)]}' { "log": [ { "commit": "254f49634ee16a731174d2ae34bc50bd5f45e731", "tree": "85d458ac0d767dfd837e09fce9cbf96186955475", "parents": [ "14479877c1ec9667edb4a7c20a8d7a704e7249ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:19:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:19:00 2026 -0700" }, "message": "Linux 7.1-rc1\n" }, { "commit": "14479877c1ec9667edb4a7c20a8d7a704e7249ca", "tree": "5c90898ad7fd03b7d0164bcde816bd25c1e51c79", "parents": [ "20b64cf8705a0f6268bb9a320eb6b4c425f3ec6c", "522567362b634015ca85b5460482ee0843feb105" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:03:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:03:20 2026 -0700" }, "message": "Merge tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fix from Stephen Boyd:\n \"One more fix for the merge window to avoid a boot hang on\n Raspberry Pi 3B by marking the VEC clk critical so that it\n doesn\u0027t get turned off and hang the bus\"\n\n* tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED\n" }, { "commit": "20b64cf8705a0f6268bb9a320eb6b4c425f3ec6c", "tree": "6e55fdd6b6bfc4efe61d061cca785890663ba769", "parents": [ "b935117fe6d1af576e39b1f18c9e875f44bd146f", "3177779ae17db4c66c851f799505fb95c7530c03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 09:51:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 09:51:29 2026 -0700" }, "message": "Merge tag \u0027tsm-for-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm\n\nPull PCIe TSP update from Dan Williams:\n \"A small update for the TSM core. It is arguably a fix and coming in\n late as I have been offline the past few weeks:\n\n - Drop class_create() for the \u0027tsm\u0027 class\"\n\n* tag \u0027tsm-for-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:\n virt: coco: change tsm_class to a const struct\n" }, { "commit": "b935117fe6d1af576e39b1f18c9e875f44bd146f", "tree": "1da88d9f76fcf4a130f93657dbe79f16e7959968", "parents": [ "2ff1bc41ef9133a52c116b36e5e88430353a8ba5", "75f7c47ccd78c947cf1b6ddb18ea453ff0555716" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 17:04:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 17:04:15 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nicolas Schier:\n\n - builddeb - avoid recompiles for non-cross-compiles\n\n Avoid triggering complete rebuilds for non-cross-compile Debian\n package builds by only triggering the rebuild of host tools for\n actual cross-compile builds\n\n - Never respect CONFIG_WERROR / W\u003de to fixdep\n\n Avoid spurious rebuilds of fixdep w/ and w/o -Werror during a single\n kbuild invocation by never respecting CONFIG_WERROR for fixdep\n\n* tag \u0027kbuild-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n kbuild: Never respect CONFIG_WERROR / W\u003de to fixdep\n kbuild: builddeb - avoid recompiles for non-cross-compiles\n" }, { "commit": "2ff1bc41ef9133a52c116b36e5e88430353a8ba5", "tree": "b996f0b1396f6300f50afa1703b54ec4f4c249bb", "parents": [ "211d5933141197b37a7501271e49e4b88540615f", "6112da1ea4a7cfac35e51a20d17ca9cdf946c368" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:58:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:58:34 2026 -0700" }, "message": "Merge tag \u0027power-utilities-2026.04.25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux\n\nPull power utility updates from Len Brown:\n \"x86_energy_perf_policy:\n - Initial SoC Slider support\n\n turbostat:\n - Display HT siblings in cpu# order\n - Add Module-ID column\n - Print Core-ID and APIC-ID in hex\n - Fix misc bugs\"\n\n* tag \u0027power-utilities-2026.04.25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:\n tools/power x86_energy_perf_policy: Version 2026.04.25\n tools/power x86_energy_perf_policy.8: Document SoC Slider Options\n tools/power x86_energy_perf_policy: Enhances SoC Slider related checks\n tools/power turbostat: v2026.04.21\n tools/power turbostat: Process HT siblings in CPU order\n tools/power turbostat: Show module_id column\n tools/power turbostat: Print core_id and apic_id in hex\n tools/power turbostat: Cleanup print helper functions\n tools/power turbostat: Fix --cpu-set 1 regression on HT systems\n tools/power turbostat: Fix --cpu-set 0 regression on HT systems\n tools/power turbostat: Fix unrecognized option \u0027-P\u0027\n tools/power turbostat: Fix AMD RAPL regression on big systems\n tools/power/x86: Add SOC slider and platform profile support\n" }, { "commit": "211d5933141197b37a7501271e49e4b88540615f", "tree": "010d7ae0a4ac4aeda99bebefc4c0194551613424", "parents": [ "1d9f1b5e4374c6b40df1a56b35901312ec98c9af", "0fedce7244e4b85c049ce579c87e298a1b0b811d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:39:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:39:03 2026 -0700" }, "message": "Merge tag \u0027rtc-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC updates from Alexandre Belloni:\n \"Subsystem:\n - add data_race() in rtc_dev_poll()\n\n Drivers:\n - remove i2c_match_id usage\n - abx80x: Disable alarm feature if no interrupt attached\n - ti-k3: support resuming from IO DDR low power mode\"\n\n* tag \u0027rtc-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n rtc: abx80x: Disable alarm feature if no interrupt attached\n rtc: ntxec: fix OF node reference imbalance\n rtc: pic32: allow driver to be compiled with COMPILE_TEST\n rtc: ti-k3: Add support to resume from IO DDR low power mode\n rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe()\n dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc\n dt-bindings: rtc: sc2731: Add compatible for SC2730\n rtc: add data_race() in rtc_dev_poll()\n rtc: armada38x: zalloc + calloc to single allocation\n dt-bindings: rtc: isl12026: convert to YAML schema\n dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply\n rtc: max77686: convert to i2c_new_ancillary_device\n dt-bindings: rtc: mpfs-rtc: permit resets\n rtc: rx8025: Remove use of i2c_match_id()\n rtc: rv8803: Remove use of i2c_match_id()\n rtc: rs5c372: Remove use of i2c_match_id()\n rtc: pcf2127: Remove use of i2c_match_id()\n rtc: m41t80: Remove use of i2c_match_id()\n rtc: abx80x: Remove use of i2c_match_id()\n" }, { "commit": "1d9f1b5e4374c6b40df1a56b35901312ec98c9af", "tree": "d4619174e5c8572a61a0d3b103abd776bb509a29", "parents": [ "897d54018cc9aa97fd1529ca08a53b429d05a566", "949692da7211572fac419b2986b6abc0cd1aeb76" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:20:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:20:52 2026 -0700" }, "message": "Merge tag \u0027for-next-tpm-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull tpm updates from Jarkko Sakkinen:\n \"Here are the accumulated fixes for 7.1-rc1 and a single structural\n change worth mentioning separately: Rafael\u0027s commit converting tpm_crb\n from ACPI driver to a platform driver\"\n\n* tag \u0027for-next-tpm-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm: tpm_tis: stop transmit if retries are exhausted\n tpm: tpm_tis: add error logging for data transfer\n tpm: avoid -Wunused-but-set-variable\n tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()\n tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()\n tpm: Fix auth session leak in tpm2_get_random() error path\n tpm: i2c: atmel: fix block comment formatting\n tpm_crb: Convert ACPI driver to a platform one\n tpm: Make tcpci_pm_ops variable static const\n" }, { "commit": "6112da1ea4a7cfac35e51a20d17ca9cdf946c368", "tree": "6911677516ff9b9f380e363762a648b7890b3fe8", "parents": [ "b488997b9cb006e175908b70fc0a2f3601a763d1", "f1c35c73191b7d23ed4bbc660a7b9ed5b32614e0" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:26:32 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:26:32 2026 -0400" }, "message": "Merge branches \u0027turbostat\u0027 and \u0027x86_energy_perf_policy\u0027 into power-utilities\n" }, { "commit": "f1c35c73191b7d23ed4bbc660a7b9ed5b32614e0", "tree": "193af4b6b1059c628898d654c6bca19453d07e20", "parents": [ "18c5b9ea4ea4be5ed9b5b6add30a2a7911326224" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 13:26:16 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:18:45 2026 -0400" }, "message": "tools/power x86_energy_perf_policy: Version 2026.04.25\n\nSince v2025.11.22:\n\tInitial SoC Slider support\n\tSoC Slider is an SoC-wide power/performance policy setting.\n\tOn SoC Slider systems, EPP plays a diminished role.\n\nWhitespace cleanup via: indent -npro -kr -i8 -ts8 -sob -l160 -ss -ncs -cp1\n\nNo functional changes\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "18c5b9ea4ea4be5ed9b5b6add30a2a7911326224", "tree": "b164c15492eca81b874bb7463ea44b3ffc58ed75", "parents": [ "25ff5848c05bc660739089cf9c6de4a166bd7932" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 12:10:54 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:16:53 2026 -0400" }, "message": "tools/power x86_energy_perf_policy.8: Document SoC Slider Options\n\nx86_energy_perf_policy accesses the SoC Slider via standard\nuser/kernel APIs to the processor_thermal_soc_slider driver.\n\nMachines that support SoC Slider largely use it instead of EPP,\nwhich may continue to exist in a diminished role, or vanish entirely.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "25ff5848c05bc660739089cf9c6de4a166bd7932", "tree": "917afde8bd56248fc3aba561a6302061138407be", "parents": [ "feffac1874820d501e51cd8dcee697063b792c82" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Wed Apr 15 15:12:29 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:10:13 2026 -0400" }, "message": "tools/power x86_energy_perf_policy: Enhances SoC Slider related checks\n\nWhen processor_thermal_soc_slider is loaded, its slider\nand offset modparams are visible. Check that the driver\nactually registered the profile named \"SoC Slider\" before\nreading or writing these modparams.\n\nn.b. This utility allows writing the Slider and Offset modparams\neven if the driver policy is not \"balanced\". Currently the\nprocessor_thermal_soc_slider consults those modparams\nonly in \"balanced\" mode.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "522567362b634015ca85b5460482ee0843feb105", "tree": "6b85f36328e4c3b3a196c2077184e6f273b76ad7", "parents": [ "6b701fde9b31f085f39fc2a371cb33212fab6f68" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Apr 24 16:34:52 2026 +0100" }, "committer": { "name": "Stephen Boyd", "email": "sboyd@kernel.org", "time": "Sat Apr 25 10:51:23 2026 -0700" }, "message": "clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED\n\nOn Raspberry Pi 3B, the VEC clock is used by the VideoCore firmware\ndisplay driver, which remains active until the vc4 driver loads and\nsends NOTIFY_DISPLAY_DONE. If this clock is disabled during boot, a bus\nlockup happens and the firmware becomes unresponsive, causing a complete\nsystem lockup.\n\nMark the VEC clock with CLK_IGNORE_UNUSED so it survives the unused\nclock disablement and remains available until the vc4 driver takes over\ndisplay management.\n\nFixes: 672299736af6 (\"clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks\")\nReported-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCloses: https://lore.kernel.org/r/5f0bec08-f458-4fba-8bf3-06817a100c4c@sirena.org.uk\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nLink: https://patch.msgid.link/20260401111416.562279-2-mcanal@igalia.com\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nAcked-by: Brian Masney \u003cbmasney@redhat.com\u003e # Active contributor to clk\nReviewed-by: Stefan Wahren \u003cwahrenst@gmx.net\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@kernel.org\u003e\n" }, { "commit": "897d54018cc9aa97fd1529ca08a53b429d05a566", "tree": "82a5c1195638ccdfafab23fb6e6c402646c02a12", "parents": [ "129d6eb266e0848c9bf45da6e30291688c12b5ad", "448aaf54d3ae1b73dfcf723c9f8a02c2116f3358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:48:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:48:33 2026 -0700" }, "message": "Merge tag \u0027fbdev-for-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev fixes from Helge Deller:\n\n - request memory region before use (cobalt_lcdfb, clps711x-fb, hgafb)\n\n - reference cleanups in failure path (offb, savage)\n\n - a spelling fix (atyfb)\n\n* tag \u0027fbdev-for-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: hgafb: Request memory region before ioremap\n fbdev: clps711x-fb: Request memory region for MMIO\n fbdev: cobalt_lcdfb: Request memory region\n fbdev: atyfb: Fix spelling mistake \"enfore\" -\u003e \"enforce\"\n fbdev: savage: fix probe-path EDID cleanup leaks\n fbdev: offb: fix PCI device reference leak on probe failure\n" }, { "commit": "129d6eb266e0848c9bf45da6e30291688c12b5ad", "tree": "6709cec6768c96c3f7da2d248f7fdf9b55f62271", "parents": [ "27d128c1cff64c3b8012cc56dd5a1391bb4f1821", "c6e61c06d6061750597e79c598acb5dead44c35b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:44:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:44:26 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM updates from Russell King:\n\n - fix a race condition handling PG_dcache_clean\n\n - further cleanups for the fault handling, allowing RT to be enabled\n\n - fixing nzones validation in adfs filesystem driver\n\n - fix for module unwinding\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9463/1: Allow to enable RT\n ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()\n ARM: 9471/1: module: fix unwind section relocation out of range error\n fs/adfs: validate nzones in adfs_validate_bblk()\n ARM: provide individual is_translation_fault() and is_permission_fault()\n ARM: move FSR fault status definitions before fsr_fs()\n ARM: use BIT() and GENMASK() for fault status register fields\n ARM: move is_permission_fault() and is_translation_fault() to fault.h\n ARM: move vmalloc() lazy-page table population\n ARM: ensure interrupts are enabled in __do_user_fault()\n" }, { "commit": "27d128c1cff64c3b8012cc56dd5a1391bb4f1821", "tree": "4a4c32f9935f662e6141e663dde256152ea984ff", "parents": [ "f3e3dbcea15e20f7413afd8c791a496f0b80e80b", "92d5a606721f759ebebf448b3bd2b7a781d50bd0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:17:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:17:23 2026 -0700" }, "message": "Merge tag \u0027trace-ring-buffer-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fix from Steven Rostedt:\n\n - Fix accounting of persistent ring buffer rewind\n\n On boot up, the head page is moved back to the earliest point of the\n saved ring buffer. This is because the ring buffer being read by user\n space on a crash may not save the part it read. Rewinding the head\n page back to the earliest saved position helps keep those events from\n being lost.\n\n The number of events is also read during boot up and displayed in the\n stats file in the tracefs directory. It\u0027s also used for other\n accounting as well. On boot up, the \"reader page\" is accounted for\n but a rewind may put it back into the buffer and then the reader page\n may be accounted for again.\n\n Save off the original reader page and skip accounting it when\n scanning the pages in the ring buffer.\n\n* tag \u0027trace-ring-buffer-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Do not double count the reader_page\n" }, { "commit": "f3e3dbcea15e20f7413afd8c791a496f0b80e80b", "tree": "c86781264f4dde34121efe316c2cf39790d9c8e2", "parents": [ "fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247", "895a9b37917d2718ef2240a7ead7458c22f1f011" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:06:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:06:55 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Series for zloop, fixing a variety of issues\n\n - t10-pi code cleanup\n\n - Fix for a merge window regression with the bio memory allocation mask\n\n - Fix for a merge window regression in ublk, caused by an issue with\n the maple tree iteration code at teardown\n\n - ublk self tests additions\n\n - Zoned device pgmap fixes\n\n - Various little cleanups and fixes\n\n* tag \u0027block-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits)\n Revert \"floppy: fix reference leak on platform_device_register() failure\"\n ublk: avoid unpinning pages under maple tree spinlock\n ublk: refactor common helper ublk_shmem_remove_ranges()\n ublk: fix maple tree lockdep warning in ublk_buf_cleanup\n selftests: ublk: add ublk auto integrity test\n selftests: ublk: enable test_integrity_02.sh on fio 3.42\n selftests: ublk: remove unused argument to _cleanup\n block: only restrict bio allocation gfp mask asked to block\n block/blk-throttle: Add WQ_PERCPU to alloc_workqueue users\n block: Add WQ_PERCPU to alloc_workqueue users\n block: relax pgmap check in bio_add_page for compatible zone device pages\n block: add pgmap check to biovec_phys_mergeable\n floppy: fix reference leak on platform_device_register() failure\n ublk: use unchecked copy helpers for bio page data\n t10-pi: reduce ref tag code duplication\n zloop: remove irq-safe locking\n zloop: factor out zloop_mark_{full,empty} helpers\n zloop: set RQF_QUIET when completing requests on deleted devices\n zloop: improve the unaligned write pointer warning\n zloop: use vfs_truncate\n ...\n" }, { "commit": "fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247", "tree": "63d499f179e09f3377213221f6d8c55f70059d69", "parents": [ "b85900e91c8402bedc1db14e6d293e26f25d30d4", "d0be8884f56b0b800cd8966e37ce23417cd5044e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:00:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:00:54 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix for a NOMMU bug with io_uring, where NOMMU doesn\u0027t grab page refs\n at mmap time. NOMMU also has entirely broken FOLL_PIN support, yet\n here we are\n\n - A few fixes covering minor issues introduced in this merge window\n\n - data race annotation to shut up KCSAN for when io-wq limits are\n applied\n\n - A nospec addition for direct descriptor file updating. Rest of the\n direct descriptor path already had this, but for some reason the\n update did not. Now they are all the same\n\n - Various minor defensive changes that claude identified and suggested\n terrible fixes for, turned into actually useful cleanups:\n\n - Use kvfree() for the imu cache. These can come from kmalloc or\n vmalloc depending on size, but the in-cache ones are capped\n where it\u0027s always kmalloc based. Change to kvfree() in the\n cleanup path, making future changes unlikely to mess that up\n\n - Negative kbuf consumption lengths. Can\u0027t happen right now, but\n cqe-\u003eres is used directly, which if other codes changes could\n then be an error value\n\n - Fix for an issue with the futex code, where partial wakes on a\n vectored fuxes would potentially wake the same futex twice, rather\n than move on to the next one. This could confuse an application as it\n would\u0027ve expected the next futex to have been woken\n\n - Fix for a bug with ring resizing, where SQEs or CQEs might not have\n been copied correctly if large SQEs or CQEs are used in the ring.\n Application side issue, where SQEs or CQEs might have been lost\n during resize\n\n - Fix for a bug where EPOLL_URING_WAKE might have been lost, causing a\n multishot poll to not be terminated when it\u0027s nested, like it should\n have been\n\n - Fix for an issue with signed comparison of poll references for the\n slow path\n\n - Fix for a user struct UAF in the zcrx code\n\n - Two minor zcrx cleanups\n\n* tag \u0027io_uring-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: take page references for NOMMU pbuf_ring mmaps\n io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE\n io_uring/zcrx: warn on freelist violations\n io_uring/zcrx: clear RQ headers on init\n io_uring/zcrx: fix user_struct uaf\n io_uring/register: fix ring resizing with mixed/large SQEs/CQEs\n io_uring/futex: ensure partial wakes are appropriately dequeued\n io_uring/rw: add defensive hardening for negative kbuf lengths\n io_uring/rsrc: use kvfree() for the imu cache\n io_uring/rsrc: unify nospec indexing for direct descriptors\n io_uring: fix spurious fput in registered ring path\n io_uring: fix iowq_limits data race in tctx node addition\n io_uring/tctx: mark io_wq as exiting before error path teardown\n io_uring/tctx: check for setup tctx-\u003eio_wq before teardown\n io_uring/poll: fix signed comparison in io_poll_get_ownership()\n" }, { "commit": "b85900e91c8402bedc1db14e6d293e26f25d30d4", "tree": "22ff0ae976fab5251d72ad8f9c4552034f32a421", "parents": [ "ac2dc6d57425ffa9629941d7c9d7c0e51082cb5a", "e6614b88d59d110ee1a80ed0826e34f24dd35c96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 14:20:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 14:20:03 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.1-1\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs\n\nPull NFS client updates from Trond Myklebust:\n \"Bugfixes:\n\n - Fix handling of ENOSPC so that if we have to resend writes, they\n are written synchronously\n\n - SUNRPC RDMA transport fixes from Chuck\n\n - Several fixes for delegated timestamps in NFSv4.2\n\n - Failure to obtain a directory delegation should not cause stat() to\n fail with NFSv4\n\n - Rename was failing to update timestamps when a directory delegation\n is held on NFSv4\n\n - Ensure we check rsize/wsize after crossing a NFSv4 filesystem\n boundary\n\n - NFSv4/pnfs:\n\n - If the server is down, retry the layout returns on reboot\n\n - Fallback to MDS could result in a short write being incorrectly\n logged\n\n Cleanups:\n\n - Use memcpy_and_pad in decode_fh\"\n\n* tag \u0027nfs-for-7.1-1\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (21 commits)\n NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address\n NFS: remove redundant __private attribute from nfs_page_class\n NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes\n NFS: fix writeback in presence of errors\n nfs: use memcpy_and_pad in decode_fh\n NFSv4.1: Apply session size limits on clone path\n NFSv4: retry GETATTR if GET_DIR_DELEGATION failed\n NFS: fix RENAME attr in presence of directory delegations\n pnfs/flexfiles: validate ds_versions_cnt is non-zero\n NFS/blocklayout: print each device used for SCSI layouts\n xprtrdma: Post receive buffers after RPC completion\n xprtrdma: Scale receive batch size with credit window\n xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursor\n xprtrdma: Decouple frwr_wp_create from frwr_map\n xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot\n xprtrdma: Avoid 250 ms delay on backlog wakeup\n xprtrdma: Close sendctx get/put race that can block a transport\n nfs: update inode ctime after removexattr operation\n nfs: fix utimensat() for atime with delegated timestamps\n NFS: improve \"Server wrote zero bytes\" error\n ...\n" }, { "commit": "ac2dc6d57425ffa9629941d7c9d7c0e51082cb5a", "tree": "1a63ab616fe8a13d2f37772290c4aa6f8a1323ae", "parents": [ "ff9726d7a0068e6c2ae1969415285d12ef4d5c6f", "b1137e0b3d4bad1cad73fa9bac763c74ddd1813d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:47:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:47:19 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc1\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph updates from Ilya Dryomov:\n \"We have a series from Alex which extends CephFS client metrics with\n support for per-subvolume data I/O performance and latency tracking\n (metadata operations aren\u0027t included) and a good variety of fixes and\n cleanups across RBD and CephFS\"\n\n* tag \u0027ceph-for-7.1-rc1\u0027 of https://github.com/ceph/ceph-client:\n ceph: add subvolume metrics collection and reporting\n ceph: parse subvolume_id from InodeStat v9 and store in inode\n ceph: handle InodeStat v8 versioned field in reply parsing\n libceph: Fix slab-out-of-bounds access in auth message processing\n rbd: fix null-ptr-deref when device_add_disk() fails\n crush: cleanup in crush_do_rule() method\n ceph: clear s_cap_reconnect when ceph_pagelist_encode_32() fails\n ceph: only d_add() negative dentries when they are unhashed\n libceph: update outdated comment in ceph_sock_write_space()\n libceph: Remove obsolete session key alignment logic\n ceph: fix num_ops off-by-one when crypto allocation fails\n libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()\n" }, { "commit": "ff9726d7a0068e6c2ae1969415285d12ef4d5c6f", "tree": "1eda5d8552f6d806f69c49838a6b1d7706574899", "parents": [ "bdcb864c719f7cf8629ada18450fd4efbb16afe8", "36ee1313199b7f16bf963c6ac0241861585125d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:40:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:40:25 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs updates from Namjae Jeon:\n\n - Fix potential data leakage by zeroing the portion of the straddle\n block beyond initialized_size when reading non-resident attributes\n\n - Remove unnecessary zeroing in ntfs_punch_hole() for ranges beyond\n initialized_size, as they are already returned as zeros on read\n\n - Fix writable check in ntfs_file_mmap_prepare() to correctly handle\n shared mappings using VMA_SHARED_BIT | VMA_MAYWRITE_BIT\n\n - Use page allocation instead of kmemdup() for IOMAP_INLINE data to\n ensure page-aligned address and avoid BUG trap in\n iomap_inline_data_valid() caused by the page boundary check\n\n - Add a size check before memory allocation in ntfs_attr_readall() and\n reject overly large attributes\n\n - Remove unneeded noop_direct_IO from ntfs_aops as it is no longer\n required following the FMODE_CAN_ODIRECT flag\n\n - Fix seven static analysis warnings reported by Smatch\n\n* tag \u0027ntfs-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: use page allocation for resident attribute inline data\n ntfs: fix mmap_prepare writable check for shared mappings\n ntfs: fix potential 32-bit truncation in ntfs_write_cb()\n ntfs: fix uninitialized variable in ntfs_map_runlist_nolock\n ntfs: delete dead code\n ntfs: add missing error code in ntfs_mft_record_alloc()\n ntfs: fix uninitialized variables in ntfs_ea_set_wsl_inode()\n ntfs: fix uninitialized pointer in ntfs_write_mft_block\n ntfs: fix uninitialized variable in ntfs_write_simple_iomap_begin_non_resident\n ntfs: remove noop_direct_IO from address_space_operations\n ntfs: limit memory allocation in ntfs_attr_readall\n ntfs: not zero out range beyond init in punch_hole\n ntfs: zero out stale data in straddle block beyond initialized_size\n" }, { "commit": "bdcb864c719f7cf8629ada18450fd4efbb16afe8", "tree": "718baa82d9a32732a9ab06cc398c79f31d5f1455", "parents": [ "f9569c6ce4a4bbad0876ca7bd1e04fbfbbc1641f", "8fc518e489c1386fd0cf7f4256d055960ed6a2e4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:37:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:37:26 2026 -0700" }, "message": "Merge tag \u00279p-for-7.1-rc1\u0027 of https://github.com/martinetd/linux\n\nPull 9p updates from Dominique Martinet:\n\n - 9p access flag fix (cannot change access flag since new mount API implem)\n\n - some minor cleanup\n\n* tag \u00279p-for-7.1-rc1\u0027 of https://github.com/martinetd/linux:\n 9p/trans_xen: replace simple_strto* with kstrtouint\n 9p/trans_xen: make cleanup idempotent after dataring alloc errors\n 9p: document missing enum values in kernel-doc comments\n 9p: fix access mode flags being ORed instead of replaced\n 9p: fix memory leak in v9fs_init_fs_context error path\n" }, { "commit": "f9569c6ce4a4bbad0876ca7bd1e04fbfbbc1641f", "tree": "c2b6752bb078de1593437400ae359ea1e4af2ab0", "parents": [ "cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a", "ebf1bafd090790704ba54c032de299fccd90a9da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:30:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:30:54 2026 -0700" }, "message": "Merge tag \u0027spdx-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx\n\nPull SPDX update from Greg KH:\n \"Here is a single SPDX-like change for 7.1-rc1. It explicitly allows\n the use of SPDX-FileCopyrightText which has been used already in many\n files.\n\n At the same time, update checkpatch to catch any \"non allowed\" spdx\n identifiers as we don\u0027t want to go overboard here.\n\n This has been in linux-next for a long time with no reported problems\"\n\n* tag \u0027spdx-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:\n LICENSES: Explicitly allow SPDX-FileCopyrightText\n" }, { "commit": "cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a", "tree": "c50311c87c0d464bfbba34e5c3b8699897fb1b65", "parents": [ "b2680ba4a2ad259c7bbd856ed830b459e11d88ba", "1c0220a61508d67a09a6e71eb09593a8aea61822" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:23:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:23:50 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char / misc / IIO / and others driver updates from Greg KH:\n \"Here is the char/misc/iio and other smaller driver subsystem updates\n for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the\n different drivers they touch. Major points in here is:\n\n - the usual large set of new IIO drivers and updates for that\n subsystem (the large majority of this diffstat)\n\n - lots of comedi driver updates and bugfixes\n\n - coresight driver updates\n\n - interconnect driver updates and additions\n\n - mei driver updates\n\n - binder (both rust and C versions) updates and fixes\n\n - lots of other smaller driver subsystem updates and additions\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027char-misc-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits)\n coresight: tpdm: fix invalid MMIO access issue\n mei: me: add nova lake point H DID\n mei: lb: add late binding version 2\n mei: bus: add mei_cldev_uuid\n w1: ds2490: drop redundant device reference\n bus: mhi: host: pci_generic: Add Telit FE912C04 modem support\n mei: csc: wake device while reading firmware status\n mei: csc: support controller with separate PCI device\n mei: convert PCI error to common errno\n mei: trace: print return value of pci_cfg_read\n mei: me: move trace into firmware status read\n mei: fix idle print specifiers\n mei: me: use PCI_DEVICE_DATA macro\n sonypi: Convert ACPI driver to a platform one\n misc: apds990x: fix all kernel-doc warnings\n most: usb: Use kzalloc_objs for endpoint address array\n hpet: Convert ACPI driver to a platform one\n misc: vmw_vmci: Fix spelling mistakes in comments\n parport: Remove completed item from to-do list\n char: remove unnecessary module_init/exit functions\n ...\n" }, { "commit": "b2680ba4a2ad259c7bbd856ed830b459e11d88ba", "tree": "4d90dbf641d88509cbb27e82dd92bad5294f4ce6", "parents": [ "f64399836125c8512f8a3fe72c1719795a9c5812", "16ab65df5d867961a79cef366cdb33f09ebda603" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:16:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:16:36 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"This is quite a big set of fixes, almost all from Johan Hovold who is\n on an ongoing quest to clean up issues with probe and removal handling\n in drivers.\n\n There isn\u0027t anything too concerning here especially with the\n deregistration stuff which will very rarely get run in production\n systems since this is all platform devices in the SoC on embedded\n hardware, but it\u0027s all real issues which should be fixed. There\u0027s more\n in flight here.\n\n We also have a few other minor fixes, one from Felix Gu along the same\n lines as Johan\u0027s work and a couple of documentation things\"\n\n* tag \u0027spi-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (23 commits)\n spi: fix controller cleanup() documentation\n spi: fix resource leaks on device setup failure\n spi: axiado: clean up probe return value\n spi: axiado: rename probe error labels\n spi: axiado: fix runtime pm imbalance on probe failure\n spi: orion: clean up probe return value\n spi: orion: fix clock imbalance on registration failure\n spi: orion: fix runtime pm leak on unbind\n spi: imx: fix runtime pm leak on probe deferral\n spi: mpc52xx: fix use-after-free on registration failure\n spi: Fix the error description in the `ptp_sts_word_post` comment\n spi: topcliff-pch: fix use-after-free on unbind\n spi: topcliff-pch: fix controller deregistration\n spi: orion: fix controller deregistration\n spi: mxic: fix controller deregistration\n spi: mpc52xx: fix use-after-free on unbind\n spi: mpc52xx: fix controller deregistration\n spi: cadence-quadspi: fix controller deregistration\n spi: cadence: fix controller deregistration\n spi: mtk-snfi: fix memory leak in probe\n ...\n" }, { "commit": "f64399836125c8512f8a3fe72c1719795a9c5812", "tree": "0c024bf9d45eae5160b7a2ad875c40596b36b0e2", "parents": [ "6e2d43100c906c6f3d68c45fd2a08ea4be92285c", "2af72ec297d1d4928d0522b45c8ee87cb0d5f5ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:06:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:06:25 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"Just one trivial cleanup of the user visible prompts in Kconfig here,\n standardising how we describe Qualcomm\"\n\n* tag \u0027regulator-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: qcom: Unify user-visible \"Qualcomm\" name\n" }, { "commit": "92d5a606721f759ebebf448b3bd2b7a781d50bd0", "tree": "009c94ff1d7585306dadcf2e1256129b22d0e510", "parents": [ "5335e318ad3cf12d905de27e3be4e7fd7b1c6746" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Apr 24 15:52:10 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Apr 24 15:34:39 2026 -0400" }, "message": "ring-buffer: Do not double count the reader_page\n\nSince the cpu_buffer-\u003ereader_page is updated if there are unwound\npages. After that update, we should skip the page if it is the\noriginal reader_page, because the original reader_page is already\nchecked.\n\nCc: stable@vger.kernel.org\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nLink: https://patch.msgid.link/177701353063.2223789.1471163147644103306.stgit@mhiramat.tok.corp.google.com\nFixes: ca296d32ece3 (\"tracing: ring_buffer: Rewind persistent ring buffer on reboot\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6e2d43100c906c6f3d68c45fd2a08ea4be92285c", "tree": "34940de6fdcda1805d393a92d33fcad795c1e569", "parents": [ "d0fc5bf9fe9b89389287846f13cc4e462a89954d", "7e555fcae40ab2ba91fd5cd54a5a83096414957f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 12:11:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 12:11:26 2026 -0700" }, "message": "Merge tag \u0027regmap-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fixes from Mark Brown:\n \"There\u0027s couple of patches here that came in since my pull request:\n\n - What is effectively a quirk for shoehorning support for a wider\n range of I2C regmaps on weirdly restricted SMBus controllers\n\n - One minor fix for a memory leak on in error handling in the dummy\n driver used by the KUnit tests\"\n\n* tag \u0027regmap-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: ram: fix memory leaks in __regmap_init_ram() on error\n regmap-i2c: add SMBus byte/word reg16 bus for adapters lacking I2C_FUNC_I2C\n" }, { "commit": "d0fc5bf9fe9b89389287846f13cc4e462a89954d", "tree": "bc927286a49c97539d1be06403ccc2da77d8b648", "parents": [ "1fe93b2a2ace9bba2cb90920f9300834e537665c", "e31eee4a961077d60ef2362507240c6743c1c2ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:59:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:59:46 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix a regression in gpio-rockchip introduced on older chips during\n the merge window when converting to dynamic GPIO base\n\n - fix AST2700 debounce selector bit definitions in gpio-aspeed\n\n* tag \u0027gpio-fixes-for-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: aspeed: fix AST2700 debounce selector bit definitions\n gpio: rockchip: Fix GPIO regression after conversion to dynamic base allocation\n" }, { "commit": "1fe93b2a2ace9bba2cb90920f9300834e537665c", "tree": "c6c53d4a4348603d1da32922903c9e35b2045b40", "parents": [ "cf950766e96e36c90871d955cfd2a2c1feddba37", "2724fbc90e5c133fbbd030e72fe8a3869a20df08" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:49:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:49:20 2026 -0700" }, "message": "Merge tag \u0027sound-fix-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Here are the rest of small updates for 7.1-rc1. All small fixes mostly\n for device-specific issues or regressions.\n\n Core:\n - Fix a potential data race in fasync handling\n\n USB-audio:\n - New device support: Line6 POD HD PRO, NexiGo N930W webcam\n - Fixes for Audio Advantage Micro II SPDIF switch and E-MU sample\n rates\n - Limit UAC2 rate parsing to prevent potential overflows\n\n HD-Audio:\n - Device-specific quirks for HP, Acer, and Honor laptops\n - Fix for TAS2781 SPI device abnormal sound\n - Move Intel firmware loading into probe work to avoid stalling\n\n ASoC:\n - New support for TI TAS5832\n - Fixes for SoundWire SDCA/DisCo boolean parsing\n - Driver-specific fixes for Intel SOF, ES8311, RT1320, and PXA2xx\n\n Misc:\n - Fixes for resource leaks and data races in 6fire, caiaq, als4000,\n and pcmtest drivers\"\n\n* tag \u0027sound-fix-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (41 commits)\n Revert \"ALSA: pcmtest: fix reference leak on failed device registration\"\n ASoC: tas2781: Add tas5832 support\n ASoC: dt-bindings: ti,tas2781: Add TAS5832 support\n ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch\n ALSA: usb-audio: Avoid false E-MU sample-rate notifications\n ASoC: sdw_utils: cs42l43: allow spk component names to be combined\n ASoC: qcom: x1e80100: limit speaker volumes\n ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx\n ALSA: pcmtest: Fix resource leaks in module init error paths\n ALSA: usb-audio/line6: Add support for POD HD PRO\n ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops\n ASoC: SDCA: Fix reading of mipi-sdca-control-deferrable\n regmap: sdw-mbq: Allow defers on undeferrable controls\n Revert \"ALSA: usb-audio: Add quirk for SmartlinkTechnology M01\"\n ALSA: als4000: Fix capture trigger chip-\u003emode race\n ALSA: core: Fix potential data race at fasync handling\n ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device\n ALSA: hda/realtek: add quirk for Acer Nitro 16 AN16-41\n ALSA: caiaq: Fix control_put() result and cache rollback\n ALSA: pcmtest: fix reference leak on failed device registration\n ...\n" }, { "commit": "cf950766e96e36c90871d955cfd2a2c1feddba37", "tree": "898255d9dac7fa1c2b21175823a8a52885fe2e1b", "parents": [ "92c4c9fdc838d3b41a996bb700ea64b9e78fc7ea", "56d0a0b38faa13836568d425f6ea806e27f3a69e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:44:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:44:52 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull more drm fixes from Dave Airlie:\n \"These are the regular fixes that have built up over last couple of\n weeks, all pretty minor and spread all over.\n\n atomic:\n - raise the vblank timeout to avoid it on virtual drivers\n - fix colorop duplication\n\n bridge:\n - stm_lvds: state check fix\n - dw-mipi-dsi: bridge reference leak fix\n\n panel:\n - visionx-rm69299: init fix\n\n dma-fence:\n - fix sparse warning\n\n dma-buf:\n - UAF fix\n\n panthor:\n - mapping fix\n\n arcgpu:\n - device_node reference leak fix\n\n nouveau:\n - memory leak in error path fix\n - overflow in reloc path for old hw fix\n\n hv:\n - Kconfig fix\n\n v3d:\n - infinite loop fix\"\n\n* tag \u0027drm-fixes-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel:\n drm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers\n drm/v3d: Reject empty multisync extension to prevent infinite loop\n drm/panel: visionox-rm69299: Make use of prepare_prev_first\n drm/drm_atomic: duplicate colorop states if plane color pipeline in use\n drm/nouveau: fix nvkm_device leak on aperture removal failure\n hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS\n dma-fence: Silence sparse warning in dma_fence_describe\n drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails\n drm/arcpgu: fix device node leak\n drm/panthor: Fix outdated function documentation\n drm/panthor: Extend VM locked region for remap case to be a superset\n dma-buf: fix UAF in dma_buf_put() tracepoint\n drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector\n drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()\n" }, { "commit": "92c4c9fdc838d3b41a996bb700ea64b9e78fc7ea", "tree": "e5a1763ce1295ccdeb94f4e26ee52eb4f3c3aed6", "parents": [ "892c894b4ba4e4eb835f99de6fe7c41871e6d4f8", "e49712ef03dbc4e282dd0e76469642279c2811e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:33:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:33:23 2026 -0700" }, "message": "Merge tag \u0027drm-next-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm next fixes from Dave Airlie:\n \"This is the first of two fixes for the merge PRs, the other is based\n on 7.0 branch. This mostly AMD fixes, a couple of weeks of backlog\n built up and this weeks. The main complaint I\u0027ve seen is some boot\n warnings around the FP code handling which this should fix. Otherwise\n a single rcar-du and a single i915 fix.\n\n amdgpu:\n - SMU 14 fixes\n - Partition fixes\n - SMUIO 15.x fix\n - SR-IOV fixes\n - JPEG fix\n - PSP 15.x fix\n - NBIF fix\n - Devcoredump fixes\n - DPC fix\n - RAS fixes\n - Aldebaran smu fix\n - IP discovery fix\n - SDMA 7.1 fix\n - Runtime pm fix\n - MES 12.1 fix\n - DML2 fixes\n - DCN 4.2 fixes\n - YCbCr fixes\n - Freesync fixes\n - ISM fixes\n - Overlay cursor fix\n - DC FP fixes\n - UserQ locking fixes\n - DC idle state manager fix\n - ASPM fix\n - GPUVM SVM fix\n - DCE 6 fix\n\n amdkfd:\n - Fix memory clear handling\n - num_of_nodes bounds check fix\n\n i915:\n - Fix uninitialized variable in the alignment loop [psr]\n\n rcar-du:\n - fix NULL-ptr crash\"\n\n* tag \u0027drm-next-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel: (75 commits)\n drm/amdkfd: Add upper bound check for num_of_nodes\n drm: rcar-du: Fix crash when no CMM is available\n drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x\n drm/amdgpu: OR init_pte_flags into invalid leaf PTE updates\n drm/amd: Adjust ASPM support quirk to cover more Intel hosts\n drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c\n drm/i915/psr: Init variable to avoid early exit from et alignment loop\n drm/amdgpu: drop userq fence driver refs out of fence process()\n drm/amdgpu/userq: unpin and unref doorbell and wptr outside mutex\n drm/amdgpu/userq: use pm_runtime_resume_and_get and fix err handling\n drm/amdgpu/userq: unmap_helper dont return the queue state\n drm/amdgpu/userq: unmap is to be called before freeing doorbell/wptr bo\n drm/amdgpu/userq: hold root bo lock in caller of input_va_validate\n drm/amdgpu/userq: caller to take reserv lock for vas_list_cleanup\n drm/amdgpu/userq: create_mqd does not need userq_mutex\n drm/amdgpu/userq: dont lock root bo with userq_mutex held\n drm/amdgpu/userq: fix kerneldoc for amdgpu_userq_ensure_ev_fence\n drm/amdgpu/userq: clean the VA mapping list for failed queue creation\n drm/amdgpu/userq: avoid uneccessary locking in amdgpu_userq_create\n drm/amd/display: Fix ISM teardown crash from NULL dc dereference\n ...\n" }, { "commit": "892c894b4ba4e4eb835f99de6fe7c41871e6d4f8", "tree": "9cc535ebc49a51e720b7a7d2f089738b75606343", "parents": [ "8f4e8687c8f9a3387f51cd534d80b383000d7776", "0adc92b910b3d6bf4913d79869365d553154a070" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:14:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:14:29 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix ww_mutex regression, which caused hangs/pauses in some DRM drivers\n\n - Fix rtmutex proxy-rollback bug\n\n* tag \u0027locking-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/mutex: Fix ww_mutex wait_list operations\n rtmutex: Use waiter::task instead of current in remove_waiter()\n" }, { "commit": "8f4e8687c8f9a3387f51cd534d80b383000d7776", "tree": "91adaf2e869ef085ddb5132addbc0db27ea9a7fc", "parents": [ "feff82eb5f4075d541990d0ba60dad14ea83ea9b", "a39a7014825bd8d10b94fa4f953141b9473c25b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:05:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:05:42 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Prevent deadlock during shstk sigreturn (Rick Edgecombe)\n\n - Disable FRED when PTI is forced on (Dave Hansen)\n\n - Revert a CPA INVLPGB optimization that did not properly handle\n discontiguous virtual addresses (Dave Hansen)\n\n* tag \u0027x86-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mm: Revert INVLPGB optimization for set_memory code\n x86/cpu: Disable FRED when PTI is forced on\n x86/shstk: Prevent deadlock during shstk sigreturn\n" }, { "commit": "feff82eb5f4075d541990d0ba60dad14ea83ea9b", "tree": "b9f16bbd5c8a44552fe94dd2462b296acc03dea8", "parents": [ "ff57d59200baadfdb41f94a49fed7d161a9a8124", "9b3a2be84803cf18c4b4d1efc695991f0daa153c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:00:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:00:37 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.1-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V updates from Paul Walmsley:\n \"There is one significant change outside arch/riscv in this pull\n request: the addition of a set of KUnit tests for strlen(), strnlen(),\n and strrchr().\n\n Otherwise, the most notable changes are to add some RISC-V-specific\n string function implementations, to remove XIP kernel support, to add\n hardware error exception handling, and to optimize our runtime\n unaligned access speed testing.\n\n A few comments on the motivation for removing XIP support. It\u0027s been\n broken in the RISC-V kernel for months. The code is not easy to\n maintain. Furthermore, for XIP support to truly be useful for RISC-V,\n we think that compile-time feature switches would need to be added for\n many of the RISC-V ISA features and microarchitectural properties that\n are currently implemented with runtime patching. No one has stepped\n forward to take responsibility for that work, so many of us think it\u0027s\n best to remove it until clear use cases and champions emerge.\n\n Summary:\n\n - Add Kunit correctness testing and microbenchmarks for strlen(),\n strnlen(), and strrchr()\n\n - Add RISC-V-specific strnlen(), strchr(), strrchr() implementations\n\n - Add hardware error exception handling\n\n - Clean up and optimize our unaligned access probe code\n\n - Enable HAVE_IOREMAP_PROT to be able to use generic_access_phys()\n\n - Remove XIP kernel support\n\n - Warn when addresses outside the vmemmap range are passed to\n vmemmap_populate()\n\n - Update the ACPI FADT revision check to warn if it\u0027s not at least\n ACPI v6.6, which is when key RISC-V-specific tables were added to\n the specification\n\n - Increase COMMAND_LINE_SIZE to 2048 to match ARM64, x86, PowerPC,\n etc.\n\n - Make kaslr_offset() a static inline function, since there\u0027s no need\n for it to show up in the symbol table\n\n - Add KASLR offset and SATP to the VMCOREINFO ELF notes to improve\n kdump support\n\n - Add Makefile cleanup rule for vdso_cfi copied source files, and add\n a .gitignore for the build artifacts in that directory\n\n - Remove some redundant ifdefs that check Kconfig macros\n\n - Add missing SPDX license tag to the CFI selftest\n\n - Simplify UTS_MACHINE assignment in the RISC-V Makefile\n\n - Clarify some unclear comments and remove some superfluous comments\n\n - Fix various English typos across the RISC-V codebase\"\n\n* tag \u0027riscv-for-linus-7.1-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (31 commits)\n riscv: Remove support for XIP kernel\n riscv: Reuse compare_unaligned_access() in check_vector_unaligned_access()\n riscv: Split out compare_unaligned_access()\n riscv: Reuse measure_cycles() in check_vector_unaligned_access()\n riscv: Split out measure_cycles() for reuse\n riscv: Clean up \u0026 optimize unaligned scalar access probe\n riscv: lib: add strrchr() implementation\n riscv: lib: add strchr() implementation\n riscv: lib: add strnlen() implementation\n lib/string_kunit: extend benchmarks to strnlen() and chr searches\n lib/string_kunit: add performance benchmark for strlen()\n lib/string_kunit: add correctness test for strrchr()\n lib/string_kunit: add correctness test for strnlen()\n lib/string_kunit: add correctness test for strlen()\n riscv: vdso_cfi: Add .gitignore for build artifacts\n riscv: vdso_cfi: Add clean rule for copied sources\n riscv: enable HAVE_IOREMAP_PROT\n riscv: mm: WARN_ON() for bad addresses in vmemmap_populate()\n riscv: acpi: update FADT revision check to 6.6\n riscv: add hardware error trap handler support\n ...\n" }, { "commit": "ff57d59200baadfdb41f94a49fed7d161a9a8124", "tree": "ba3e10b29fe41a53e6b5c2f6f555189962859e56", "parents": [ "64edfa65062dc4509ba75978116b2f6d392346f5", "7939f96f26e96b69db1fe4e7c18537a679696358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:54:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:54:45 2026 -0700" }, "message": "Merge tag \u0027loongarch-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch updates from Huacai Chen:\n\n - Adjust build infrastructure for 32BIT/64BIT\n\n - Add HIGHMEM (PKMAP and FIX_KMAP) support\n\n - Show and handle CPU vulnerabilites correctly\n\n - Batch the icache maintenance for jump_label\n\n - Add more atomic instructions support for BPF JIT\n\n - Add more features (e.g. fsession) support for BPF trampoline\n\n - Some bug fixes and other small changes\n\n* tag \u0027loongarch-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (21 commits)\n selftests/bpf: Enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch\n LoongArch: BPF: Add fsession support for trampolines\n LoongArch: BPF: Introduce emit_store_stack_imm64() helper\n LoongArch: BPF: Support up to 12 function arguments for trampoline\n LoongArch: BPF: Support small struct arguments for trampoline\n LoongArch: BPF: Open code and remove invoke_bpf_mod_ret()\n LoongArch: BPF: Support load-acquire and store-release instructions\n LoongArch: BPF: Support 8 and 16 bit read-modify-write instructions\n LoongArch: BPF: Add the default case in emit_atomic() and rename it\n LoongArch: Define instruction formats for AM{SWAP/ADD}.{B/H} and DBAR\n LoongArch: Batch the icache maintenance for jump_label\n LoongArch: Add flush_icache_all()/local_flush_icache_all()\n LoongArch: Add spectre boundry for syscall dispatch table\n LoongArch: Show CPU vulnerabilites correctly\n LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist\n LoongArch: Use get_random_canary() for stack canary init\n LoongArch: Improve the logging of disabling KASLR\n LoongArch: Align FPU register state to 32 bytes\n LoongArch: Handle CONFIG_32BIT in syscall_get_arch()\n LoongArch: Add HIGHMEM (PKMAP and FIX_KMAP) support\n ...\n" }, { "commit": "64edfa65062dc4509ba75978116b2f6d392346f5", "tree": "a452fde9ee3a647b29bf83f71827fedb59921abc", "parents": [ "82138f0183b40e76affa427bb59c57f079d41ec1", "0c22ed0fadcad620277a56c0ba2867d4850d053a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:41:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:41:58 2026 -0700" }, "message": "Merge tag \u0027net-deletions\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next\n\nPull networking deletions from Jakub Kicinski:\n \"Delete some obsolete networking code\n\n Old code like amateur radio and NFC have long been a burden to core\n networking developers. syzbot loves to find bugs in BKL-era code, and\n noobs try to fix them.\n\n If we want to have a fighting chance of surviving the LLM-pocalypse\n this code needs to find a dedicated owner or get deleted. We\u0027ve talked\n about these deletions multiple times in the past and every time\n someone wanted the code to stay. It is never very clear to me how many\n of those people actually use the code vs are just nostalgic to see it\n go. Amateur radio did have occasional users (or so I think) but most\n users switched to user space implementations since its all super slow\n stuff. Nobody stepped up to maintain the kernel code.\n\n We were lucky enough to find someone who wants to help with NFC so\n we\u0027re giving that a chance. Let\u0027s try to put the rest of this code\n behind us\"\n\n* tag \u0027net-deletions\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next:\n drivers: net: 8390: wd80x3: Remove this driver\n drivers: net: 8390: ultra: Remove this driver\n drivers: net: 8390: AX88190: Remove this driver\n drivers: net: fujitsu: fmvj18x: Remove this driver\n drivers: net: smsc: smc91c92: Remove this driver\n drivers: net: smsc: smc9194: Remove this driver\n drivers: net: amd: nmclan: Remove this driver\n drivers: net: amd: lance: Remove this driver\n drivers: net: 3com: 3c589: Remove this driver\n drivers: net: 3com: 3c574: Remove this driver\n drivers: net: 3com: 3c515: Remove this driver\n drivers: net: 3com: 3c509: Remove this driver\n net: packetengines: remove obsolete yellowfin driver and vendor dir\n net: packetengines: remove obsolete hamachi driver\n net: remove unused ATM protocols and legacy ATM device drivers\n net: remove ax25 and amateur radio (hamradio) subsystem\n net: remove ISDN subsystem and Bluetooth CMTP\n caif: remove CAIF NETWORK LAYER\n" }, { "commit": "82138f0183b40e76affa427bb59c57f079d41ec1", "tree": "7797a14fd0d12353cb67fb07df8c9fc2f60f6cbe", "parents": [ "bbc4af7ad94c452c00e64fc400fc1317351969b4", "082a6d03a2d685a83a332666b500ad3966349588" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:39:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:39:03 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - A stable fix for k(v)ealloc() where reallocating on a different node\n or shrinking the object can result in either losing the original data\n or a buffer overflow (Marco Elver)\n\n* tag \u0027slab-for-7.1-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n slub: fix data loss and overflow in krealloc()\n" }, { "commit": "bbc4af7ad94c452c00e64fc400fc1317351969b4", "tree": "d0b26a09925b3435fc75b2558088de61380fbc4b", "parents": [ "eefe0b9dee5db64ec87707c8e44f31851f257389", "4f96b7c68a9904e01049ef610d701b382dca9574" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:29:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:29:51 2026 -0700" }, "message": "Merge tag \u0027clang-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux\n\nPull Clang build fix from Nathan Chancellor:\n\n - Wrap declaration and assignment of key_pass in certs/extract-cert.c\n with \u0027#ifdef\u0027 that matches its only usage to clear up an instance of\n a new clang subwarning, -Wunused-but-set-global.\n\n* tag \u0027clang-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:\n extract-cert: Wrap key_pass with \u0027#ifdef USE_PKCS11_ENGINE\u0027\n" }, { "commit": "eefe0b9dee5db64ec87707c8e44f31851f257389", "tree": "cf1f706574c5139653803742813ed1f161c44852", "parents": [ "dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b", "11b7df0952663f20ce72c9a22a3cf9278cf84db7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:22:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:22:21 2026 -0700" }, "message": "Merge tag \u0027apparmor-pr-2026-04-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor\n\nPull apparmor updates from John Johansen:\n \"Cleanups\n - Use sysfs_emit in param_get_{audit,mode}\n - Remove redundant if check in sk_peer_get_label\n - Replace memcpy + NUL termination with kmemdup_nul in do_setattr\n\n Bug Fixes:\n - Fix aa_dfa_unpack\u0027s error handling in aa_setup_dfa_engine\n - Fix string overrun due to missing termination\n - Fix wrong dentry in RENAME_EXCHANGE uid check\n - fix unpack_tags to properly return error in failure cases\n - fix dfa size check\n - return error on namespace mismatch in verify_header\n - use target task\u0027s context in apparmor_getprocattr()\"\n\n* tag \u0027apparmor-pr-2026-04-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:\n apparmor/lsm: Fix aa_dfa_unpack\u0027s error handling in aa_setup_dfa_engine\n apparmor: Fix string overrun due to missing termination\n apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check\n apparmor: fix unpack_tags to properly return error in failure cases\n apparmor: fix dfa size check\n apparmor: Use sysfs_emit in param_get_{audit,mode}\n apparmor: Remove redundant if check in sk_peer_get_label\n apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr\n apparmor: return error on namespace mismatch in verify_header\n apparmor: use target task\u0027s context in apparmor_getprocattr()\n" }, { "commit": "c6e61c06d6061750597e79c598acb5dead44c35b", "tree": "5838962da4e26e1dcbc042792566536ec51b620a", "parents": [ "6f685f12fd8327c9da19ae5b1875acaaa9297494" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Nov 11 16:54:38 2025 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:59 2026 +0100" }, "message": "ARM: 9463/1: Allow to enable RT\n\nAll known issues have been adressed.\nAllow to select RT.\n\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "6f685f12fd8327c9da19ae5b1875acaaa9297494", "tree": "ccd62da8ba134ceb17d36c1b0b7bdc057ba4d985", "parents": [ "dd9d3e16c2d5fa166e13dce07413be51f42c8f5d", "d1fed2d600905e7f007d8c88c936b768d45c09d6", "75f9a484e817adea211c73f89ed938a2b2f90953", "5a21253b3073df578ee074da2f9427cbb4c3146a" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:07 2026 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:44 2026 +0100" }, "message": "Merge branches \u0027adfs\u0027, \u0027arm-fault-handling\u0027, \u0027fixes\u0027 and \u0027misc\u0027\n" }, { "commit": "75f9a484e817adea211c73f89ed938a2b2f90953", "tree": "f20c71037ce487744ac320ef4cf2fe14980249dc", "parents": [ "6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f" ], "author": { "name": "Brian Ruley", "email": "brian.ruley@gehealthcare.com", "time": "Wed Apr 15 18:12:48 2026 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:12:52 2026 +0100" }, "message": "ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()\n\nThis bug was already discovered and fixed for arm64 in\ncommit 588a513d3425 (\"arm64: Fix race condition on PG_dcache_clean in\n__sync_icache_dcache()\").\n\nVerified with added instrumentation to track dcache flushes in a ring\nbuffer, as shown by the (distilled) output:\n\n kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte\u003d8eff659f\n hw_pte\u003d8eff6e7e young\u003d1 exec\u003d1\n kernel: dcache flush START cpu0 pfn\u003d8eff6 ts\u003d48629557020154\n kernel: dcache flush SKIPPED cpu1 pfn\u003d8eff6 ts\u003d48629557020154\n kernel: dcache flush FINISH cpu0 pfn\u003d8eff6 ts\u003d48629557036154\n audisp-syslog: comm\u003d\"journalctl\" exe\u003d\"/usr/bin/journalctl\" sig\u003d4 [...]\n\nDiscussions in the mailing list mentioned that arch/arm is also affected\nbut the fix was never applied to it [1][2]. Apply the change now, since\nthe race condition can cause sporadic SIGILL\u0027s and SEGV\u0027s especially\nwhile under high memory pressure.\n\nLink: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]\nLink: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]\nSigned-off-by: Brian Ruley \u003cbrian.ruley@gehealthcare.com\u003e\nReviewed-by: Will Deacon \u003cwill@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nFixes: 6012191aa9c6 (\"ARM: 6380/1: Introduce __sync_icache_dcache() for VIPT caches\")\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "a39a7014825bd8d10b94fa4f953141b9473c25b4", "tree": "144aa25d316cc906986e3c6939776cde98d690ad", "parents": [ "932d922285ef4d0d655a6f5def2779ae86ca0d73" ], "author": { "name": "Dave Hansen", "email": "dave.hansen@linux.intel.com", "time": "Tue Apr 21 08:19:09 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Apr 24 15:42:48 2026 +0200" }, "message": "x86/mm: Revert INVLPGB optimization for set_memory code\n\ntl;dr: Revert an INVLPGB optimization that did not properly handle\ndiscontiguous virtual addresses.\n\nFull story:\n\nI got a report from some graphics (i915) folks that bisected a\nregression in their test suite to 86e6815b316e (\"x86/mm: Change\ncpa_flush() to call flush_kernel_range() directly\"). There was a bit\nof flip-flopping on the exact bisect, but the code here does seem\nwrong to me. The i915 folks were calling set_pages_array_wc(), so\nusing the CPA_PAGES_ARRAY mode.\n\nBasically, the \u0027struct cpa_data\u0027 can wrap up all kinds of page table\nchanges. Some of these are virtually contiguous, but some are very\nmuch not which is one reason why there are -\u003evaddr and -\u003epages arrays.\n\n86e6815b316e made the mistake of assuming that the virtual addresses\nin the cpa_data are always contiguous. It got things right when neither\nCPA_ARRAY/CPA_PAGES_ARRAY is used, but theoretically wrong when either\nof those is used.\n\nIn the i915 case, it probably failed to flush some WB TLB entries and\ninstall WC ones, leaving some data in the caches and not flushing it\nout to where the device could see it. That eventually caused graphics\nproblems.\n\nRevert the INVLPGB optimization. It can be reintroduced later, but it\nwill need to be a bit careful about the array modes.\n\nFixes: 86e6815b316ec (\"x86/mm: Change cpa_flush() to call flush_kernel_range()\")\nReported-by: Cui, Ling \u003cling.cui@intel.com\u003e\nSigned-off-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Rick Edgecombe \u003crick.p.edgecombe@intel.com\u003e\nReviewed-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260421151909.6B3281C6@davehans-spike.ostc.intel.com\n" }, { "commit": "75f7c47ccd78c947cf1b6ddb18ea453ff0555716", "tree": "7749dcb203c93e5defb2a1f0b2f17876b495ef9b", "parents": [ "2452dcf4d740effff5aa71b7f6529ee8c04fd8f6" ], "author": { "name": "Thomas Weißschuh", "email": "linux@weissschuh.net", "time": "Wed Apr 22 17:10:27 2026 +0200" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Fri Apr 24 13:57:48 2026 +0200" }, "message": "kbuild: Never respect CONFIG_WERROR / W\u003de to fixdep\n\nThe fixdep hostprog may be built multiple times during a single build.\nOnce during the configuration phase and later during the regular phase.\nAs only the regular build phase respects CONFIG_WERROR / W\u003de, the\ncompiler flags might change between the phases, leading to rebuilds.\n\nExample, the rebuilds will happen twice on each invocation of the build:\n\n $ make allyesconfig prepare\n make[1]: Entering directory \u0027/tmp/deleteme\u0027\n HOSTCC scripts/basic/fixdep\n #\n # No change to .config\n #\n HOSTCC scripts/basic/fixdep\n DESCEND objtool\n INSTALL libsubcmd_headers\n make[1]: Leaving directory \u0027/tmp/deleteme\u0027\n\nFix the compilation flags used for scripts/basic/ before\nscripts/Makefile.warn is evaluated to stop CONFIG_WERROR / W\u003de\ninfluencing the fixdep build to avoid the spurious rebuilds.\n\nFixes: 7ded7d37e5f5 (\"scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W\u003de for hostprogs\")\nSigned-off-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260422-kbuild-scripts-basic-werror-v1-1-8c6912ff22e0@weissschuh.net\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "56d0a0b38faa13836568d425f6ea806e27f3a69e", "tree": "7668ea1aaa9945c9f2ea43cd56e3fea73b2514ef", "parents": [ "028ef9c96e96197026887c0f092424679298aae8", "2fc87d37be1b730a149b035f9375fdb8cc5333a5" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 13:17:50 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 13:56:54 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-04-23\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nThis week in drm-misc-fixes, we have:\n- A patch to raise the vblank timeout to avoid it on virtual drivers\n- a state check fix for stm_lvds\n- a use-after-free fix for dma-buf\n- a mapping fix for panthor\n- a device_node reference leak fix for arcgpu\n- a bridge reference leak fix for dw-mipi-dsi\n- a sparse warning fix for dma-fence\n- a kconfig fix for hv\n- a memory leak fix for nouveau\n- a fix to duplicate colorop when duplicating states\n- a panel initialisation order fix for visionox-rm69299\n- a fix to prevent an infinite loop for v3d\n- an overflow fix for nouveau\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260423-realistic-eager-reindeer-4dacf7@houat\n" }, { "commit": "dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b", "tree": "c96be83061cb29d3e1d7cb6667440441e265e226", "parents": [ "bd1886d6e4ca6b84041d17ba6e11d0f85f7ee1a4", "ac8777cc36224b4705d2c6efb10c56135d479b21" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:08:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:08:04 2026 -0700" }, "message": "Merge tag \u0027vfs-7.1-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - eventpoll: fix ep_remove() UAF and follow-up cleanup\n\n - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference\n error\n\n - writeback: Fix use after free in inode_switch_wbs_work_fn()\n\n - fuse: reject oversized dirents in page cache\n\n - fs: aio: reject partial mremap to avoid Null-pointer-dereference\n error\n\n - nstree: fix func. parameter kernel-doc warnings\n\n - fs: Handle multiply claimed blocks more gracefully with mmb\n\n* tag \u0027vfs-7.1-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n eventpoll: drop vestigial epi-\u003edying flag\n eventpoll: drop dead bool return from ep_remove_epi()\n eventpoll: refresh eventpoll_release() fast-path comment\n eventpoll: move f_lock acquisition into ep_remove_file()\n eventpoll: fix ep_remove struct eventpoll / struct file UAF\n eventpoll: move epi_fget() up\n eventpoll: rename ep_remove_safe() back to ep_remove()\n eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()\n eventpoll: kill __ep_remove()\n eventpoll: split __ep_remove()\n eventpoll: use hlist_is_singular_node() in __ep_remove()\n fs: Handle multiply claimed blocks more gracefully with mmb\n nstree: fix func. parameter kernel-doc warnings\n fs: aio: reject partial mremap to avoid Null-pointer-dereference error\n fuse: reject oversized dirents in page cache\n writeback: Fix use after free in inode_switch_wbs_work_fn()\n fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error\n" }, { "commit": "bd1886d6e4ca6b84041d17ba6e11d0f85f7ee1a4", "tree": "145b8288615b323d572d9497f18dbb46a25ce417", "parents": [ "d0ed69f3e380276e7ab36f1a3f19702c5e993915", "1249c01aa42160e40bc765ba5a3cde751491ff0a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:04:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:04:18 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc-part2-ksmbd-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull more smb server updates from Steve French:\n\n - move fs/smb/common/smbdirect to fs/smb/smbdirect\n\n - change signature calc to use AES-CMAC library, simpler and faster\n\n - invalid signature fix\n\n - multichannel fix\n\n - open create options fix\n\n - fix durable handle leak\n\n - cap maximum lock count to avoid potential denial of service\n\n - four connection fixes: connection free and session destroy IDA fixes,\n refcount fix, connection leak fix, max_connections off by one fix\n\n - IPC validation fix\n\n - fix out of bounds write in getting xattrs\n\n - fix use after free in durable handle reconnect\n\n - three ACL fixes: fix potential ACL overflow, harden num_aces check,\n and fix minimum ACE size check\n\n* tag \u0027v7.1-rc-part2-ksmbd-fixes\u0027 of git://git.samba.org/ksmbd:\n smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/\n smb: server: stop sending fake security descriptors\n ksmbd: scope conn-\u003ebinding slowpath to bound sessions only\n ksmbd: fix CreateOptions sanitization clobbering the whole field\n ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open\n ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount\n ksmbd: destroy async_ida in ksmbd_conn_free()\n ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()\n ksmbd: Use AES-CMAC library for SMB3 signature calculation\n ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()\n ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n ksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n ksmbd: fix use-after-free in smb2_open during durable reconnect\n ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()\n smb: server: fix max_connections off-by-one in tcp accept path\n ksmbd: require minimum ACE size in smb_check_perm_dacl()\n ksmbd: validate response sizes in ipc_validate_msg()\n smb: server: fix active_num_conn leak on transport allocation failure\n" }, { "commit": "d0ed69f3e380276e7ab36f1a3f19702c5e993915", "tree": "1fa742f35805c25ea97abda254f54db1f1fac182", "parents": [ "e728258debd553c95d2e70f9cd97c9fde27c7130", "a83307f34e0bd9b0e595b1074dc8fbcc1b7f3172" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:59:55 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc1-part3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Four bug fixes: OOB read in ioctl query info, 3 ACL fixes\n\n - SMB1 Unix extensions mount fix\n\n - Four crypto improvements: move to AES-CMAC library, simpler and faster\n\n - Remove drop_dir_cache to avoid potential crash, and move to /procfs\n\n - Seven SMB3.1.1 compression fixes\n\n* tag \u0027v7.1-rc1-part3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: Drop \u0027allocate_crypto\u0027 arg from smb*_calc_signature()\n smb: client: Make generate_key() return void\n smb: client: Remove obsolete cmac(aes) allocation\n smb: client: Use AES-CMAC library for SMB3 signature calculation\n smb: common: add SMB3_COMPRESS_MAX_ALGS\n smb: client: compress: add code docs to lz77.c\n smb: client: compress: LZ77 optimizations\n smb: client: compress: increase LZ77_MATCH_MAX_DIST\n smb: client: compress: fix counting in LZ77 match finding\n smb: client: compress: fix buffer overrun in lz77_compress()\n smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl\n smb: client: fix (remove) drop_dir_cache module parameter\n smb: client: require a full NFS mode SID before reading mode bits\n smb: client: validate the whole DACL before rewriting it in cifsacl\n smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n cifs: update internal module version number\n smb: client: compress: fix bad encoding on last LZ77 flag\n smb: client: fix dir separator in SMB1 UNIX mounts\n" }, { "commit": "e728258debd553c95d2e70f9cd97c9fde27c7130", "tree": "18ef97c80f9923717f5cf6bdab44d77607ca0f4b", "parents": [ "e8df5a0c0d041588e7f02781822d637d226cdbe8", "5e6391da4539c35422c0df1d1d2d9a9bb97cd736" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:50:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:50:42 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Netfilter.\n\n Steady stream of fixes. Last two weeks feel comparable to the two\n weeks before the merge window. Lots of AI-aided bug discovery. A newer\n big source is Sashiko/Gemini (Roman Gushchin\u0027s system), which points\n out issues in existing code during patch review (maybe 25% of fixes\n here likely originating from Sashiko). Nice thing is these are often\n fixed by the respective maintainers, not drive-bys.\n\n Current release - new code bugs:\n\n - kconfig: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP\n\n Previous releases - regressions:\n\n - add async ndo_set_rx_mode and switch drivers which we promised to\n be called under the per-netdev mutex to it\n\n - dsa: remove duplicate netdev_lock_ops() for conduit ethtool ops\n\n - hv_sock: report EOF instead of -EIO for FIN\n\n - vsock/virtio: fix MSG_PEEK calculation on bytes to copy\n\n Previous releases - always broken:\n\n - ipv6: fix possible UAF in icmpv6_rcv()\n\n - icmp: validate reply type before using icmp_pointers\n\n - af_unix: drop all SCM attributes for SOCKMAP\n\n - netfilter: fix a number of bugs in the osf (OS fingerprinting)\n\n - eth: intel: fix timestamp interrupt configuration for E825C\n\n Misc:\n\n - bunch of data-race annotations\"\n\n* tag \u0027net-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (148 commits)\n rxrpc: Fix error handling in rxgk_extract_token()\n rxrpc: Fix re-decryption of RESPONSE packets\n rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets\n rxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n rxgk: Fix potential integer overflow in length check\n rxrpc: Fix conn-level packet handling to unshare RESPONSE packets\n rxrpc: Fix potential UAF after skb_unshare() failure\n rxrpc: Fix rxkad crypto unalignment handling\n rxrpc: Fix memory leaks in rxkad_verify_response()\n net: rds: fix MR cleanup on copy error\n m68k: mvme147: Make me the maintainer\n net: txgbe: fix firmware version check\n selftests/bpf: check epoll readiness during reuseport migration\n tcp: call sk_data_ready() after listener migration\n vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()\n ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim\n tipc: fix double-free in tipc_buf_append()\n llc: Return -EINPROGRESS from llc_ui_connect()\n ipv4: icmp: validate reply type before using icmp_pointers\n selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges\n ...\n" }, { "commit": "e8df5a0c0d041588e7f02781822d637d226cdbe8", "tree": "aeb7d43c945caf4bd87c6d2c9945e67cd24545af", "parents": [ "5fb4fde3b287fdd9097c53fee7126c2f74698073", "79fc229e8a471356ddfea225f42e02f4fb73c469" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:45:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:45:17 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull more i2c updates from Wolfram Sang:\n\n - cx92755: convert I2C bindings to DT schema\n\n - mediatek: add optional bus power management during transfers\n\n - pxa: handle early bus busy condition\n\n - MAINTAINERS: update I2C RUST entry\n\n* tag \u0027i2c-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n MAINTAINERS: add Rust I2C tree and update Igor Korotin\u0027s email\n i2c: mediatek: add bus regulator control for power saving\n dt-bindings: i2c: cnxt,cx92755-i2c: Convert to DT schema\n i2c: pxa: handle \u0027Early Bus Busy\u0027 condition on Armada 3700\n" }, { "commit": "5fb4fde3b287fdd9097c53fee7126c2f74698073", "tree": "175fa19bad07f3a0c5369b7d0bdde9adbf2eb0db", "parents": [ "9c59b464517c6ef0302ffa7d993a979a4cb50bf7", "aa5903b47d4bc0e7d1fb76941731cbda32ef9cbc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:40:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:40:03 2026 -0700" }, "message": "Merge tag \u0027xtensa-20260422\u0027 of https://github.com/jcmvbkbc/linux-xtensa\n\nPull Xtensa updates from Max Filippov:\n\n - use register_sys_off_handler(SYS_OFF_MODE_RESTART) instead of\n the deprecated register_restart_handler()\n\n - drop custom ucontext.h and reuse asm-generic ucontext.h\n\n* tag \u0027xtensa-20260422\u0027 of https://github.com/jcmvbkbc/linux-xtensa:\n xtensa: uapi: Reuse asm-generic ucontext.h\n xtensa: xtfpga: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n xtensa: xt2000: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n xtensa: ISS: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n" }, { "commit": "e49712ef03dbc4e282dd0e76469642279c2811e5", "tree": "3ff1fc4f972978c1638997e7d859ef05e95d1866", "parents": [ "52edde745dde8fff44e9f0eeeb77a4e38ef9eef6", "74b73fa56a395d46745e4f245225963e9f8be7f1" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:17:31 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:17:41 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-04-23\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-next\n\namd-drm-fixes-7.1-2026-04-23:\n\namdgpu:\n- DC idle state manager fix\n- ASPM fix\n- GPUVM SVM fix\n- DCE 6 fix\n\namdkfd:\n- num_of_nodes bounds check fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260423170129.2345978-1-alexander.deucher@amd.com\n" }, { "commit": "52edde745dde8fff44e9f0eeeb77a4e38ef9eef6", "tree": "efa18725a687633485b77cf24367819105ae35ab", "parents": [ "a6fe8bd56f7344b0c42f287c4b744d4d43e31ebe", "f6c73e7156b54d8b9ddf1a27f4e93d3a1e49a73e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:16:33 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:16:44 2026 +1000" }, "message": "Merge tag \u0027drm-misc-next-fixes-2026-04-23\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next\n\nShort summary of fixes pull:\n\nrcar-du:\n- fix NULL-ptr crash\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260423130852.GA114622@linux.fritz.box\n" }, { "commit": "0c22ed0fadcad620277a56c0ba2867d4850d053a", "tree": "57bd4b666e2edb807c49240104487401abe9d1df", "parents": [ "fc5f996bfb7576f8cffbba09cb02432622ffea61", "15d07f9ef4af71e454cde4eebfbf7676ac0d972e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:54:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "Merge branch \u0027remove-a-number-of-isa-and-pcmcia-ethernet-drivers\u0027\n\nAndrew Lunn says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nRemove a number of ISA and PCMCIA Ethernet drivers\n\nThese old drivers have not been much of a Maintenance burden until\nrecently. Now there are more newbies using AI and fuzzers finding\nissues, resulting in more work for Maintainers. Fixing these old\ndrivers make little sense, if it is not clear they have users.\n\nThese mostly ISA and PCMCIA Ethernet devices, mostly from the last\ncentury, a couple from 2001 or 2002. It seems unlikely they are still\nused. However, remove them one patch at a time so they can be brought\nback if somebody still has the hardware, runs modern kernels and wants\nto take up the roll of driver Maintainer.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-0-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15d07f9ef4af71e454cde4eebfbf7676ac0d972e", "tree": "57bd4b666e2edb807c49240104487401abe9d1df", "parents": [ "b0b807aa78d213ee08759130ba6a2e92fb5a3b76" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:58 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: wd80x3: Remove this driver\n\nThe wd80x3 was written by Donald Becker 1993 to 1994. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nAcked-by: Dominik Brodowski \u003clinux@dominikbrodowski.net\u003e\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-15-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b0b807aa78d213ee08759130ba6a2e92fb5a3b76", "tree": "500aaf0ab148713ab62f7599f9eaf0c143ce4f14", "parents": [ "57835223486216bc8b4187269e03dba1dc62168b" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:57 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: ultra: Remove this driver\n\nThe ultra was written by Donald Becker 1993 to 1998. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nAcked-by: Dominik Brodowski \u003clinux@dominikbrodowski.net\u003e\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-14-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57835223486216bc8b4187269e03dba1dc62168b", "tree": "87001818cce1b9e575ad21d5fdd66270d4b32560", "parents": [ "51c1c88b64354a1c535799a7751cad20fa32f779" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:55 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: AX88190: Remove this driver\n\nThe ax88190 was written by David A. Hinds in 2001. It is an PCMCIA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-12-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "51c1c88b64354a1c535799a7751cad20fa32f779", "tree": "af78d62f9c29ed447d98a3aaa5aeb85e7d8615f8", "parents": [ "a3fb9a5bf66071e21f51696816f79bb0c051908c" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:54 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: fujitsu: fmvj18x: Remove this driver\n\nThe fmvj18x was written by Shingo Fujimoto in 2002. It is an PCMCIA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-11-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a3fb9a5bf66071e21f51696816f79bb0c051908c", "tree": "0d6b5be3b81f599bf9a44eb37fee1148ce5c6218", "parents": [ "9fdf9f61fa6d3cb31ba501f65522fcd9f5c8acd4" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:51 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:06 2026 -0700" }, "message": "drivers: net: smsc: smc91c92: Remove this driver\n\nThe smc91c92 was written by David A Hinds in 1999. It is an PCMCIA\ndevice, so unlikely to be used with modern kernels.\n\nRemove the Documentation as well, since it refers to kernel versions\n1.2.13 until 1.3.71 and FTP sites which no longer exist.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-8-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9fdf9f61fa6d3cb31ba501f65522fcd9f5c8acd4", "tree": "ef79f70da2a3530bb7572e02340b3c5dc49f96d5", "parents": [ "29103588d74d95d7cb0847450fe3a2c39dd4d829" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:50 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: smsc: smc9194: Remove this driver\n\nThe smc9194 was written by Erik Stahlman in 1996. It is an ISA device,\nso unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-7-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "29103588d74d95d7cb0847450fe3a2c39dd4d829", "tree": "de84cef211336746657582a17d9c8918b8d7142f", "parents": [ "2fbd04dc74cef371895ae2a17c99eb7c82a02984" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:49 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: amd: nmclan: Remove this driver\n\nThe nmclan was written by Roger C Pao in 1995. It is an PCMCIA device,\nso unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-6-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2fbd04dc74cef371895ae2a17c99eb7c82a02984", "tree": "eeefe92b4be9066dde5132a09caf981acbbd097c", "parents": [ "4ff8d0672d99a80785a3051dc47a9f8b0684ebff" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:48 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: amd: lance: Remove this driver\n\nThe lance was written by Donald Becker between 1993-1998. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-5-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ff8d0672d99a80785a3051dc47a9f8b0684ebff", "tree": "5ec1662f291955b3c62806e767da90776380bb78", "parents": [ "a7fbf27d77b1c993cbe097f35bb44f98a54a6b09" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:47 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: 3com: 3c589: Remove this driver\n\nThe 3c589 was written by David A. Hinds 2001. It is an PCMCIA device,\nso unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-4-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a7fbf27d77b1c993cbe097f35bb44f98a54a6b09", "tree": "b0eabe922761a999b0930372e7aece86a94d2b10", "parents": [ "082b2e07ccd84af2ed88ccc3316033ac64942008" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:46 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: 3com: 3c574: Remove this driver\n\nThe 3c574 was written by Donald Becker between 1993-1998. It is\nan PCMCIA device, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-3-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "082b2e07ccd84af2ed88ccc3316033ac64942008", "tree": "738c2b1cf19e4fa68e7876b8eb8f96b8d109ca50", "parents": [ "91f3a27ae9f66d81a5906461762c37c8a2bcab06" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:45 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:49 2026 -0700" }, "message": "drivers: net: 3com: 3c515: Remove this driver\n\nThe 3c515 was written by Donald Becker between 1997-1998. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-2-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "91f3a27ae9f66d81a5906461762c37c8a2bcab06", "tree": "d52a49ddbe8e6f85f729eeabcff8f5bd8df1caaf", "parents": [ "fc5f996bfb7576f8cffbba09cb02432622ffea61" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:44 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:56:43 2026 -0700" }, "message": "drivers: net: 3com: 3c509: Remove this driver\n\nThe 3c509 was written by Donald Becker between 1993-2000. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-1-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac8777cc36224b4705d2c6efb10c56135d479b21", "tree": "e57002b66f4e4717af08a5bbd126a51a7beb2036", "parents": [ "9a466382c5e1ab706e155914e5532c80c2f3f76c", "07422c948f4bdf15567a129a0983f7c12e57ba8e" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:29:48 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:37:04 2026 +0200" }, "message": "Merge patch series \"eventpoll: fix ep_remove() UAF and follow-up cleanup\"\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\n\nep_remove() (via __ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file in the same critical section:\nis_file_epoll(), hlist_del_rcu() through the head, spin_unlock. A\nconcurrent __fput() on the watched eventpoll caught the transient\nNULL in eventpoll_release()\u0027s lockless fast path, skipped\neventpoll_release_file() entirely, and ran to ep_eventpoll_release()\n-\u003e ep_clear_and_put() -\u003e ep_free(). That kfree()s the struct\neventpoll whose embedded -\u003erefs hlist_head is exactly where\nepi-\u003efllink.pprev points and the subsequent hlist_del_rcu()\u0027s\n\"*pprev \u003d next\" scribbles into freed kmalloc-192 memory, which is\nthe slab-use-after-free KASAN caught.\n\nstruct file is SLAB_TYPESAFE_BY_RCU on top of that so the same window\nalso lets the slot recycle while ep_remove() is still nominally\ninside file-\u003ef_lock. The upshot is an attacker-influencable\nkmem_cache_free() against the wrong slab cache.\n\nThe comment on eventpoll_release()\u0027s fast path - \"False positives\nsimply cannot happen because the file in on the way to be removed\nand nobody ( but eventpoll ) has still a reference to this file\" -\nwas itself the wrong invariant this race exploits.\n\nThe fix pins @file via epi_fget() at the top of ep_remove() and\ngates the f_ep clear / hlist_del_rcu() on the pin succeeding. With\nthe pin held __fput() cannot start which transitively keeps the\nwatched struct eventpoll alive across the critical section and also\nprevents the struct file slot from recycling. Both UAFs are closed.\n\nIf the pin fails __fput() is already in flight on @file. Because we\nbail before clearing f_ep that path takes eventpoll_release()\u0027s slow\npath into eventpoll_release_file() which blocks on ep-\u003emtx until\nep_clear_and_put() drops it and then cleans up the orphaned epi. The\nbailed epi\u0027s share of ep-\u003erefcount stays intact so\nep_clear_and_put()\u0027s trailing ep_refcount_dec_and_test() cannot free\nthe eventpoll out from under eventpoll_release_file().\n\nWith epi_fget() now gating every ep_remove() call the epi-\u003edying\nflag becomes vestigial. epi-\u003edying \u003d\u003d true always coincides with\nfile_ref_get() \u003d\u003d false because __fput() is reachable only once the\nrefcount hits zero and the refcount is monotone there. The last\npatch drops the flag and leaves a single coordination mechanism\ninstead of two.\n\n* patches from https://patch.msgid.link/20260423-work-epoll-uaf-v1-0-2470f9eec0f5@kernel.org:\n eventpoll: drop vestigial epi-\u003edying flag\n eventpoll: drop dead bool return from __ep_remove_epi()\n eventpoll: refresh eventpoll_release() fast-path comment\n eventpoll: move f_lock acquisition into __ep_remove_file()\n eventpoll: fix ep_remove struct eventpoll / struct file UAF\n eventpoll: move epi_fget() up\n eventpoll: rename ep_remove_safe() back to ep_remove()\n eventpoll: kill __ep_remove()\n eventpoll: split __ep_remove()\n eventpoll: use hlist_is_singular_node() in __ep_remove()\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-0-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "07422c948f4bdf15567a129a0983f7c12e57ba8e", "tree": "e57002b66f4e4717af08a5bbd126a51a7beb2036", "parents": [ "3a4551ea9c042502019b1d8a986e962cb9015366" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:13 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:37:01 2026 +0200" }, "message": "eventpoll: drop vestigial epi-\u003edying flag\n\nWith ep_remove() now pinning @file via epi_fget() across the\nf_ep clear and hlist_del_rcu(), the dying flag no longer\norchestrates anything: it was set in eventpoll_release_file()\n(which only runs from __fput(), i.e. after @file\u0027s refcount has\nreached zero) and read in __ep_remove() / ep_remove() as a cheap\nbail before attempting the same synchronization epi_fget() now\nprovides unconditionally.\n\nThe implication is simple: epi-\u003edying \u003d\u003d true always coincides\nwith file_ref_get(\u0026file-\u003ef_ref) \u003d\u003d false, because __fput() is\nreachable only once the refcount hits zero and the refcount is\nmonotone in that state. The READ_ONCE(epi-\u003edying) in ep_remove()\ntherefore selects exactly the same callers that epi_fget() would\nreject, just one atomic cheaper. That\u0027s not worth a struct\nfield, a second coordination mechanism, and the comments on\nboth.\n\nRefresh the eventpoll_release_file() comment to describe what\nactually makes the path race-free now (the pin in ep_remove()).\nNo functional change: the correctness argument is unchanged,\nonly the mechanism is now a single one instead of two.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-10-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "3a4551ea9c042502019b1d8a986e962cb9015366", "tree": "916990e767efc24cff025cc0c40fd1e5f8c75431", "parents": [ "33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:12 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:57 2026 +0200" }, "message": "eventpoll: drop dead bool return from ep_remove_epi()\n\nep_remove_epi() always returns true -- the \"can be disposed\"\nanswer was meaningful back when the dying-check lived inside the\npre-split __ep_remove(), but after that check moved to ep_remove()\nthe return value is just noise. Both callers gate on it\nunconditionally:\n\n if (ep_remove_epi(ep, epi))\n WARN_ON_ONCE(ep_refcount_dec_and_test(ep));\n\n dispose \u003d ep_remove_epi(ep, epi);\n ...\n if (dispose \u0026\u0026 ep_refcount_dec_and_test(ep))\n ep_free(ep);\n\nMake ep_remove_epi() return void, drop the dispose local in\neventpoll_release_file(), and the useless conditionals at both\ncallers. No functional change.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-9-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e", "tree": "3db1462c972a1b2d704cd4ab21a8b7035a460b78", "parents": [ "d30deeb8b0cf6259785c1fb79b87905d281b0a5a" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:11 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:50 2026 +0200" }, "message": "eventpoll: refresh eventpoll_release() fast-path comment\n\nThe old comment justified the lockless READ_ONCE(file-\u003ef_ep) check\nwith \"False positives simply cannot happen because the file is on\nthe way to be removed and nobody ( but eventpoll ) has still a\nreference to this file.\" That reasoning was the root of the UAF\nfixed in \"eventpoll: fix ep_remove struct eventpoll / struct file\nUAF\": __ep_remove() could clear f_ep while another close raced\npast the fast path and freed the watched eventpoll / recycled the\nstruct file slot.\n\nWith ep_remove() now pinning @file via epi_fget() across the f_ep\nclear and hlist_del_rcu(), the invariant is re-established for the\nright reason: anyone who might clear f_ep holds @file alive for\nthe duration, so a NULL observation really does mean no\nconcurrent eventpoll path has work left on this file. Refresh the\ncomment accordingly so the next reader doesn\u0027t inherit the broken\nmodel.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "d30deeb8b0cf6259785c1fb79b87905d281b0a5a", "tree": "7890a5d6635ace9c4354f6b6eaaf6fa937322a3c", "parents": [ "a6dc643c69311677c574a0f17a3f4d66a5f3744b" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:10 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:37 2026 +0200" }, "message": "eventpoll: move f_lock acquisition into ep_remove_file()\n\nLet the helper own its critical section end-to-end: take \u0026file-\u003ef_lock\nat the top, read file-\u003ef_ep inside the lock, release on exit. Callers\n(ep_remove() and eventpoll_release_file()) no longer need to wrap the\ncall, and the function-comment lock-handoff contract is gone.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-7-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "a6dc643c69311677c574a0f17a3f4d66a5f3744b", "tree": "94f10bc43ea4f7a04de9996aa6131d82e726b678", "parents": [ "86e87059e6d1fd5115a31949726450ed03c1073b" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:09 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:29 2026 +0200" }, "message": "eventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()\u0027s \"*pprev \u003d next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside\u0027s ep_clear_and_put() drops it. The bailed epi\u0027s share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays.\n\nFixes: 58c9b016e128 (\"epoll: use refcount to reduce ep_mutex contention\")\nReported-by: Jaeyoung Chung \u003cjjy600901@snu.ac.kr\u003e\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "86e87059e6d1fd5115a31949726450ed03c1073b", "tree": "935b065cc5b32d831ee421f47c847a0434c3e36f", "parents": [ "0bade234723e40e4937be912e105785d6a51464e" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:08 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:25 2026 +0200" }, "message": "eventpoll: move epi_fget() up\n\nWe\u0027ll need it when removing files so move it up. No functional change.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "0bade234723e40e4937be912e105785d6a51464e", "tree": "7f366f8aa97b3473cbbd9a86bc19de5df4334c88", "parents": [ "0feaf644f7180c4a91b6b405a881afbfd958f1cf" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:07 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:20 2026 +0200" }, "message": "eventpoll: rename ep_remove_safe() back to ep_remove()\n\nThe current name is just confusing and doesn\u0027t clarify anything.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "0feaf644f7180c4a91b6b405a881afbfd958f1cf", "tree": "29a6203cd4081386acab4e068753bebcd4f3064a", "parents": [ "e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:23:18 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:36:03 2026 +0200" }, "message": "eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()\n\nWith __ep_remove() gone, the double-underscore on __ep_remove_file()\nand __ep_remove_epi() no longer contrasts with a __-less parent and\njust reads as noise. Rename both to ep_remove_file() and\nep_remove_epi(). No functional change.\n\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330", "tree": "5eacf4f9d714168d831dad504644ee64fb164a35", "parents": [ "0f7bdfd413000985de09fc39eb9efa1e091a3ce0" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:06 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:35:56 2026 +0200" }, "message": "eventpoll: kill __ep_remove()\n\nRemove the boolean conditional in __ep_remove() and restructure the code\nso the check for racing with eventpoll_release_file() are only done in\nthe ep_remove_safe() path where they belong.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "0f7bdfd413000985de09fc39eb9efa1e091a3ce0", "tree": "73384aeac7a237d5245f0b3e71292bd7ec706089", "parents": [ "3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:05 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:35:50 2026 +0200" }, "message": "eventpoll: split __ep_remove()\n\nSplit __ep_remove() to delineate file removal from epoll item removal.\n\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b", "tree": "668f5707a75ce1ef077bc13e37f17ee067af7917", "parents": [ "9a466382c5e1ab706e155914e5532c80c2f3f76c" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 23 11:56:04 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:35:41 2026 +0200" }, "message": "eventpoll: use hlist_is_singular_node() in __ep_remove()\n\nReplace the open-coded \"epi is the only entry in file-\u003ef_ep\" check\nwith hlist_is_singular_node(). Same semantics, and the helper avoids\nthe head-cacheline access in the common false case.\n\nLink: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "9a466382c5e1ab706e155914e5532c80c2f3f76c", "tree": "dd6e36ea99429ad506ca1a37b0fc317f71f56778", "parents": [ "43eb354ecb471426e97b0ce6a0c922ec20f82027" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Apr 23 11:03:12 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:59 2026 +0200" }, "message": "fs: Handle multiply claimed blocks more gracefully with mmb\n\nWhen a metadata block is referenced by multiple inodes and tracked by\nmetadata bh infrastructure (which is forbidden and generally indicates\nfilesystem corruption), it can happen that mmb_mark_buffer_dirty() is\ncalled for two different mmb structures in parallel. This can lead to a\ncorruption of mmb linked list. Handle that situation gracefully (at\nleast from mmb POV) by serializing on setting bh-\u003eb_mmb.\n\nReported-by: Ruikai Peng \u003cruikai@pwno.io\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260423090311.10955-2-jack@suse.cz\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "43eb354ecb471426e97b0ce6a0c922ec20f82027", "tree": "de9b1786f88fa0ce31bc371657f31d392ab3f6fb", "parents": [ "3adf7ae18bf42601246031002287c103a27df307" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@infradead.org", "time": "Thu Apr 16 14:54:29 2026 -0700" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:59 2026 +0200" }, "message": "nstree: fix func. parameter kernel-doc warnings\n\nUse the correct parameter name (\"__ns\") for function parameter kernel-doc\nto avoid 3 warnings:\n\nWarning: include/linux/nstree.h:68 function parameter \u0027__ns\u0027 not described in \u0027ns_tree_add_raw\u0027\nWarning: include/linux/nstree.h:77 function parameter \u0027__ns\u0027 not described in \u0027ns_tree_add\u0027\nWarning: include/linux/nstree.h:88 function parameter \u0027__ns\u0027 not described in \u0027ns_tree_remove\u0027\n\nFixes: 885fc8ac0a4d (\"nstree: make iterator generic\")\nSigned-off-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nLink: https://patch.msgid.link/20260416215429.948898-1-rdunlap@infradead.org\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "3adf7ae18bf42601246031002287c103a27df307", "tree": "d7219dc7aad73afa1d7de1884dab973935fd5888", "parents": [ "51a8de6c50bf947c8f534cd73da4c8f0a13e7bed" ], "author": { "name": "Zizhi Wo", "email": "wozizhi@huawei.com", "time": "Sat Apr 18 14:06:34 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:59 2026 +0200" }, "message": "fs: aio: reject partial mremap to avoid Null-pointer-dereference error\n\n[BUG]\nRecently, our internal syzkaller testing uncovered a null pointer\ndereference issue:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\n[ 51.111664] filemap_read_folio+0x25/0xe0\n[ 51.112410] filemap_fault+0xad7/0x1250\n[ 51.113112] __do_fault+0x4b/0x460\n[ 51.113699] do_pte_missing+0x5bc/0x1db0\n[ 51.114250] ? __pte_offset_map+0x23/0x170\n[ 51.114822] __handle_mm_fault+0x9f8/0x1680\n...\nCrash analysis showed the file involved was an AIO ring file. The\nphenomenon triggered is the same as the issue described in [1].\n\n[CAUSE]\nConsider the following scenario: userspace sets up an AIO context via\nio_setup(), which creates a VMA covering the entire ring buffer. Then\nuserspace calls mremap() with the AIO ring address as the source, a smaller\nold_len (less than the full ring size), MREMAP_MAYMOVE set, and without\nMREMAP_DONTUNMAP. The kernel will relocate the requested portion to a new\ndestination address.\n\nDuring this move, __split_vma() splits the original AIO ring VMA. The\nrequested portion is unmapped from the source and re-established at the\ndestination, while the remainder stays at the original source address as\nan orphan VMA. The aio_ring_mremap() callback fires on the new destination\nVMA, updating ctx-\u003emmap_base to the destination address. But the callback\nis unaware that only a partial region was moved and that an orphan VMA\nstill exists at the source:\n\n source(AIO):\n +-------------------+---------------------+\n | moved to dest | orphan VMA (AIO) |\n +-------------------+---------------------+\n A A+partial_len A+ctx-\u003emmap_size\n\n dest:\n +-------------------+\n | moved VMA (AIO) |\n +-------------------+\n B B+partial_len\n\nLater, io_destroy() calls vm_munmap(ctx-\u003emmap_base, ctx-\u003emmap_size), which\nunmaps the destination. This not only fails to unmap the orphan VMA at the\nsource, but also overshoots the destination VMA and may unmap unrelated\nmappings adjacent to it! After put_aio_ring_file() calls truncate_setsize()\nto remove all pages from the pagecache, any subsequent access to the orphan\nVMA triggers filemap_fault(), which calls a_ops-\u003eread_folio(). Since aio\ndoes not implement read_folio, this results in a NULL pointer dereference.\n\n[FIX]\nNote that expanding mremap (new_len \u003e old_len) is already rejected because\nAIO ring VMAs are created with VM_DONTEXPAND. The only problematic case is\na partial move where \"old_len \u003d\u003d new_len\" but both are smaller than the\nfull ring size.\n\nFix this by checking in aio_ring_mremap() that the new VMA covers the\nentire ring. This ensures the AIO ring is always moved as a whole,\npreventing orphan VMAs and the subsequent crash.\n\n[1]: https://lore.kernel.org/all/20260413010814.548568-1-wozizhi@huawei.com/\n\nSigned-off-by: Zizhi Wo \u003cwozizhi@huaweicloud.com\u003e\nLink: https://patch.msgid.link/20260418060634.3713620-1-wozizhi@huaweicloud.com\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "51a8de6c50bf947c8f534cd73da4c8f0a13e7bed", "tree": "d8ad8104d3902813f3c27fa1dd9f6cb7e5dc09f9", "parents": [ "6689f01d6740cf358932b3e97ee968c6099800d9" ], "author": { "name": "Samuel Page", "email": "sam@bynar.io", "time": "Mon Apr 20 11:01:37 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:58 2026 +0200" }, "message": "fuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen\u003d4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache.\n\nFixes: 69e34551152a (\"fuse: allow caching readdir\")\nCc: stable@vger.kernel.org # v6.16+\nAssisted-by: Bynario AI\nSigned-off-by: Samuel Page \u003csam@bynar.io\u003e\nReported-by: Qi Tang \u003ctpluszz77@gmail.com\u003e\nReported-by: Zijun Hu \u003cnightu@northwestern.edu\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nLink: https://patch.msgid.link/20260420090139.662772-1-mszeredi@redhat.com\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "6689f01d6740cf358932b3e97ee968c6099800d9", "tree": "3dbcf556feb965130583a909c267c3028ab4f9d9", "parents": [ "c03ce4173c7bffe1e7477f905a09b015d4000d3c" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Apr 13 11:36:19 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:58 2026 +0200" }, "message": "writeback: Fix use after free in inode_switch_wbs_work_fn()\n\ninode_switch_wbs_work_fn() has a loop like:\n\n wb_get(new_wb);\n while (1) {\n list \u003d llist_del_all(\u0026new_wb-\u003eswitch_wbs_ctxs);\n /* Nothing to do? */\n if (!list)\n break;\n ... process the items ...\n }\n\nNow adding of items to the list looks like:\n\nwb_queue_isw()\n if (llist_add(\u0026isw-\u003elist, \u0026wb-\u003eswitch_wbs_ctxs))\n queue_work(isw_wq, \u0026wb-\u003eswitch_work);\n\nBecause inode_switch_wbs_work_fn() loops when processing isw items, it\ncan happen that wb-\u003eswitch_work is pending while wb-\u003eswitch_wbs_ctxs is\nempty. This is a problem because in that case wb can get freed (no isw\nitems -\u003e no wb reference) while the work is still pending causing\nuse-after-free issues.\n\nWe cannot just fix this by cancelling work when freeing wb because that\ncould still trigger problematic 0 -\u003e 1 transitions on wb refcount due to\nwb_get() in inode_switch_wbs_work_fn(). It could be all handled with\nmore careful code but that seems unnecessarily complex so let\u0027s avoid\nthat until it is proven that the looping actually brings practical\nbenefit. Just remove the loop from inode_switch_wbs_work_fn() instead.\nThat way when wb_queue_isw() queues work, we are guaranteed we have\nadded the first item to wb-\u003eswitch_wbs_ctxs and nobody is going to\nremove it (and drop the wb reference it holds) until the queued work\nruns.\n\nFixes: e1b849cfa6b6 (\"writeback: Avoid contention on wb-\u003elist_lock when switching inodes\")\nCC: stable@vger.kernel.org\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260413093618.17244-2-jack@suse.cz\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "c03ce4173c7bffe1e7477f905a09b015d4000d3c", "tree": "bffc9c517645ace8637e4bf04117e75edb36eb11", "parents": [ "d60bc140158342716e13ff0f8aa65642f43ba053" ], "author": { "name": "Zizhi Wo", "email": "wozizhi@huawei.com", "time": "Mon Apr 13 09:08:14 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Apr 24 00:34:58 2026 +0200" }, "message": "fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error\n\n[BUG]\nRecently, our internal syzkaller testing uncovered a null pointer\ndereference issue:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\n[ 51.111664] filemap_read_folio+0x25/0xe0\n[ 51.112410] filemap_fault+0xad7/0x1250\n[ 51.113112] __do_fault+0x4b/0x460\n[ 51.113699] do_pte_missing+0x5bc/0x1db0\n[ 51.114250] ? __pte_offset_map+0x23/0x170\n[ 51.114822] __handle_mm_fault+0x9f8/0x1680\n[ 51.115408] handle_mm_fault+0x24c/0x570\n[ 51.115958] do_user_addr_fault+0x226/0xa50\n...\nCrash analysis showed the file involved was an AIO ring file.\n\n[CAUSE]\n\tPARENT process\t\tCHILD process\nt\u003d0\tio_setup(1, \u0026ctx)\n\t[access ctx addr]\n\tfork()\n\tio_destroy\n\t vm_munmap // not affect child vma\n\t percpu_ref_put\n\t ...\n\t put_aio_ring_file\nt\u003d1\t\t\t\t[access ctx addr]\t// pagefault\n\t\t\t\t...\n\t\t\t\t __do_fault\n\t\t\t\t filemap_fault\n\t\t\t\t max_idx \u003d DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE)\nt\u003d2\t truncate_setsize\n\t truncate_pagecache\nt\u003d3\t\t\t\t filemap_get_folio\t// no folio, create folio\n\t\t\t\t __filemap_get_folio(..., FGP_CREAT, ...)\t// page_not_uptodate\n\t\t\t\t filemap_read_folio(file, mapping-\u003ea_ops-\u003eread_folio, folio) // oops!\n\nAt t\u003d0, the parent process calls io_setup and then fork. The child process\ngets its own VMA but without any PTEs. The parent then calls io_destroy.\nBefore i_size is truncated to 0, at t\u003d1 the child process accesses this AIO\nctx address and triggers a pagefault. After the max_idx check passes, at\nt\u003d2 the parent calls truncate_setsize and truncate_pagecache. At t\u003d3 the\nchild fails to obtain the folio, falls into the \"page_not_uptodate\" path,\nand hits this problem because AIO does not implement \"read_folio\".\n\n[Fix]\nFix this by marking the AIO ring buffer VMA with VM_DONTCOPY so\nthat fork()\u0027s dup_mmap() skips it entirely. This is the correct\nsemantic because:\n\n1) The child\u0027s ioctx_table is already reset to NULL by mm_init_aio() during\nfork(), so the child has no AIO context and no way to perform any AIO\noperations on this mapping.\n2) The AIO ring VMA is only meaningful in conjunction with its associated\nkioctx, which is never inherited across fork(). So child process with no\nAIO context has no legitimate reason to access the ring buffer. Delivering\nSIGSEGV on such an erroneous access is preferable to a kernel crash.\n\nSigned-off-by: Zizhi Wo \u003cwozizhi@huaweicloud.com\u003e\nLink: https://patch.msgid.link/20260413010814.548568-1-wozizhi@huawei.com\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "fc5f996bfb7576f8cffbba09cb02432622ffea61", "tree": "1ae1577f2eb1c338d5a43c2b5c4507288289bce2", "parents": [ "6deb53595092b1426885f6503d93eedc1e3ece77", "aec3202247b4ab41c5bf3b9f704a2d9a323a051b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:49:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:49:25 2026 -0700" }, "message": "Merge branch \u0027net-packetengines-remove-obsolete-pci-drivers\u0027\n\nMingyu Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: packetengines: remove obsolete PCI drivers\n\nAs discussed with Andrew Lunn, this patch series removes the obsolete\nhamachi and yellowfin PCI drivers. Both drivers support hardware that\nis over two decades old and no longer in active use.\n\nRemoving them eliminates dead code and reduces the overall maintenance\nburden on the netdev subsystem.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nJakub: trim defconfigs appropriately\n\nLink: https://patch.msgid.link/20260422044820.485660-1-25181214217@stu.xidian.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aec3202247b4ab41c5bf3b9f704a2d9a323a051b", "tree": "1ae1577f2eb1c338d5a43c2b5c4507288289bce2", "parents": [ "4cf42f9c3e3624fedf4f6c38c3d81d80c8b3cbd6" ], "author": { "name": "Mingyu Wang", "email": "25181214217@stu.xidian.edu.cn", "time": "Wed Apr 22 12:48:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:49:08 2026 -0700" }, "message": "net: packetengines: remove obsolete yellowfin driver and vendor dir\n\nSimilar to the hamachi driver, the yellowfin driver supports hardware\nthat is over two decades old and no longer in active use.\n\nSince yellowfin was the last remaining driver in the packetengines\nvendor directory, we can now safely remove the entire directory and\ndrop its associated references from the parent Kconfig and Makefile.\n\nThis eliminates dead code and reduces the overall maintenance burden\non the netdev subsystem.\n\nSigned-off-by: Mingyu Wang \u003c25181214217@stu.xidian.edu.cn\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422044820.485660-3-25181214217@stu.xidian.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4cf42f9c3e3624fedf4f6c38c3d81d80c8b3cbd6", "tree": "b13d8f828f00d93f29d56dfab726c9b9371e0032", "parents": [ "6deb53595092b1426885f6503d93eedc1e3ece77" ], "author": { "name": "Mingyu Wang", "email": "25181214217@stu.xidian.edu.cn", "time": "Wed Apr 22 12:48:19 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:48:07 2026 -0700" }, "message": "net: packetengines: remove obsolete hamachi driver\n\nThe PacketEngine Hamachi driver is for PCI hardware that has been\nobsolete for over two decades. It recently triggered arithmetic\nexceptions during automated fuzzing.\n\nAs suggested by maintainers, remove the driver entirely to eliminate\ndead code and reduce the maintenance burden.\n\nSigned-off-by: Mingyu Wang \u003c25181214217@stu.xidian.edu.cn\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422044820.485660-2-25181214217@stu.xidian.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e6391da4539c35422c0df1d1d2d9a9bb97cd736", "tree": "80b84988dd3fc7088fbdd41e48dd0dde1bbd1da8", "parents": [ "27ae4bcf4df480eb7588e01de8f3c4fb74b11d30", "3476c8bb960f48e49355d6f93fb7673211e0163f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:29:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:29:18 2026 -0700" }, "message": "Merge branch \u0027rxrpc-miscellaneous-fixes\u0027\n\nDavid Howells says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nrxrpc: Miscellaneous fixes\n\nHere are some fixes for rxrpc, as found by Sashiko[1]:\n\n (1) Fix rxrpc_input_call_event() to only unshare DATA packets.\n\n (2) Fix re-decryption of RESPONSE packets where a partially decrypted\n skbuff gets requeued if there was a failure due to ENOMEM.\n\n (3) Fix error handling in rxgk_extract_token() where the ENOMEM case is\n unhandled.\n\nLink: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com [1]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260423200909.3049438-1-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3476c8bb960f48e49355d6f93fb7673211e0163f", "tree": "80b84988dd3fc7088fbdd41e48dd0dde1bbd1da8", "parents": [ "0422e7a4883f25101903f3e8105c0808aa5f4ce9" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Apr 23 21:09:08 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:29:16 2026 -0700" }, "message": "rxrpc: Fix error handling in rxgk_extract_token()\n\nFix a missing bit of error handling in rxgk_extract_token(): in the event\nthat rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather\nthan continuing on (for anything else, it generates an abort).\n\nFixes: 64863f4ca494 (\"rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()\")\nCloses: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260423200909.3049438-4-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0422e7a4883f25101903f3e8105c0808aa5f4ce9", "tree": "e80782b0dadb6553039c13dfe2dd9721547f7de5", "parents": [ "55b2984c96c37f909bbfe8851f13152693951382" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Apr 23 21:09:07 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:29:15 2026 -0700" }, "message": "rxrpc: Fix re-decryption of RESPONSE packets\n\nIf a RESPONSE packet gets a temporary failure during processing, it may end\nup in a partially decrypted state - and then get requeued for a retry.\n\nFix this by just discarding the packet; we will send another CHALLENGE\npacket and thereby elicit a further response. Similarly, discard an\nincoming CHALLENGE packet if we get an error whilst generating a RESPONSE;\nthe server will send another CHALLENGE.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nCloses: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260423200909.3049438-3-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "55b2984c96c37f909bbfe8851f13152693951382", "tree": "f7791502de8268d74335793e71885f2ccd1829cd", "parents": [ "27ae4bcf4df480eb7588e01de8f3c4fb74b11d30" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Thu Apr 23 21:09:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:29:15 2026 -0700" }, "message": "rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets\n\nFix rxrpc_input_call_event() to only unshare DATA packets and not ACK,\nABORT, etc..\n\nAnd with that, rxrpc_input_packet() doesn\u0027t need to take a pointer to the\npointer to the packet, so change that to just a pointer.\n\nFixes: 1f2740150f90 (\"rxrpc: Fix potential UAF after skb_unshare() failure\")\nCloses: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "27ae4bcf4df480eb7588e01de8f3c4fb74b11d30", "tree": "f55e9a5d255d089f1c6c90cb139299bb1c53225b", "parents": [ "8141a2dc70080eda1aedc0389ed2db2b292af5bd", "ac33733b10b484d666f97688561670afd5861383" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:54 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:41:52 2026 -0700" }, "message": "Merge branch \u0027rxrpc-miscellaneous-fixes\u0027\n\nDavid Howells says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nrxrpc: Miscellaneous fixes\n\nHere are some fixes for rxrpc, as found by Sashiko[1]:\n\n (1) Fix leaks in rxkad_verify_response().\n\n (2) Fix handling of rxkad-encrypted packets with crypto-misaligned\n lengths.\n\n (3) Fix problem with unsharing DATA packets potentially causing a crash in\n the caller.\n\n (4) Fix lack of unsharing of RESPONSE packets.\n\n (5) Fix integer overflow in RxGK ticket length check.\n\n (6) Fix missing length check in RxKAD tickets.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260422161438.2593376-1-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac33733b10b484d666f97688561670afd5861383", "tree": "f55e9a5d255d089f1c6c90cb139299bb1c53225b", "parents": [ "6929350080f4da292d111a3b33e53138fee51cec" ], "author": { "name": "Anderson Nascimento", "email": "anderson@allelesecurity.com", "time": "Wed Apr 22 17:14:35 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:41:49 2026 -0700" }, "message": "rxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads \u003c\u003d 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic.\n\nFixes: 8a7a3eb4ddbe (\"KEYS: RxRPC: Use key preparsing\")\nFixes: 84924aac08a4 (\"rxrpc: Fix checker warning\")\nReported-by: Anderson Nascimento \u003canderson@allelesecurity.com\u003e\nSigned-off-by: Anderson Nascimento \u003canderson@allelesecurity.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-7-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6929350080f4da292d111a3b33e53138fee51cec", "tree": "48a53f5a175ab0773672ee4faba0eaf1858e9941", "parents": [ "24481a7f573305706054c59e275371f8d0fe919f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 22 17:14:34 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:52 2026 -0700" }, "message": "rxgk: Fix potential integer overflow in length check\n\nFix potential integer overflow in rxgk_extract_token() when checking the\nlength of the ticket. Rather than rounding up the value to be tested\n(which might overflow), round down the size of the available data.\n\nFixes: 2429a1976481 (\"rxrpc: Fix untrusted unsigned subtract\")\nCloses: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-6-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "24481a7f573305706054c59e275371f8d0fe919f", "tree": "84bca631e50b152fa0fbd9718197b641e9a6dbdb", "parents": [ "1f2740150f904bfa60e4bad74d65add3ccb5e7f8" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 22 17:14:33 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:52 2026 -0700" }, "message": "rxrpc: Fix conn-level packet handling to unshare RESPONSE packets\n\nThe security operations that verify the RESPONSE packets decrypt bits of it\nin place - however, the sk_buff may be shared with a packet sniffer, which\nwould lead to the sniffer seeing an apparently corrupt packet (actually\ndecrypted).\n\nFix this by handing a copy of the packet off to the specific security\nhandler if the packet was cloned.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nCloses: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-5-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1f2740150f904bfa60e4bad74d65add3ccb5e7f8", "tree": "23830c6584d05c839ea956459f38d162d191b553", "parents": [ "def304aae2edf321d2671fd6ca766a93c21f877e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 22 17:14:32 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:52 2026 -0700" }, "message": "rxrpc: Fix potential UAF after skb_unshare() failure\n\nIf skb_unshare() fails to unshare a packet due to allocation failure in\nrxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread())\nwill be NULL\u0027d out. This will likely cause the call to\ntrace_rxrpc_rx_done() to oops.\n\nFix this by moving the unsharing down to where rxrpc_input_call_event()\ncalls rxrpc_input_call_packet(). There are a number of places prior to\nthat where we ignore DATA packets for a variety of reasons (such as the\ncall already being complete) for which an unshare is then avoided.\n\nAnd with that, rxrpc_input_packet() doesn\u0027t need to take a pointer to the\npointer to the packet, so change that to just a pointer.\n\nFixes: 2d1faf7a0ca3 (\"rxrpc: Simplify skbuff accounting in receive path\")\nCloses: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-4-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "def304aae2edf321d2671fd6ca766a93c21f877e", "tree": "95917a1d02c3de70230fba9ce7183964438c88f3", "parents": [ "34f61a07e0cdefaecd3ec03bb5fb22215643678f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 22 17:14:31 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:52 2026 -0700" }, "message": "rxrpc: Fix rxkad crypto unalignment handling\n\nFix handling of a packet with a misaligned crypto length. Also handle\nnon-ENOMEM errors from decryption by aborting. Further, remove the\nWARN_ON_ONCE() so that it can\u0027t be remotely triggered (a trace line can\nstill be emitted).\n\nFixes: f93af41b9f5f (\"rxrpc: Fix missing error checks for rxkad encryption/decryption failure\")\nCloses: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-3-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "34f61a07e0cdefaecd3ec03bb5fb22215643678f", "tree": "13cf4318618295e8dc84a0ee0a4f40205a52f1d2", "parents": [ "8141a2dc70080eda1aedc0389ed2db2b292af5bd" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 22 17:14:30 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:40:52 2026 -0700" }, "message": "rxrpc: Fix memory leaks in rxkad_verify_response()\n\nFix rxkad_verify_response() to free the ticket and the server key under all\ncircumstances by initialising the ticket pointer to NULL and then making\nall paths through the function after the first allocation has been done go\nthrough a single common epilogue that just releases everything - where all\nthe releases skip on a NULL pointer.\n\nFixes: 57af281e5389 (\"rxrpc: Tidy up abort generation infrastructure\")\nFixes: ec832bd06d6f (\"rxrpc: Don\u0027t retain the server key in the connection\")\nCloses: https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260422161438.2593376-2-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9c59b464517c6ef0302ffa7d993a979a4cb50bf7", "tree": "d01ccb6b55199adae728c0d6d70bd4b0c9d6c49f", "parents": [ "45dcf5e28813954da4150e7260ccb61e95856176", "beca8264d502bbe8509141432c73ab7a816a4076" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 12:29:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 12:29:22 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These fix two potential refcount leaks in error code paths in the ACPI\n core code, address a recently introduced build breakage related to the\n CPU UID handling consolidation, fix up a recently added MAINTAINERS\n entry, fix the quirk list in the ACPI video bus driver, and add a new\n quirk to it:\n\n - Add an acpi_get_cpu_uid() stub helper to address an x86 Xen support\n build breakage (Arnd Bergmann)\n\n - Use acpi_dev_put() in object add error paths in the ACPI core to\n avoid refcount leaks (Guangshuo Li)\n\n - Adjust the file entry in the recently added NVIDIA GHES HANDLER\n entry in MAINTAINERS to the actual existing file (Lukas Bulwahn)\n\n - Add backlight\u003dnative quirk for Dell OptiPlex 7770 AIO to the ACPI\n video bus driver (Jan Schär)\n\n - Move Lenovo Legion S7 15ACH6 quirk to the right section of the\n quirk list in the ACPI video bus driver (Hans de Goede)\"\n\n* tag \u0027acpi-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section\n ACPI: video: Add backlight\u003dnative quirk for Dell OptiPlex 7770 AIO\n ACPI: add acpi_get_cpu_uid() stub helper\n MAINTAINERS: adjust file entry in NVIDIA GHES HANDLER\n ACPI: scan: Use acpi_dev_put() in object add error paths\n" }, { "commit": "6deb53595092b1426885f6503d93eedc1e3ece77", "tree": "9b3b387aafc114beea48cef0cfcc431f0d957e10", "parents": [ "dd8d4bc28ad7252610d8e79c1313a2d1e3499a51" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 20 13:42:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 12:21:14 2026 -0700" }, "message": "net: remove unused ATM protocols and legacy ATM device drivers\n\nRemove the ATM protocol modules and PCI/SBUS ATM device drivers\nthat are no longer in active use.\n\nThe ATM core protocol stack, PPPoATM, BR2684, and USB DSL modem\ndrivers (drivers/usb/atm/) are retained in-tree to maintain PPP\nover ATM (PPPoA) and PPPoE-over-BR2684 support for DSL connections.\nThe Solos ADSL2+ PCI driver is also retained.\n\nRemoved ATM protocol modules:\n - net/atm/clip.c - Classical IP over ATM (RFC 2225)\n - net/atm/lec.c - LAN Emulation Client (LANE)\n - net/atm/mpc.c, mpoa_caches.c, mpoa_proc.c - Multi-Protocol Over ATM\n\nRemoved PCI/SBUS ATM device drivers (drivers/atm/):\n - adummy, atmtcp - software/testing ATM devices\n - eni - Efficient Networks ENI155P (OC-3, ~1995)\n - fore200e - FORE Systems 200E PCI/SBUS (OC-3, ~1999)\n - he - ForeRunner HE (OC-3/OC-12, ~2000)\n - idt77105 - IDT 77105 25 Mbps ATM PHY\n - idt77252 - IDT 77252 NICStAR II (OC-3, ~2000)\n - iphase - Interphase ATM PCI (OC-3/DS3/E3)\n - lanai - Efficient Networks Speedstream 3010\n - nicstar - IDT 77201 NICStAR (155/25 Mbps, ~1999)\n - suni - PMC S/UNI SONET PHY library\n\nAlso clean up references in:\n - net/bridge/ - remove ATM LANE hook (br_fdb_test_addr_hook,\n br_fdb_test_addr)\n - net/core/dev.c - remove br_fdb_test_addr_hook export\n - defconfig files - remove ATM driver config options\n\nThe removed code is moved to an out-of-tree module package (mod-orphan).\n\nAcked-by: Andy Shevchenko \u003candriy.shevchenko@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260422041846.2035118-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "8141a2dc70080eda1aedc0389ed2db2b292af5bd" }