)]}' { "log": [ { "commit": "7d0a66e4bb9081d75c82ec4957c50034cb0ea449", "tree": "61e7217a84de6106ad5cc06aa62164e1862d2bdc", "parents": [ "e69c7c175115c51c7f95394fc55425a395b3af59" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 30 14:42:10 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 30 14:42:10 2025 -0800" }, "message": "Linux 6.18\n" }, { "commit": "e69c7c175115c51c7f95394fc55425a395b3af59", "tree": "eda96dee5b666e2cba563107d8546a85cada2ac6", "parents": [ "6bda50f4333fa61c07f04f790fdd4e2c9f4ca610", "c7418164b463056bf4327b6a2abe638b78250f13" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 30 08:47:10 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 30 08:47:10 2025 -0800" }, "message": "Merge tag \u0027timers_urgent_for_v6.18_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Borislav Petkov:\n\n - Have timekeeping aux clocks sysfs interface setup function return an\n error code on failure instead of success\n\n* tag \u0027timers_urgent_for_v6.18_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timekeeping: Fix error code in tk_aux_sysfs_init()\n" }, { "commit": "6bda50f4333fa61c07f04f790fdd4e2c9f4ca610", "tree": "f87e3105d67989e66964dcd4c08144cf999850e7", "parents": [ "19eef1d98eeda3745df35839190b7d4a4adea656", "841ecc979b18d3227fad5e2d6a1e6f92688776b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 29 15:15:14 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 29 15:15:14 2025 -0800" }, "message": "Merge tag \u0027mips-fixes_6.18_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS fix from Thomas Bogendoerfer:\n \"Fix TLB unification for cores with more than 64 TLB entries\"\n\n* tag \u0027mips-fixes_6.18_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:\n MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow\n" }, { "commit": "841ecc979b18d3227fad5e2d6a1e6f92688776b5", "tree": "a9e37859e45da68bdad9a19eaea3b3c25b78563e", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Fri Nov 28 16:53:46 2025 +0000" }, "committer": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Sat Nov 29 13:36:05 2025 +0100" }, "message": "MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow\n\nOwing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+\ncores can have more than 64 TLB entries. Therefore allocate an array\nfor uniquification instead of placing too an small array on the stack.\n\nFixes: 35ad7e181541 (\"MIPS: mm: tlb-r4k: Uniquify TLB entries on init\")\nCo-developed-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nCc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification\nCc: stable@vger.kernel.org # v6.17+\nTested-by: Gregory CLEMENT \u003cgregory.clement@bootlin.com\u003e\nTested-by: Klara Modin \u003cklarasmodin@gmail.com\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\n" }, { "commit": "19eef1d98eeda3745df35839190b7d4a4adea656", "tree": "8d0b29825fa335ad0b98a8fc9e09d34d87d5e96b", "parents": [ "e6640487845061255af9614ec0a192e4fafa486e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sat Nov 29 00:40:11 2025 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 16:48:18 2025 -0800" }, "message": "afs: Fix uninit var in afs_alloc_anon_key()\n\nFix an uninitialised variable (key) in afs_alloc_anon_key() by setting it\nto cell-\u003eanonymous_key. Without this change, the error check may return a\nfalse failure with a bad error number.\n\nMost of the time this is unlikely to happen because the first encounter\nwith afs_alloc_anon_key() will usually be from (auto)mount, for which all\nsubsequent operations must wait - apart from other (auto)mounts. Once the\ncall-\u003eanonymous_key is allocated, all further calls to afs_request_key()\nwill skip the call to afs_alloc_anon_key() for that cell.\n\nFixes: d27c71257825 (\"afs: Fix delayed allocation of a cell\u0027s anonymous key\")\nReported-by: Paulo Alcantra \u003cpc@manguebit.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com\ncc: linux-afs@lists.infradead.org\ncc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e6640487845061255af9614ec0a192e4fafa486e", "tree": "39cb744281ad49ea6fba0310683d0c340381e32f", "parents": [ "82ebd4e32029f299011a6ef68d96f5ddcea0723a", "40ad64ac25bb736740f895d99a4aebbda9b80991" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 14:08:09 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 14:08:09 2025 -0800" }, "message": "Merge tag \u0027spi-fix-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A disappointingly large set of device specific fixes that have built\n up since I\u0027ve been a bit tardy with sending a pull requests as people\n kept sending me new new fixes.\n\n The bcm63xx and lpspi issues could lead to corruption so the fixes are\n fairly important for the affected parts, the other issues should all\n be relatively minor\"\n\n* tag \u0027spi-fix-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: nxp-fspi: Propagate fwnode in ACPI case as well\n spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA\n spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors\n spi: spi-fsl-lpspi: fix watermark truncation caused by type cast\n spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm\n spi: bcm63xx: fix premature CS deassertion on RX-only transactions\n spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call\n spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance\n" }, { "commit": "82ebd4e32029f299011a6ef68d96f5ddcea0723a", "tree": "a9f7a54f25e42ec6a417368a3e5ab6dcc98794bc", "parents": [ "9917bf8e7f5a9efbab844cf06cfd8da8eb7e13b6", "8684229e19c4185d53d6fb7004d733907c865a91" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 14:06:05 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 14:06:05 2025 -0800" }, "message": "Merge tag \u0027regulator-fix-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of fixes for incorrect device descriptions in the rtq2208\n driver\"\n\n* tag \u0027regulator-fix-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: rtq2208: Correct LDO2 logic judgment bits\n regulator: rtq2208: Correct buck group2 phase mapping logic\n" }, { "commit": "9917bf8e7f5a9efbab844cf06cfd8da8eb7e13b6", "tree": "a390d32ccf610e7929e58fad97ee5ff5e42662c4", "parents": [ "f3b17337b943949d0f3d12835d10d866210aeee8", "f6dc5a36195d3f5be769f60d6987150192dfb099" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 12:42:11 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 12:42:11 2025 -0800" }, "message": "Merge tag \u0027io_uring-6.18-20251128\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Ensure that vectored registered buffer imports ties the lifetime of\n those to the zero-copy send notification, not the parent request\n\n - Fix a bug introduced in this merge window, with the introduction of\n mixed sized CQE support\n\n* tag \u0027io_uring-6.18-20251128\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: fix mixed cqe overflow handling\n io_uring/net: ensure vectored buffer node import is tied to notification\n" }, { "commit": "f3b17337b943949d0f3d12835d10d866210aeee8", "tree": "1eab6626c88ea639473bf6d522e008c903679466", "parents": [ "7fa0d7744c28267142287a75134de58790999e72", "d27c71257825dced46104eefe42e4d9964bd032e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 10:01:24 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 10:01:24 2025 -0800" }, "message": "Merge tag \u0027vfs-6.18-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - afs: Fix delayed allocation of a cell\u0027s anonymous key\n\n The allocation of a cell\u0027s anonymous key is done in a background\n thread along with other cell setup such as doing a DNS upcall. The\n normal key lookup tries to use the key description on the anonymous\n authentication key as the reference for request_key() - but it may\n not yet be set, causing an oops\n\n - ovl: fail ovl_lock_rename_workdir() if either target is unhashed\n\n As well as checking that the parent hasn\u0027t changed after getting the\n lock, the code needs to check that the dentry hasn\u0027t been unhashed.\n Otherwise overlayfs might try to rename something that has been\n removed\n\n - namespace: fix a reference leak in grab_requested_mnt_ns\n\n lookup_mnt_ns() already takes a reference on mnt_ns, and so\n grab_requested_mnt_ns() doesn\u0027t need to take an extra reference\n\n* tag \u0027vfs-6.18-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n afs: Fix delayed allocation of a cell\u0027s anonymous key\n ovl: fail ovl_lock_rename_workdir() if either target is unhashed\n fs/namespace: fix reference leak in grab_requested_mnt_ns\n" }, { "commit": "7fa0d7744c28267142287a75134de58790999e72", "tree": "3005f185ddd899780bd3645adf6b8d473f6e486b", "parents": [ "6cf62f0174de64e4161e301bb0ed52e198ce25dc", "3ecfcf34f0992d11e5eb2458a2108b3320c61ba4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:57:31 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:57:31 2025 -0800" }, "message": "Merge tag \u0027soc-fixes-6.18-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"A few last minute fixes came in this week:\n\n - interrupt and gpio numbers in foud separate i.MX8 specific\n devicetree files were wrong\n\n - The vector length property in the C906 CPU description used the\n wrong unit\n\n - Two bugs with uninitialized stack variables in the tee subsystem\n\n - Alexander Stein now maintains additional devicetree files\"\n\n* tag \u0027soc-fixes-6.18-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n riscv: dts: allwinner: d1: fix vlenb property\n MAINTAINERS: Add entry for TQ-Systems AM335 device trees\n tee: qcomtee: initialize result before use in release worker\n arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity\n tee: qcomtee: fix uninitialized pointers with free attribute\n ARM: dts: nxp: imx6ul: correct SAI3 interrupt line\n arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos\n arm64: dts: imx8dxl: Correct pcie-ep interrupt number\n" }, { "commit": "6cf62f0174de64e4161e301bb0ed52e198ce25dc", "tree": "f697250b484083386113e8d1d3e8aaa3cd36f76d", "parents": [ "dabf127d641e43d5fbb72a1f48209818349db7ef", "03bc4831ef064e114328dea906101cff7c6fb8b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:44:48 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:44:48 2025 -0800" }, "message": "Merge tag \u0027char-misc-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char / misc / IIO fixes from Greg KH:\n \"Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8.\n\n Fixes in here include:\n\n - lots of iio driver bugfixes for reported issues.\n\n - counter driver bugfix\n\n - slimbus driver bugfix\n\n - mei tiny bugfix\n\n - nvmem layout uevent bugfix\n\n All of these have been in linux-next for a while, but due to travel on\n my side, I haven\u0027t had a chance to get them to you\"\n\n* tag \u0027char-misc-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits)\n nvmem: layouts: fix nvmem_layout_bus_uevent\n iio: accel: bmc150: Fix irq assumption regression\n most: usb: fix double free on late probe failure\n slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves\n firmware: stratix10-svc: fix bug in saving controller data\n mei: fix error flow in probe\n iio: st_lsm6dsx: Fixed calibrated timestamp calculation\n iio: humditiy: hdc3020: fix units for thresholds and hysteresis\n iio: humditiy: hdc3020: fix units for temperature and humidity measurement\n iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields\n iio: accel: fix ADXL355 startup race condition\n iio: adc: ad7124: fix temperature channel\n iio:common:ssp_sensors: Fix an error handling path ssp_probe()\n iio: adc: ad7280a: fix ad7280_store_balance_timer()\n iio: buffer-dmaengine: enable .get_dma_dev()\n iio: buffer-dma: support getting the DMA channel\n iio: buffer: support getting dma channel from the buffer\n iio: pressure: bmp280: correct meas_time_us calculation\n iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling\n iio: adc: ad7380: fix SPI offload trigger rate\n ...\n" }, { "commit": "dabf127d641e43d5fbb72a1f48209818349db7ef", "tree": "0db4788f6376b39c5d1c3f266acea52643a4408e", "parents": [ "5d324e5159d9e6a1e6678007ce3f24e569650db6", "2bf95a9bcb50002ca9d47403d60aedaeb2e19abe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:16:20 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:16:20 2025 -0800" }, "message": "Merge tag \u0027tty-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull serial driver fixes from Greg KH:\n \"Here are two serial driver fixes for reported issues for 6.18-rc8.\n\n These are:\n\n - fix for a much reported symbol build loop that broke the build for\n some kernel configurations\n\n - amba-pl011 driver bugfix for a reported issue\n\n Both have been in linux next (the last for weeks, the first for a\n shorter amount of time), with no reported issues\"\n\n* tag \u0027tty-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n serial: 8250: Fix 8250_rsa symbol loop\n serial: amba-pl011: prefer dma_mapping_error() over explicit address checking\n" }, { "commit": "5d324e5159d9e6a1e6678007ce3f24e569650db6", "tree": "cbdb974120a5f26c551072014ba5ab3fd2e6a61f", "parents": [ "24a84ea4eef6ec6245e1efdc64764d60d17321bb", "74851fbb6d647304f8a7dc491434d3a335ef4b8d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:12:40 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:12:40 2025 -0800" }, "message": "Merge tag \u0027usb-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB/Thunderbolt fixes from Greg KH:\n \"Here are some last-minutes USB and Thunderbolt driver fixes and new\n device ids for 6.18-rc8. Included in here are:\n\n - usb storage quirk fixup\n\n - xhci driver fixes for reported issues\n\n - usb gadget driver fixes\n\n - dwc3 driver fixes\n\n - UAS driver fixup\n\n - thunderbolt new device ids\n\n - usb-serial driver new ids\n\n All of these have been in linux-next with no reported issues, many for\n many weeks\"\n\n* tag \u0027usb-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits)\n usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors\n USB: storage: Remove subclass and protocol overrides from Novatek quirk\n usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer\n usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths\n xhci: dbgtty: fix device unregister\n usb: storage: sddr55: Reject out-of-bound new_pba\n USB: serial: option: add support for Rolling RW101R-GL\n usb: typec: ucsi: psy: Set max current to zero when disconnected\n usb: gadget: f_eem: Fix memory leak in eem_unwrap\n usb: dwc3: pci: Sort out the Intel device IDs\n usb: dwc3: pci: add support for the Intel Nova Lake -S\n drivers/usb/dwc3: fix PCI parent check\n usb: storage: Fix memory leak in USB bulk transport\n xhci: sideband: Fix race condition in sideband unregister\n xhci: dbgtty: Fix data corruption when transmitting data form DbC to host\n xhci: fix stale flag preventig URBs after link state error is cleared\n USB: serial: ftdi_sio: add support for u-blox EVK-M101\n usb: cdns3: Fix double resource release in cdns3_pci_probe\n usb: gadget: udc: fix use-after-free in usb_gadget_state_work\n usb: renesas_usbhs: Fix synchronous external abort on unbind\n ...\n" }, { "commit": "24a84ea4eef6ec6245e1efdc64764d60d17321bb", "tree": "6e962208454ce59b006c8865e17955a4b5ac66b7", "parents": [ "4331989728da4e868fcda75bde872d032f5ce6ac", "e3cee98f2fcc2234be7813c0e55a7f7a5e77aaf2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:09:33 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 09:09:33 2025 -0800" }, "message": "Merge tag \u0027mailbox-fixes-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox\n\nPull mailbox fixes from Jassi Brar:\n\n - omap: check for pending msgs only when mbox is exclusive\n\n - mailbox-test: debugfs_create_dir error checking\n\n - mtk:\n - cmdq: fix DMA address handling\n - gpueb: Add missing \u0027static\u0027 to mailbox ops struct\n\n - pcc: don\u0027t zero error register\n\n - th1520: fix clock imbalance on probe failure\n\n* tag \u0027mailbox-fixes-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:\n mailbox: th1520: fix clock imbalance on probe failure\n mailbox: pcc: don\u0027t zero error register\n mailbox: mtk-gpueb: Add missing \u0027static\u0027 to mailbox ops struct\n mailbox: mtk-cmdq: Refine DMA address handling for the command buffer\n mailbox: mailbox-test: Fix debugfs_create_dir error checking\n mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive\n" }, { "commit": "3ecfcf34f0992d11e5eb2458a2108b3320c61ba4", "tree": "168af3a321808723abcd5115c8e20a17e411fac7", "parents": [ "a6737fe620315db4a47d577703d516cdea960991", "9f393d8e757f79060baf4b2e703bd6b2d0d8d323" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Nov 28 17:37:13 2025 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Nov 28 17:37:13 2025 +0100" }, "message": "Merge tag \u0027sunxi-fixes-for-6.18\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes\n\nAllwinner fixes for 6.18\n\nJust one fix to correct the \"thead,vlenb\" property for the RISC-V based\nD1 SoC family.\n\n* tag \u0027sunxi-fixes-for-6.18\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:\n riscv: dts: allwinner: d1: fix vlenb property\n" }, { "commit": "a6737fe620315db4a47d577703d516cdea960991", "tree": "e51ef53ff070fd24a9871bb9f52001d213c9a5d0", "parents": [ "fe7cdcd1bacec3a54ec94131292b5c883cec50cf", "517d066dc080fc297f1ab5e8c6fda7c59d48ef8d" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Nov 21 22:14:04 2025 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Nov 28 17:36:52 2025 +0100" }, "message": "Merge tag \u0027omap-for-v6.19/maintainers-signed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes\n\nMAINTAINERS: Add entry for TQ-Systems AM335 device trees\n\n* tag \u0027omap-for-v6.19/maintainers-signed\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:\n MAINTAINERS: Add entry for TQ-Systems AM335 device trees\n" }, { "commit": "4331989728da4e868fcda75bde872d032f5ce6ac", "tree": "40c3aca46921f9bd85c91e33e0c29f60f64498b5", "parents": [ "f849f26f77205e25f6ad0b9011b1b68a560d35ff", "747528729c9b6733839f9c95f300d5bef95ee52c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 08:20:14 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 08:20:14 2025 -0800" }, "message": "Merge tag \u0027mmc-v6.18-rc2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fix from Ulf Hansson:\n\n - sdhci-of-dwcmshc: Fix reset handling for some variants\n\n* tag \u0027mmc-v6.18-rc2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level\n" }, { "commit": "f849f26f77205e25f6ad0b9011b1b68a560d35ff", "tree": "d19e745f2bbfa91b2074eff192f77f9822fa73af", "parents": [ "e538109ac71d801d26776af5f3c54f548296c29c", "c98c99d5dbdf9fb0063650594edfd7d49b5f4e29" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 08:08:02 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 28 08:08:02 2025 -0800" }, "message": "Merge tag \u0027pmdomain-v6.18-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - mediatek: Fix spinlock recursion in probe\n\n - tegra: Use GENPD_FLAG_NO_STAY_ON to restore old behaviour\n\n* tag \u0027pmdomain-v6.18-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag\n pmdomains: mtk-pm-domains: Fix spinlock recursion in probe\n" }, { "commit": "e3cee98f2fcc2234be7813c0e55a7f7a5e77aaf2", "tree": "ee6c5d21fba8bb6ec03aea8658ee25e0c712dc3f", "parents": [ "ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Fri Oct 17 07:54:14 2025 +0200" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:47:44 2025 -0600" }, "message": "mailbox: th1520: fix clock imbalance on probe failure\n\nThe purpose of the devm_add_action_or_reset() helper is to call the\naction function in case adding an action ever fails so drop the clock\ndisable from the error path to avoid disabling the clocks twice.\n\nFixes: 5d4d263e1c6b (\"mailbox: Introduce support for T-head TH1520 Mailbox driver\")\nCc: Michal Wilczynski \u003cm.wilczynski@samsung.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nReviewed-by: Michal Wilczynski \u003cm.wilczynski@samsung.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "ff0e4d4c97c94af34cc9cad37b5a5cdbe597a3b0", "tree": "e11d8ce81d4ed1e58bc775401fe5642267200548", "parents": [ "094b53ecaa3ef227f9c800f8de90a9b44f1c1bb4" ], "author": { "name": "Jamie Iles", "email": "jamie.iles@oss.qualcomm.com", "time": "Wed Nov 05 14:42:29 2025 +0000" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:31:53 2025 -0600" }, "message": "mailbox: pcc: don\u0027t zero error register\n\nThe error status mask for a type 3/4 subspace is used for reading the\nerror status, and the bitwise inverse is used for clearing the error\nwith the intent being to preserve any of the non-error bits. However,\nwe were previously applying the mask to extract the status and then\napplying the inverse to the result which ended up clearing all bits.\n\nInstead, store the inverse mask in the preserve mask and then use that\non the original value read from the error status so that only the error\nis cleared.\n\nFixes: c45ded7e1135 (\"mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)\")\nSigned-off-by: Jamie Iles \u003cjamie.iles@oss.qualcomm.com\u003e\nSigned-off-by: Punit Agrawal \u003cpunit.agrawal@oss.qualcomm.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "094b53ecaa3ef227f9c800f8de90a9b44f1c1bb4", "tree": "d42011d4945d70f78c613f5d14e4f60b7ff92c30", "parents": [ "a195c7ccfb7a21b8118139835e25936ec8722596" ], "author": { "name": "Nicolas Frattaroli", "email": "nicolas.frattaroli@collabora.com", "time": "Mon Oct 13 10:09:01 2025 +0200" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:31:53 2025 -0600" }, "message": "mailbox: mtk-gpueb: Add missing \u0027static\u0027 to mailbox ops struct\n\nmtk_gpueb_mbox_ops should be declared static. However, due to its const\nnature, this specifier was missed, as it compiled fine without it and\nwith no warning by the compiler.\n\narc-linux-gcc (GCC) 12.5.0 doesn\u0027t seem to like it however, so add the\nstatic to fix that.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202510100629.3nGvrhEU-lkp@intel.com/\nFixes: dbca0eabb821 (\"mailbox: add MediaTek GPUEB IPI mailbox\")\nSigned-off-by: Nicolas Frattaroli \u003cnicolas.frattaroli@collabora.com\u003e\nReviewed-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "a195c7ccfb7a21b8118139835e25936ec8722596", "tree": "11c4b59ec59d236f3fdc1340341124ef21a51fc1", "parents": [ "3acf1028f5003731977f750a7070f3321a9cb740" ], "author": { "name": "Jason-JH Lin", "email": "jason-jh.lin@mediatek.com", "time": "Thu Oct 23 01:16:30 2025 +0800" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:31:53 2025 -0600" }, "message": "mailbox: mtk-cmdq: Refine DMA address handling for the command buffer\n\nGCE can only fetch the command buffer address from a 32-bit register.\nSome SoCs support a 35-bit command buffer address for GCE, which\nrequires a right shift of 3 bits before setting the address into\nthe 32-bit register. A comment has been added to the header of\ncmdq_get_shift_pa() to explain this requirement.\n\nTo prevent the GCE command buffer address from being DMA mapped beyond\nits supported bit range, the DMA bit mask for the device is set during\ninitialization.\n\nAdditionally, to ensure the correct shift is applied when setting or\nreading the register that stores the GCE command buffer address,\nnew APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have\nbeen introduced for consistent operations on this register.\n\nThe variable type for the command buffer address has been standardized\nto dma_addr_t to prevent handling issues caused by type mismatches.\n\nFixes: 0858fde496f8 (\"mailbox: cmdq: variablize address shift in platform\")\nSigned-off-by: Jason-JH Lin \u003cjason-jh.lin@mediatek.com\u003e\nReviewed-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "3acf1028f5003731977f750a7070f3321a9cb740", "tree": "ee621fe6c53cfed3ab0b3eeb777f9cfbef79ab85", "parents": [ "060e4e835f9394816584942511f22d771f05100c" ], "author": { "name": "Haotian Zhang", "email": "vulab@iscas.ac.cn", "time": "Thu Nov 20 10:40:39 2025 +0800" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:31:52 2025 -0600" }, "message": "mailbox: mailbox-test: Fix debugfs_create_dir error checking\n\nThe debugfs_create_dir() function returns ERR_PTR() on error, not NULL.\nThe current null-check fails to catch errors.\n\nUse IS_ERR() to correctly check for errors.\n\nFixes: 8ea4484d0c2b (\"mailbox: Add generic mechanism for testing Mailbox Controllers\")\nSigned-off-by: Haotian Zhang \u003cvulab@iscas.ac.cn\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "060e4e835f9394816584942511f22d771f05100c", "tree": "43feb4e5a3681f3e59cff582c36680703916108b", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Beleswar Padhi", "email": "b-padhi@ti.com", "time": "Tue Nov 04 01:41:11 2025 +0530" }, "committer": { "name": "Jassi Brar", "email": "jassisinghbrar@gmail.com", "time": "Fri Nov 28 09:31:52 2025 -0600" }, "message": "mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive\n\nOn TI K3 devices, the mailbox resides in the Always-On power domain\n(LPSC_main_alwayson) and is shared among multiple processors. The\nmailbox is not solely exclusive to Linux.\n\nCurrently, the suspend path checks all FIFO queues for pending messages\nand blocks suspend if any are present. This behavior is unnecessary for\nK3 devices, since some of the FIFOs are used for RTOS\u003c-\u003eRTOS\ncommunication and are independent of Linux.\n\nFor FIFOs used in Linux\u003c-\u003eRTOS communication, any pending message would\ntrigger an interrupt, which naturally prevents suspend from completing.\nHence, there is no need for the mailbox driver to explicitly check for\npending messages on K3 platforms.\n\nIntroduce a device match flag to indicate whether the mailbox instance\nis exclusive to Linux, and skip the pending message check for\nnon-exclusive instances (such as in K3).\n\nFixes: a49f991e740f (\"arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware\")\nCloses: https://lore.kernel.org/all/sid7gtg5vay5qgicsl6smnzwg5mnneoa35cempt5ddwjvedaio@hzsgcx6oo74l/\nSigned-off-by: Beleswar Padhi \u003cb-padhi@ti.com\u003e\nTested-by: Hiago De Franco \u003chiago.franco@toradex.com\u003e\nReviewed-by: Andrew Davis \u003cafd@ti.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\n" }, { "commit": "d27c71257825dced46104eefe42e4d9964bd032e", "tree": "76396a8374b2bbe2c36cc0fb1ceb7958ac2e2cc3", "parents": [ "e9c70084a64e51b65bb68f810692a03dc8bedffa" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Nov 28 10:19:05 2025 +0000" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Nov 28 11:30:10 2025 +0100" }, "message": "afs: Fix delayed allocation of a cell\u0027s anonymous key\n\nThe allocation of a cell\u0027s anonymous key is done in a background thread\nalong with other cell setup such as doing a DNS upcall. In the reported\nbug, this is triggered by afs_parse_source() parsing the device name given\nto mount() and calling afs_lookup_cell() with the name of the cell.\n\nThe normal key lookup then tries to use the key description on the\nanonymous authentication key as the reference for request_key() - but it\nmay not yet be set and so an oops can happen.\n\nThis has been made more likely to happen by the fix for dynamic lookup\nfailure.\n\nFix this by firstly allocating a reference name and attaching it to the\nafs_cell record when the record is created. It can share the memory\nallocation with the cell name (unfortunately it can\u0027t just overlap the cell\nname by prepending it with \"afs@\" as the cell name already has a \u0027.\u0027\nprepended for other purposes). This reference name is then passed to\nrequest_key().\n\nSecondly, the anon key is now allocated on demand at the point a key is\nrequested in afs_request_key() if it is not already allocated. A mutex is\nused to prevent multiple allocation for a cell.\n\nThirdly, make afs_request_key_rcu() return NULL if the anonymous key isn\u0027t\nyet allocated (if we need it) and then the caller can return -ECHILD to\ndrop out of RCU-mode and afs_request_key() can be called.\n\nNote that the anonymous key is kind of necessary to make the key lookup\ncache work as that doesn\u0027t currently cache a negative lookup, but it\u0027s\nprobably worth some investigation to see if NULL can be used instead.\n\nFixes: 330e2c514823 (\"afs: Fix dynamic lookup to fail on cell lookup failure\")\nReported-by: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nLink: https://patch.msgid.link/800328.1764325145@warthog.procyon.org.uk\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: linux-afs@lists.infradead.org\ncc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "e9c70084a64e51b65bb68f810692a03dc8bedffa", "tree": "c60df6e8d321623c713abde42894ee7ebf8e701b", "parents": [ "7b6dcd9bfd869eee7693e45b1817dac8c56e5f86" ], "author": { "name": "NeilBrown", "email": "neil@brown.name", "time": "Fri Nov 28 12:22:35 2025 +1100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Nov 28 10:42:32 2025 +0100" }, "message": "ovl: fail ovl_lock_rename_workdir() if either target is unhashed\n\nAs well as checking that the parent hasn\u0027t changed after getting the\nlock we need to check that the dentry hasn\u0027t been unhashed.\nOtherwise we might try to rename something that has been removed.\n\nReported-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com\nFixes: d2c995581c7c (\"ovl: Call ovl_create_temp() without lock held.\")\nSigned-off-by: NeilBrown \u003cneil@brown.name\u003e\nLink: https://patch.msgid.link/176429295510.634289.1552337113663461690@noble.neil.brown.name\nTested-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com\nReviewed-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "e538109ac71d801d26776af5f3c54f548296c29c", "tree": "ac348e20ec08fed5f5c67343df17b1caee51672a", "parents": [ "aa7243aaf1947a0cb54c44337795d6759493fe02", "6dbcb801e1eb1b1764fd0012918225b60dd7916c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 21:06:27 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 21:06:27 2025 -0800" }, "message": "Merge tag \u0027drm-fixes-2025-11-28\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Last one for this round hopefully, mostly the usual suspects,\n xe/amdgpu, with some single fixes otherwise.\n\n There is one amdgpu HDMI blackscreen bug that came in late in the\n cycle, but it was bisected and the revert is in here.\n\n i915:\n - Reject async flips when PSR\u0027s selective fetch is enabled\n\n xe:\n - Fix resource leak in xe_guc_ct_init_noalloc()\u0027s error path\n - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT\n - Fix overflow in conversion from clock tics to msec\n\n amdgpu:\n - Unified MES fix\n - HDMI fix\n - Cursor fix\n - Bightness fix\n - EDID reading improvement\n - UserQ fix\n - Cyan Skillfish IP discovery fix\n\n bridge:\n - sil902x: Fix HDMI detection\n\n imagination:\n - Update documentation\n\n sti:\n - Fix leaks in probe\n\n vga_switcheroo:\n - Avoid race condition during fbcon initialization\"\n\n* tag \u0027drm-fixes-2025-11-28\u0027 of https://gitlab.freedesktop.org/drm/kernel:\n drm/amdgpu: fix cyan_skillfish2 gpu info fw handling\n drm/amdgpu: attach tlb fence to the PTs update\n drm/amd/display: Increase EDID read retries\n drm/amd/display: Don\u0027t change brightness for disabled connectors\n drm/amd/display: Check NULL before accessing\n Revert \"drm/amd/display: Move setup_stream_attribute\"\n drm/xe: Fix conversion from clock ticks to milliseconds\n drm/xe/guc: Fix stack_depot usage\n drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc()\n drm/i915/psr: Reject async flips when selective fetch is enabled\n drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\n drm/amd/amdgpu: reserve vm invalidation engine for uni_mes\n drm: sti: fix device leaks at component probe\n drm/imagination: Document pvr_device.power member\n drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR\n" }, { "commit": "6dbcb801e1eb1b1764fd0012918225b60dd7916c", "tree": "3c2b0f70bbb416bfffe266393d4fc19569b5190e", "parents": [ "26c7a181fdb873297d3424794762e5c4f4ef7227", "7276878b069c57d9a9cca5db01d2f7a427b73456" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 12:10:19 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 12:10:25 2025 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2025-11-27\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n - Fix resource leak in xe_guc_ct_init_noalloc()\u0027s error path (Shuicheng Lin)\n - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT (Lucas)\n - Fix overflow in conversion from clock tics to msec (Harish Chegondi)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nLink: https://patch.msgid.link/7ejiqjgthpqybg5svmkind2pszk4fqadxuq7rngchaaw76iept@5pn6sngqj6lk\n" }, { "commit": "26c7a181fdb873297d3424794762e5c4f4ef7227", "tree": "cc2b9b15705a0b8155f9a407a662f352cc59fe43", "parents": [ "4fc3ad63dd31e9ecd44211a4cd331acebb077551", "eb76d0f5553575599561010f24c277cc5b31d003" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 12:00:07 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 12:04:20 2025 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2025-11-27\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nbridge:\n- sil902x: Fix HDMI detection\n\nimagination:\n- Update documentation\n\nsti:\n- Fix leaks in probe\n\nvga_switcheroo:\n- Avoid race condition during fbcon initialization\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20251127081007.GA13578@2a02-2454-fd5e-fd00-689d-32c0-780c-bb87.dyn6.pyur.net\n" }, { "commit": "4fc3ad63dd31e9ecd44211a4cd331acebb077551", "tree": "2c3abbb5da936ec4c7d7ebd30cb977500d7618c9", "parents": [ "b31e2e3bb744c8fa852ad2a70712db97147071c9", "7fa666ab07ba9e08f52f357cb8e1aad753e83ac6" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 11:56:37 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 11:57:04 2025 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.18-2025-11-26\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.18-2025-11-26:\n\namdgpu:\n- Unified MES fix\n- HDMI fix\n- Cursor fix\n- Bightness fix\n- EDID reading improvement\n- UserQ fix\n- Cyan Skillfish IP discovery fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20251126204925.3316684-1-alexander.deucher@amd.com\n" }, { "commit": "aa7243aaf1947a0cb54c44337795d6759493fe02", "tree": "3f42844d1ca426768197c0523d6320c41ff58747", "parents": [ "3fa77874b4a7ae96d4ad40623d449cef6265ae4a", "d0d08f4bd7f667dc7a65cd7133c0a94a6f02aca3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 17:29:15 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 17:29:15 2025 -0800" }, "message": "Merge tag \u0027dma-mapping-6.18-2025-11-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two last minute fixes for the recently modified DMA API infrastructure:\n\n - proper handling of DMA_ATTR_MMIO in dma_iova_unlink() function (me)\n\n - regression fix for the code refactoring related to P2PDMA (Pranjal\n Shrivastava)\"\n\n* tag \u0027dma-mapping-6.18-2025-11-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings\n iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink()\n" }, { "commit": "3fa77874b4a7ae96d4ad40623d449cef6265ae4a", "tree": "5eca08bb06134b9ead7f75248983a0dae81d5f54", "parents": [ "e1afacb68573c3cd0a3785c6b0508876cd3423bc", "fbf04215d9966da61feee3f4ec24dbf4544cfd0f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 17:25:46 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 17:25:46 2025 -0800" }, "message": "Merge tag \u0027acpi-6.18-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"One more urgent ACPI support fix for 6.18\n\n There is one more commit that needs to be reverted after reverting\n problematic commit 7a8c994cbb2d (\"ACPI: processor: idle: Optimize ACPI\n idle driver registration\"), so revert it\"\n\n* tag \u0027acpi-6.18-rc8-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n Revert \"ACPI: processor: Update cpuidle driver check in __acpi_processor_start()\"\n" }, { "commit": "b31e2e3bb744c8fa852ad2a70712db97147071c9", "tree": "48d45cbac6be556caf7842c677469ea0b7bfca3f", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d", "7c373b3bd03c77fe8f6ea206ed49375eb4d43d13" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 11:08:54 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 28 11:16:13 2025 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2025-11-26\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Reject async flips when PSR\u0027s selective fetch is enabled (Ville)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aScgY8QMjmyJRBX2@intel.com\n" }, { "commit": "fbf04215d9966da61feee3f4ec24dbf4544cfd0f", "tree": "90dd67e74a9090d53eb8997ea7feb1893c872e41", "parents": [ "43ff36c4a5a574ee83b4b0d3f3d74f09a3a8c2d3" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Nov 27 20:52:55 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Nov 27 20:52:55 2025 +0100" }, "message": "Revert \"ACPI: processor: Update cpuidle driver check in __acpi_processor_start()\"\n\nRevert commit 8a1b5d412cb4 (\"ACPI: processor: Update cpuidle driver\ncheck in __acpi_processor_start()\") which depends on commit\n7a8c994cbb2d (\"ACPI: processor: idle: Optimize ACPI idle driver\nregistration\") that got reverted.\n\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "e1afacb68573c3cd0a3785c6b0508876cd3423bc", "tree": "455f83deddb63b4a27b03a9b9da7a5f35f4f5038", "parents": [ "1f5e808aa63af61ec0d6a14909056d6668813e86", "7fce830ecd0a0256590ee37eb65a39cbad3d64fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 11:11:03 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 11:11:03 2025 -0800" }, "message": "Merge tag \u0027ceph-for-6.18-rc8\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"A patch to make sparse read handling work in msgr2 secure mode from\n Slava and a couple of fixes from Ziming and myself to avoid operating\n on potentially invalid memory, all marked for stable\"\n\n* tag \u0027ceph-for-6.18-rc8\u0027 of https://github.com/ceph/ceph-client:\n libceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n libceph: replace BUG_ON with bounds check for map-\u003emax_osd\n ceph: fix crash in process_v2_sparse_read() for encrypted directories\n libceph: drop started parameter of __ceph_open_session()\n libceph: fix potential use-after-free in have_mon_and_osd_map()\n" }, { "commit": "1f5e808aa63af61ec0d6a14909056d6668813e86", "tree": "92082838256bf26b7abb69440717fd065391d998", "parents": [ "a76dce0e54091556c0981375859d6cb60d2f7bfa", "f07f4ea53e22429c84b20832fa098b5ecc0d4e35" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 09:18:40 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 09:18:40 2025 -0800" }, "message": "Merge tag \u0027net-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from bluetooth and CAN. No known outstanding\n regressions.\n\n Current release - regressions:\n\n - mptcp: initialize rcv_mss before calling tcp_send_active_reset()\n\n - eth: mlx5e: fix validation logic in rate limiting\n\n Previous releases - regressions:\n\n - xsk: avoid data corruption on cq descriptor number\n\n - bluetooth:\n - prevent race in socket write iter and sock bind\n - fix not generating mackey and ltk when repairing\n\n - can:\n - kvaser_usb: fix potential infinite loop in command parsers\n - rcar_canfd: fix CAN-FD mode as default\n\n - eth:\n - veth: reduce XDP no_direct return section to fix race\n - virtio-net: avoid unnecessary checksum calculation on guest RX\n\n Previous releases - always broken:\n\n - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()\n\n - bluetooth: mediatek: fix kernel crash when releasing iso interface\n\n - vhost: rewind next_avail_head while discarding descriptors\n\n - eth:\n - r8169: fix RTL8127 hang on suspend/shutdown\n - aquantia: add missing descriptor cache invalidation on ATL2\n\n - dsa: microchip: fix resource releases in error path\"\n\n* tag \u0027net-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)\n mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().\n net: fec: do not register PPS event for PEROUT\n net: fec: do not allow enabling PPS and PEROUT simultaneously\n net: fec: do not update PEROUT if it is enabled\n net: fec: cancel perout_timer when PEROUT is disabled\n net: mctp: unconditionally set skb-\u003edev on dst output\n net: atlantic: fix fragment overflow handling in RX path\n MAINTAINERS: separate VIRTIO NET DRIVER and add netdev\n virtio-net: avoid unnecessary checksum calculation on guest RX\n eth: fbnic: Fix counter roll-over issue\n mptcp: clear scheduled subflows on retransmit\n net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic\n s390/net: list Aswin Karuvally as maintainer\n net: wwan: mhi: Keep modem name match with Foxconn T99W640\n vhost: rewind next_avail_head while discarding descriptors\n net/sched: em_canid: fix uninit-value in em_canid_match\n can: rcar_canfd: Fix CAN-FD mode as default\n xsk: avoid data corruption on cq descriptor number\n r8169: fix RTL8127 hang on suspend/shutdown\n net: sxgbe: fix potential NULL dereference in sxgbe_rx()\n ...\n" }, { "commit": "a76dce0e54091556c0981375859d6cb60d2f7bfa", "tree": "94fe9f9c82708548fabbf103fcfbc048d1193138", "parents": [ "765e56e41a5af2d456ddda6cbd617b9d3295ab4e", "9b9c0adbc3f8a524d291baccc9d0c04097fb4869" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 08:51:36 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 27 08:51:36 2025 -0800" }, "message": "Merge tag \u0027platform-drivers-x86-v6.18-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull platform driver fixes from Ilpo Järvinen:\n\n - arm64/thinkpad-t14s-ec:\n - Fix IRQ race condition\n - Sleep after EC access\n\n - intel/punit_ipc: Fix memory corruption\n\n* tag \u0027platform-drivers-x86-v6.18-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: intel: punit_ipc: fix memory corruption\n platform: arm64: thinkpad-t14s-ec: sleep after EC access\n platform: arm64: thinkpad-t14s-ec: fix IRQ race condition\n" }, { "commit": "f07f4ea53e22429c84b20832fa098b5ecc0d4e35", "tree": "f3994ba83130dce362e23853ad85040e0d8eadc0", "parents": [ "36d747866445a362d486028792e56dbe04fc16fb" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Nov 25 19:53:29 2025 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 13:10:16 2025 +0100" }, "message": "mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().\n\nsyzbot reported divide-by-zero in __tcp_select_window() by\nMPTCP socket. [0]\n\nWe had a similar issue for the bare TCP and fixed in commit\n499350a5a6e7 (\"tcp: initialize rcv_mss to TCP_MIN_MSS instead\nof 0\").\n\nLet\u0027s apply the same fix to mptcp_do_fastclose().\n\n[0]:\nOops: divide error: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nRIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336\nCode: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 \u003cf7\u003e 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00\nRSP: 0018:ffffc90003017640 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028\nR10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n tcp_select_window net/ipv4/tcp_output.c:281 [inline]\n __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568\n tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]\n tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836\n mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793\n mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253\n mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776\n mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0xe5/0x270 net/socket.c:742\n __sys_sendto+0x3bd/0x520 net/socket.c:2244\n __do_sys_sendto net/socket.c:2251 [inline]\n __se_sys_sendto net/socket.c:2247 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2247\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f66e998f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006\n \u003c/TASK\u003e\n\nFixes: ae155060247b (\"mptcp: fix duplicate reset on fastclose\")\nReported-by: syzbot+3a92d359bc2ec6255a33@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/69260882.a70a0220.d98e3.00b4.GAE@google.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20251125195331.309558-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "40ad64ac25bb736740f895d99a4aebbda9b80991", "tree": "a68597443ffbc4d3fac6a1fd2a169318b39a88d6", "parents": [ "3dcf44ab56e1d3ca3532083c0d5390b758e45b45" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Wed Nov 26 21:25:01 2025 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Nov 27 11:41:06 2025 +0000" }, "message": "spi: nxp-fspi: Propagate fwnode in ACPI case as well\n\nPropagate fwnode of the ACPI device to the SPI controller Linux device.\nCurrently only OF case propagates fwnode to the controller.\n\nWhile at it, replace several calls to dev_fwnode() with a single one\ncached in a local variable, and unify checks for fwnode type by using\nis_*_node() APIs.\n\nFixes: 55ab8487e01d (\"spi: spi-nxp-fspi: Add ACPI support\")\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Haibo Chen \u003chaibo.chen@nxp.com\u003e\nLink: https://patch.msgid.link/20251126202501.2319679-1-andriy.shevchenko@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "8684229e19c4185d53d6fb7004d733907c865a91", "tree": "65990286dda70da1a261b2c31205a906111b1c06", "parents": [ "45cc214152bc1f6b1cc135532cd7cdbe08716aaf" ], "author": { "name": "ChiYuan Huang", "email": "cy_huang@richtek.com", "time": "Thu Nov 27 10:25:51 2025 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Nov 27 11:41:00 2025 +0000" }, "message": "regulator: rtq2208: Correct LDO2 logic judgment bits\n\nThe LDO2 judgement bit position should be 7, not 6.\n\nCc: stable@vger.kernel.org\nReported-by: Yoon Dong Min \u003cdm.youn@telechips.com\u003e\nFixes: b65439d90150 (\"regulator: rtq2208: Fix the LDO DVS capability\")\nSigned-off-by: ChiYuan Huang \u003ccy_huang@richtek.com\u003e\nLink: https://patch.msgid.link/faadb009f84b88bfcabe39fc5009c7357b00bbe2.1764209258.git.cy_huang@richtek.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "45cc214152bc1f6b1cc135532cd7cdbe08716aaf", "tree": "870299e871555f258e46696c160e7ce17bfbac22", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "ChiYuan Huang", "email": "cy_huang@richtek.com", "time": "Thu Nov 27 10:25:50 2025 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Nov 27 11:40:59 2025 +0000" }, "message": "regulator: rtq2208: Correct buck group2 phase mapping logic\n\nCorrect buck group2 H and F mapping logic.\n\nCc: stable@vger.kernel.org\nReported-by: Yoon Dong Min \u003cdm.youn@telechips.com\u003e\nFixes: 1742e7e978ba (\"regulator: rtq2208: Fix incorrect buck converter phase mapping\")\nSigned-off-by: ChiYuan Huang \u003ccy_huang@richtek.com\u003e\nLink: https://patch.msgid.link/8527ae02a72b754d89b7580a5fe7474d6f80f5c3.1764209258.git.cy_huang@richtek.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "36d747866445a362d486028792e56dbe04fc16fb", "tree": "02277713e63e41a0202cf4bf7cc63b9f6bbca607", "parents": [ "b3e528a5811bbc8246dbdb962f0812dc9b721681", "9a060d0fac9e75524f72864adec6d8cdb70a5bca" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:47 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:47 2025 +0100" }, "message": "Merge branch \u0027net-fec-fix-some-ptp-related-issues\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: fec: fix some PTP related issues\n\nThere are some issues which were introduced by the commit 350749b909bf\n(\"net: fec: Add support for periodic output signal of PPS\"). See each\npatch for more details.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251125085210.1094306-1-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9a060d0fac9e75524f72864adec6d8cdb70a5bca", "tree": "02277713e63e41a0202cf4bf7cc63b9f6bbca607", "parents": [ "c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Tue Nov 25 16:52:10 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:45 2025 +0100" }, "message": "net: fec: do not register PPS event for PEROUT\n\nThere are currently two situations that can trigger the PTP interrupt,\none is the PPS event, the other is the PEROUT event. However, the irq\nhandler fec_pps_interrupt() does not check the irq event type and\ndirectly registers a PPS event into the system, but the event may be\na PEROUT event. This is incorrect because PEROUT is an output signal,\nwhile PPS is the input of the kernel PPS system. Therefore, add a check\nfor the event type, if pps_enable is true, it means that the current\nevent is a PPS event, and then the PPS event is registered.\n\nFixes: 350749b909bf (\"net: fec: Add support for periodic output signal of PPS\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20251125085210.1094306-5-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "c0a1f3d7e128e8d1b6c0fe09c68eac5ebcf677c8", "tree": "aaf55241cebd0785394f16bcc777cebe66be6140", "parents": [ "e97faa0c20ea8840f45569ba434e30538fff8fc9" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Tue Nov 25 16:52:09 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:45 2025 +0100" }, "message": "net: fec: do not allow enabling PPS and PEROUT simultaneously\n\nIn the current driver, PPS and PEROUT use the same channel to generate\nthe events, so they cannot be enabled at the same time. Otherwise, the\nlater configuration will overwrite the earlier configuration. Therefore,\nwhen configuring PPS, the driver will check whether PEROUT is enabled.\nSimilarly, when configuring PEROUT, the driver will check whether PPS\nis enabled.\n\nFixes: 350749b909bf (\"net: fec: Add support for periodic output signal of PPS\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20251125085210.1094306-4-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "e97faa0c20ea8840f45569ba434e30538fff8fc9", "tree": "59fcc70cf84baf109cb15cda83c3aa73ce0660e1", "parents": [ "50caa744689e505414673c20359b04aa918439e3" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Tue Nov 25 16:52:08 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:45 2025 +0100" }, "message": "net: fec: do not update PEROUT if it is enabled\n\nIf the previously set PEROUT is already active, updating it will cause\nthe new PEROUT to start immediately instead of at the specified time.\nThis is because fep-\u003ereload_period is updated whithout check whether\nthe PEROUT is enabled, and the old PEROUT is not disabled. Therefore,\nthe pulse period will be updated immediately in the pulse interrupt\nhandler fec_pps_interrupt().\n\nCurrently, the driver does not support directly updating PEROUT and it\nwill make the logic be more complicated. To fix the current issue, add\na check before enabling the PEROUT, the driver will return an error if\nPEROUT is enabled. If users wants to update a new PEROUT, they should\ndisable the old PEROUT first.\n\nFixes: 350749b909bf (\"net: fec: Add support for periodic output signal of PPS\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20251125085210.1094306-3-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "50caa744689e505414673c20359b04aa918439e3", "tree": "b251b0a19e3f68ecd977d62081b5027822b7ee9f", "parents": [ "b3e528a5811bbc8246dbdb962f0812dc9b721681" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Tue Nov 25 16:52:07 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:57:45 2025 +0100" }, "message": "net: fec: cancel perout_timer when PEROUT is disabled\n\nThe PEROUT allows the user to set a specified future time to output the\nperiodic signal. If the future time is far from the current time, the FEC\ndriver will use hrtimer to configure PEROUT one second before the future\ntime. However, the hrtimer will not be canceled if the PEROUT is disabled\nbefore the hrtimer expires. So the PEROUT will be configured when the\nhrtimer expires, which is not as expected. Therefore, cancel the hrtimer\nin fec_ptp_pps_disable() to fix this issue.\n\nFixes: 350749b909bf (\"net: fec: Add support for periodic output signal of PPS\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20251125085210.1094306-2-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "b3e528a5811bbc8246dbdb962f0812dc9b721681", "tree": "09ed92895bdd9ef9441b47f5363462f613339667", "parents": [ "8ec205e8797046b79d02a6359ebd57091b594cd8" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Tue Nov 25 14:48:54 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Nov 27 11:39:12 2025 +0100" }, "message": "net: mctp: unconditionally set skb-\u003edev on dst output\n\nOn transmit, we are currently relying on skb-\u003edev being set by\nmctp_local_output() when we first set up the skb destination fields.\nHowever, forwarded skbs do not use the local_output path, so will retain\ntheir incoming netdev as their -\u003edev on tx. This does not work when\nwe\u0027re forwarding between interfaces.\n\nSet skb-\u003edev unconditionally in the transmit path, to allow for proper\nforwarding.\n\nWe keep the skb-\u003edev initialisation in mctp_local_output(), as we use it\nfor fragmentation.\n\nFixes: 269936db5eb3 (\"net: mctp: separate routing database from routing operations\")\nSuggested-by: Vince Chang \u003cvince_chang@aspeedtech.com\u003e\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20251125-dev-forward-v1-1-54ecffcd0616@codeconstruct.com.au\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "7fce830ecd0a0256590ee37eb65a39cbad3d64fc", "tree": "96a79030a9b57fa32d344072ff49fe77e1b82d6c", "parents": [ "ec3797f043756a94ea2d0f106022e14ac4946c02" ], "author": { "name": "ziming zhang", "email": "ezrakiez@gmail.com", "time": "Fri Nov 14 16:56:10 2025 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Nov 27 09:59:49 2025 +0100" }, "message": "libceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ]\n\nCc: stable@vger.kernel.org\nSigned-off-by: ziming zhang \u003cezrakiez@gmail.com\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "ec3797f043756a94ea2d0f106022e14ac4946c02", "tree": "edb57174fdafc34bc7389f5c1bfbf9b7602c5771", "parents": [ "43962db4a6f593903340c85591056a0cef812dfd" ], "author": { "name": "ziming zhang", "email": "ezrakiez@gmail.com", "time": "Mon Nov 17 18:07:41 2025 +0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Nov 27 09:59:42 2025 +0100" }, "message": "libceph: replace BUG_ON with bounds check for map-\u003emax_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map-\u003emax_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n edits ]\n\nCc: stable@vger.kernel.org\nSigned-off-by: ziming zhang \u003cezrakiez@gmail.com\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "43962db4a6f593903340c85591056a0cef812dfd", "tree": "d5c1153babdf861eb5315bbc5e9ecf017cf40fbe", "parents": [ "85f5491d9c6e9662653c8e6e7b70637b98537ecc" ], "author": { "name": "Viacheslav Dubeyko", "email": "Slava.Dubeyko@ibm.com", "time": "Thu Nov 13 14:36:24 2025 -0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Thu Nov 27 09:59:34 2025 +0100" }, "message": "ceph: fix crash in process_v2_sparse_read() for encrypted directories\n\nThe crash in process_v2_sparse_read() for fscrypt-encrypted directories\nhas been reported. Issue takes place for Ceph msgr2 protocol in secure\nmode. It can be reproduced by the steps:\n\nsudo mount -t ceph :/ /mnt/cephfs/ -o name\u003dadmin,fs\u003dcephfs,ms_mode\u003dsecure\n\n(1) mkdir /mnt/cephfs/fscrypt-test-3\n(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3\n(3) fscrypt encrypt --source\u003draw_key --key\u003d./my.key /mnt/cephfs/fscrypt-test-3\n(4) fscrypt lock /mnt/cephfs/fscrypt-test-3\n(5) fscrypt unlock --key\u003dmy.key /mnt/cephfs/fscrypt-test-3\n(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar\n(7) Issue has been triggered\n\n[ 408.072247] ------------[ cut here ]------------\n[ 408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865\nceph_con_v2_try_read+0x4b39/0x72f0\n[ 408.072267] Modules linked in: intel_rapl_msr intel_rapl_common\nintel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery\npmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass\npolyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse\nserio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg\npata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore\n[ 408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+\n[ 408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[ 408.072310] Workqueue: ceph-msgr ceph_con_workfn\n[ 408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0\n[ 408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8\n8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff \u003c0f\u003e 0b e9 06\nfe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85\n[ 408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246\n[ 408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38\n[ 408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8\n[ 408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8\n[ 408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000\n[ 408.072329] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[ 408.072331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[ 408.072336] PKRU: 55555554\n[ 408.072337] Call Trace:\n[ 408.072338] \u003cTASK\u003e\n[ 408.072340] ? sched_clock_noinstr+0x9/0x10\n[ 408.072344] ? __pfx_ceph_con_v2_try_read+0x10/0x10\n[ 408.072347] ? _raw_spin_unlock+0xe/0x40\n[ 408.072349] ? finish_task_switch.isra.0+0x15d/0x830\n[ 408.072353] ? __kasan_check_write+0x14/0x30\n[ 408.072357] ? mutex_lock+0x84/0xe0\n[ 408.072359] ? __pfx_mutex_lock+0x10/0x10\n[ 408.072361] ceph_con_workfn+0x27e/0x10e0\n[ 408.072364] ? metric_delayed_work+0x311/0x2c50\n[ 408.072367] process_one_work+0x611/0xe20\n[ 408.072371] ? __kasan_check_write+0x14/0x30\n[ 408.072373] worker_thread+0x7e3/0x1580\n[ 408.072375] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 408.072378] ? __pfx_worker_thread+0x10/0x10\n[ 408.072381] kthread+0x381/0x7a0\n[ 408.072383] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 408.072385] ? __pfx_kthread+0x10/0x10\n[ 408.072387] ? __kasan_check_write+0x14/0x30\n[ 408.072389] ? recalc_sigpending+0x160/0x220\n[ 408.072392] ? _raw_spin_unlock_irq+0xe/0x50\n[ 408.072394] ? calculate_sigpending+0x78/0xb0\n[ 408.072395] ? __pfx_kthread+0x10/0x10\n[ 408.072397] ret_from_fork+0x2b6/0x380\n[ 408.072400] ? __pfx_kthread+0x10/0x10\n[ 408.072402] ret_from_fork_asm+0x1a/0x30\n[ 408.072406] \u003c/TASK\u003e\n[ 408.072407] ---[ end trace 0000000000000000 ]---\n[ 408.072418] Oops: general protection fault, probably for non-canonical\naddress 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n[ 408.072984] KASAN: null-ptr-deref in range [0x0000000000000000-\n0x0000000000000007]\n[ 408.073350] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Tainted: G W\n6.17.0-rc7+ #1 PREEMPT(voluntary)\n[ 408.073886] Tainted: [W]\u003dWARN\n[ 408.074042] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[ 408.074468] Workqueue: ceph-msgr ceph_con_workfn\n[ 408.074694] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80\n[ 408.074976] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00\n00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 \u003c0f\u003e b6 14 16\n84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03\n[ 408.075884] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246\n[ 408.076305] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000\n[ 408.076909] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378\n[ 408.077466] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8\n[ 408.078034] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71\n[ 408.078575] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378\n[ 408.079159] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[ 408.079736] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 408.080039] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[ 408.080376] PKRU: 55555554\n[ 408.080513] Call Trace:\n[ 408.080630] \u003cTASK\u003e\n[ 408.080729] ceph_con_v2_try_read+0x49b9/0x72f0\n[ 408.081115] ? __pfx_ceph_con_v2_try_read+0x10/0x10\n[ 408.081348] ? _raw_spin_unlock+0xe/0x40\n[ 408.081538] ? finish_task_switch.isra.0+0x15d/0x830\n[ 408.081768] ? __kasan_check_write+0x14/0x30\n[ 408.081986] ? mutex_lock+0x84/0xe0\n[ 408.082160] ? __pfx_mutex_lock+0x10/0x10\n[ 408.082343] ceph_con_workfn+0x27e/0x10e0\n[ 408.082529] ? metric_delayed_work+0x311/0x2c50\n[ 408.082737] process_one_work+0x611/0xe20\n[ 408.082948] ? __kasan_check_write+0x14/0x30\n[ 408.083156] worker_thread+0x7e3/0x1580\n[ 408.083331] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 408.083557] ? __pfx_worker_thread+0x10/0x10\n[ 408.083751] kthread+0x381/0x7a0\n[ 408.083922] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 408.084139] ? __pfx_kthread+0x10/0x10\n[ 408.084310] ? __kasan_check_write+0x14/0x30\n[ 408.084510] ? recalc_sigpending+0x160/0x220\n[ 408.084708] ? _raw_spin_unlock_irq+0xe/0x50\n[ 408.084917] ? calculate_sigpending+0x78/0xb0\n[ 408.085138] ? __pfx_kthread+0x10/0x10\n[ 408.085335] ret_from_fork+0x2b6/0x380\n[ 408.085525] ? __pfx_kthread+0x10/0x10\n[ 408.085720] ret_from_fork_asm+0x1a/0x30\n[ 408.085922] \u003c/TASK\u003e\n[ 408.086036] Modules linked in: intel_rapl_msr intel_rapl_common\nintel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery\npmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass\npolyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse\nserio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg\npata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore\n[ 408.087778] ---[ end trace 0000000000000000 ]---\n[ 408.088007] RIP: 0010:ceph_msg_data_advance+0x79/0x1a80\n[ 408.088260] Code: fc ff df 49 8d 77 08 48 c1 ee 03 80 3c 16 00 0f 85 07 11 00\n00 48 ba 00 00 00 00 00 fc ff df 49 8b 5f 08 48 89 de 48 c1 ee 03 \u003c0f\u003e b6 14 16\n84 d2 74 09 80 fa 03 0f 8e 0f 0e 00 00 8b 13 83 fa 03\n[ 408.089118] RSP: 0018:ffff88811c3e7990 EFLAGS: 00010246\n[ 408.089357] RAX: ffff8881243a6388 RBX: 0000000000000000 RCX: 0000000000000000\n[ 408.089678] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8881243a6378\n[ 408.090020] RBP: ffff88811c3e7a20 R08: 0000000000000000 R09: 00000000000000c8\n[ 408.090360] R10: ffff8881243a6388 R11: 0000000000000000 R12: ffffed1024874c71\n[ 408.090687] R13: dffffc0000000000 R14: ffff8881243a6030 R15: ffff8881243a6378\n[ 408.091035] FS: 0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[ 408.091452] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 408.092015] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[ 408.092530] PKRU: 55555554\n[ 417.112915]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 417.113491] BUG: KASAN: slab-use-after-free in\n__mutex_lock.constprop.0+0x1522/0x1610\n[ 417.114014] Read of size 4 at addr ffff888124870034 by task kworker/2:0/4951\n\n[ 417.114587] CPU: 2 UID: 0 PID: 4951 Comm: kworker/2:0 Tainted: G D W\n6.17.0-rc7+ #1 PREEMPT(voluntary)\n[ 417.114592] Tainted: [D]\u003dDIE, [W]\u003dWARN\n[ 417.114593] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[ 417.114596] Workqueue: events handle_timeout\n[ 417.114601] Call Trace:\n[ 417.114602] \u003cTASK\u003e\n[ 417.114604] dump_stack_lvl+0x5c/0x90\n[ 417.114610] print_report+0x171/0x4dc\n[ 417.114613] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 417.114617] ? kasan_complete_mode_report_info+0x80/0x220\n[ 417.114621] kasan_report+0xbd/0x100\n[ 417.114625] ? __mutex_lock.constprop.0+0x1522/0x1610\n[ 417.114628] ? __mutex_lock.constprop.0+0x1522/0x1610\n[ 417.114630] __asan_report_load4_noabort+0x14/0x30\n[ 417.114633] __mutex_lock.constprop.0+0x1522/0x1610\n[ 417.114635] ? queue_con_delay+0x8d/0x200\n[ 417.114638] ? __pfx___mutex_lock.constprop.0+0x10/0x10\n[ 417.114641] ? __send_subscribe+0x529/0xb20\n[ 417.114644] __mutex_lock_slowpath+0x13/0x20\n[ 417.114646] mutex_lock+0xd4/0xe0\n[ 417.114649] ? __pfx_mutex_lock+0x10/0x10\n[ 417.114652] ? ceph_monc_renew_subs+0x2a/0x40\n[ 417.114654] ceph_con_keepalive+0x22/0x110\n[ 417.114656] handle_timeout+0x6b3/0x11d0\n[ 417.114659] ? _raw_spin_unlock_irq+0xe/0x50\n[ 417.114662] ? __pfx_handle_timeout+0x10/0x10\n[ 417.114664] ? queue_delayed_work_on+0x8e/0xa0\n[ 417.114669] process_one_work+0x611/0xe20\n[ 417.114672] ? __kasan_check_write+0x14/0x30\n[ 417.114676] worker_thread+0x7e3/0x1580\n[ 417.114678] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 417.114682] ? __pfx_sched_setscheduler_nocheck+0x10/0x10\n[ 417.114687] ? __pfx_worker_thread+0x10/0x10\n[ 417.114689] kthread+0x381/0x7a0\n[ 417.114692] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 417.114694] ? __pfx_kthread+0x10/0x10\n[ 417.114697] ? __kasan_check_write+0x14/0x30\n[ 417.114699] ? recalc_sigpending+0x160/0x220\n[ 417.114703] ? _raw_spin_unlock_irq+0xe/0x50\n[ 417.114705] ? calculate_sigpending+0x78/0xb0\n[ 417.114707] ? __pfx_kthread+0x10/0x10\n[ 417.114710] ret_from_fork+0x2b6/0x380\n[ 417.114713] ? __pfx_kthread+0x10/0x10\n[ 417.114715] ret_from_fork_asm+0x1a/0x30\n[ 417.114720] \u003c/TASK\u003e\n\n[ 417.125171] Allocated by task 2:\n[ 417.125333] kasan_save_stack+0x26/0x60\n[ 417.125522] kasan_save_track+0x14/0x40\n[ 417.125742] kasan_save_alloc_info+0x39/0x60\n[ 417.125945] __kasan_slab_alloc+0x8b/0xb0\n[ 417.126133] kmem_cache_alloc_node_noprof+0x13b/0x460\n[ 417.126381] copy_process+0x320/0x6250\n[ 417.126595] kernel_clone+0xb7/0x840\n[ 417.126792] kernel_thread+0xd6/0x120\n[ 417.126995] kthreadd+0x85c/0xbe0\n[ 417.127176] ret_from_fork+0x2b6/0x380\n[ 417.127378] ret_from_fork_asm+0x1a/0x30\n\n[ 417.127692] Freed by task 0:\n[ 417.127851] kasan_save_stack+0x26/0x60\n[ 417.128057] kasan_save_track+0x14/0x40\n[ 417.128267] kasan_save_free_info+0x3b/0x60\n[ 417.128491] __kasan_slab_free+0x6c/0xa0\n[ 417.128708] kmem_cache_free+0x182/0x550\n[ 417.128906] free_task+0xeb/0x140\n[ 417.129070] __put_task_struct+0x1d2/0x4f0\n[ 417.129259] __put_task_struct_rcu_cb+0x15/0x20\n[ 417.129480] rcu_do_batch+0x3d3/0xe70\n[ 417.129681] rcu_core+0x549/0xb30\n[ 417.129839] rcu_core_si+0xe/0x20\n[ 417.130005] handle_softirqs+0x160/0x570\n[ 417.130190] __irq_exit_rcu+0x189/0x1e0\n[ 417.130369] irq_exit_rcu+0xe/0x20\n[ 417.130531] sysvec_apic_timer_interrupt+0x9f/0xd0\n[ 417.130768] asm_sysvec_apic_timer_interrupt+0x1b/0x20\n\n[ 417.131082] Last potentially related work creation:\n[ 417.131305] kasan_save_stack+0x26/0x60\n[ 417.131484] kasan_record_aux_stack+0xae/0xd0\n[ 417.131695] __call_rcu_common+0xcd/0x14b0\n[ 417.131909] call_rcu+0x31/0x50\n[ 417.132071] delayed_put_task_struct+0x128/0x190\n[ 417.132295] rcu_do_batch+0x3d3/0xe70\n[ 417.132478] rcu_core+0x549/0xb30\n[ 417.132658] rcu_core_si+0xe/0x20\n[ 417.132808] handle_softirqs+0x160/0x570\n[ 417.132993] __irq_exit_rcu+0x189/0x1e0\n[ 417.133181] irq_exit_rcu+0xe/0x20\n[ 417.133353] sysvec_apic_timer_interrupt+0x9f/0xd0\n[ 417.133584] asm_sysvec_apic_timer_interrupt+0x1b/0x20\n\n[ 417.133921] Second to last potentially related work creation:\n[ 417.134183] kasan_save_stack+0x26/0x60\n[ 417.134362] kasan_record_aux_stack+0xae/0xd0\n[ 417.134566] __call_rcu_common+0xcd/0x14b0\n[ 417.134782] call_rcu+0x31/0x50\n[ 417.134929] put_task_struct_rcu_user+0x58/0xb0\n[ 417.135143] finish_task_switch.isra.0+0x5d3/0x830\n[ 417.135366] __schedule+0xd30/0x5100\n[ 417.135534] schedule_idle+0x5a/0x90\n[ 417.135712] do_idle+0x25f/0x410\n[ 417.135871] cpu_startup_entry+0x53/0x70\n[ 417.136053] start_secondary+0x216/0x2c0\n[ 417.136233] common_startup_64+0x13e/0x141\n\n[ 417.136894] The buggy address belongs to the object at ffff888124870000\n which belongs to the cache task_struct of size 10504\n[ 417.138122] The buggy address is located 52 bytes inside of\n freed 10504-byte region [ffff888124870000, ffff888124872908)\n\n[ 417.139465] The buggy address belongs to the physical page:\n[ 417.140016] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0\npfn:0x124870\n[ 417.140789] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0\npincount:0\n[ 417.141519] memcg:ffff88811aa20e01\n[ 417.141874] anon flags:\n0x17ffffc0000040(head|node\u003d0|zone\u003d2|lastcpupid\u003d0x1fffff)\n[ 417.142600] page_type: f5(slab)\n[ 417.142922] raw: 0017ffffc0000040 ffff88810094f040 0000000000000000\ndead000000000001\n[ 417.143554] raw: 0000000000000000 0000000000030003 00000000f5000000\nffff88811aa20e01\n[ 417.143954] head: 0017ffffc0000040 ffff88810094f040 0000000000000000\ndead000000000001\n[ 417.144329] head: 0000000000000000 0000000000030003 00000000f5000000\nffff88811aa20e01\n[ 417.144710] head: 0017ffffc0000003 ffffea0004921c01 00000000ffffffff\n00000000ffffffff\n[ 417.145106] head: ffffffffffffffff 0000000000000000 00000000ffffffff\n0000000000000008\n[ 417.145485] page dumped because: kasan: bad access detected\n\n[ 417.145859] Memory state around the buggy address:\n[ 417.146094] ffff88812486ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\nfc\n[ 417.146439] ffff88812486ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\nfc\n[ 417.146791] \u003effff888124870000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb\nfb\n[ 417.147145] ^\n[ 417.147387] ffff888124870080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\nfb\n[ 417.147751] ffff888124870100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\nfb\n[ 417.148123]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFirst of all, we have warning in get_bvec_at() because\ncursor-\u003etotal_resid contains zero value. And, finally,\nwe have crash in ceph_msg_data_advance() because\ncursor-\u003edata is NULL. It means that get_bvec_at()\nreceives not initialized ceph_msg_data_cursor structure\nbecause data is NULL and total_resid contains zero.\n\nMoreover, we don\u0027t have likewise issue for the case of\nCeph msgr1 protocol because ceph_msg_data_cursor_init()\nhas been called before reading sparse data.\n\nThis patch adds calling of ceph_msg_data_cursor_init()\nin the beginning of process_v2_sparse_read() with\nthe goal to guarantee that logic of reading sparse data\nworks correctly for the case of Ceph msgr2 protocol.\n\nCc: stable@vger.kernel.org\nLink: https://tracker.ceph.com/issues/73152\nSigned-off-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nReviewed-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "765e56e41a5af2d456ddda6cbd617b9d3295ab4e", "tree": "92584f3340134f20de080007d2cc0dd60dbdc5b8", "parents": [ "4941a17751c99e17422be743c02c923ad706f888", "3184b6a5a24ec9ee74087b2a550476f386df7dc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 20:22:20 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 20:22:20 2025 -0800" }, "message": "Merge tag \u0027v6.18rc7-SMB-client-fix\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fix from Steve French:\n \"smb client multiuser (with cifscreds) mount fix\"\n\n* tag \u0027v6.18rc7-SMB-client-fix\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: fix memory leak in cifs_construct_tcon()\n" }, { "commit": "8ec205e8797046b79d02a6359ebd57091b594cd8", "tree": "4c53792343fec40dfdebbf8564a2e7013ea64597", "parents": [ "5ffcb7b890f61541201461580bb6622ace405aec", "0c922106d7a58d106c6a5c52a741ae101cfaf088" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 19:56:00 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 19:56:00 2025 -0800" }, "message": "Merge tag \u0027linux-can-fixes-for-6.18-20251126\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2025-11-26\n\nthis is a pull request of 8 patches for net/main.\n\nSeungjin Bae provides a patch for the kvaser_usb driver to fix a\npotential infinite loop in the USB data stream command parser.\n\nThomas Mühlbacher\u0027s patch for the sja1000 driver IRQ handler\u0027s max\nloop handling, that might lead to unhandled interrupts.\n\n3 patches by me for the gs_usb driver fix handling of failed transmit\nURBs and add checking of the actual length of received URBs before\naccessing the data.\n\nThe next patch is by me and is a port of Thomas Mühlbacher\u0027s patch\n(fix IRQ handler\u0027s max loop handling, that might lead to unhandled\ninterrupts.) to the sun4i_can driver.\n\nBiju Das provides a patch for the rcar_canfd driver to fix the CAN-FD\nmode setting.\n\nThe last patch is by Shaurya Rane for the em_canid filter to ensure\nthat the complete CAN frame is present in the linear data buffer\nbefore accessing it.\n\n* tag \u0027linux-can-fixes-for-6.18-20251126\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n net/sched: em_canid: fix uninit-value in em_canid_match\n can: rcar_canfd: Fix CAN-FD mode as default\n can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling\n can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data\n can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header\n can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs\n can: sja1000: fix max irq loop handling\n can: kvaser_usb: leaf: Fix potential infinite loop in command parsers\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20251126155713.217105-1-mkl@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5ffcb7b890f61541201461580bb6622ace405aec", "tree": "2249529e5765841459292ade67435998f51c0027", "parents": [ "384c1a4e2722b43f26b55cc041562ff8b229b536" ], "author": { "name": "Jiefeng Zhang", "email": "jiefeng.z.zhang@gmail.com", "time": "Wed Nov 26 11:22:49 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 19:52:49 2025 -0800" }, "message": "net: atlantic: fix fragment overflow handling in RX path\n\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\nfragments when handling large multi-descriptor packets. This causes an\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\n\nThe issue occurs because the driver doesn\u0027t check the total number of\nfragments before calling skb_add_rx_frag(). When a packet requires more\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\n\nFix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\nthen all fragments are accounted for. And reusing the existing check to\nprevent the overflow earlier in the code path.\n\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\n\nStack trace from production environment:\n```\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\nc8 00 00 00 \u003c48\u003e 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\n89 fa 83\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\nfffffffe0a0c8000\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\n0000000000037a40\nRBP: 0000000000000024 R08: 0000000000000000 R09:\n0000000000000021\nR10: 0000000000000848 R11: 0000000000000000 R12:\nffffa9bec02a8e24\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\nffff925b22e80a00\nFS: 0000000000000000(0000)\nGS:ffff925e47880000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\n0000000000f72ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\naq_ring_rx_clean+0x175/0xe60 [atlantic]\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\n? kmem_cache_free+0x348/0x450\n? aq_vec_poll+0x81/0x1d0 [atlantic]\n? __napi_poll+0x28/0x1c0\n? net_rx_action+0x337/0x420\n```\n\nFixes: 6aecbba12b5c (\"net: atlantic: add check for MAX_SKB_FRAGS\")\nChanges in v4:\n- Add Fixes: tag to satisfy patch validation requirements.\n\nChanges in v3:\n- Fix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\n then all fragments are accounted for.\n\nSigned-off-by: Jiefeng Zhang \u003cjiefeng.z.zhang@gmail.com\u003e\nLink: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "384c1a4e2722b43f26b55cc041562ff8b229b536", "tree": "2da3d324a70d60fdecf68b4b13e221da8596351d", "parents": [ "1cd1c472343b06d6d32038636ce51bfa2251e3cf" ], "author": { "name": "Jon Kohler", "email": "jon@nutanix.com", "time": "Tue Nov 25 18:57:48 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 19:48:34 2025 -0800" }, "message": "MAINTAINERS: separate VIRTIO NET DRIVER and add netdev\n\nChanges to virtio network stack should be cc\u0027d to netdev DL, separate\nit into its own group to add netdev in addition to virtualization DL.\n\nSigned-off-by: Jon Kohler \u003cjon@nutanix.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20251126015750.2200267-1-jon@nutanix.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1cd1c472343b06d6d32038636ce51bfa2251e3cf", "tree": "6d6bfc0a51eb0cf09c22cea3786b4f155ededd8e", "parents": [ "6d66e093e0740d39a36ef742c60eec247df26f41" ], "author": { "name": "Jon Kohler", "email": "jon@nutanix.com", "time": "Tue Nov 25 15:27:53 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 19:45:54 2025 -0800" }, "message": "virtio-net: avoid unnecessary checksum calculation on guest RX\n\nCommit a2fb4bc4e2a6 (\"net: implement virtio helpers to handle UDP\nGSO tunneling.\") inadvertently altered checksum offload behavior\nfor guests not using UDP GSO tunneling.\n\nBefore, tun_put_user called tun_vnet_hdr_from_skb, which passed\nhas_data_valid \u003d true to virtio_net_hdr_from_skb.\n\nAfter, tun_put_user began calling tun_vnet_hdr_tnl_from_skb instead,\nwhich passes has_data_valid \u003d false into both call sites.\n\nThis caused virtio hdr flags to not include VIRTIO_NET_HDR_F_DATA_VALID\nfor SKBs where skb-\u003eip_summed \u003d\u003d CHECKSUM_UNNECESSARY. As a result,\nguests are forced to recalculate checksums unnecessarily.\n\nRestore the previous behavior by ensuring has_data_valid \u003d true is\npassed in the !tnl_gso_type case, but only from tun side, as\nvirtio_net_hdr_tnl_from_skb() is used also by the virtio_net driver,\nwhich in turn must not use VIRTIO_NET_HDR_F_DATA_VALID on tx.\n\ncc: stable@vger.kernel.org\nFixes: a2fb4bc4e2a6 (\"net: implement virtio helpers to handle UDP GSO tunneling.\")\nSigned-off-by: Jon Kohler \u003cjon@nutanix.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nLink: https://patch.msgid.link/20251125222754.1737443-1-jon@nutanix.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6d66e093e0740d39a36ef742c60eec247df26f41", "tree": "76b7a78b7aca72c814c6fdd8cfe537ac745a8dfd", "parents": [ "27fd02860164bfa78cec2640dfad630d832e302c" ], "author": { "name": "Mohsin Bashir", "email": "mohsin.bashr@gmail.com", "time": "Tue Nov 25 13:17:04 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 18:25:52 2025 -0800" }, "message": "eth: fbnic: Fix counter roll-over issue\n\nFix a potential counter roll-over issue in fbnic_mbx_alloc_rx_msgs()\nwhen calculating descriptor slots. The issue occurs when head - tail\nresults in a large positive value (unsigned) and the compiler interprets\nhead - tail - 1 as a signed value.\n\nSince FBNIC_IPC_MBX_DESC_LEN is a power of two, use a masking operation,\nwhich is a common way of avoiding this problem when dealing with these\nsort of ring space calculations.\n\nFixes: da3cde08209e (\"eth: fbnic: Add FW communication mechanism\")\nSigned-off-by: Mohsin Bashir \u003cmohsin.bashr@gmail.com\u003e\nLink: https://patch.msgid.link/20251125211704.3222413-1-mohsin.bashr@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "27fd02860164bfa78cec2640dfad630d832e302c", "tree": "a6f8b56ff9ad072c5caa83c4e693156e7d36e2fd", "parents": [ "da62abaaa268357b1aa66b372ace562189a05df1" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 25 17:59:11 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 18:24:35 2025 -0800" }, "message": "mptcp: clear scheduled subflows on retransmit\n\nWhen __mptcp_retrans() kicks-in, it schedules one or more subflows for\nretransmission, but such subflows could be actually left alone if there\nis no more data to retransmit and/or in case of concurrent fallback.\n\nScheduled subflows could be processed much later in time, i.e. when new\ndata will be transmitted, leading to bad subflow selection.\n\nExplicitly clear all scheduled subflows before leaving the\nretransmission function.\n\nFixes: ee2708aedad0 (\"mptcp: use get_retrans wrapper\")\nCc: stable@vger.kernel.org\nReported-by: Filip Pokryvka \u003cfpokryvk@redhat.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20251125-net-mptcp-clear-sched-rtx-v1-1-1cea4ad2165f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "da62abaaa268357b1aa66b372ace562189a05df1", "tree": "e8e5f2b819978fe9f0d9afd6a285a2fca33e4568", "parents": [ "b9ba6338bc6e0e97dee30fa705f40950ed556729" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Sat Nov 22 13:13:24 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 18:18:28 2025 -0800" }, "message": "net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic\n\nWhen using the SGMII PCS as a fixed-link chip-to-chip connection, it is\neasy to miss the fact that traffic passes only at 1G, since that\u0027s what\nany normal such connection would use.\n\nWhen using the SGMII PCS connected towards an on-board PHY or an SFP\nmodule, it is immediately noticeable that when the link resolves to a\nspeed other than 1G, traffic from the MAC fails to pass: TX counters\nincrease, but nothing gets decoded by the other end, and no local RX\ncounters increase either.\n\nArtificially lowering a fixed-link rate to speed \u003d \u003c100\u003e makes us able\nto see the same issue as in the case of having an SGMII PHY.\n\nSome debugging shows that the XPCS configuration is A-OK, but that the\nMAC Configuration Table entry for the port has the SPEED bits still set\nto 1000Mbps, due to a special condition in the driver. Deleting that\ncondition, and letting the resolved link speed be programmed directly\ninto the MAC speed field, results in a functional link at all 3 speeds.\n\nThis piece of evidence, based on testing on both generations with SGMII\nsupport (SJA1105S and SJA1110A) directly contradicts the statement from\nthe blamed commit that \"the MAC is fixed at 1 Gbps and we need to\nconfigure the PCS only (if even that)\". Worse, that statement is not\nbacked by any documentation, and no one from NXP knows what it might\nrefer to.\n\nI am unable to recall sufficient context regarding my testing from March\n2020 to understand what led me to draw such a braindead and factually\nincorrect conclusion. Yet, there is nothing of value regarding forcing\nthe MAC speed, either for SGMII or 2500Base-X (introduced at a later\nstage), so remove all such logic.\n\nFixes: ffe10e679cec (\"net: dsa: sja1105: Add support for the SGMII port\")\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nLink: https://patch.msgid.link/20251122111324.136761-1-vladimir.oltean@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9ba6338bc6e0e97dee30fa705f40950ed556729", "tree": "ff3e90362fe2926aeff082dc036bc9c18f0a7df1", "parents": [ "4fcb8ab4a09b1855dbfd7062605dd13abd64c086" ], "author": { "name": "Alexandra Winter", "email": "wintera@linux.ibm.com", "time": "Tue Nov 25 09:58:29 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 17:13:57 2025 -0800" }, "message": "s390/net: list Aswin Karuvally as maintainer\n\nThank you Aswin for taking this responsibility.\n\nSigned-off-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nAcked-by: Aswin Karuvally \u003caswin@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20251125085829.3679506-1-wintera@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4fcb8ab4a09b1855dbfd7062605dd13abd64c086", "tree": "934f7c9627e2a94c2c981d4988839d94edeb41b1", "parents": [ "779bcdd4b9ae6566f309043c53c946e8ac0015fd" ], "author": { "name": "Slark Xiao", "email": "slark_xiao@163.com", "time": "Tue Nov 25 15:09:00 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 17:04:07 2025 -0800" }, "message": "net: wwan: mhi: Keep modem name match with Foxconn T99W640\n\nCorrect it since M.2 device T99W640 has updated from T99W515.\nWe need to align it with MHI side otherwise this modem can\u0027t\nget the network.\n\nFixes: ae5a34264354 (\"bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640\")\nSigned-off-by: Slark Xiao \u003cslark_xiao@163.com\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20251125070900.33324-1-slark_xiao@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "779bcdd4b9ae6566f309043c53c946e8ac0015fd", "tree": "0bcafa42fb0c4efad98e1289630b6bad741256da", "parents": [ "0ebc27a4c67d44e5ce88d21cdad8201862b78837" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Thu Nov 20 10:29:50 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Nov 26 14:44:58 2025 -0800" }, "message": "vhost: rewind next_avail_head while discarding descriptors\n\nWhen discarding descriptors with IN_ORDER, we should rewind\nnext_avail_head otherwise it would run out of sync with\nlast_avail_idx. This would cause driver to report\n\"id X is not a head\".\n\nFixing this by returning the number of descriptors that is used for\neach buffer via vhost_get_vq_desc_n() so caller can use the value\nwhile discarding descriptors.\n\nFixes: 67a873df0c41 (\"vhost: basic in order support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20251120022950.10117-1-jasowang@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "85f5491d9c6e9662653c8e6e7b70637b98537ecc", "tree": "f2db455c1d0752e39fd3d95e5a97fd056f24bcc3", "parents": [ "076381c261374c587700b3accf410bdd2dba334e" ], "author": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Mon Nov 03 21:34:01 2025 +0100" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Wed Nov 26 23:29:11 2025 +0100" }, "message": "libceph: drop started parameter of __ceph_open_session()\n\nWith the previous commit revamping the timeout handling, started isn\u0027t\nused anymore. It could be taken into account by adjusting the initial\nvalue of the timeout, but there is little point as both callers capture\nthe timestamp shortly before calling __ceph_open_session() -- the only\nthing of note that happens in the interim is taking client-\u003emount_mutex\nand that isn\u0027t expected to take multiple seconds.\n\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\n" }, { "commit": "076381c261374c587700b3accf410bdd2dba334e", "tree": "4d944675db62e26aecf860036f1332b8ef7a98dc", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Mon Nov 03 21:34:01 2025 +0100" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Wed Nov 26 23:29:10 2025 +0100" }, "message": "libceph: fix potential use-after-free in have_mon_and_osd_map()\n\nThe wait loop in __ceph_open_session() can race with the client\nreceiving a new monmap or osdmap shortly after the initial map is\nreceived. Both ceph_monc_handle_map() and handle_one_map() install\na new map immediately after freeing the old one\n\n kfree(monc-\u003emonmap);\n monc-\u003emonmap \u003d monmap;\n\n ceph_osdmap_destroy(osdc-\u003eosdmap);\n osdc-\u003eosdmap \u003d newmap;\n\nunder client-\u003emonc.mutex and client-\u003eosdc.lock respectively, but\nbecause neither is taken in have_mon_and_osd_map() it\u0027s possible for\nclient-\u003emonc.monmap-\u003eepoch and client-\u003eosdc.osdmap-\u003eepoch arms in\n\n client-\u003emonc.monmap \u0026\u0026 client-\u003emonc.monmap-\u003eepoch \u0026\u0026\n client-\u003eosdc.osdmap \u0026\u0026 client-\u003eosdc.osdmap-\u003eepoch;\n\ncondition to dereference an already freed map. This happens to be\nreproducible with generic/395 and generic/397 with KASAN enabled:\n\n BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70\n Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305\n CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266\n ...\n Call Trace:\n \u003cTASK\u003e\n have_mon_and_osd_map+0x56/0x70\n ceph_open_session+0x182/0x290\n ceph_get_tree+0x333/0x680\n vfs_get_tree+0x49/0x180\n do_new_mount+0x1a3/0x2d0\n path_mount+0x6dd/0x730\n do_mount+0x99/0xe0\n __do_sys_mount+0x141/0x180\n do_syscall_64+0x9f/0x100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n\n Allocated by task 13305:\n ceph_osdmap_alloc+0x16/0x130\n ceph_osdc_init+0x27a/0x4c0\n ceph_create_client+0x153/0x190\n create_fs_client+0x50/0x2a0\n ceph_get_tree+0xff/0x680\n vfs_get_tree+0x49/0x180\n do_new_mount+0x1a3/0x2d0\n path_mount+0x6dd/0x730\n do_mount+0x99/0xe0\n __do_sys_mount+0x141/0x180\n do_syscall_64+0x9f/0x100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n Freed by task 9475:\n kfree+0x212/0x290\n handle_one_map+0x23c/0x3b0\n ceph_osdc_handle_map+0x3c9/0x590\n mon_dispatch+0x655/0x6f0\n ceph_con_process_message+0xc3/0xe0\n ceph_con_v1_try_read+0x614/0x760\n ceph_con_workfn+0x2de/0x650\n process_one_work+0x486/0x7c0\n process_scheduled_works+0x73/0x90\n worker_thread+0x1c8/0x2a0\n kthread+0x2ec/0x300\n ret_from_fork+0x24/0x40\n ret_from_fork_asm+0x1a/0x30\n\nRewrite the wait loop to check the above condition directly with\nclient-\u003emonc.mutex and client-\u003eosdc.lock taken as appropriate. While\nat it, improve the timeout handling (previously mount_timeout could be\nexceeded in case wait_event_interruptible_timeout() slept more than\nonce) and access client-\u003eauth_err under client-\u003emonc.mutex to match\nhow it\u0027s set in finish_auth().\n\nmonmap_show() and osdmap_show() now take the respective lock before\naccessing the map as well.\n\nCc: stable@vger.kernel.org\nReported-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nReviewed-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\n" }, { "commit": "4941a17751c99e17422be743c02c923ad706f888", "tree": "e5557e3ba019b993173f5c277bdab4e1378f0bfa", "parents": [ "9eb220edddb20a019d1630347555bc4ae1514e61", "b042fdf18e89a347177a49e795d8e5184778b5b6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 13:16:22 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 13:16:22 2025 -0800" }, "message": "Merge tag \u0027trace-ringbuffer-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fix from Steven Rostedt:\n\n - Do not allow mmapped ring buffer to be split\n\n When the ring buffer VMA is split by a partial munmap or a MAP_FIXED,\n the kernel calls vm_ops-\u003eclose() on each portion. This causes the\n ring_buffer_unmap() to be called multiple times. This causes\n subsequent calls to return -ENODEV and triggers a warning.\n\n There\u0027s no reason to allow user space to split up memory mapping of\n the ring buffer. Have it return -EINVAL when that happens.\n\n* tag \u0027trace-ringbuffer-v6.18-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs\n" }, { "commit": "d0d08f4bd7f667dc7a65cd7133c0a94a6f02aca3", "tree": "37a2c66db05f827a1723cd08eff97efebdf4b71d", "parents": [ "1a96f3a22fd88b8ea217233d359e0334981b0384" ], "author": { "name": "Pranjal Shrivastava", "email": "praan@google.com", "time": "Wed Nov 26 11:41:12 2025 +0000" }, "committer": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Wed Nov 26 21:47:13 2025 +0100" }, "message": "dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings\n\nPrior to commit a25e7962db0d7 (\"PCI/P2PDMA: Refactor the p2pdma mapping\nhelpers\"), P2P segments were mapped using the pci_p2pdma_map_segment()\nhelper. This helper was responsible for populating sg-\u003edma_address,\nmarking the bus address, and also setting sg_dma_len(sg).\n\nThe refactor[1] removed this helper and moved the mapping logic directly\ninto the callers. While iommu_dma_map_sg() was correctly updated to set\nthe length in the new flow, it was missed in dma_direct_map_sg().\n\nThus, in dma_direct_map_sg(), the PCI_P2PDMA_MAP_BUS_ADDR case sets the\ndma_address and marks the segment, but immediately executes \u0027continue\u0027,\nwhich causes the loop to skip the standard assignment logic at the end:\n\n sg_dma_len(sg) \u003d sg-\u003elength;\n\nAs a result, when CONFIG_NEED_SG_DMA_LENGTH is enabled, the dma_length\nfield remains uninitialized (zero) for P2P bus address mappings. This\nbreaks upper-layer drivers (for e.g. RDMA/IB) that rely on sg_dma_len()\nto determine the transfer size.\n\nFix this by explicitly setting the DMA length in the\nPCI_P2PDMA_MAP_BUS_ADDR case before continuing to the next scatterlist\nentry.\n\nFixes: a25e7962db0d7 (\"PCI/P2PDMA: Refactor the p2pdma mapping helpers\")\nReported-by: Jacob Moroni \u003cjmoroni@google.com\u003e\nSigned-off-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\n\n[1]\nhttps://lore.kernel.org/all/ac14a0e94355bf898de65d023ccf8a2ad22a3ece.1746424934.git.leon@kernel.org/\n\nReviewed-by: Logan Gunthorpe \u003clogang@deltatee.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nReviewed-by: Shivaji Kant \u003cshivajikant@google.com\u003e\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nLink: https://lore.kernel.org/r/20251126114112.3694469-1-praan@google.com\n" }, { "commit": "9eb220edddb20a019d1630347555bc4ae1514e61", "tree": "616bd7086bc4d2bc78e5419eaf57514072cb88d9", "parents": [ "ad8cccc24887655ebf0a3f459d38d1fb683df46a", "7c9580f44f90f7a4c11fc7831efe323ebe446091" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:38:05 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:38:05 2025 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2025-11-26-11-51\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"8 hotfixes. 4 are cc:stable, 7 are against mm/.\n\n All are singletons - please see the respective changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2025-11-26-11-51\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/filemap: fix logic around SIGBUS in filemap_map_pages()\n mm/huge_memory: fix NULL pointer deference when splitting folio\n MAINTAINERS: add test_kho to KHO\u0027s entry\n mailmap: add entry for Sam Protsenko\n selftests/mm: fix division-by-zero in uffd-unit-tests\n mm/mmap_lock: reset maple state on lock_vma_under_rcu() retry\n mm/memfd: fix information leak in hugetlb folios\n mm: swap: remove duplicate nr_swap_pages decrement in get_swap_page_of_type()\n" }, { "commit": "ad8cccc24887655ebf0a3f459d38d1fb683df46a", "tree": "ebc1e653e1aa79655d616e4afe0eda4a62181013", "parents": [ "32115734c0ed8b463d1020e8da47968735f882c0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:31:48 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:31:48 2025 -0800" }, "message": "Fix Intel Dollar Cove TI battery driver 32-bit build error\n\nThe driver is doing a 64-bit divide, rather than using the proper\nhelpers, causing link errors on i386 allyesconfig builds:\n\n x86_64-linux-ld: drivers/power/supply/intel_dc_ti_battery.o: in function `dc_ti_battery_get_voltage_and_current_now\u0027:\n intel_dc_ti_battery.c:(.text+0x5c): undefined reference to `__udivdi3\u0027\n x86_64-linux-ld: intel_dc_ti_battery.c:(.text+0x96): undefined reference to `__udivdi3\u0027\n\nand while fixing that, fix the double rounding: keep the timing\ndifference in nanoseconds (\u0027ktime\u0027), and then just convert to usecs at\nthe end.\n\nNot because the timing precision is likely to matter, but because doing\nit right also makes the code simpler.\n\nReported-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nCc: Hans de Goede \u003chansg@kernel.org\u003e\nCc: Sebastian Reichel \u003csebastian.reichel@collabora.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "32115734c0ed8b463d1020e8da47968735f882c0", "tree": "86a562efd5bac078a184a937aa2d1837b725e4fd", "parents": [ "430c89fe3a523fe24faaad25ccc76cc9ff8034d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:11:28 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 12:11:28 2025 -0800" }, "message": "Increase the default 32-bit build frame size warning limit to 1280 bytes\n\nThat was already the limit with KASAN enabled, and the 32-bit x86 build\nends up having a couple of drm cases that have stack frames _just_ over\n1kB on my allmodconfig test. So the minimal fix for this build issue\nfor now is to just bump the limit and make it independent of KASAN.\n\n[ Side note: XTENSA already used 1.5k and PARISC uses 2k, so 1280 is\n still relatively conservative ]\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "430c89fe3a523fe24faaad25ccc76cc9ff8034d6", "tree": "01bd04d309f3af57835f3fa3ca12d979c54604ab", "parents": [ "a10d15a08f62bf97c707ef3c2a7493604c1bcc89", "d041e5e748f926398ad96436a86667dea8b591e0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 10:33:32 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 10:33:32 2025 -0800" }, "message": "Merge tag \u0027sound-6.18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes. All changes are device-specific and\n trivial, mostly HD-audio and USB-audio quirks and fixups\"\n\n* tag \u0027sound-6.18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek: Add quirk for HP ProBook 450 G8\n ALSA: usb-audio: fix uac2 clock source at terminal parser\n ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200\n ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection\n ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230\n ALSA: au88x0: Fix incorrect error handling for PCI config reads\n" }, { "commit": "a10d15a08f62bf97c707ef3c2a7493604c1bcc89", "tree": "31f228fb71341f98fd8b46ed23461d0728840f9c", "parents": [ "30f09200cc4aefbd8385b01e41bde2e4565a6f0e", "43ff36c4a5a574ee83b4b0d3f3d74f09a3a8c2d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 10:17:10 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 26 10:17:10 2025 -0800" }, "message": "Merge tag \u0027acpi-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Revert a commit that attempted to make the code in the ACPI processor\n driver more straightforward, but it turned out to cause the kernel to\n crash on at least one system, along with some further cleanups on top\n of it\"\n\n* tag \u0027acpi-6.18-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n Revert \"ACPI: processor: idle: Optimize ACPI idle driver registration\"\n Revert \"ACPI: processor: Remove unused empty stubs of some functions\"\n Revert \"ACPI: processor: idle: Rearrange declarations in header file\"\n Revert \"ACPI: processor: idle: Redefine two functions as void\"\n Revert \"ACPI: processor: Do not expose global variable acpi_idle_driver\"\n" }, { "commit": "7fa666ab07ba9e08f52f357cb8e1aad753e83ac6", "tree": "c0ef3006ece56ec6affc117789167e9734e6a8af", "parents": [ "b4a7f4e7ad2b120a94f3111f92a11520052c762d" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 09:40:31 2025 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:34:16 2025 -0500" }, "message": "drm/amdgpu: fix cyan_skillfish2 gpu info fw handling\n\nIf the board supports IP discovery, we don\u0027t need to\nparse the gpu info firmware.\n\nBackport to 6.18.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/4721\nFixes: fa819e3a7c1e (\"drm/amdgpu: add support for cyan skillfish gpu_info\")\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 5427e32fa3a0ba9a016db83877851ed277b065fb)\n" }, { "commit": "b4a7f4e7ad2b120a94f3111f92a11520052c762d", "tree": "c6a9e453c1e4cca336a9ce4e0cbdee9b7d3c3ffb", "parents": [ "8ea902361734c87b82122f9c17830f168ebfc65a" ], "author": { "name": "Prike Liang", "email": "Prike.Liang@amd.com", "time": "Fri Oct 31 17:02:51 2025 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:33:05 2025 -0500" }, "message": "drm/amdgpu: attach tlb fence to the PTs update\n\nEnsure the userq TLB flush is emitted only after\nthe VM update finishes and the PT BOs have been\nannotated with bookkeeping fences.\n\nSuggested-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Prike Liang \u003cPrike.Liang@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f3854e04b708d73276c4488231a8bd66d30b4671)\nCc: stable@vger.kernel.org\n" }, { "commit": "8ea902361734c87b82122f9c17830f168ebfc65a", "tree": "5ee27d532cb007e45f9ba393e3fb86449f4b7242", "parents": [ "81f4d4ba509522596143fd5d7dc2fc3495296b0a" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Wed Nov 05 23:04:54 2025 -0600" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:32:05 2025 -0500" }, "message": "drm/amd/display: Increase EDID read retries\n\n[WHY]\nWhen monitor is still booting EDID read can fail while DPCD read\nis successful. In this case no EDID data will be returned, and this\ncould happen for a while.\n\n[HOW]\nIncrease number of attempts to read EDID in dm_helpers_read_local_edid()\nto 25.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/4672\nCc: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit a76d6f2c76c3abac519ba753e2723e6ffe8e461c)\nCc: stable@vger.kernel.org\n" }, { "commit": "81f4d4ba509522596143fd5d7dc2fc3495296b0a", "tree": "952037c75d9d2b8f90bd28ec3321321f1bb424f0", "parents": [ "3ce62c189693e8ed7b3abe551802bbc67f3ace54" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Mon Nov 03 16:02:11 2025 -0600" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:31:26 2025 -0500" }, "message": "drm/amd/display: Don\u0027t change brightness for disabled connectors\n\n[WHY]\nWhen a laptop lid is closed the connector is disabled but userspace\ncan still try to change brightness. This doesn\u0027t work because the\npanel is turned off. It will eventually time out, but there is a lot\nof stutter along the way.\n\n[How]\nIterate all connectors to check whether the matching one for the backlight\nindex is enabled.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/4675\nCc: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Ray Wu \u003cray.wu@amd.com\u003e\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f6eeab30323d1174a4cc022e769d248fe8241304)\nCc: stable@vger.kernel.org\n" }, { "commit": "3ce62c189693e8ed7b3abe551802bbc67f3ace54", "tree": "c2515639eb905583c36885ac8a835b059d1fe412", "parents": [ "3126c9ccb4373d8758733c6699ba5ab93dbe5c9d" ], "author": { "name": "Alex Hung", "email": "alex.hung@amd.com", "time": "Fri Nov 07 15:35:58 2025 -0700" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:17:38 2025 -0500" }, "message": "drm/amd/display: Check NULL before accessing\n\n[WHAT]\nIGT kms_cursor_legacy\u0027s long-nonblocking-modeset-vs-cursor-atomic\nfails with NULL pointer dereference. This can be reproduced with\nboth an eDP panel and a DP monitors connected.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted\n6.16.0-99-custom #8 PREEMPT(voluntary)\n Hardware name: AMD ........\n RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu]\n Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49\n 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30\n c2 \u003c48\u003e 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02\n RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668\n RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000\n RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760\n R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000\n R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c\n FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)\nknlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu]\n amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu]\n ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu]\n amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu]\n drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400\n drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30\n drm_crtc_get_last_vbltimestamp+0x55/0x90\n drm_crtc_next_vblank_start+0x45/0xa0\n drm_atomic_helper_wait_for_fences+0x81/0x1f0\n ...\n\nCc: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReviewed-by: Aurabindo Pillai \u003caurabindo.pillai@amd.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)\nCc: stable@vger.kernel.org\n" }, { "commit": "3126c9ccb4373d8758733c6699ba5ab93dbe5c9d", "tree": "0dc5b9306e4acca1cdcfe10aac709dc6fac9b709", "parents": [ "971fb57429df5aa4e6efc796f7841e0d10b1e83c" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Nov 25 09:08:45 2025 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Nov 26 12:16:58 2025 -0500" }, "message": "Revert \"drm/amd/display: Move setup_stream_attribute\"\n\nThis reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414.\n\nThis results in a blank screen on the HDMI port on some systems.\nRevert for now so as not to regress 6.18, can be addressed\nin 6.19 once the issue is root caused.\n\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/4652\nCc: Sunpeng.Li@amd.com\nCc: ivan.lipski@amd.com\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb)\n" }, { "commit": "0c922106d7a58d106c6a5c52a741ae101cfaf088", "tree": "6e6279bb8bcb7e465c2c516878a81cf15c3d6c81", "parents": [ "6d849ff573722afcf5508d2800017bdd40f27eb9" ], "author": { "name": "Shaurya Rane", "email": "ssrane_b23@ee.vjti.ac.in", "time": "Wed Nov 26 14:27:18 2025 +0530" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Nov 26 16:28:10 2025 +0100" }, "message": "net/sched: em_canid: fix uninit-value in em_canid_match\n\nUse pskb_may_pull() to ensure a complete CAN frame is present in the\nlinear data buffer before reading the CAN ID. A simple skb-\u003elen check\nis insufficient because it only verifies the total data length but does\nnot guarantee the data is present in skb-\u003edata (it could be in\nfragments).\n\npskb_may_pull() both validates the length and pulls fragmented data\ninto the linear buffer if necessary, making it safe to directly\naccess skb-\u003edata.\n\nReported-by: syzbot+5d8269a1e099279152bc@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d5d8269a1e099279152bc\nFixes: f057bbb6f9ed (\"net: em_canid: Ematch rule to match CAN frames according to their identifiers\")\nSigned-off-by: Shaurya Rane \u003cssrane_b23@ee.vjti.ac.in\u003e\nLink: https://patch.msgid.link/20251126085718.50808-1-ssranevjti@gmail.com\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "6d849ff573722afcf5508d2800017bdd40f27eb9", "tree": "64fadf45c9a8debfb65bffb811ae9cc73cd45075", "parents": [ "76544beea7cfe5bcce6d60f53811657b88ec8be1" ], "author": { "name": "Biju Das", "email": "biju.das.jz@bp.renesas.com", "time": "Tue Nov 18 12:39:25 2025 +0000" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Nov 26 16:26:41 2025 +0100" }, "message": "can: rcar_canfd: Fix CAN-FD mode as default\n\nThe commit 5cff263606a1 (\"can: rcar_canfd: Fix controller mode setting\")\nhas aligned with the flow mentioned in the hardware manual for all SoCs\nexcept R-Car Gen3 and RZ/G2L SoCs. On R-Car Gen4 and RZ/G3E SoCs, due to\nthe wrong logic in the commit[1] sets the default mode to FD-Only mode\ninstead of CAN-FD mode.\n\nThis patch sets the CAN-FD mode as the default for all SoCs by dropping\nthe rcar_canfd_set_mode() as some SoC requires mode setting in global\nreset mode, and the rest of the SoCs in channel reset mode and update the\nrcar_canfd_reset_controller() to take care of these constraints. Moreover,\nthe RZ/G3E and R-Car Gen4 SoCs support 3 modes compared to 2 modes on the\nR-Car Gen3. Use inverted logic in rcar_canfd_reset_controller() to\nsimplify the code later to support FD-only mode.\n\n[1]\ncommit 45721c406dcf (\"can: rcar_canfd: Add support for r8a779a0 SoC\")\n\nFixes: 5cff263606a1 (\"can: rcar_canfd: Fix controller mode setting\")\nCc: stable@vger.kernel.org\nSigned-off-by: Biju Das \u003cbiju.das.jz@bp.renesas.com\u003e\nLink: https://patch.msgid.link/20251118123926.193445-1-biju.das.jz@bp.renesas.com\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "3dcf44ab56e1d3ca3532083c0d5390b758e45b45", "tree": "1bac75f9997663b694d1fa0e9f5f31fca838b063", "parents": [ "a90903c2a3c38bce475f46ea3f93dbf6a9971553" ], "author": { "name": "Francesco Lavra", "email": "flavra@baylibre.com", "time": "Wed Nov 26 10:50:27 2025 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Nov 26 12:30:15 2025 +0000" }, "message": "spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA\n\nThis driver runs also on Tegra SoCs without a Tegra20 APB DMA controller\n(e.g. Tegra234).\nRemove the Kconfig dependency on TEGRA20_APB_DMA; in addition, amend the\nhelp text to reflect the fact that this driver works on SoCs different from\nTegra114.\n\nFixes: bb9667d8187b (\"arm64: tegra: Add SPI device tree nodes for Tegra234\")\nSigned-off-by: Francesco Lavra \u003cflavra@baylibre.com\u003e\nLink: https://patch.msgid.link/20251126095027.4102004-1-flavra@baylibre.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "2bf95a9bcb50002ca9d47403d60aedaeb2e19abe", "tree": "cb262479d17ffd1884fa94a4c75daa6f7ff1e986", "parents": [ "eb4917f557d43c7a1c805dd73ffcdfddb2aba39a" ], "author": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Mon Nov 10 12:50:43 2025 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 26 13:16:53 2025 +0100" }, "message": "serial: 8250: Fix 8250_rsa symbol loop\n\nDepmod fails for a kernel made with:\n make allnoconfig\n echo -e \"CONFIG_MODULES\u003dy\\nCONFIG_SERIAL_8250\u003dm\\nCONFIG_SERIAL_8250_EXTENDED\u003dy\\nCONFIG_SERIAL_8250_RSA\u003dy\" \u003e\u003e .config\n make olddefconfig\n\n...due to a dependency loop:\n\n depmod: ERROR: Cycle detected: 8250 -\u003e 8250_base -\u003e 8250\n depmod: ERROR: Found 2 modules in dependency cycles!\n\nThis is caused by the move of 8250 RSA code from 8250_port.c (in\n8250_base.ko) into 8250_rsa.c (in 8250.ko) by the commit 5a128fb475fb\n(\"serial: 8250: move RSA functions to 8250_rsa.c\"). The commit\nb20d6576cdb3 (\"serial: 8250: export RSA functions\") tried to fix a\nmissing symbol issue with EXPORTs but those then cause this dependency\ncycle.\n\nBreak dependency loop by moving 8250_rsa.o from 8250.ko to 8250_base.ko\nand by passing univ8250_port_base_ops to univ8250_rsa_support() that\ncan make a local copy of it.\n\nReported-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nReported-by: Alex Davis \u003calex47794@gmail.com\u003e\nFixes: 5a128fb475fb (\"serial: 8250: move RSA functions to 8250_rsa.c\")\nFixes: b20d6576cdb3 (\"serial: 8250: export RSA functions\")\nCc: stable \u003cstable@kernel.org\u003e\nLink: https://lore.kernel.org/all/87frc3sd8d.fsf@posteo.net/\nLink: https://lore.kernel.org/all/CADiockCvM6v+d+UoFZpJSMoLAdpy99_h-hJdzUsdfaWGn3W7-g@mail.gmail.com/\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Jiri Slaby \u003cjirislaby@kernel.org\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/20251110105043.4062-1-ilpo.jarvinen@linux.intel.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d041e5e748f926398ad96436a86667dea8b591e0", "tree": "e5392c8765f210408b91b6b336e86eda5f0e0417", "parents": [ "d26e9f669cc0a6a85cf17180c09a6686db9f4002" ], "author": { "name": "Ilyas Gasanov", "email": "public@gsnoff.com", "time": "Wed Nov 26 03:54:41 2025 +0400" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Nov 26 07:26:56 2025 +0100" }, "message": "ALSA: hda/realtek: Add quirk for HP ProBook 450 G8\n\nMy laptop, HP ProBook 450 G8 (32M40EA), has Realtek ALC236 codec on its\nintegrated sound card, and uses GPIO pins 0x2 and 0x1 for speaker mute\nand mic mute LEDs correspondingly, as found out by me through hda-verb\ninvocations. This matches the GPIO masks used by the\nalc236_fixup_hp_gpio_led() function.\n\nPCI subsystem vendor and device IDs happen to be 0x103c and 0x8a75,\nwhich has not been covered in the ALC2xx driver code yet.\n\nSigned-off-by: Ilyas Gasanov \u003cpublic@gsnoff.com\u003e\nLink: https://patch.msgid.link/20251125235441.53629-1-public@gsnoff.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "0ebc27a4c67d44e5ce88d21cdad8201862b78837", "tree": "7550641e6efb5ff3156cecb5d068948cf5578f2a", "parents": [ "ae1737e7339b513f8c2fc21b500a0fc215d155c3" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Mon Nov 24 18:14:09 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 25 19:51:50 2025 -0800" }, "message": "xsk: avoid data corruption on cq descriptor number\n\nSince commit 30f241fcf52a (\"xsk: Fix immature cq descriptor\nproduction\"), the descriptor number is stored in skb control block and\nxsk_cq_submit_addr_locked() relies on it to put the umem addrs onto\npool\u0027s completion queue.\n\nskb control block shouldn\u0027t be used for this purpose as after transmit\nxsk doesn\u0027t have control over it and other subsystems could use it. This\nleads to the following kernel panic due to a NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 2 UID: 1 PID: 927 Comm: p4xsk.bin Not tainted 6.16.12+deb14-cloud-amd64 #1 PREEMPT(lazy) Debian 6.16.12-1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n RIP: 0010:xsk_destruct_skb+0xd0/0x180\n [...]\n Call Trace:\n \u003cIRQ\u003e\n ? napi_complete_done+0x7a/0x1a0\n ip_rcv_core+0x1bb/0x340\n ip_rcv+0x30/0x1f0\n __netif_receive_skb_one_core+0x85/0xa0\n process_backlog+0x87/0x130\n __napi_poll+0x28/0x180\n net_rx_action+0x339/0x420\n handle_softirqs+0xdc/0x320\n ? handle_edge_irq+0x90/0x1e0\n do_softirq.part.0+0x3b/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x60/0x70\n __dev_direct_xmit+0x14e/0x1f0\n __xsk_generic_xmit+0x482/0xb70\n ? __remove_hrtimer+0x41/0xa0\n ? __xsk_generic_xmit+0x51/0xb70\n ? _raw_spin_unlock_irqrestore+0xe/0x40\n xsk_sendmsg+0xda/0x1c0\n __sys_sendto+0x1ee/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x84/0x2f0\n ? __pfx_pollwake+0x10/0x10\n ? __rseq_handle_notify_resume+0xad/0x4c0\n ? restore_fpregs_from_fpstate+0x3c/0x90\n ? switch_fpu_return+0x5b/0xe0\n ? do_syscall_64+0x204/0x2f0\n ? do_syscall_64+0x204/0x2f0\n ? do_syscall_64+0x204/0x2f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n [...]\n Kernel panic - not syncing: Fatal exception in interrupt\n Kernel Offset: 0x1c000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n\nInstead use the skb destructor_arg pointer along with pointer tagging.\nAs pointers are always aligned to 8B, use the bottom bit to indicate\nwhether this a single address or an allocated struct containing several\naddresses.\n\nFixes: 30f241fcf52a (\"xsk: Fix immature cq descriptor production\")\nCloses: https://lore.kernel.org/netdev/0435b904-f44f-48f8-afb0-68868474bf1c@nop.hu/\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nReviewed-by: Jason Xing \u003ckerneljasonxing@gmail.com\u003e\nLink: https://patch.msgid.link/20251124171409.3845-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ae1737e7339b513f8c2fc21b500a0fc215d155c3", "tree": "d3fb07ea728ac47f70517f19bc13059ffab794a5", "parents": [ "f5bce28f6b9125502abec4a67d68eabcd24b3b17" ], "author": { "name": "Heiner Kallweit", "email": "hkallweit1@gmail.com", "time": "Sat Nov 22 15:23:02 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 25 19:12:48 2025 -0800" }, "message": "r8169: fix RTL8127 hang on suspend/shutdown\n\nThere have been reports that RTL8127 hangs on suspend and shutdown,\npartially disappearing from lspci until power-cycling.\nAccording to Realtek disabling PLL\u0027s when switching to D3 should be\navoided on that chip version. Fix this by aligning disabling PLL\u0027s\nwith the vendor drivers, what in addition results in PLL\u0027s not being\ndisabled when switching to D3hot on other chip versions.\n\nFixes: f24f7b2f3af9 (\"r8169: add support for RTL8127A\")\nTested-by: Fabio Baltieri \u003cfabio.baltieri@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nLink: https://patch.msgid.link/d7faae7e-66bc-404a-a432-3a496600575f@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f5bce28f6b9125502abec4a67d68eabcd24b3b17", "tree": "ad64313294a1b138172e2176c7f52be4e0e17753", "parents": [ "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef" ], "author": { "name": "Alexey Kodanev", "email": "aleksei.kodanev@bell-sw.com", "time": "Fri Nov 21 12:38:34 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 25 19:08:53 2025 -0800" }, "message": "net: sxgbe: fix potential NULL dereference in sxgbe_rx()\n\nCurrently, when skb is null, the driver prints an error and then\ndereferences skb on the next line.\n\nTo fix this, let\u0027s add a \u0027break\u0027 after the error message to switch\nto sxgbe_rx_refill(), which is similar to the approach taken by the\nother drivers in this particular case, e.g. calxeda with xgmac_rx().\n\nFound during a code review.\n\nFixes: 1edb9ca69e8a (\"net: sxgbe: add basic framework for Samsung 10Gb ethernet driver\")\nSigned-off-by: Alexey Kodanev \u003caleksei.kodanev@bell-sw.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef", "tree": "32cc13cbf60f9718e31dc6f5577d23928e65858f", "parents": [ "d2099d9f16dbfa1c5266d4230ff7860047bb0b68" ], "author": { "name": "Nikola Z. Ivanov", "email": "zlatistiv@gmail.com", "time": "Sat Nov 22 02:20:27 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 25 17:28:15 2025 -0800" }, "message": "team: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops-\u003ecreate of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n - If port_dev is not the same type as dev, dev takes mtu from port_dev\n - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev-\u003emtu \u003d dev-\u003emtu and instead\nletting team_dev_type_check_change assign dev-\u003emtu \u003d port_dev-\u003emtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n - team device driver in-tree selftests\n - Add/remove various devices as slaves of team device\n - syzbot\n\nReported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003da2a3b519de727b0f7903\nFixes: 1d76efe1577b (\"team: add support for non-ethernet devices\")\nSigned-off-by: Nikola Z. Ivanov \u003czlatistiv@gmail.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@nvidia.com\u003e\nLink: https://patch.msgid.link/20251122002027.695151-1-zlatistiv@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d2099d9f16dbfa1c5266d4230ff7860047bb0b68", "tree": "6d100f937d5c5ae17ccfdb3b6b6d0c16572a72f7", "parents": [ "9780f535f8e0f20b4632b5a173ead71aa8f095d2" ], "author": { "name": "Danielle Costantino", "email": "dcostantino@meta.com", "time": "Mon Nov 24 10:00:43 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Nov 25 16:38:08 2025 -0800" }, "message": "net/mlx5e: Fix validation logic in rate limiting\n\nThe rate limiting validation condition currently checks the output\nvariable max_bw_value[i] instead of the input value\nmaxrate-\u003etc_maxrate[i]. This causes the validation to compare an\nuninitialized or stale value rather than the actual requested rate.\n\nThe condition should check the input rate to properly validate against\nthe upper limit:\n\n } else if (maxrate-\u003etc_maxrate[i] \u003c\u003d upper_limit_gbps) {\n\nThis aligns with the pattern used in the first branch, which correctly\nchecks maxrate-\u003etc_maxrate[i] against upper_limit_mbps.\n\nThe current implementation can lead to unreliable validation behavior:\n\n- For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0\n from initialization, the GBPS path may be taken regardless of whether\n the actual rate is within bounds\n\n- When processing multiple TCs (i \u003e 0), max_bw_value[i] contains the\n value computed for the previous TC, affecting the validation logic\n\n- The overflow check for rates exceeding 255 Gbps may not trigger\n consistently depending on previous array values\n\nThis patch ensures the validation correctly examines the requested rate\nvalue for proper bounds checking.\n\nFixes: 43b27d1bd88a (\"net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps\")\nSigned-off-by: Danielle Costantino \u003cdcostantino@meta.com\u003e\nReviewed-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3184b6a5a24ec9ee74087b2a550476f386df7dc2", "tree": "0d4c94f56b40b0306473599d4ed90d9053d88393", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Mon Nov 24 17:00:36 2025 -0300" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Tue Nov 25 18:00:06 2025 -0600" }, "message": "smb: client: fix memory leak in cifs_construct_tcon()\n\nWhen having a multiuser mount with domain\u003d specified and using\ncifscreds, cifs_set_cifscreds() will end up setting @ctx-\u003edomainname,\nso it needs to be freed before leaving cifs_construct_tcon().\n\nThis fixes the following memory leak reported by kmemleak:\n\n mount.cifs //srv/share /mnt -o domain\u003dZELDA,multiuser,...\n su - testuser\n cifscreds add -d ZELDA -u testuser\n ...\n ls /mnt/1\n ...\n umount /mnt\n echo scan \u003e /sys/kernel/debug/kmemleak\n cat /sys/kernel/debug/kmemleak\n unreferenced object 0xffff8881203c3f08 (size 8):\n comm \"ls\", pid 5060, jiffies 4307222943\n hex dump (first 8 bytes):\n 5a 45 4c 44 41 00 cc cc ZELDA...\n backtrace (crc d109a8cf):\n __kmalloc_node_track_caller_noprof+0x572/0x710\n kstrdup+0x3a/0x70\n cifs_sb_tlink+0x1209/0x1770 [cifs]\n cifs_get_fattr+0xe1/0xf50 [cifs]\n cifs_get_inode_info+0xb5/0x240 [cifs]\n cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]\n cifs_getattr+0x28e/0x450 [cifs]\n vfs_getattr_nosec+0x126/0x180\n vfs_statx+0xf6/0x220\n do_statx+0xab/0x110\n __x64_sys_statx+0xd5/0x130\n do_syscall_64+0xbb/0x380\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFixes: f2aee329a68f (\"cifs: set domainName when a domain-key is used in multiuser\")\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nCc: Jay Shin \u003cjaeshin@redhat.com\u003e\nCc: stable@vger.kernel.org\nCc: linux-cifs@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "b042fdf18e89a347177a49e795d8e5184778b5b6", "tree": "78e95a2b0b43769dc89f466721d745be0c0c1c0b", "parents": [ "dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Wed Nov 19 12:10:19 2025 +0530" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Tue Nov 25 15:21:16 2025 -0500" }, "message": "tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs\n\nWhen a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel\ncalls vm_ops-\u003eclose on each portion. For trace buffer mappings, this\nresults in ring_buffer_unmap() being called multiple times while\nring_buffer_map() was only called once.\n\nThis causes ring_buffer_unmap() to return -ENODEV on subsequent calls\nbecause user_mapped is already 0, triggering a WARN_ON.\n\nTrace buffer mappings cannot support partial mappings because the ring\nbuffer structure requires the complete buffer including the meta page.\n\nFix this by adding a may_split callback that returns -EINVAL to prevent\nVMA splits entirely.\n\nCc: stable@vger.kernel.org\nFixes: cf9f0f7c4c5bb (\"tracing: Allow user-space mapping of the ring-buffer\")\nLink: https://patch.msgid.link/20251119064019.25904-1-kartikey406@gmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003da72c325b042aae6403c7\nTested-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com\nReported-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com\nSigned-off-by: Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7276878b069c57d9a9cca5db01d2f7a427b73456", "tree": "1eda9c6f2a841c55d3f54bf86959b508b2d1ea36", "parents": [ "0e234632e39bd21dd28ffc9ba3ae8eec4deb949c" ], "author": { "name": "Harish Chegondi", "email": "harish.chegondi@intel.com", "time": "Mon Nov 17 11:48:43 2025 -0800" }, "committer": { "name": "Lucas De Marchi", "email": "lucas.demarchi@intel.com", "time": "Tue Nov 25 11:53:34 2025 -0800" }, "message": "drm/xe: Fix conversion from clock ticks to milliseconds\n\nWhen tick counts are large and multiplication by MSEC_PER_SEC is larger\nthan 64 bits, the conversion from clock ticks to milliseconds can go bad.\n\nUse mul_u64_u32_div() instead.\n\nCc: Ashutosh Dixit \u003cashutosh.dixit@intel.com\u003e\nSigned-off-by: Harish Chegondi \u003charish.chegondi@intel.com\u003e\nSuggested-by: Umesh Nerlige Ramappa \u003cumesh.nerlige.ramappa@intel.com\u003e\nFixes: 49cc215aad7f (\"drm/xe: Add xe_gt_clock_interval_to_ms helper\")\nReviewed-by: Ashutosh Dixit \u003cashutosh.dixit@intel.com\u003e\nSigned-off-by: Ashutosh Dixit \u003cashutosh.dixit@intel.com\u003e\nLink: https://patch.msgid.link/1562f1b62d5be3fbaee100f09107f3cc49e40dd1.1763408584.git.harish.chegondi@intel.com\n(cherry picked from commit 96b93ac214f9dd66294d975d86c5dee256faef91)\nSigned-off-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\n" }, { "commit": "0e234632e39bd21dd28ffc9ba3ae8eec4deb949c", "tree": "c000fdcd39f62c76dd233206bad18682199efa7a", "parents": [ "76555b1eb278da420b6e4d26714319a7a4460e7b" ], "author": { "name": "Lucas De Marchi", "email": "lucas.demarchi@intel.com", "time": "Tue Nov 18 11:08:11 2025 -0800" }, "committer": { "name": "Lucas De Marchi", "email": "lucas.demarchi@intel.com", "time": "Tue Nov 25 11:53:28 2025 -0800" }, "message": "drm/xe/guc: Fix stack_depot usage\n\nAdd missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is\nenabled to fix the following call stack:\n\n\t[] BUG: kernel NULL pointer dereference, address: 0000000000000000\n\t[] Workqueue: drm_sched_run_job_work [gpu_sched]\n\t[] RIP: 0010:stack_depot_save_flags+0x172/0x870\n\t[] Call Trace:\n\t[] \u003cTASK\u003e\n\t[] fast_req_track+0x58/0xb0 [xe]\n\nFixes: 16b7e65d299d (\"drm/xe/guc: Track FAST_REQ H2Gs to report where errors came from\")\nTested-by: Sagar Ghuge \u003csagar.ghuge@intel.com\u003e\nCc: stable@vger.kernel.org # v6.17+\nReviewed-by: Stuart Summers \u003cstuart.summers@intel.com\u003e\nLink: https://patch.msgid.link/20251118-fix-debug-guc-v1-1-9f780c6bedf8@intel.com\nSigned-off-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\n(cherry picked from commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f)\nSigned-off-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\n" }, { "commit": "76555b1eb278da420b6e4d26714319a7a4460e7b", "tree": "c14de80ea46720befa73e384313942dee0f1d989", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Mon Nov 10 18:45:23 2025 +0000" }, "committer": { "name": "Lucas De Marchi", "email": "lucas.demarchi@intel.com", "time": "Tue Nov 25 11:53:23 2025 -0800" }, "message": "drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc()\n\nxe_guc_ct_init_noalloc() allocates the CT workqueue and other helpers\nbefore it tries to initialize ct-\u003elock. If drmm_mutex_init() fails\nwe currently bail out without releasing those resources because the\nguc_ct_fini() hasn’t been registered yet.\n\nSince destroy_workqueue() in guc_ct_fini() may flush the workqueue, which\nin turn can take the ct lock, the initialization sequence is restructured\nto first initialize the ct-\u003elock, then set up all CT state, and finally\nregister guc_ct_fini().\n\nv2: guc_ct_fini() does take ct lock. (Matt)\nv3: move primelockdep() together with drmm_mutex_init(). (Lucas)\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nReviewed-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nLink: https://patch.msgid.link/20251110184522.1581001-2-shuicheng.lin@intel.com\nSigned-off-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\n(cherry picked from commit 2e4ad5b0667244f496783c58de0995b9562d3344)\nSigned-off-by: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\n" }, { "commit": "c7418164b463056bf4327b6a2abe638b78250f13", "tree": "5246c720af7982f3b50af2261b133866dc663e43", "parents": [ "ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@linaro.org", "time": "Tue Nov 25 16:55:19 2025 +0300" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Nov 25 17:52:24 2025 +0100" }, "message": "timekeeping: Fix error code in tk_aux_sysfs_init()\n\nIf kobject_create_and_add() fails on the first iteration, then the error\ncode is set to -ENOMEM which is correct. But if it fails in subsequent\niterations then \"ret\" is zero, which means success, but it should be\n-ENOMEM.\n\nSet the error code to -ENOMEM correctly.\n\nFixes: 7b5ab04f035f (\"timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Malaya Kumar Rout \u003cmrout@redhat.com\u003e\nLink: https://patch.msgid.link/aSW1R8q5zoY_DgQE@stanley.mountain\n" }, { "commit": "30f09200cc4aefbd8385b01e41bde2e4565a6f0e", "tree": "aff9ce07283b08a58ccc42e3addb1249bf6d288e", "parents": [ "5f8a6c70afc58d4be849407658f27f47f006a3c7", "165eb13e485c5c25c7cb276ac85f788a2bd200cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 25 08:36:03 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 25 08:36:03 2025 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"We\u0027ve got a revert due to one of the recent CCA commits breaking ACPI\n firmware-based error reporting, a fix for a hard-lockup introduced by\n a prior fix affecting non-default (CONFIG_EXPERT) configurations and\n another ACPI fix for systems using MMIO-based timers.\n\n Other than that, we\u0027re looking pretty good.\n\n - Avoid hardlockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY\u003dn\n\n - Fix regression in APEI/GHES error handling\n\n - Fix MMIO timers when probed via ACPI\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY\n ACPI: GTDT: Correctly number platform devices for MMIO timers\n Revert \"arm64: acpi: Enable ACPI CCEL support\"\n" }, { "commit": "5f8a6c70afc58d4be849407658f27f47f006a3c7", "tree": "dba8123db5139d2cfd13665cadef46618148e921", "parents": [ "8a2bcda5e139064b255531eb5889ff826a8b6995", "b07bf253ef8e48e7ff0b378f441a180a8ad37124" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 25 08:31:28 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Nov 25 08:31:28 2025 -0800" }, "message": "Merge tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd\n\nPull iommufd fixes from Jason Gunthorpe:\n \"Two build fixes, no functional change:\n\n - Fix a possible compiler error around counted_by() due to wrong\n initialization order\n\n - Fix a -Wflex-array-member-not-at-end\"\n\n* tag \u0027for-linus-iommufd\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:\n iommufd/iommufd_private.h: Avoid -Wflex-array-member-not-at-end warning\n iommufd/driver: Fix counter initialization for counted_by annotation\n" }, { "commit": "43ff36c4a5a574ee83b4b0d3f3d74f09a3a8c2d3", "tree": "c9237e79f97e4d1b7e432dc6fd23767d284a4040", "parents": [ "1a8b3501821b608383f7c7aa0f24e2006681e2b5" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 15:06:12 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 16:08:06 2025 +0100" }, "message": "Revert \"ACPI: processor: idle: Optimize ACPI idle driver registration\"\n\nRevert commit 7a8c994cbb2d (\"ACPI: processor: idle: Optimize ACPI idle\ndriver registration\") because it is reported to introduce a cpuidle\nregression leading to a kernel crash on a platform using the ACPI idle\ndriver.\n\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReported-by: Borislav Petkov \u003cbp@alien8.de\u003e\nTested-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nCloses: https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/\n" }, { "commit": "d26e9f669cc0a6a85cf17180c09a6686db9f4002", "tree": "f04b7e4052944900b3f101cb16ca77937238da86", "parents": [ "be4c9abdf04b86bb33f4a2ce59fd7cb64a739c51" ], "author": { "name": "René Rebe", "email": "rene@exactco.de", "time": "Tue Nov 25 15:41:49 2025 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Nov 25 15:53:39 2025 +0100" }, "message": "ALSA: usb-audio: fix uac2 clock source at terminal parser\n\nSince 8b3a087f7f65 (\"ALSA: usb-audio: Unify virtual type units type to\nUAC3 values\") usb-audio is using UAC3_CLOCK_SOURCE instead of\nbDescriptorSubtype, later refactored with e0ccdef9265 (\"ALSA: usb-audio:\nClean up check_input_term()\") into parse_term_uac2_clock_source().\n\nThis breaks the clock source selection for at least my\n1397:0003 BEHRINGER International GmbH FCA610 Pro.\n\nFix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source().\n\nFixes: 8b3a087f7f65 (\"ALSA: usb-audio: Unify virtual type units type to UAC3 values\")\nSigned-off-by: René Rebe \u003crene@exactco.de\u003e\nLink: https://patch.msgid.link/20251125.154149.1121389544970412061.rene@exactco.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "9780f535f8e0f20b4632b5a173ead71aa8f095d2", "tree": "e24d74474312dce544f1f164a824ba427ef22f5d", "parents": [ "081156ce13f8fa4e97b5148dc54d8c0ddf02117b" ], "author": { "name": "Horatiu Vultur", "email": "horatiu.vultur@microchip.com", "time": "Fri Nov 21 07:14:11 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 25 15:45:19 2025 +0100" }, "message": "net: lan966x: Fix the initialization of taprio\n\nTo initialize the taprio block in lan966x, it is required to configure\nthe register REVISIT_DLY. The purpose of this register is to set the\ndelay before revisit the next gate and the value of this register depends\non the system clock. The problem is that the we calculated wrong the value\nof the system clock period in picoseconds. The actual system clock is\n~165.617754MHZ and this correspond to a period of 6038 pico seconds and\nnot 15125 as currently set.\n\nFixes: e462b2717380b4 (\"net: lan966x: Add offload support for taprio\")\nSigned-off-by: Horatiu Vultur \u003choratiu.vultur@microchip.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20251121061411.810571-1-horatiu.vultur@microchip.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "1a8b3501821b608383f7c7aa0f24e2006681e2b5", "tree": "73d8df26aac74eb8fb663089a2ce6baa71263b55", "parents": [ "e6889323c2184c700428dd4b90a1c2c06b8ae51f" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 15:05:01 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 15:05:01 2025 +0100" }, "message": "Revert \"ACPI: processor: Remove unused empty stubs of some functions\"\n\nRevert commit 5020d05b3476 (\"ACPI: processor: Remove unused empty stubs\nof some functions\") because it depends on a problematic one.\n\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "f6dc5a36195d3f5be769f60d6987150192dfb099", "tree": "805eb95eb169721771e03cfd43e7e3036d23d8b2", "parents": [ "f6041803a831266a2a5a5b5af66f7de0845bcbf3" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Tue Nov 25 12:33:06 2025 +0000" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Tue Nov 25 07:03:45 2025 -0700" }, "message": "io_uring: fix mixed cqe overflow handling\n\nI started to see zcrx data corruptions. That turned out to be due\nto CQ tail pointing to a stale entry which happened to be from\na zcrx request. I.e. the tail is incremented without the CQE\nmemory being changed.\n\nThe culprit is __io_cqring_overflow_flush() passing \"cqe32\u003dtrue\"\nto io_get_cqe_overflow() for non-mixed CQE32 setups, which only\nexpects it to be set for mixed 32B CQEs and not for SETUP_CQE32.\n\nThe fix is slightly hacky, long term it\u0027s better to unify mixed and\nCQE32 handling.\n\nFixes: e26dca67fde19 (\"io_uring: add support for IORING_SETUP_CQE_MIXED\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "e6889323c2184c700428dd4b90a1c2c06b8ae51f", "tree": "0e12243d25abd9d9de960e3cc71835269160b82b", "parents": [ "66e600a26ee7d845d9434c3d60cef4bbf7dd3eb4" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 15:03:24 2025 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Nov 25 15:03:24 2025 +0100" }, "message": "Revert \"ACPI: processor: idle: Rearrange declarations in header file\"\n\nRevert commit bdf780fbcef5 (\"ACPI: processor: idle: Rearrange declarations\nin header file\") because it depends on a problematic one.\n\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" } ], "next": "66e600a26ee7d845d9434c3d60cef4bbf7dd3eb4" }