mm: Unify device DAX and HugeTLB vmemmap population paths\",\nv4.\n\nThis series is split out from the earlier, larger series \"mm: Generalize\nHVO for HugeTLB and device DAX\" [2]. While the parent series generalizes\nvmemmap optimization across HugeTLB and device DAX, this subset addresses\na single, self-contained step: unifying their vmemmap population paths.\n\nAfter the preceding Device DAX conversion, both HugeTLB and Device DAX\ndescribe optimized vmemmap mappings through memory-section metadata and\nuse per-zone shared tail vmemmap pages. The generic code, however, still\ncarries a Device DAX-specific population flag and compound-page population\npath, along with arguments and helpers needed only by that path.\n\nThis series first removes VMEMMAP_POPULATE_DAX and moves selection and\nreference handling for the shared tail page into the common vmemmap\npopulation path. It then removes the generic Device DAX-specific\ncompound-page population path and routes section vmemmap population\nthrough vmemmap_populate(). The powerpc radix path continues to use its\narchitecture-specific compound-page population implementation for\noptimizable sections.\n\nThe remaining patches remove the unused ptpfn argument, open-code\nvmemmap_populate_address() now that no caller needs its returned PTE, and\nadd a warning for inconsistent zone initialization of shared tail vmemmap\npages.\n\nThis is the fourth smaller step toward the broader HVO generalization. \nAfter this series, HugeTLB and Device DAX use the same population model\ninstead of parallel generic paths, while powerpc keeps its\narchitecture-specific implementation.\n\n\nThis patch (of 6):\n\nVMEMMAP_POPULATE_DAX currently distinguishes DAX vmemmap population in two\nplaces: it keeps allocations on the normal path and takes a reference when\na backing page is supplied for reuse.\n\nAfter Device DAX switched to the common per-zone shared tail page, both\nconditions can be determined locally. DAX supplies ptpfn for every shared\ntail mapping and requests an allocation only for compound head mappings,\nwhose PFNs are not optimizable. Therefore, vmemmap_optimizable_pfn()\nalone selects the correct allocation path.\n\nWhen ptpfn is supplied, the caller is reusing an existing backing page. \nOnce the slab allocator is available, take a reference for each reused\nmapping to balance the release performed by vmemmap_free(). Although the\nbuddy allocator is available before slab, no vmemmap population occurs in\nthat interval. Earlier mappings are backed by memblock/reserved memory\nand do not need page reference accounting.\n\nRemove VMEMMAP_POPULATE_DAX and the flags argument from the vmemmap\npopulation helpers.\n\nLink: https://lore.kernel.org/20261010075755.83339-1-songmuchun@bytedance.com\nLink: https://lore.kernel.org/20261010075755.83339-2-songmuchun@bytedance.com\nLink: https://lore.kernel.org/20260930140627.57431-1-songmuchun@bytedance.com/ [1]\nLink: https://lore.kernel.org/20260513130542.35604-1-songmuchun@bytedance.com/ [2]\nSigned-off-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: Christophe Leroy \u003cchleroy@kernel.org\u003e\nCc: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nCc: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\n" }, { "commit": "60f34fedf3a4c91ed631ed2f80713ab993cde5ee", "tree": "076af28e952c97fe09d7490edb05bf09845b017c", "parents": [ "397e087605526e31c067afd5fba85bd999e5738f" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Thu Oct 15 14:05:27 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:35 2026 -0700" }, "message": "mm/swap: fix swap_cache_get_folio() returning a folio that left the swap cache\n\nswap_cache_get_folio() reads the folio from the swap table and takes a\nreference with folio_try_get(), without any lock. If the folio is removed\nfrom the swap cache and freed in between, and its memory gets reused,\nfolio_try_get() still succeeds and we return a page that has nothing to do\nwith the swap entry:\n\n CPU 0 CPU 1\n do_swap_page()\n swap_cache_get_folio()\n swp_tb \u003d swap_table_get()\n folio \u003d swp_tb_to_folio(swp_tb)\n madvise(MADV_DONTNEED)\n zap_nonpresent_ptes()\n swap_put_entries_direct()\n swap_put_entries_cluster()\n __try_to_reclaim_swap()\n swap_cache_del_folio()\n folio_put() \u003c- freed\n page reused, e.g. as an anon\n folio of another task\n folio_try_get(folio) \u003c- succeeds\n return folio\n swap_update_readahead() \u003c- may clear PG_readahead on it\n folio_lock_or_retry() \u003c- locks it\n folio_matches_swap_entry() fails, unlock and put\n\nfilemap_get_entry() does the same lockless lookup for the page cache, and\nafter folio_try_get() it rechecks the xarray, because the folio may have\nbeen freed and reused in between. swap_cache_get_folio() lost that\nrecheck when the swap cache moved to the swap table.\n\nSo CPU 0 writes to a folio it doesn\u0027t own: it may clear PG_readahead and\ntakes the folio lock of someone else\u0027s page, before\nfolio_matches_swap_entry() finds out the folio is not ours.\n\nWhen the race occurs, a swap fault can acquire a reference to a\nphysical page that has been freed and reused for an unrelated purpose,\npotentially by another process. The fault handler may then clear that\npage\u0027s PG_readahead/PG_reclaim flag, wait on or acquire its folio lock,\nand potentially attempt to remove it from an unrelated swap cache.\n\nThese operations can interfere with unrelated workloads and may cause\nunexpected stalls and impaired reclaim. The subsequent swap-entry\nvalidation normally prevents the wrong folio from being mapped into the\nfaulting process.\n\nIt\u0027s documented that caller always double checks the folio so this part\nis harmless from the aspect of data corruption or crash.\n\nRecheck the slot after folio_try_get() and retry if it no longer holds\nthis folio.\n\n[akpm@linux-foundation.org: add LLM-generated description of userspace impact]\nLink: https://lore.kernel.org/20261015060528.302634-1-jiayuan.chen@linux.dev\nFixes: 8578e0c00dcf (\"mm, swap: use the swap table for the swap cache and switch API\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Chris Li \u003cchrisl@kernel.org\u003e\nCc: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nCc: Nhat Pham \u003cnphamcs@gmail.com\u003e\nCc: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Youngjun Park \u003cyoungjun.park@lge.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "397e087605526e31c067afd5fba85bd999e5738f", "tree": "9a47f5a4bce150188adef125aa3902605eb5e251", "parents": [ "7135a05838e85845e1bbf6caa6596a7e3b791a40" ], "author": { "name": "Nimrod Oren", "email": "noren@nvidia.com", "time": "Wed Oct 14 17:08:59 2026 +0300" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:35 2026 -0700" }, "message": "mm: stop recalculating min_free_kbytes once set by userspace\n\nmin_free_kbytes is recalculated on memory hotplug and on THP sysfs writes.\nThe new value comes from calculate_min_free_kbytes() or, while THP is\nenabled, from set_recommended_min_free_kbytes(). A value written to the\nvm.min_free_kbytes sysctl is replaced whenever the new value is higher, so\na lower value does not stick. This matters most when THP is enabled on\nconfigurations with large pageblocks, where the new value can be excessive\n[1].\n\nFor example, with default arm64 pageblock sizes, the THP recommendation\ncan reach 5.5 GiB per eligible zone with 64 KiB pages vs 22 MiB with 4 KiB\npages. This keeps a significant amount of memory free, reducing what\napplications can use and triggering reclaim much earlier. Users can lower\nvm.min_free_kbytes to avoid this, but the lower value only sticks until\nthe next recalculation.\n\nStop recalculating min_free_kbytes once a value has been written to the\nsysctl. Systems where the sysctl is never written keep the current\nbehavior.\n\nLink: https://lore.kernel.org/20261014140859.1006967-1-noren@nvidia.com\nLink: https://lore.kernel.org/r/20260716173504.760369-1-noren@nvidia.com/ [1]\nSigned-off-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSuggested-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nLink: https://lore.kernel.org/r/d202dcc3-d7d7-4e98-a9a5-3137cfbfd041@kernel.org/\nReviewed-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nReviewed-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nCc: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nCc: Randy Dunlap \u003crdunlap@infradead.org\u003e\nCc: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: Nico Pache \u003cnico.pache@linux.dev\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: Dev Jain \u003cdev.jain@arm.com\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Lance Yang \u003clance.yang@linux.dev\u003e\nCc: Usama Arif \u003cusama.arif@linux.dev\u003e\nCc: Kiryl Shutsemau \u003ckas@kernel.org\u003e\nCc: Brendan Jackman \u003cbrendan.jackman@linux.dev\u003e\nCc: David Laight \u003cdavid.laight.linux@gmail.com\u003e\n" }, { "commit": "7135a05838e85845e1bbf6caa6596a7e3b791a40", "tree": "59b93e4706e2d4335bbda90cbb733dc144d717bc", "parents": [ "86aca64badd203af6035979991a9be63f2af7b9e" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Fri Oct 16 12:34:33 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:35 2026 -0700" }, "message": "mm/vma: avoid spurious write locks when mm-\u003emm_lock_seq overflows\n\nSo far the assumption has been that mm-\u003emm_lock_seq overflow is benign,\nresulting only in readers spuriously falling back to the mmap lock, however\nit turns out that this was an unsafe assumption.\n\nIf a VMA can be spuriously considered write locked that means read lock\nexclusion does not take place, and thus a VMA can end up write-locked with\nconcurrent readers.\n\nSince overflow only occurs every 2^31 write lock/unlock cycles, resolve the\nissue by resetting every VMA\u0027s vma-\u003evm_lock_seq each time such an overflow\noccurs.\n\nThis is done in vma_end_write_all(), which is called when the mmap write\nlock is released, i.e. in mmap_write_unlock() and mmap_write_downgrade().\n\nCare must be taken, as resetting the sequence count at overflow means\nchanging the seqcount of VMAs which are already attached and observable.\n\nThe mm\u0027s seqcount is guaranteed to be odd when a write lock is held, and\nthus any write locked VMA will have an odd seqcount assigned.\n\nTherefore resetting to an even value prevents spurious write locks, since\nthese can only occur with the mmap write lock held, at which point the mmap\nseqcount will be odd.\n\nHowever, vma_start_read() also checks vma-\u003evm_lock_seq \u003d\u003d mm-\u003emm_lock_seq,\nbailing if so (indicating a write lock).\n\nThis would cause any even reset value chosen to prevent VMA read locks from\nbeing taken - avoid this by also checking whether the VMA seqcount is odd\nbefore bailing on the read lock.\n\nSo far, vma-\u003evm_lock_seq has defaulted to UINT_MAX, but this has been\nunnecessary since commit e5e7fb278e59 (\"mm: convert mm_lock_seq to a proper\nseqcount\"), since this is assigned when the VMA is still detached, and\ncannot be observed.\n\nTherefore perform both reset and initialisation of vma-\u003evm_lock_seq by\nsimply setting vma-\u003evm_lock_seq to zero.\n\nThe reset, performed in __mm_reset_vma_seqcounts(), only needs to\nWRITE_ONCE() the value.\n\nHowever the read of vma-\u003evm_lock_seq in vma_start_read() needs to have\nacquire semantics to pair with the smp_wmb() in do_raw_write_seqcount_end()\nso a reader reading a reset value also observes VMA modifications made\nunder the write lock.\n\nSince all VMA write locks were just released and the mmap write lock is\nstill held, there are no concurrent VMA writers.\n\nConcurrent VMA readers are unaffected. New VMA readers observe either zero,\nnever a write lock, or the prior seqcount, behaving as before the reset.\n\nSince this only occurs every 2^31 write lock/unlock cycles, the time taken\nto update all VMAs is considered to be acceptable.\n\nAlso update comments, documentation and VMA userland tests to reflect the\nchange.\n\nUser facing effects are - dangerous races that could cause memory\ncorruption or NULL pointer derefences (especially on page table traversal)\nare avoided.\n\nLink: https://lore.kernel.org/20261016-fix-vma-lock-overflow-v2-1-9eb778b79b58@kernel.org\nFixes: 5e31275cc997 (\"mm: add per-VMA lock and helper functions to control it\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nCloses: https://lore.kernel.org/all/20261015143735.1630957-1-4ncienth@gmail.com/\nReviewed-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nTested-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nCc: Randy Dunlap \u003crdunlap@infradead.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 7.3.x\n" }, { "commit": "86aca64badd203af6035979991a9be63f2af7b9e", "tree": "c27d734db1c2559afbe5149712e9505e5bb490b5", "parents": [ "2ca8b38962f239b17f7881a4710c11328ce38ac9" ], "author": { "name": "Vlastimil Babka (SUSE)", "email": "vbabka@kernel.org", "time": "Thu Oct 15 18:31:46 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:34 2026 -0700" }, "message": "MAINTAINERS: exclude DAMON docs from MEMORY MANAGEMENT - MISC\n\nMEMORY MANAGEMENT - MISC is a list of misc mm sources and also acts as\ncatch-all for the mm Documentation subdirectories. Documentation for\nDAMON is well maintained within its own subsystem and also actively\nupdated, so there\u0027s no need to Cc all MISC maintainers for them as well.\nThus add exclusion entries for them.\n\nLink: https://lore.kernel.org/20261015-maint-mm-core-x-doc-damon-v1-1-226decb5cd0d@kernel.org\nSigned-off-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nAcked-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAcked-by: SJ Park \u003csj@kernel.org\u003e\nCc: Jonathan Corbet \u003ccorbet@lwn.net\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nCc: Randy Dunlap \u003crdunlap@infradead.org\u003e\n" }, { "commit": "2ca8b38962f239b17f7881a4710c11328ce38ac9", "tree": "378b21f34d02795b366573825713da5dd27de121", "parents": [ "e387ebe5cd31720b1e0281fd045be4eef36fadb3" ], "author": { "name": "Vernon Yang", "email": "yanglincheng@kylinos.cn", "time": "Mon Oct 12 10:29:17 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Oct 24 01:56:34 2026 -0700" }, "message": "mm: vmscan: don\u0027t count per-node proactive reclaim as memory pressure\n\nWhen the cgroup has no memory pressure at all, writing to\n/sys/devices/system/nodeX/reclaim triggers proactive reclaim on\nNUMA node, causing increase in the writer cgroup\u0027s memory PSI.\n\nDue to this reclaim is performed in the context of the write(),\naccounted as memory pressure on the writer, like\ncommit e22c6ed90aa9 (\"mm: memcontrol: don\u0027t count limit-setting reclaim\nas memory pressure\"). This is unexpected, the similar scenarios (e.g.\nsenpai) will continue to occur, only this time it is for the\n/sys/devices/system/nodeX/reclaim knob.\n\nThe Documentation/ABI/stable/sysfs-devices-node documentation also\nnotes that \"This interface is equivalent to the memcg variant.\"\n\nThis patch unifies the semantics of the memcg and node interfaces:\nper-node proactive reclaim is no longer counted as memory pressure,\nand the per-node proactive reclaim interface no longer produces\nphantom pressure.\n\nI ran demo[1] that performs per-node proactive reclaim 10000 times\nin qemu, writer cgroup memory.pressure as follows:\n\nwithout patch:\n\nsome avg10\u003d31.53 avg60\u003d13.42 avg300\u003d3.31 total\u003d10602985\nfull avg10\u003d31.53 avg60\u003d13.42 avg300\u003d3.31 total\u003d10602985\n\nwith patch:\n\nsome avg10\u003d9.59 avg60\u003d3.41 avg300\u003d0.81 total\u003d2686221\nfull avg10\u003d9.59 avg60\u003d3.41 avg300\u003d0.81 total\u003d2686221\n\n\nLink: https://lore.kernel.org/20261012022917.1102467-1-vernon2gm@gmail.com\nLink: https://github.com/vernon2gh/app_and_module/tree/main/reclaim_node_psi [1]\nFixes: b980077899ea (\"mm: introduce per-node proactive reclaim interface\")\nSigned-off-by: Vernon Yang \u003cyanglincheng@kylinos.cn\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nReviewed-by: Barry Song \u003cbaohua@kernel.org\u003e\nReviewed-by: Ridong Chen \u003cridong.chen@linux.dev\u003e\nAcked-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Kairui Song \u003ckasong@tencent.com\u003e\nCc: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nCc: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Yuanchu Xie \u003cyuanchu@google.com\u003e\nCc: Wei Xu \u003cweixugc@google.com\u003e\nCc: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" } ], "next": "e387ebe5cd31720b1e0281fd045be4eef36fadb3" }