)]}' { "log": [ { "commit": "adbbd9714f8058730f93c8df5c5bf1679456424b", "tree": "ac62006fc8fe318c96d06952d6c98ab550591c0b", "parents": [ "e356da60144bcd06bf2880999f67a6415a7499d5" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Jan 14 08:28:17 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:46:17 2026 +0100" }, "message": "scripts: headers_install.sh: Remove config leak ignore machinery\n\nThere are no entries left to ignore and none should be added again.\n\nRemove the now unused logic.\n\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "e356da60144bcd06bf2880999f67a6415a7499d5", "tree": "3cf9ccf46fdf7a6450463d303498b3a3ca4e0a6d", "parents": [ "9b21aa9f038184aa49f894e663957933507718d1" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Jan 14 08:28:16 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:46:17 2026 +0100" }, "message": "x86/uapi: Stop leaking kconfig references to userspace\n\nUAPI headers are not supposed to leak references to kconfig symbols.\nThese won\u0027t be set when building userspace. Hide the kconfig reference\nbehind \u0027if defined(__KERNEL__)\u0027, so it will be stripped by\nheaders_install.sh. The result for userspace will be the same, but the\nexceptions in headers_install.sh can also be removed.\n\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "9b21aa9f038184aa49f894e663957933507718d1", "tree": "00af963d1f47ba9eff400207726189f248c20b84", "parents": [ "49d7819aa9b0b494d140ae28789b1190acdb9032" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Jan 14 08:28:15 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:46:17 2026 +0100" }, "message": "nios2: uapi: Remove custom asm/swab.h from UAPI\n\nUAPI headers are not supposed to leak references to kconfig symbols.\nThey are undefined there in any case. As all actual definitions of this\nheader are guarded behind a kconfig symbol, for userspace the header is\nalways identical to its asm-generic variant.\n\nMake the custom UAPI header a kernel-internal one, so the leaks of\nkconfig symbols are fixed and userspace will instead use\nasm-generic/swab.h directly.\n\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://lore.kernel.org/lkml/93c55086-931a-4282-a94c-de4954047fa9@app.fastmail.com/\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "49d7819aa9b0b494d140ae28789b1190acdb9032", "tree": "8f4cbeaaa363a3bb6cb65f52e6a202a22de39271", "parents": [ "b4171fd0b091072f403b66bf05d01051d4bd94d9" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Jan 14 08:28:14 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:46:17 2026 +0100" }, "message": "ARM: uapi: Drop PSR_ENDSTATE\n\nThe symbol PSR_ENDSTATE is pointless for userspace. Drop it from the\nUAPI headers and instead inline it into the only two callers.\n\nAs as side-effect, remove a leak of an internal kconfig symbol through\nthe UAPI headers.\n\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://lore.kernel.org/lkml/d2ad12f2-3d65-4bef-890c-65d78a33d790@app.fastmail.com/\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "b4171fd0b091072f403b66bf05d01051d4bd94d9", "tree": "8f1879b05b4fb316d08015d04d7cbe3b7b56add1", "parents": [ "eed444d02585b426645532166ede3e2427db901d" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Jan 14 08:28:13 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:46:17 2026 +0100" }, "message": "ARC: Always use SWAPE instructions for __arch_swab32()\n\nSince commit 67a697e7576 (\"ARC: retire ARC750 support\") all supported\nCPUs have the \u0027swape\u0027 instruction.\n\nAlways use the implementation of __arch_swabe() which uses \u0027swape\u0027.\nARCH_USE_BUILTIN_BSWAP can not be used as that results on libcalls on\n-mcpu\u003darc700.\n\nAs as side-effect, remove a leak of an internal kconfig symbol through\nthe UAPI headers.\n\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://lore.kernel.org/lkml/0ae2688a-5a22-405b-adaf-9b5ad712b245@app.fastmail.com/\nSuggested-by: Vineet Gupta \u003cvgupta@kernel.org\u003e\nLink: https://lore.kernel.org/lkml/a033a402-e3c5-4982-9fff-b6a4c55817ae@kernel.org/\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "eed444d02585b426645532166ede3e2427db901d", "tree": "134f57a2b41a5b461569fe29b4d67287ffa5986c", "parents": [ "0f61b1860cc3f52aef9036d7235ed1f017632193" ], "author": { "name": "John Garry", "email": "john.g.garry@oracle.com", "time": "Wed Jan 07 09:40:04 2026 +0000" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri Jan 30 16:44:38 2026 +0100" }, "message": "include/asm-generic/topology.h: Remove unused definition of cpumask_of_node()\n\nThe definition of cpumask_of_node() in question is guarded by conflicting\nCONFIG_NUMA and !CONFIG_NUMA checks, so remove it.\n\nSigned-off-by: John Garry \u003cjohn.g.garry@oracle.com\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "0f61b1860cc3f52aef9036d7235ed1f017632193", "tree": "29e4048ecebf0abc501ad4bc8eb3e9c194fa94aa", "parents": [ "7143203341dccbca809ba0a8e72239ea4652ace6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 17:03:14 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 17:03:14 2026 -1000" }, "message": "Linux 6.19-rc5\n" }, { "commit": "7143203341dccbca809ba0a8e72239ea4652ace6", "tree": "e3bf2473363e968ebfd26097ad80348c62d1366e", "parents": [ "9c7ef209cd0f7c1a92ed61eed3e835d6e4abc66c", "74d74bb78aeccc9edc10db216d6be121cf7ec176" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 15:07:56 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 15:07:56 2026 -1000" }, "message": "Merge tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - A couple more fixes for the lib/crypto KUnit tests\n\n - Fix missing MMU protection for the AES S-box\n\n* tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n lib/crypto: aes: Fix missing MMU protection for AES S-box\n MAINTAINERS: add test vector generation scripts to \"CRYPTO LIBRARY\"\n lib/crypto: tests: Fix syntax error for old python versions\n lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs\n" }, { "commit": "9c7ef209cd0f7c1a92ed61eed3e835d6e4abc66c", "tree": "187bfb72c24eba7cdd47afd5ad908725491fe515", "parents": [ "316a94cb6398ea073790462ddd337da06ad8e1de", "361e0ff456a8daf9753c18030533256e4133ce7a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:27:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:27:44 2026 -1000" }, "message": "Merge tag \u0027char-misc-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are some small char/misc driver fixes for some reported issues.\n Included in here is:\n\n - much reported rust_binder fix\n\n - counter driver fixes\n\n - new device ids for the mei driver\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027char-misc-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n rust_binder: remove spin_lock() in rust_shrink_free_page()\n mei: me: add nova lake point S DID\n counter: 104-quad-8: Fix incorrect return value in IRQ handler\n counter: interrupt-cnt: Drop IRQF_NO_THREAD flag\n" }, { "commit": "316a94cb6398ea073790462ddd337da06ad8e1de", "tree": "f74bc928199f22e143e5680f19df92da8dcb7b26", "parents": [ "fac4bdbacab5a9abe7e017069c640273c2a704e2", "9efb74f84ba82a9de81fc921baf3c5e2decf8256" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:19:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:19:43 2026 -1000" }, "message": "Merge tag \u0027x86-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n \"Disable GCOV instrumentation in the SEV noinstr.c collection of SEV\n noinstr methods, to further robustify the code\"\n\n* tag \u0027x86-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/sev: Disable GCOV on noinstr object\n" }, { "commit": "fac4bdbacab5a9abe7e017069c640273c2a704e2", "tree": "b89acb94f450802cdf88ddecee536e0ee9c56380", "parents": [ "fe948326e95dcc7b1efb6b76e92b5b919f56250c", "2bdf777410dc6e022d1081885ff34673b5dfee99" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:11:53 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 07:11:53 2026 -1000" }, "message": "Merge tag \u0027sched-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n \"Fix a crash in sched_mm_cid_after_execve()\"\n\n* tag \u0027sched-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()\n" }, { "commit": "fe948326e95dcc7b1efb6b76e92b5b919f56250c", "tree": "6005f7d3f342a3bb27cfb83cc4e41b26fc89846c", "parents": [ "88730166f3ee261c43e5087ea665f3a47966865b", "ff5860f5088e9076ebcccf05a6ca709d5935cfa9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:55:27 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:55:27 2026 -1000" }, "message": "Merge tag \u0027perf-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf event fix from Ingo Molnar:\n \"Fix perf swevent hrtimer deinit regression\"\n\n* tag \u0027perf-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Ensure swevent hrtimer is properly destroyed\n" }, { "commit": "88730166f3ee261c43e5087ea665f3a47966865b", "tree": "9c4c5704ce52aca69d3f35b5d25dbc5748d7caba", "parents": [ "2e4b28c48f88ce9e263957b1d944cf5349952f88", "a33d16dc874a9512c02b1f1a3e08c26a82b4be5e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:36:20 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:36:20 2026 -1000" }, "message": "Merge tag \u0027irq-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc irqchip fixes from Ingo Molnar:\n\n - Fix an endianness bug in the gic-v5 irqchip driver\n\n - Revert a broken commit from the riscv-imsic irqchip driver\n\n* tag \u0027irq-urgent-2026-01-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n Revert \"irqchip/riscv-imsic: Embed the vector array in lpriv\"\n irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness\n" }, { "commit": "2e4b28c48f88ce9e263957b1d944cf5349952f88", "tree": "8c5aa5d9f94ddfc086819c069bb9b08c75048da9", "parents": [ "755bc1335e3b116b702205b72eb57b7b8aef2bb2" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sun Jan 11 16:53:48 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 11 06:09:11 2026 -1000" }, "message": "treewide: Update email address\n\nIn a vain attempt to consolidate the email zoo switch everything to the\nkernel.org account.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "755bc1335e3b116b702205b72eb57b7b8aef2bb2", "tree": "3b4b7cbd9217bd19a769b5e0192e7fac2e0b3fc3", "parents": [ "0fa27899e0147fe180b603bda30930e8c145dd47", "b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:54:41 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:54:41 2026 -1000" }, "message": "Merge tag \u0027riscv-for-linus-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Notable changes include a fix to close one common microarchitectural\n attack vector for out-of-order cores. Another patch exposed an\n omission in my boot test coverage, which is currently missing\n relocatable kernels. Otherwise, the fixes seem to be settling down for\n us.\n\n - Fix CONFIG_RELOCATABLE\u003dy boots by building Image files from\n vmlinux, rather than vmlinux.unstripped, now that the .modinfo\n section is included in vmlinux.unstripped\n\n - Prevent branch predictor poisoning microarchitectural attacks that\n use the syscall index as a vector by using array_index_nospec() to\n clamp the index after the bounds check (as x86 and ARM64 already\n do)\n\n - Fix a crash in test_kprobes when building with Clang\n\n - Fix a deadlock possible when tracing is enabled for SBI ecalls\n\n - Fix the definition of the Zk standard RISC-V ISA extension bundle,\n which was missing the Zknh extension\n\n - A few other miscellaneous non-functional cleanups, removing unused\n macros, fixing an out-of-date path in code comments, resolving a\n compile-time warning for a type mismatch in a pr_crit(), and\n removing an unnecessary header file inclusion\"\n\n* tag \u0027riscv-for-linus-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: trace: fix snapshot deadlock with sbi ecall\n riscv: remove irqflags.h inclusion in asm/bitops.h\n riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int\n riscv: configs: Clean up references to non-existing configs\n riscv: kexec_image: Fix dead link to boot-image-header.rst\n riscv: pgtable: Cleanup useless VA_USER_XXX definitions\n riscv: cpufeature: Fix Zk bundled extension missing Zknh\n riscv: fix KUnit test_kprobes crash when building with Clang\n riscv: Sanitize syscall table indexing under speculation\n riscv: boot: Always make Image from vmlinux, not vmlinux.unstripped\n" }, { "commit": "0fa27899e0147fe180b603bda30930e8c145dd47", "tree": "1a9f4ef6b4871ddcdfcc0cafcd7a05f0d33ba5b4", "parents": [ "b061fcffe336f1f1d1afe6a904f36962378c4026", "8510ef5e3cfbd7d59a16845f85cd0194a8689761" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:04:04 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 15:04:04 2026 -1000" }, "message": "Merge tag \u0027driver-core-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Fix swapped example values for the `family` and `machine` attributes\n in the sysfs SoC bus ABI documentation\n\n - Fix Rust build and intra-doc issues when optional subsystems\n (CONFIG_PCI, CONFIG_AUXILIARY_BUS, CONFIG_PRINTK) are disabled\n\n - Fix typos and incorrect safety comments in Rust PCI, DMA, and\n device ID documentation\n\n* tag \u0027driver-core-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n rust: device: Remove explicit import of CStrExt\n rust: pci: fix typos in Bar struct\u0027s comments\n rust: device: fix broken intra-doc links\n rust: dma: fix broken intra-doc links\n rust: driver: fix broken intra-doc links to example driver types\n rust: device_id: replace incorrect word in safety documentation\n rust: dma: remove incorrect safety documentation\n docs: ABI: sysfs-devices-soc: Fix swapped sample values\n" }, { "commit": "b061fcffe336f1f1d1afe6a904f36962378c4026", "tree": "4b487c997a2875f001d678d667ed8d5d0fc0b081", "parents": [ "97313d6113ab4362ad15076f65560e65288fbcb8", "6e39903c73df08b256322d04c4dfe4a82ec63a45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 14:57:55 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 14:57:55 2026 -1000" }, "message": "Merge tag \u0027linux_kselftest-fixes-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest fix from Shuah Khan:\n \"Fix tracing test_multiple_writes stalls when buffer_size_kb is less\n than 12KB\"\n\n* tag \u0027linux_kselftest-fixes-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n selftests/tracing: Fix test_multiple_writes stall\n" }, { "commit": "97313d6113ab4362ad15076f65560e65288fbcb8", "tree": "ab69e5df60f015d96a3b268492eedc9d1fe4a183", "parents": [ "7893cc12251f6f19e7689a4cf3ba803bddbd8437", "6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 07:14:40 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 07:14:40 2026 -1000" }, "message": "Merge tag \u0027iommu-fixes-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iomu fixes from Joerg Roedel:\n\n - several Kconfig-related build fixes\n\n - fix for when gcc 8.5 on PPC refuses to inline a function from a\n header file\n\n* tag \u0027iommu-fixes-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommupt: Make pt_feature() always_inline\n iommufd/selftest: Prevent module/builtin conflicts in kconfig\n iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER\n iommupt: Fix the kunit building\n" }, { "commit": "7893cc12251f6f19e7689a4cf3ba803bddbd8437", "tree": "cea3118673d1aef8096b83eeb20f5a33e13cba46", "parents": [ "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Sat Jan 10 19:47:03 2026 +0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 10 06:39:20 2026 -1000" }, "message": "erofs: fix file-backed mounts no longer working on EROFS partitions\n\nSheng Yong reported [1] that Android APEX images didn\u0027t work with commit\n072a7c7cdbea (\"erofs: don\u0027t bother with s_stack_depth increasing for\nnow\") because \"EROFS-formatted APEX file images can be stored within an\nEROFS-formatted Android system partition.\"\n\nIn response, I sent a quick fat-fingered [PATCH v3] to address the\nreport. Unfortunately, the updated condition was incorrect:\n\n if (erofs_is_fileio_mode(sbi)) {\n- sb-\u003es_stack_depth \u003d\n- file_inode(sbi-\u003edif0.file)-\u003ei_sb-\u003es_stack_depth + 1;\n- if (sb-\u003es_stack_depth \u003e FILESYSTEM_MAX_STACK_DEPTH) {\n- erofs_err(sb, \"maximum fs stacking depth exceeded\");\n+ inode \u003d file_inode(sbi-\u003edif0.file);\n+ if ((inode-\u003ei_sb-\u003es_op \u003d\u003d \u0026erofs_sops \u0026\u0026 !sb-\u003es_bdev) ||\n+ inode-\u003ei_sb-\u003es_stack_depth) {\n\nThe condition `!sb-\u003es_bdev` is always true for all file-backed EROFS\nmounts, making the check effectively a no-op.\n\nThe real fix tested and confirmed by Sheng Yong [2] at that time was\n[PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup\nworks:\n EROFS (on a block device) + EROFS (file-backed mount)\n\nBut sadly I screwed it up again by upstreaming the outdated [PATCH v3].\n\nThis patch applies the same logic as the delta between the upstream\n[PATCH v3] and the real fix [PATCH v3 RESEND].\n\nReported-by: Sheng Yong \u003cshengyong1@xiaomi.com\u003e\nCloses: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1]\nFixes: 072a7c7cdbea (\"erofs: don\u0027t bother with s_stack_depth increasing for now\")\nLink: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2]\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6a3d5fda2ce464a80a9af9e358dfbab6a989ab5d", "tree": "f5a726481f386a9d81da34d476641fa86c875255", "parents": [ "7adfd682745a41fdf0279e4457d11fffab145a8f" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Fri Jan 09 10:29:52 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:50:45 2026 +0100" }, "message": "iommupt: Make pt_feature() always_inline\n\ngcc 8.5 on powerpc does not automatically inline these functions even\nthough they evaluate to constants in key cases. Since the constant\npropagation is essential for some code elimination and built-time checks\nthis causes a build failure:\n\n ERROR: modpost: \"__pt_no_sw_bit\" [drivers/iommu/generic_pt/fmt/iommu_amdv1.ko] undefined!\n\nCaused by this:\n\n\tif (pts_feature(\u0026pts, PT_FEAT_DMA_INCOHERENT) \u0026\u0026\n\t !pt_test_sw_bit_acquire(\u0026pts,\n\t\t\t\t SW_BIT_CACHE_FLUSH_DONE))\n\t\tflush_writes_item(\u0026pts);\n\nWhere pts_feature() evaluates to a constant false. Mark them as\n__always_inline to force it to evaluate to a constant and trigger the code\nelimination.\n\nFixes: 7c5b184db714 (\"genpt: Generic Page Table base API\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512230720.9y9DtWIo-lkp@intel.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\n" }, { "commit": "7adfd682745a41fdf0279e4457d11fffab145a8f", "tree": "fe049c6c14ed9dc3886a907c868be581731d5003", "parents": [ "faa37ff3bf18d5242fe3d54f5462b1c3254c2567" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:12 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:58 2026 +0100" }, "message": "iommufd/selftest: Prevent module/builtin conflicts in kconfig\n\nThe selftest now depends on the AMDv1 page table, however the selftest\nkconfig itself is just an sub-option of the main IOMMUFD module kconfig.\n\nThis means it cannot be modular and so kconfig allowed a modular\nIOMMU_PT_AMDV1 with a built in IOMMUFD. This causes link failures:\n\n ld: vmlinux.o: in function `mock_domain_alloc_pgtable.isra.0\u0027:\n selftest.c:(.text+0x12e8ad3): undefined reference to `pt_iommu_amdv1_init\u0027\n ld: vmlinux.o: in function `BSWAP_SHUFB_CTL\u0027:\n sha1-avx2-asm.o:(.rodata+0xaa36a8): undefined reference to `pt_iommu_amdv1_read_and_clear_dirty\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa36f0): undefined reference to `pt_iommu_amdv1_map_pages\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa36f8): undefined reference to `pt_iommu_amdv1_unmap_pages\u0027\n ld: sha1-avx2-asm.o:(.rodata+0xaa3720): undefined reference to `pt_iommu_amdv1_iova_to_phys\u0027\n\nAdjust the kconfig to disable IOMMUFD_TEST if IOMMU_PT_AMDV1 is incompatible.\n\nFixes: e93d5945ed5b (\"iommufd: Change the selftest to use iommupt instead of xarray\")\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202512210135.freQWpxa-lkp@intel.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "faa37ff3bf18d5242fe3d54f5462b1c3254c2567", "tree": "8e5c862c2bb83fbd774896c0b58ce49d3742b7a7", "parents": [ "cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:11 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:58 2026 +0100" }, "message": "iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER\n\nThe test doesn\u0027t build without it, dma-buf.h does not provide stub\nfunctions if it is not enabled. Compilation can fail with:\n\n ERROR:root:ld: vmlinux.o: in function `iommufd_test\u0027:\n (.text+0x3b1cdd): undefined reference to `dma_buf_get\u0027\n ld: (.text+0x3b1d08): undefined reference to `dma_buf_put\u0027\n ld: (.text+0x3b2105): undefined reference to `dma_buf_export\u0027\n ld: (.text+0x3b211f): undefined reference to `dma_buf_fd\u0027\n ld: (.text+0x3b2e47): undefined reference to `dma_buf_move_notify\u0027\n\nAdd the missing select.\n\nFixes: d2041f1f11dd (\"iommufd/selftest: Add some tests for the dmabuf flow\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "cefd81e76a8c0dc4aa2bacd884acca44e7b61e5b", "tree": "61c2360c5a324c83eebe92e7ff9633c106bcfd27", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue Jan 06 15:22:10 2026 -0400" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Sat Jan 10 10:40:57 2026 +0100" }, "message": "iommupt: Fix the kunit building\n\nThe kunit doesn\u0027t work since the below commit made GENERIC_PT\nunselectable:\n\n $ make ARCH\u003dx86_64 O\u003dbuild_kunit_x86_64 olddefconfig\n ERROR:root:Not all Kconfig options selected in kunitconfig were in the generated .config.\n This is probably due to unsatisfied dependencies.\n Missing: CONFIG_DEBUG_GENERIC_PT\u003dy, CONFIG_IOMMUFD_TEST\u003dy,\n CONFIG_IOMMU_PT_X86_64\u003dy, CONFIG_GENERIC_PT\u003dy, CONFIG_IOMMU_PT_AMDV1\u003dy,\n CONFIG_IOMMU_PT_VTDSS\u003dy, CONFIG_IOMMU_PT\u003dy, CONFIG_IOMMU_PT_KUNIT_TEST\u003dy\n\nAlso remove the unneeded CONFIG_IOMMUFD_TEST reference as the iommupt kunit\ndoesn\u0027t interact with iommufd, and it doesn\u0027t currently build for the\nkunit due problems with DMA_SHARED buffer either.\n\nFixes: 01569c216dde (\"genpt: Make GENERIC_PT invisible\")\nFixes: 1dd4187f53c3 (\"iommupt: Add a kunit test for Generic Page Table\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Alejandro Jimenez \u003calejandro.j.jimenez@oracle.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b6151c4e60e5f695fac8b5c3e011cfcfd6e27cba", "tree": "847e5358a6c67c8260b2bdd46478ae6cfce0cd36", "parents": [ "cb2076b0910f3b19036ec7d50530113fcb9736c8", "072a7c7cdbea4f91df854ee2bb216256cd619f2a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 19:34:50 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 19:34:50 2026 -1000" }, "message": "Merge tag \u0027erofs-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fix from Gao Xiang:\n\n - Don\u0027t increase s_stack_depth which caused regressions in some\n composefs mount setups (EROFS + ovl^2)\n\n Instead just allow one extra unaccounted fs stacking level for\n straightforward cases.\n\n* tag \u0027erofs-for-6.19-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: don\u0027t bother with s_stack_depth increasing for now\n" }, { "commit": "072a7c7cdbea4f91df854ee2bb216256cd619f2a", "tree": "aab8613a5bbfd7a1c0fe8e8273a81599000fb2b5", "parents": [ "f8f9c1f4d0c7a64600e2ca312dec824a0bc2f1da" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Thu Jan 08 10:38:31 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Sat Jan 10 13:01:15 2026 +0800" }, "message": "erofs: don\u0027t bother with s_stack_depth increasing for now\n\nPreviously, commit d53cd891f0e4 (\"erofs: limit the level of fs stacking\nfor file-backed mounts\") bumped `s_stack_depth` by one to avoid kernel\nstack overflow when stacking an unlimited number of EROFS on top of\neach other.\n\nThis fix breaks composefs mounts, which need EROFS+ovl^2 sometimes\n(and such setups are already used in production for quite a long time).\n\nOne way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH\nfrom 2 to 3, but proving that this is safe in general is a high bar.\n\nAfter a long discussion on GitHub issues [1] about possible solutions,\none conclusion is that there is no need to support nesting file-backed\nEROFS mounts on stacked filesystems, because there is always the option\nto use loopback devices as a fallback.\n\nAs a quick fix for the composefs regression for this cycle, instead of\nbumping `s_stack_depth` for file backed EROFS mounts, we disallow\nnesting file-backed EROFS over EROFS and over filesystems with\n`s_stack_depth` \u003e 0.\n\nThis works for all known file-backed mount use cases (composefs,\ncontainerd, and Android APEX for some Android vendors), and the fix is\nself-contained.\n\nEssentially, we are allowing one extra unaccounted fs stacking level of\nEROFS below stacking filesystems, but EROFS can only be used in the read\npath (i.e. overlayfs lower layers), which typically has much lower stack\nusage than the write path.\n\nWe can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more\nstack usage analysis or using alternative approaches, such as splitting\nthe `s_stack_depth` limitation according to different combinations of\nstacking.\n\nFixes: d53cd891f0e4 (\"erofs: limit the level of fs stacking for file-backed mounts\")\nReported-and-tested-by: Dusty Mabe \u003cdusty@dustymabe.com\u003e\nReported-by: Timothée Ravier \u003ctim@siosm.fr\u003e\nCloses: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]\nReported-by: \"Alekséi Naidénov\" \u003can@digitaltide.io\u003e\nCloses: https://lore.kernel.org/r/CAFHtUiYv4+\u003d+JP_-JjARWjo6OwcvBj1wtYN\u003dz0QXwCpec9sXtg@mail.gmail.com\nAcked-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nAcked-by: Alexander Larsson \u003calexl@redhat.com\u003e\nReviewed-and-tested-by: Sheng Yong \u003cshengyong1@xiaomi.com\u003e\nReviewed-by: Zhiguo Niu \u003czhiguo.niu@unisoc.com\u003e\nReviewed-by: Chao Yu \u003cchao@kernel.org\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Miklos Szeredi \u003cmszeredi@redhat.com\u003e\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "cb2076b0910f3b19036ec7d50530113fcb9736c8", "tree": "7acbea961c180ab45e5799abc511aab127cfa495", "parents": [ "68ad2095ca0f42a92d16d8cd1df0fb4f4bff634a", "f0d385f6689f37a2828c686fb279121df006b4cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:42:46 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:42:46 2026 -1000" }, "message": "Merge tag \u0027block-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Kill unlikely checks for blk-rq-qos. These checks are really\n all-or-nothing, either the branch is taken all the time, or it\u0027s not.\n Depending on the configuration, either one of those cases may be\n true. Just remove the annotation\n\n - Fix for merging bios with different app tags set\n\n - Fix for a recently introduced slowdown due to RCU synchronization\n\n - Fix for a status change on loop while it\u0027s in use, and then a later\n fix for that fix\n\n - Fix for the async partition scanning in ublk\n\n* tag \u0027block-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n ublk: fix use-after-free in ublk_partition_scan_work\n blk-mq: avoid stall during boot due to synchronize_rcu_expedited\n loop: add missing bd_abort_claiming in loop_set_status\n block: don\u0027t merge bios with different app_tags\n blk-rq-qos: Remove unlikely() hints from QoS checks\n loop: don\u0027t change loop device under exclusive opener in loop_set_status\n" }, { "commit": "68ad2095ca0f42a92d16d8cd1df0fb4f4bff634a", "tree": "bf7dcf081a974e348dfbe52690f0f11cc1e5a63f", "parents": [ "e28ddd0b7af218e1a8863c524e15918895af9ac8", "e4fdbca2dc774366aca6532b57bfcdaae29aaf63" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:21:15 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:21:15 2026 -1000" }, "message": "Merge tag \u0027io_uring-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n \"A single fix for a regression introduced in 6.15, where a failure to\n wake up idle io-wq workers at ring exit will wait for the timeout to\n expire.\n\n This isn\u0027t normally noticeable, as the exit is async.\n\n But if a parent task created a thread that sets up a ring and uses\n requests that cause io-wq threads to be created, and the parent task\n then waits for the thread to exit, then it can take 5 seconds for that\n pthread_join() to succeed as the child thread is waiting for its\n children to exit.\n\n On top of that, just a basic cleanup as well\"\n\n* tag \u0027io_uring-6.19-20260109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/io-wq: remove io_wq_for_each_worker() return value\n io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic\n" }, { "commit": "e28ddd0b7af218e1a8863c524e15918895af9ac8", "tree": "0a0350c6837e5bd973533442d538dab7807a0f32", "parents": [ "e55feea3a03aa1eaf5abb22cc854208813865e04", "bdf3f4176092df5281877cacf42f843063b4784d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:17:48 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:17:48 2026 -1000" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Do not return false if !preemptible() in current_in_efi(). EFI\n runtime services can now run with preemption enabled\n\n - Fix uninitialised variable in the arm MPAM driver, reported by sparse\n\n - Fix partial kasan_reset_tag() use in change_memory_common() when\n calculating page indices or comparing ranges\n\n - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit\n is lost\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: Fix cleared E0POE bit after cpu_suspend()/resume()\n arm64: mm: Fix incomplete tag reset in change_memory_common()\n arm_mpam: Stop using uninitialized variables in __ris_msmon_read()\n arm64/efi: Don\u0027t fail check current_in_efi() if preemptible\n" }, { "commit": "e55feea3a03aa1eaf5abb22cc854208813865e04", "tree": "ec953d00c28b555e8c36e53ce3cbd7f9189c50ad", "parents": [ "4621c338d33f2e49c55d317fa5b1fbc0ae1cccb7", "bf104037ebd5c1774fa736050a484c1f28cb2e6b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:11:45 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:11:45 2026 -1000" }, "message": "Merge tag \u0027soc-fixes-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"The main code change is a revert of the Raspberry Pi RP1 overlay\n support that was decided to not be ready.\n\n The other fixes are all for devicetree sources:\n\n - ethernet configuration on ixp42x-actiontec-mi424wr is board\n revision specific\n\n - validation warning fixes for imx27/imx51/imx6, hikey960 and k3\n\n - Minor corrections across imx8 boards, addressing all types of\n issues with interrups, dma, ethernet and clock settings, all simple\n one-line changes\"\n\n* tag \u0027soc-fixes-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)\n arm64: dts: hisilicon: hikey960: Drop \"snps,gctl-reset-quirk\" and \"snps,tx_de_emphasis*\" properties\n Documentation/process: maintainer-soc: Mark \u0027make\u0027 as commands\n Documentation/process: maintainer-soc: Be more explicit about defconfig\n arm64: dts: mba8mx: Fix Ethernet PHY IRQ support\n arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart\n arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM\n arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells\n arm64: dts: freescale: moduline-display: fix compatible\n dt-bindings: arm: fsl: moduline-display: fix compatible\n ARM: dts: imx6q-ba16: fix RTC interrupt level\n arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position\n arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt\n arm64: dts: add off-on-delay-us for usdhc2 regulator\n arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level\n ARM: dts: nxp: imx: Fix mc13xxx LED node names\n arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP\n MAINTAINERS: Fix a linusw mail address\n arm64: dts: broadcom: rp1: drop RP1 overlay\n arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology\n misc: rp1: drop overlay support\n ...\n" }, { "commit": "4621c338d33f2e49c55d317fa5b1fbc0ae1cccb7", "tree": "90897bc6911827159349e8e97870ca640eee90db", "parents": [ "372800cb95a35a7c40a07e2e0f7de4ce6786d230", "c0fe2994f9a9d0a2ec9e42441ea5ba74b6a16176" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:05:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 15:05:19 2026 -1000" }, "message": "Merge tag \u0027ceph-for-6.19-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"A bunch of libceph fixes split evenly between memory safety and\n implementation correctness issues (all marked for stable) and a change\n in maintainers for CephFS: Slava and Alex have formally taken over\n Xiubo\u0027s role\"\n\n* tag \u0027ceph-for-6.19-rc5\u0027 of https://github.com/ceph/ceph-client:\n libceph: make calc_target() set t-\u003epaused, not just clear it\n libceph: reset sparse-read state in osd_fault()\n libceph: return the handler error from mon_handle_auth_done()\n libceph: make free_choose_arg_map() resilient to partial allocation\n ceph: update co-maintainers list in MAINTAINERS\n libceph: replace overzealous BUG_ON in osdmap_apply_incremental()\n libceph: prevent potential out-of-bounds reads in handle_auth_done()\n" }, { "commit": "6e39903c73df08b256322d04c4dfe4a82ec63a45", "tree": "61a0058a144352f62814575cfe25c91b9cfd137c", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Fushuai Wang", "email": "wangfushuai@baidu.com", "time": "Fri Jan 09 11:36:20 2026 +0800" }, "committer": { "name": "Shuah Khan", "email": "skhan@linuxfoundation.org", "time": "Fri Jan 09 15:49:32 2026 -0700" }, "message": "selftests/tracing: Fix test_multiple_writes stall\n\nWhen /sys/kernel/tracing/buffer_size_kb is less than 12KB,\nthe test_multiple_writes test will stall and wait for more\ninput due to insufficient buffer space.\n\nCheck current buffer_size_kb value before the test. If it is\nless than 12KB, it temporarily increase the buffer to 12KB,\nand restore the original value after the tests are completed.\n\nLink: https://lore.kernel.org/r/20260109033620.25727-1-fushuai.wang@linux.dev\nFixes: 37f46601383a (\"selftests/tracing: Add basic test for trace_marker_raw file\")\nSuggested-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Fushuai Wang \u003cwangfushuai@baidu.com\u003e\nAcked-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\n" }, { "commit": "372800cb95a35a7c40a07e2e0f7de4ce6786d230", "tree": "1162377754d67a6afcebdb9f85f995d3fc79fe05", "parents": [ "4d6fe1dd12a77c7774a3210f8450bdad2f84d879", "2bb83bc42be6280d9bc363b8fbcd6fdab690d16d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 07:02:38 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 07:02:38 2026 -1000" }, "message": "Merge tag \u0027for-6.19-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix potential NULL pointer dereference when replaying tree log after\n an error\n\n - release path before initializing extent tree to avoid potential\n deadlock when allocating new inode\n\n - on filesystems with block size \u003e page size\n - fix potential read out of bounds during encoded read of an inline\n extent\n - only enforce free space tree if v1 cache is required\n\n - print correct tree id in error message\n\n* tag \u0027for-6.19-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: show correct warning if can\u0027t read data reloc tree\n btrfs: fix NULL pointer dereference in do_abort_log_replay()\n btrfs: force free space tree for bs \u003e ps cases\n btrfs: only enforce free space tree if v1 cache is required for bs \u003c ps cases\n btrfs: release path before initializing extent tree in btrfs_read_locked_inode()\n btrfs: avoid access-beyond-folio for bs \u003e ps encoded writes\n" }, { "commit": "4d6fe1dd12a77c7774a3210f8450bdad2f84d879", "tree": "5d938686b1b3578e02c99ecce49ee194493a1030", "parents": [ "553410fcb95e3acf1a4ac7c08c5b30407f5f30b6", "bdb32359eab94013e80cf7e3d40a3fd4972da93a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:41:10 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:41:10 2026 -1000" }, "message": "Merge tag \u0027pci-v6.19-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Remove ASPM L0s support for MSM8996 SoC since we now enable L0s when\n advertised, and it caused random hangs on this device (Manivannan\n Sadhasivam)\n\n - Fix meson-pcie to report that the link is up while in ASPM L0s or L1,\n since those are active states from the software point of view, and\n treating the link as down caused config access failures (Bjorn\n Helgaas)\n\n - Fix up sparc DTS BAR descriptions that are above 4GB but not marked\n as prefetchable, which caused resource assignment and driver probe\n failures after we converted from the SPARC pcibios_enable_device() to\n the generic version (Ilpo Järvinen)\n\n* tag \u0027pci-v6.19-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n sparc/PCI: Correct 64-bit non-pref -\u003e pref BAR resources\n PCI: meson: Report that link is up while in ASPM L0s and L1 states\n PCI: qcom: Remove ASPM L0s support for MSM8996 SoC\n" }, { "commit": "553410fcb95e3acf1a4ac7c08c5b30407f5f30b6", "tree": "fc5caa329f649d7c0ed28c530fa58d850469e5f8", "parents": [ "81c5ffec9ece10079b8c6d944a754fcddfcd37da", "1ca8677d9f3491e51395b0e6b9a2b7a75089dc6f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:20:15 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:20:15 2026 -1000" }, "message": "Merge tag \u0027acpi-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"This fixes the ACPI/PCI legacy interrupts (INTx) parsing in the case\n when the ACPI Global System Interrupt (GSI) value is a 32-bit one with\n the MSB set.\n\n That was interpreted as a negative integer and caused\n acpi_pci_link_allocate_irq() to fail and acpi_irq_get_penalty() to\n trigger an out-of-bounds array dereference (Lorenzo Pieralisi)\"\n\n* tag \u0027acpi-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: PCI: IRQ: Fix INTx GSIs signedness\n" }, { "commit": "81c5ffec9ece10079b8c6d944a754fcddfcd37da", "tree": "25c26f8e15476b0b99a54f162441e1194c9e69b8", "parents": [ "a81668db9e2c46d7274fe00892f943ed68f86481", "7966cf0ebe32c981bfa3db252cb5fc3bb1bf2e77" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:18:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:18:05 2026 -1000" }, "message": "Merge tag \u0027pm-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"This fixes a crash in the hibernation image saving code that can be\n triggered when the given compression algorithm is unavailable (Malaya\n Kumar Rout)\"\n\n* tag \u0027pm-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM: hibernate: Fix crash when freeing invalid crypto compressor\n" }, { "commit": "a81668db9e2c46d7274fe00892f943ed68f86481", "tree": "565f10bdc65594c70b32f10d1e1a7b60124a3709", "parents": [ "cbd4480cfac54dd4e9f7fb9ac2e0226ea38fecbb", "d578b31856cec31315f27b3ba97b212e4c6989b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:10:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:10:22 2026 -1000" }, "message": "Merge tag \u0027gpio-fixes-for-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n \"There are several ordinary driver fixes and a fix to a race between\n the registration of two chips that causes a crash in GPIO core.\n\n The bulk of the changed lines however, concerns the management of\n shared GPIOs that landed in v6.19-rc1. Enabling it for ARCH_QCOM\n enabled it in defconfig which effectively enabled it for all arm64\n platforms and exposed the code to quite a lot of testing (which is\n good, right? :)).\n\n As a resukt, I received a number of bug reports, which I progressively\n fixed over the course of last weeks. This explains the number of lines\n higher than what I normally aim for at this stage.\n\n - balance superio enter/exit calls in error path in gpio-it87\n\n - fix a race where we try to take the SRCU read lock of the GPIO\n device before it\u0027s been initialized causing a NULL-pointer\n dereference\n\n - fix handling of short-pulse interrupts in gpio-pca053x\n\n - fix a reference leak in error path in gpio-mpsse\n\n - mark the GPIO controller as sleeping (it calls sleeping functions)\n in gpio-rockchip\n\n - fix several issues in management of shared GPIOs\"\n\n* tag \u0027gpio-fixes-for-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: shared: fix a false-positive sharing detection with reset-gpios\n gpiolib: fix lookup table matching\n gpio: shared: don\u0027t allocate the lookup table until we really need it\n gpio: shared: fix a race condition\n gpio: shared: assign the correct firmware node for reset-gpio use-case\n gpio: rockchip: mark the GPIO controller as sleeping\n gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths\n gpio: pca953x: handle short interrupt pulses on PCAL devices\n gpiolib: fix race condition for gdev-\u003esrcu\n gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib\n gpio: shared: verify con_id when adding proxy lookup\n gpiolib: allow multiple lookup tables per consumer\n gpio: it87: balance superio enter/exit calls in error path\n" }, { "commit": "cbd4480cfac54dd4e9f7fb9ac2e0226ea38fecbb", "tree": "b1e0dfbea9b5c66631bf904b26e074dbaa6d8d74", "parents": [ "2bfe3e0da6e619dbf6157dfad896307ab6b9a58a", "f6eac56d6bf2026437b606a69aff903941282f9a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:04:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 06:04:05 2026 -1000" }, "message": "Merge tag \u0027drm-fixes-2026-01-09\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"I missed the drm-rust fixes tree for last week, so this catches up on\n that, along with amdgpu, and then some misc fixes across a few\n drivers. I hadn\u0027t got an xe pull by the time I sent this, I suspect\n one will arrive 10 mins after, but I don\u0027t think there is anything\n that can\u0027t wait for next week.\n\n Things seem to have picked up a little with people coming back from\n holidays,\n\n MAINTAINERS:\n - Fix Nova GPU driver git links\n - Fix typo in TYR driver entry preventing correct behavior of\n scripts/get_maintainer.pl\n - Exclude TYR driver from DRM MISC\n\n nova-core:\n - Correctly select RUST_FW_LOADER_ABSTRACTIONS to prevent build\n errors\n - Regenerate nova-core bindgen bindings with \u0027--explicit-padding\u0027 to\n avoid uninitialized bytes\n - Fix length of received GSP messages, due to miscalculated message\n payload size\n - Regenerate bindings to derive MaybeZeroable\n - Use a bindings alias to derive the firmware version\n\n exynos:\n - hdmi: replace system_wq with system_percpu_wq\n\n pl111:\n - Fix error handling in probe\n\n mediatek/atomic/tidss:\n - Fix tidss in another way and revert reordering of pre-enable and\n post-disable operations, as it breaks other bridge drivers\n\n nouveau:\n - Fix regression from fwsec s/r fix\n\n pci/vga:\n - Fix multiple gpu\u0027s being reported a \u0027boot_display\u0027\n\n fb-helper:\n - Fix vblank timeout during suspend/reset\n\n amdgpu:\n - Clang fixes\n - Navi1x PCIe DPM fixes\n - Ring reset fixes\n - ISP suspend fix\n - Analog DC fixes\n - VPE fixes\n - Mode1 reset fix\n\n radeon:\n - Variable sized array fix\"\n\n* tag \u0027drm-fixes-2026-01-09\u0027 of https://gitlab.freedesktop.org/drm/kernel: (32 commits)\n Reapply \"Revert \"drm/amd: Skip power ungate during suspend for VPE\"\"\n drm/amd/display: Check NULL before calling dac_load_detection\n drm/amd/pm: Disable MMIO access during SMU Mode 1 reset\n drm/exynos: hdmi: replace use of system_wq with system_percpu_wq\n drm/fb-helper: Fix vblank timeout during suspend/reset\n PCI/VGA: Don\u0027t assume the only VGA device on a system is `boot_vga`\n drm/amdgpu: Fix query for VPE block_type and ip_count\n drm/amd/display: Add missing encoder setup to DACnEncoderControl\n drm/amd/display: Correct color depth for SelectCRTC_Source\n drm/amd/amdgpu: Fix SMU warning during isp suspend-resume\n drm/amdgpu: always backup and reemit fences\n drm/amdgpu: don\u0027t reemit ring contents more than once\n drm/amd/pm: force send pcie parmater on navi1x\n drm/amd/pm: fix wrong pcie parameter on navi1x\n drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[]\n drm/amd/display: Reduce number of arguments of dcn30\u0027s CalculateWatermarksAndDRAMSpeedChangeSupport()\n drm/amd/display: Reduce number of arguments of dcn30\u0027s CalculatePrefetchSchedule()\n drm/amd/display: Apply e4479aecf658 to dml\n nouveau: don\u0027t attempt fwsec on sb on newer platforms\n drm/tidss: Fix enable/disable order\n ...\n" }, { "commit": "2bfe3e0da6e619dbf6157dfad896307ab6b9a58a", "tree": "1c8cd111ef9d4e28ce69675db5aa605b2e0a75a8", "parents": [ "77d4c5da97ceb5f9bf9993a36b5fb453616412e8", "75ddaa4ddc86d31edb15e50152adf4ddee77a6ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:57:57 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:57:57 2026 -1000" }, "message": "Merge tag \u0027vfs-6.19-rc5.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Remove incorrect __user annotation from struct xattr_args::value\n\n - Documentation fix: Add missing kernel-doc description for the @isnew\n parameter in ilookup5_nowait() to silence Sphinx warnings\n\n - Documentation fix: Fix kernel-doc comment for __start_dirop() - the\n function name in the comment was wrong and the @state parameter was\n undocumented\n\n - Replace dynamic folio_batch allocation with stack allocation in\n iomap_zero_range(). The dynamic allocation was problematic for\n ext4-on-iomap work (didn\u0027t handle allocation failure properly) and\n triggered lockdep complaints. Uses a flag instead to control batch\n usage\n\n - Re-add #ifdef guards around PIDFD_GET_\u003cns-type\u003e_NAMESPACE ioctls.\n When a namespace type is disabled, ns-\u003eops is NULL, causes crashes\n during inode eviction when closing the fd. The ifdefs were removed in\n a recent simplification but are still needed\n\n - Fixe a race where a folio could be unlocked before the trailing zeros\n (for EOF within the page) were written\n\n - Split out a dedicated lease_dispose_list() helper since lease code\n paths always know they\u0027re disposing of leases. Removes unnecessary\n runtime flag checks and prepares for upcoming lease_manager\n enhancements\n\n - Fix userland delegation requests succeeding despite conflicting\n opens. Previously, FL_LAYOUT and FL_DELEG leases bypassed conflict\n checks (a hack for nfsd). Adds new -\u003elm_open_conflict() lease_manager\n operation so userland delegations get proper conflict checking while\n nfsd can continue its own conflict handling\n\n - Fix LOOKUP_CACHED path lookups incorrectly falling through to the\n slow path. After legitimize_links() calls were conditionally elided,\n the routine would always fail with LOOKUP_CACHED regardless of\n whether there were any links. Now the flag is checked at the two\n callsites before calling legitimize_links()\n\n - Fix bug in media fd allocation in media_request_alloc()\n\n - Fix mismatched API calls in ecryptfs_mknod(): was calling\n end_removing() instead of end_creating() after\n ecryptfs_start_creating_dentry()\n\n - Fix dentry reference count leak in ecryptfs_mkdir(): a dget() of the\n lower parent dir was added but never dput()\u0027d, causing BUG during\n lower filesystem unmount due to the still-in-use dentry\n\n* tag \u0027vfs-6.19-rc5.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:\n pidfs: protect PIDFD_GET_* ioctls() via ifdef\n ecryptfs: Release lower parent dentry after creating dir\n ecryptfs: Fix improper mknod pairing of start_creating()/end_removing()\n get rid of bogus __user in struct xattr_args::value\n VFS: fix __start_dirop() kernel-doc warnings\n fs: Describe @isnew parameter in ilookup5_nowait()\n fs: make sure to fail try_to_unlazy() and try_to_unlazy() for LOOKUP_CACHED\n netfs: Fix early read unlock of page with EOF in middle\n filelock: allow lease_managers to dictate what qualifies as a conflict\n filelock: add lease_dispose_list() helper\n iomap: replace folio_batch allocation with stack allocation\n media: mc: fix potential use-after-free in media_request_alloc()\n" }, { "commit": "77d4c5da97ceb5f9bf9993a36b5fb453616412e8", "tree": "5beb0d19fa854091bf77f227b2408cd0f49e5120", "parents": [ "623fb9912f6af600cda3b6bd166ac738c1115ef4", "961ac9d97be72267255f1ed841aabf6694b17454" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:55:34 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jan 09 05:55:34 2026 -1000" }, "message": "Merge tag \u0027v6.19-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fix from Herbert Xu:\n\n - Fix duplicate restart messages in qat\n\n* tag \u0027v6.19-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: qat - fix duplicate restarting msg during AER error\n" }, { "commit": "a33d16dc874a9512c02b1f1a3e08c26a82b4be5e", "tree": "8f727026735092d2905633eee3b412b1e517171f", "parents": [ "1690eeb0cb2bb77096cb6c826b6849ef05013e34" ], "author": { "name": "Anup Patel", "email": "anup.patel@oss.qualcomm.com", "time": "Tue Dec 23 20:05:44 2025 +0530" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 16:10:05 2026 +0100" }, "message": "Revert \"irqchip/riscv-imsic: Embed the vector array in lpriv\"\n\nThe __alloc_percpu() fails when the number of IDs are greater than 959\nbecause size parameter of __alloc_percpu() must be less than 32768 (aka\nPCPU_MIN_UNIT_SIZE). This failure is observed with KVMTOOL when AIA is\ntrap-n-emulated by in-kernel KVM because in this case KVM guest has 2047\ninterrupt IDs.\n\nTo address this issue, don\u0027t embed vector array in struct imsic_local_priv\nuntil __alloc_percpu() support size parameter greater than 32768.\n\nThis reverts commit 79eaabc61dfb (\"irqchip/riscv-imsic: Embed the vector\narray in lpriv\").\n\nSigned-off-by: Anup Patel \u003canup.patel@oss.qualcomm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nLink: https://patch.msgid.link/20251223143544.1504217-1-anup.patel@oss.qualcomm.com\n" }, { "commit": "1690eeb0cb2bb77096cb6c826b6849ef05013e34", "tree": "f07671aecafa710e03c24b224c86ab2740100155", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Lorenzo Pieralisi", "email": "lpieralisi@kernel.org", "time": "Mon Dec 22 11:22:50 2025 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 16:10:04 2026 +0100" }, "message": "irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness\n\nKbuild bot (through sparse) reported that the ITTE read to carry out\na valid check in gicv5_its_map_event() lacks proper endianness handling.\n\nAdd the missing endianess conversion.\n\nFixes: 57d72196dfc8 (\"irqchip/gic-v5: Add GICv5 ITS support\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Lorenzo Pieralisi \u003clpieralisi@kernel.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nAcked-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nLink: https://patch.msgid.link/20251222102250.435460-1-lpieralisi@kernel.org\nCloses: https://lore.kernel.org/oe-kbuild-all/202512131849.30ZRTBeR-lkp@intel.com/\n" }, { "commit": "f0d385f6689f37a2828c686fb279121df006b4cb", "tree": "06a18f95b540441acaf99f8876ce06734ae2df06", "parents": [ "9670db22e7ab4aefe2b2619589a47fef9d3e0c7e" ], "author": { "name": "Ming Lei", "email": "ming.lei@redhat.com", "time": "Fri Jan 09 20:14:54 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jan 09 06:55:30 2026 -0700" }, "message": "ublk: fix use-after-free in ublk_partition_scan_work\n\nA race condition exists between the async partition scan work and device\nteardown that can lead to a use-after-free of ub-\u003eub_disk:\n\n1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()\n2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:\n - del_gendisk(ub-\u003eub_disk)\n - ublk_detach_disk() sets ub-\u003eub_disk \u003d NULL\n - put_disk() which may free the disk\n3. The worker ublk_partition_scan_work() then dereferences ub-\u003eub_disk\n leading to UAF\n\nFix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold\na reference to the disk during the partition scan. The spinlock in\nublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker\neither gets a valid reference or sees NULL and exits early.\n\nAlso change flush_work() to cancel_work_sync() to avoid running the\npartition scan work unnecessarily when the disk is already detached.\n\nFixes: 7fc4da6a304b (\"ublk: scan partition in async way\")\nReported-by: Ruikai Peng \u003cruikai@pwno.io\u003e\nSigned-off-by: Ming Lei \u003cming.lei@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "2bdf777410dc6e022d1081885ff34673b5dfee99", "tree": "5a369dca9ec971aeba85768e9fbbe6771b140a3d", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Cong Wang", "email": "cwang@multikernel.io", "time": "Tue Dec 23 13:51:13 2025 -0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Jan 09 13:02:57 2026 +0100" }, "message": "sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()\n\nsched_mm_cid_after_execve() is called in bprm_execve()\u0027s cleanup path even\nwhen exec_binprm() fails. For the init task\u0027s first execve(), this causes a\nproblem:\n\n 1. current-\u003emm is NULL (kernel threads don\u0027t have an mm)\n 2. sched_mm_cid_before_execve() exits early because mm is NULL\n 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)\n 4. sched_mm_cid_after_execve() is called with mm still NULL\n 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON\n\nThis is easily reproduced by booting with an init that is a shell script\n(#!/bin/sh) where the interpreter doesn\u0027t exist in the initramfs.\n\nFix this by checking if t-\u003emm is NULL before calling sched_mm_cid_fork(),\nmatching the behavior of sched_mm_cid_before_execve() which already\nhandles this case via sched_mm_cid_exit()\u0027s early return.\n\nFixes: b0c3d51b54f8 (\"sched/mmcid: Provide precomputed maximal value\")\nSigned-off-by: Cong Wang \u003ccwang@multikernel.io\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nAcked-by: Will Deacon \u003cwill@kernel.org\u003e\nLink: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com\n" }, { "commit": "bdf3f4176092df5281877cacf42f843063b4784d", "tree": "3296b5fa5765bdc867c4f0aa7ecd735002fc7e80", "parents": [ "5fcd5513072b09f6533e22a779183fa2818bce81" ], "author": { "name": "Yeoreum Yun", "email": "yeoreum.yun@arm.com", "time": "Wed Jan 07 16:21:15 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Jan 09 10:41:45 2026 +0000" }, "message": "arm64: Fix cleared E0POE bit after cpu_suspend()/resume()\n\nTCR2_ELx.E0POE is set during smp_init().\nHowever, this bit is not reprogrammed when the CPU enters suspension and\nlater resumes via cpu_resume(), as __cpu_setup() does not re-enable E0POE\nand there is no save/restore logic for the TCR2_ELx system register.\n\nAs a result, the E0POE feature no longer works after cpu_resume().\n\nTo address this, save and restore TCR2_EL1 in the cpu_suspend()/cpu_resume()\npath, rather than adding related logic to __cpu_setup(), taking into account\npossible future extensions of the TCR2_ELx feature.\n\nFixes: bf83dae90fbc (\"arm64: enable the Permission Overlay Extension for EL0\")\nCc: \u003cstable@vger.kernel.org\u003e # 6.12.x\nSigned-off-by: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nReviewed-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nReviewed-by: Kevin Brodsky \u003ckevin.brodsky@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "d578b31856cec31315f27b3ba97b212e4c6989b3", "tree": "d29cc084d841368a081d621843c41de5cf394e5e", "parents": [ "36f597bba049928004a050c132ab787ba0eba524" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 14:39:19 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri Jan 09 09:56:46 2026 +0100" }, "message": "gpio: shared: fix a false-positive sharing detection with reset-gpios\n\nAfter scanning the devicetree, we remove all entries that have only one\nreference, while creating GPIO shared proxies for the remaining, shared\nentries. However: for the reset-gpio corner-case, we will have two\nreferences for a \"reset-gpios\" pin that\u0027s not really shared. In this\ncase one will come from the actual consumer fwnode and the other from\nthe potential auxiliary reset-gpio device. This causes the GPIO core to\ncreate unnecessary GPIO shared proxy devices for pins that are not\nreally shared.\n\nAdd a function that can detect this situation and remove entries that\nhave exactly two references but one of them is a reset-gpio.\n\nFixes: 7b78b26757e0 (\"gpio: shared: handle the reset-gpios corner case\")\nLink: https://lore.kernel.org/r/20260108-gpio-shared-false-positive-v1-1-5dbf8d1b2f7d@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "623fb9912f6af600cda3b6bd166ac738c1115ef4", "tree": "f9e07b4af8c6c731caddf67a7ac4bd2f1a5a1098", "parents": [ "5572ad8fddecd4a0db19801262072ff5916b7589", "ebc18e9854e5a2b62a041fb57b216a903af45b85" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 16:38:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 16:38:19 2026 -1000" }, "message": "Merge tag \u0027pinctrl-v6.19-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Fix the mt8189 register base name order back from being fixed broken\n\n - Add REGMAP_MMIO to the pic64gx-gpio2 to avoid build breakages\n\n - Mark the Qualcomm lpass-lpi pin controller GPIO chip instance as\n sleeping to fix lock splats\n\n - Update .mailmap with my new kernel.org address for all old mails\n after maintainers ran into issues with this\n\n* tag \u0027pinctrl-v6.19-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping\n pinctrl: pic64gx-gpio2: Add REGMAP_MMIO dependency\n Update .mailmap for Linus Walleij\n pinctrl: mediatek: mt8189: restore previous register base name array order\n" }, { "commit": "5fcd5513072b09f6533e22a779183fa2818bce81", "tree": "9450913e4a6e0384e96092d58223300f286e1e61", "parents": [ "c2803bd580db226008aabf2fb2f0c9a7d3b5d0de" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Sun Jan 04 20:35:27 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Jan 08 19:47:59 2026 +0000" }, "message": "arm64: mm: Fix incomplete tag reset in change_memory_common()\n\nRunning KASAN KUnit tests with {HW,SW}_TAGS mode triggers a fault in\nchange_memory_common():\n\n Call trace:\n change_memory_common+0x168/0x210 (P)\n set_memory_ro+0x20/0x48\n vmalloc_helpers_tags+0xe8/0x338\n kunit_try_run_case+0x74/0x188\n kunit_generic_run_threadfn_adapter+0x30/0x70\n kthread+0x11c/0x200\n ret_from_fork+0x10/0x20\n ---[ end trace 0000000000000000 ]---\n # vmalloc_helpers_tags: try faulted\n not ok 67 vmalloc_helpers_tags\n\nCommit a06494adb7ef (\"arm64: mm: use untagged address to calculate page index\")\nfixed a KASAN warning in the BPF subsystem by adding kasan_reset_tag() to\nthe index calculation. In the execmem flow:\n\n bpf_prog_pack_alloc()\n -\u003e bpf_jit_alloc_exec()\n -\u003e execmem_alloc()\n\nThe returned address from execmem_vmalloc/execmem_cache_alloc is passed\nthrough kasan_reset_tag(), so start has no tag while area-\u003eaddr still\nretains the original tag. The fix correctly handled this case by resetting\nthe tag on area-\u003eaddr:\n\n (start - (unsigned long)kasan_reset_tag(area-\u003eaddr)) \u003e\u003e PAGE_SHIFT\n\nHowever, in normal vmalloc paths, both start and area-\u003eaddr have matching\ntags(or no tags). Resetting only area-\u003eaddr causes a mismatch when\nsubtracting a tagged address from an untagged one, resulting in an\nincorrect index.\n\nFix this by resetting tags on both addresses in the index calculation.\nThis ensures correct results regardless of the tag state of either address.\n\nTested with KASAN KUnit tests under CONFIG_KASAN_GENERIC,\nCONFIG_KASAN_SW_TAGS, and CONFIG_KASAN_HW_TAGS - all pass. Also verified\nthe original BPF KASAN warning from [1] is still fixed.\n\n[1] https://lore.kernel.org/all/20251118164115.GA3977565@ax162/\n\nFixes: a06494adb7ef (\"arm64: mm: use untagged address to calculate page index\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "74d74bb78aeccc9edc10db216d6be121cf7ec176", "tree": "bd7e5fea28ac6c0b710af29946f08845e9c43eb2", "parents": [ "2eb57ca7cc373404aa1399a9d926dea8479eb728" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Tue Jan 06 21:20:23 2026 -0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: aes: Fix missing MMU protection for AES S-box\n\n__cacheline_aligned puts the data in the \".data..cacheline_aligned\"\nsection, which isn\u0027t marked read-only i.e. it doesn\u0027t receive MMU\nprotection. Replace it with ____cacheline_aligned which does the right\nthing and just aligns the data while keeping it in \".rodata\".\n\nFixes: b5e0b032b6c3 (\"crypto: aes - add generic time invariant AES cipher\")\nCc: stable@vger.kernel.org\nReported-by: Qingfang Deng \u003cdqfext@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20260105074712.498-1-dqfext@gmail.com/\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260107052023.174620-1-ebiggers@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "2eb57ca7cc373404aa1399a9d926dea8479eb728", "tree": "2471c8f0ae6d94c677ff3cec1a70cd03ceb4dbe0", "parents": [ "0f42c2a52d8a7535088895c3104150ac9019afd8" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Tue Jan 06 19:39:48 2026 -0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "MAINTAINERS: add test vector generation scripts to \"CRYPTO LIBRARY\"\n\nThe scripts in scripts/crypto/ are used to generate files in\nlib/crypto/, so they should be included in \"CRYPTO LIBRARY\".\n\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260107033948.29368-1-ebiggers@kernel.org\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "0f42c2a52d8a7535088895c3104150ac9019afd8", "tree": "6673a78a42d15b3dd2a0ab241b4903fbc23966a6", "parents": [ "fcff71fd888dce1533a3975e68fc80824ff69ef9" ], "author": { "name": "Jie Zhan", "email": "zhanjie9@hisilicon.com", "time": "Wed Jan 07 09:58:29 2026 +0800" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: tests: Fix syntax error for old python versions\n\n\u0027make binrpm-pkg\u0027 throws me this error, with Python 3.9:\n\n*** Error compiling \u0027.../gen-hash-testvecs.py\u0027...\n File \".../scripts/crypto/gen-hash-testvecs.py\", line 121\n return f\u0027{alg.upper().replace(\u0027-\u0027, \u0027_\u0027)}_DIGEST_SIZE\u0027\n ^\nSyntaxError: f-string: unmatched \u0027(\u0027\n\nOld python versions, presumably \u003c\u003d 3.11, can\u0027t resolve these quotes.\n\nFix it with double quotes for compatibility.\n\nFixes: 15c64c47e484 (\"lib/crypto: tests: Add SHA3 kunit tests\")\nSigned-off-by: Jie Zhan \u003czhanjie9@hisilicon.com\u003e\nLink: https://lore.kernel.org/r/20260107015829.2000699-1-zhanjie9@hisilicon.com\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "fcff71fd888dce1533a3975e68fc80824ff69ef9", "tree": "4555d1365e243f18abf608dbc812630f91ab63a1", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Fri Jan 02 08:32:03 2026 +0100" }, "committer": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Thu Jan 08 11:14:59 2026 -0800" }, "message": "lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs\n\nOn my development machine the generic, memcpy()-only implementation of\npolyval_preparekey() is too fast for the IRQ workers to actually fire.\nThe test fails.\n\nIncrease the iterations to make the test more robust.\nThe test will run for a maximum of one second in any case.\n\n[EB: This failure was already fixed by commit c31f4aa8fed0 (\"kunit:\nEnforce task execution in {soft,hard}irq contexts\"). I\u0027m still applying\nthis patch too, since the iteration count in this test made its running\ntime much shorter than the other similar ones.]\n\nFixes: b3aed551b3fc (\"lib/crypto: tests: Add KUnit tests for POLYVAL\")\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nLink: https://lore.kernel.org/r/20260102-kunit-polyval-fix-v1-1-5313b5a65f35@linutronix.de\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\n" }, { "commit": "c2803bd580db226008aabf2fb2f0c9a7d3b5d0de", "tree": "5a193d3486a6ba4051658c0c5009cd8430418cdf", "parents": [ "dd4d71f587f3908f058b516d3793aaed66cfb692" ], "author": { "name": "Ben Horgan", "email": "ben.horgan@arm.com", "time": "Fri Dec 19 18:11:03 2025 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu Jan 08 19:03:15 2026 +0000" }, "message": "arm_mpam: Stop using uninitialized variables in __ris_msmon_read()\n\nDan has reported two uses of uninitialized variables in __ris_msmon_read().\nIf an unknown monitor type is encountered then the local variable, now, is\nused uninitialized. Fix this by returning early on error. If a non-mbwu\nmonitor is being read then the local variable, overflow, is not initialized\nbut still read. Initialize it to false as overflow is not relevant for csu\nmonitors.\n\nFixes: 823e7c3712c5 (\"arm_mpam: Add mpam_msmon_read() to read monitor value\")\nFixes: 9e5afb7c3283 (\"arm_mpam: Use long MBWU counters if supported\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCloses: https://lore.kernel.org/r/202512091519.RBwiJcSq-lkp@intel.com/\nCloses: https://lore.kernel.org/r/202512100547.N7QPYgfb-lkp@intel.com/\nSigned-off-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nReviewed-by: Jonathan Cameron \u003cjonathan.cameron@huawei.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "5572ad8fddecd4a0db19801262072ff5916b7589", "tree": "2f4572a9a6b14d511581f0c2467f2e323c687ea4", "parents": [ "f2a3b12b305c7bb72467b2a56d19a4587b6007f9", "1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:47:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:47:05 2026 -1000" }, "message": "Merge tag \u0027trace-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Remove useless assignment of soft_mode variable\n\n The function __ftrace_event_enable_disable() sets \"soft_mode\" in one\n of the branch paths but doesn\u0027t use it after that. Remove the setting\n of that variable.\n\n - Add a cond_resched() in ring_buffer_resize()\n\n The resize function that allocates all the pages for the ring buffer\n was causing a soft lockup on PREEMPT_NONE configs when allocating\n large buffers on machines with many CPUs. Hopefully this is the last\n cond_resched() needed to be added as PREEMPT_LAZY becomes the norm in\n the future.\n\n - Make ftrace_graph_ent depth field signed\n\n The \"depth\" field of struct ftrace_graph_ent was converted from \"int\"\n to \"unsigned long\" for alignment reasons to work with being embedded\n in other structures. The conversion from a signed to unsigned caused\n integrity checks to always pass as they were comparing \"depth\" to\n less than zero. Make the field signed long.\n\n - Add recursion protection to stack trace events\n\n A infinite recursion was triggered by a stack trace event calling RCU\n which internally called rcu_read_unlock_special(), which triggered an\n event that was also doing stacktraces which cause it to trigger the\n same RCU lock that called rcu_read_unlock_special() again.\n\n Update the trace_test_and_set_recursion() to add a set of context\n checks for events to use, and have the stack trace event use that for\n recursion protection.\n\n - Make the variable ftrace_dump_on_oops static\n\n The cleanup of sysctl that moved all the updates to the files that\n use them moved the reference of ftrace_dump_on_oops to where it is\n used. It is no longer used outside of the trace.c file. Make it\n static.\n\n* tag \u0027trace-v6.19-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n trace: ftrace_dump_on_oops[] is not exported, make it static\n tracing: Add recursion protection in kernel stack trace recording\n ftrace: Make ftrace_graph_ent depth field signed\n ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free\n tracing: Drop unneeded assignment to soft_mode\n" }, { "commit": "f2a3b12b305c7bb72467b2a56d19a4587b6007f9", "tree": "2ec90d83ea6f42067376ba27127cc725fc2fb837", "parents": [ "79b95d74470dd97d7d0908d5a3c0734a23e51aa4", "c92510f5e3f82ba11c95991824a41e59a9c5ed81" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:40:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 08:40:35 2026 -1000" }, "message": "Merge tag \u0027net-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from netfilter and wireless.\n\n Current release - fix to a fix:\n\n - net: do not write to msg_get_inq in callee\n\n - arp: do not assume dev_hard_header() does not change skb-\u003ehead\n\n Current release - regressions:\n\n - wifi: mac80211: don\u0027t iterate not running interfaces\n\n - eth: mlx5: fix NULL pointer dereference in ioctl module EEPROM\n\n Current release - new code bugs:\n\n - eth: bnge: add AUXILIARY_BUS to Kconfig dependencies\n\n Previous releases - regressions:\n\n - eth: mlx5: dealloc forgotten PSP RX modify header\n\n Previous releases - always broken:\n\n - ping: fix ICMP out SNMP stats double-counting with ICMP sockets\n\n - bonding: preserve NETIF_F_ALL_FOR_ALL across TSO updates\n\n - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress\n\n - eth: bnxt: fix potential data corruption with HW GRO/LRO\"\n\n* tag \u0027net-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits)\n arp: do not assume dev_hard_header() does not change skb-\u003ehead\n net: enetc: fix build warning when PAGE_SIZE is greater than 128K\n atm: Fix dma_free_coherent() size\n tools: ynl: don\u0027t install tests\n net: do not write to msg_get_inq in callee\n bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\n net: usb: pegasus: fix memory leak in update_eth_regs_async()\n net: 3com: 3c59x: fix possible null dereference in vortex_probe1()\n net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n wifi: mac80211: collect station statistics earlier when disconnect\n wifi: mac80211: restore non-chanctx injection behaviour\n wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n wifi: mac80211: don\u0027t iterate not running interfaces\n wifi: mac80211_hwsim: fix typo in frequency notification\n wifi: avoid kernel-infoleak from struct iw_point\n net: airoha: Fix schedule while atomic in airoha_ppe_deinit()\n selftests: netdevsim: add carrier state consistency test\n net: netdevsim: fix inconsistent carrier state after link/unlink\n selftests: drv-net: Bring back tool() to driver __init__s\n net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy\n ...\n" }, { "commit": "c92510f5e3f82ba11c95991824a41e59a9c5ed81", "tree": "6329c392e3e007ded629b97ee38299def0fdf002", "parents": [ "1f20c77496b3e253f18ea636f4f14069e383749d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jan 07 21:22:50 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 09:04:24 2026 -0800" }, "message": "arp: do not assume dev_hard_header() does not change skb-\u003ehead\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb-\u003ehead being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call.\n\nFixes: db5b4e39c4e6 (\"ip6_gre: make ip6gre_header() robust\")\nReported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1f20c77496b3e253f18ea636f4f14069e383749d", "tree": "dc9714c5a1eca66aa452ae68fcc486fd0dd2352f", "parents": [ "4b5bdabb5449b652122e43f507f73789041d4abe", "4648fb2f2e7210c53b85220ee07d42d1e4bae3f9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:54:54 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:54:55 2026 -0800" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-01-06 (idpf)\n\nThis series contains updates to idpf driver only.\n\nEmil fixes issues related to resets; among them timeouts, NULL pointer\ndereferences, and memory leaks.\n\nSreedevi resolves issues around RSS; mainly involving operations when\nthe interface is down and resets. She also addresses some incomplete\ncleanups for ntuple filters and interrupts.\n\nErik fixes incomplete output of ntuple filters.\n\nJosh sets restriction of Rx buffer size to follow hardware restrictions.\n\nLarysa adds check to prevent NULL pointer dereference when RDMA is not\nenabled.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n idpf: fix aux device unplugging when rdma is not supported by vport\n idpf: cap maximum Rx buffer size\n idpf: Fix error handling in idpf_vport_open()\n idpf: Fix RSS LUT NULL ptr issue after soft reset\n idpf: Fix RSS LUT configuration on down interfaces\n idpf: Fix RSS LUT NULL pointer crash on early ethtool operations\n idpf: fix issue with ethtool -n command display\n idpf: fix memory leak of flow steer list on rmmod\n idpf: fix error handling in the init_task on load\n idpf: fix memory leak in idpf_vc_core_deinit()\n idpf: fix memory leak in idpf_vport_rel()\n idpf: detach and close netdevs while handling a reset\n idpf: keep the netdev when a reset fails\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260107000648.1861994-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b5bdabb5449b652122e43f507f73789041d4abe", "tree": "0b59e68534b8feea7d2706093af85553c1d86693", "parents": [ "804809ae408571d67e171e87bdd03b6b88fbfd3d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed Jan 07 17:12:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:51:09 2026 -0800" }, "message": "net: enetc: fix build warning when PAGE_SIZE is greater than 128K\n\nThe max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE\nis greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will\nbe greater than 0xFFFF, thus causing a build warning.\n\nThis will not cause any practical issues because ENETC is currently only\nused on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch\nis only for fixing the build warning that occurs when compiling ENETC\ndrivers for other platforms.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/\nFixes: e59bc32df2e9 (\"net: enetc: correct the value of ENETC_RXB_TRUESIZE\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nLink: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "804809ae408571d67e171e87bdd03b6b88fbfd3d", "tree": "b35dcdd47bee772f7cc740f78eb0c82294cd2d36", "parents": [ "4d984b0574ff708e66152763fbfdef24ea40933f", "a203dbeeca15a9b924f0d51f510921f4bae96801" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:49:24 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:49:24 2026 -0800" }, "message": "Merge tag \u0027wireless-2026-01-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nCouple of fixes:\n - mac80211:\n - long-standing injection bug due to chanctx rework\n - more recent interface iteration issue\n - collect statistics before removing stations\n - hwsim:\n - fix NAN frequency typo (potential NULL ptr deref)\n - fix locking of radio lock (needs softirqs disabled)\n - wext:\n - ancient issue with compat and events copying some\n uninitialized stack data to userspace\n\n* tag \u0027wireless-2026-01-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: mac80211: collect station statistics earlier when disconnect\n wifi: mac80211: restore non-chanctx injection behaviour\n wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n wifi: mac80211: don\u0027t iterate not running interfaces\n wifi: mac80211_hwsim: fix typo in frequency notification\n wifi: avoid kernel-infoleak from struct iw_point\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260108140141.139687-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d984b0574ff708e66152763fbfdef24ea40933f", "tree": "6ecc7b27cf5c14515c4ec8a4dee7feb61ed6e182", "parents": [ "790792ebc9603a7ccbf6996cb537d89607e3a75b" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Wed Jan 07 10:01:36 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:47:32 2026 -0800" }, "message": "atm: Fix dma_free_coherent() size\n\nThe size of the buffer is not the same when alloc\u0027d with\ndma_alloc_coherent() in he_init_tpdrq() and freed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nLink: https://patch.msgid.link/20260107090141.80900-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "790792ebc9603a7ccbf6996cb537d89607e3a75b", "tree": "2a5a9718462d68f6ea8dcd23891e3f9b61d3fc48", "parents": [ "7d11e047eda5f98514ae62507065ac961981c025" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 06 08:34:26 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:46:36 2026 -0800" }, "message": "tools: ynl: don\u0027t install tests\n\nmake\u0027s install target is meant for installing the production\nartifacts, AFAIU. Don\u0027t install test_ynl_cli and test_ynl_ethtool\nfrom under the main YNL install target. The install target\nunder tests/ is retained in case someone wants the tests\nto be installed.\n\nFixes: 308b7dee3e5c (\"tools: ynl: add YNL test framework\")\nReviewed-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nReviewed-by: Donald Hunter \u003cdonald.hunter@gmail.com\u003e\nLink: https://patch.msgid.link/20260106163426.1468943-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7d11e047eda5f98514ae62507065ac961981c025", "tree": "9f5786b4d6fb6d0aade3e1cec6fda738c231ac2b", "parents": [ "3358995b1a7f9dcb52a56ec8251570d71024dad0" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Tue Jan 06 10:05:46 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:45:13 2026 -0800" }, "message": "net: do not write to msg_get_inq in callee\n\nNULL pointer dereference fix.\n\nmsg_get_inq is an input field from caller to callee. Don\u0027t set it in\nthe callee, as the caller may not clear it on struct reuse.\n\nThis is a kernel-internal variant of msghdr only, and the only user\ndoes reinitialize the field. So this is not critical for that reason.\nBut it is more robust to avoid the write, and slightly simpler code.\nAnd it fixes a bug, see below.\n\nCallers set msg_get_inq to request the input queue length to be\nreturned in msg_inq. This is equivalent to but independent from the\nSO_INQ request to return that same info as a cmsg (tp-\u003erecvmsg_inq).\nTo reduce branching in the hot path the second also sets the msg_inq.\nThat is WAI.\n\nThis is a fix to commit 4d1442979e4a (\"af_unix: don\u0027t post cmsg for\nSO_INQ unless explicitly asked for\"), which fixed the inverse.\n\nAlso avoid NULL pointer dereference in unix_stream_read_generic if\nstate-\u003emsg is NULL and msg-\u003emsg_get_inq is written. A NULL state-\u003emsg\ncan happen when splicing as of commit 2b514574f7e8 (\"net: af_unix:\nimplement splice for stream af_unix sockets\").\n\nAlso collapse two branches using a bitwise or.\n\nCc: stable@vger.kernel.org\nFixes: 4d1442979e4a (\"af_unix: don\u0027t post cmsg for SO_INQ unless explicitly asked for\")\nLink: https://lore.kernel.org/netdev/willemdebruijn.kernel.24d8030f7a3de@gmail.com/\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260106150626.3944363-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3358995b1a7f9dcb52a56ec8251570d71024dad0", "tree": "8a355f7a4931494b4340ff224bf11ea0024afbdc", "parents": [ "afa27621a28af317523e0836dad430bec551eb54" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Jan 06 06:31:14 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:44:41 2026 -0800" }, "message": "bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\n\nWhen bnxt_init_one() fails during initialization (e.g.,\nbnxt_init_int_mode returns -ENODEV), the error path calls\nbnxt_free_hwrm_resources() which destroys the DMA pool and sets\nbp-\u003ehwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,\nwhich invokes ptp_clock_unregister().\n\nSince commit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to\ndisable events\"), ptp_clock_unregister() now calls\nptp_disable_all_events(), which in turn invokes the driver\u0027s .enable()\ncallback (bnxt_ptp_enable()) to disable PTP events before completing the\nunregistration.\n\nbnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()\nand bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This\nfunction tries to allocate from bp-\u003ehwrm_dma_pool, causing a NULL\npointer dereference:\n\n bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed\n KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n Call Trace:\n __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)\n bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)\n ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)\n ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)\n bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)\n bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)\n\nLines are against commit f8f9c1f4d0c7 (\"Linux 6.19-rc3\")\n\nFix this by clearing and unregistering ptp (bnxt_ptp_clear()) before\nfreeing HWRM resources.\n\nSuggested-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nFixes: a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable events\")\nCc: stable@vger.kernel.org\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260106-bnxt-v3-1-71f37e11446a@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "afa27621a28af317523e0836dad430bec551eb54", "tree": "f0121427cc8bdf8b92688117b635fda06ae54169", "parents": [ "a4e305ed60f7c41bbf9aabc16dd75267194e0de3" ], "author": { "name": "Petko Manolov", "email": "petkan@nucleusys.com", "time": "Tue Jan 06 10:48:21 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:40:20 2026 -0800" }, "message": "net: usb: pegasus: fix memory leak in update_eth_regs_async()\n\nWhen asynchronously writing to the device registers and if usb_submit_urb()\nfail, the code fail to release allocated to this point resources.\n\nFixes: 323b34963d11 (\"drivers: net: usb: pegasus: fix control urb submission\")\nSigned-off-by: Petko Manolov \u003cpetkan@nucleusys.com\u003e\nLink: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a4e305ed60f7c41bbf9aabc16dd75267194e0de3", "tree": "c2d21e1de7d79ceacf57c055f856f2dc25a0ddcd", "parents": [ "c1d73b1480235731e35c81df70b08f4714a7d095" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Tue Jan 06 10:47:21 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:36:56 2026 -0800" }, "message": "net: 3com: 3c59x: fix possible null dereference in vortex_probe1()\n\npdev can be null and free_ring: can be called in 1297 with a null\npdev.\n\nFixes: 55c82617c3e8 (\"3c59x: convert to generic DMA API\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nLink: https://patch.msgid.link/20260106094731.25819-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1d73b1480235731e35c81df70b08f4714a7d095", "tree": "6e01873ec969f37a072572b8865ce9ab097c47f9", "parents": [ "6abcf751bc084804a9e5b3051442e8a2ce67f48a" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Jan 05 20:41:00 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 08 08:22:28 2026 -0800" }, "message": "net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u003eleaf_qdisc-\u003eq.qlen \u003e 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u003eq.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u003eq.qlen \u003d\u003d 0, but its class\u0027s leaf\nqdisc-\u003eq.qlen \u003e 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 0.903571] #PF: supervisor write access in kernel mode\n[ 0.903860] #PF: error_code(0x0002) - not-present page\n[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t0f 84 4d 01 00 00 \tje 0x153\n 6:\t48 89 70 18 \tmov %rsi,0x18(%rax)\n a:\t8b 4b 10 \tmov 0x10(%rbx),%ecx\n d:\t48 c7 c2 ff ff ff ff \tmov $0xffffffffffffffff,%rdx\n 14:\t48 8b 78 08 \tmov 0x8(%rax),%rdi\n 18:\t48 d3 e2 \tshl %cl,%rdx\n 1b:\t48 21 f2 \tand %rsi,%rdx\n 1e:\t48 2b 13 \tsub (%rbx),%rdx\n 21:\t48 8b 30 \tmov (%rax),%rsi\n 24:\t48 d3 ea \tshr %cl,%rdx\n 27:\t8b 4b 18 \tmov 0x18(%rbx),%ecx\n\t...\n[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[ 0.910247] PKRU: 55555554\n[ 0.910391] Call Trace:\n[ 0.910527] \u003cTASK\u003e\n[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)\n[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)\n[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)\n[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)\n[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))\n[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)\n[ 0.913077] ksys_write (fs/read_write.c:738)\n[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n[ 0.913687] RIP: 0033:0x424c34\n[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t89 02 \tmov %eax,(%rdx)\n 2:\t48 c7 c0 ff ff ff ff \tmov $0xffffffffffffffff,%rax\n 9:\teb bd \tjmp 0xffffffffffffffc8\n b:\t66 2e 0f 1f 84 00 00 \tcs nopw 0x0(%rax,%rax,1)\n 12:\t00 00 00\n 15:\t90 \tnop\n 16:\tf3 0f 1e fa \tendbr64\n 1a:\t80 3d 2d 44 09 00 00 \tcmpb $0x0,0x9442d(%rip) # 0x9444e\n 21:\t74 13 \tje 0x36\n 23:\tb8 01 00 00 00 \tmov $0x1,%eax\n 28:\t0f 05 \tsyscall\n 2a:\t09 \t.byte 0x9\n[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34\n[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003\n[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000\n[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28\n[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001\n[ 0.917039] \u003c/TASK\u003e\n[ 0.917158] Modules linked in:\n[ 0.917316] CR2: 0000000000000000\n[ 0.917484] ---[ end trace 0000000000000000 ]---\n[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n 0:\t0f 84 4d 01 00 00 \tje 0x153\n 6:\t48 89 70 18 \tmov %rsi,0x18(%rax)\n a:\t8b 4b 10 \tmov 0x10(%rbx),%ecx\n d:\t48 c7 c2 ff ff ff ff \tmov $0xffffffffffffffff,%rdx\n 14:\t48 8b 78 08 \tmov 0x8(%rax),%rdi\n 18:\t48 d3 e2 \tshl %cl,%rdx\n 1b:\t48 21 f2 \tand %rsi,%rdx\n 1e:\t48 2b 13 \tsub (%rbx),%rdx\n 21:\t48 8b 30 \tmov (%rax),%rsi\n 24:\t48 d3 ea \tshr %cl,%rdx\n 27:\t8b 4b 18 \tmov 0x18(%rbx),%ecx\n\t...\n[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[ 0.922097] PKRU: 55555554\n[ 0.922240] Kernel panic - not syncing: Fatal exception\n[ 0.922590] Kernel Offset: disabled\n\nFixes: 0545a3037773 (\"pkt_sched: QFQ - quick fair queue scheduler\")\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nLink: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "79b95d74470dd97d7d0908d5a3c0734a23e51aa4", "tree": "129761473149e8fc28991b4b83c8f75242b21465", "parents": [ "108b661c79111ec163edb999825718aa57c3452d", "d7f6629bffdcb962d383ef8c9a30afef81e997fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:44:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:44:48 2026 -0800" }, "message": "Merge tag \u0027hid-for-linus-2026010801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - build fix for HID-BPF (Benjamin Tissoires)\n\n - fix for potential buffer overflow in i2c-hid (Kwok Kin Ming)\n\n - a couple of selftests/hid fixes (Peter Hutterer)\n\n - fix for handling pressure pads in hid-multitouch (Peter Hutterer)\n\n - fix for potential NULL pointer dereference in intel-thc-hid (Even Xu)\n\n - fix for interrupt delay control in intel-thc-hid (Even Xu)\n\n - fix finger release detection on some VTL-class touchpads (DaytonCL)\n\n - fix for correct enumeration on intel-ish-hid systems with no sensors\n (Zhang Lixu)\n\n - assorted device ID additions and device-specific quirks\n\n* tag \u0027hid-for-linus-2026010801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (21 commits)\n HID: logitech: add HID++ support for Logitech MX Anywhere 3S\n HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)\n HID: quirks: work around VID/PID conflict for appledisplay\n HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)\n HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()\n selftests/hid: add a test for the Digitizer/Button Type pressurepad\n selftests/hid: use a enum class for the different button types\n selftests/hid: require hidtools 0.12\n HID: multitouch: set INPUT_PROP_PRESSUREPAD based on Digitizer/Button Type\n HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list\n HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer\n hid: intel-thc-hid: Select SGL_ALLOC\n selftests/hid: fix bpf compilations due to -fms-extensions\n HID: bpf: fix bpf compilation with -fms-extensions\n HID: Intel-thc-hid: Intel-thc: Fix wrong register reading\n HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL\n HID: intel-ish-hid: Reset enum_devices_done before enumeration\n HID: intel-ish-hid: Update ishtp bus match to support device ID table\n HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value\n HID: playstation: Center initial joystick axes to prevent spurious events\n ...\n" }, { "commit": "108b661c79111ec163edb999825718aa57c3452d", "tree": "810b800394843d492bd8a114fd533b9b33734a15", "parents": [ "f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1", "9ed7a28225af02b74f61e7880d460db49db83758" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:42:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 08 07:42:16 2026 -0800" }, "message": "Merge tag \u0027sound-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small device-specific fixes:\n\n - ASoC Intel topology fixes for conflicting Bluetooth bits\n\n - Cleanups of ASoC drivers for superfluous NULL checks\n\n - Fix for error handling in the AC97 bus\n\n - A regression fix for TAS2781 speaker ID handling\n\n - HD-audio quirks\"\n\n* tag \u0027sound-6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk\n ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55\n ALSA: hda/tas2781: properly initialize speaker_id for TAS2563\n ALSA: ac97: fix a double free in snd_ac97_controller_register()\n ASoC: sun4i-spdif: Add missing kerneldoc fields for sun4i_spdif_quirks\n ASoC: codecs: pm4125: clean up bind() device reference handling\n ASoC: soc_sdw_utils: drop bogus container_of() error handling\n ASoC: codecs: wcd937x: drop bogus container_of() error handling\n ASoC: codecs: pm4125: drop bogus container_of() error handling\n ASoC: SOF: Intel: add -bt tplg suffix if BT is present\n ASoC: Intel: sof_sdw: shift SSP BT mask bits.\n" }, { "commit": "36f597bba049928004a050c132ab787ba0eba524", "tree": "65b1483641ab20dc467dc68a9c309e843d1e9983", "parents": [ "a80208072df8f4ceb53cd905c1f4362f84ce397f" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 11:23:14 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Jan 08 15:23:15 2026 +0100" }, "message": "gpiolib: fix lookup table matching\n\nIf on any iteration in gpiod_find(), gpio_desc_table_match() returns\nNULL (which is normal and expected), we never reinitialize desc back to\nERR_PTR(-ENOENT) and if we don\u0027t find a match later on, we will return\nNULL causing a NULL-pointer dereference in users not expecting it. Don\u0027t\ninitialize desc, but return ERR_PTR(-ENOENT) explicitly at the end of\nthe function.\n\nFixes: 9700b0fccf38 (\"gpiolib: allow multiple lookup tables per consumer\")\nReported-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCloses: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/\nTested-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nLink: https://lore.kernel.org/r/20260108102314.18816-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "a203dbeeca15a9b924f0d51f510921f4bae96801", "tree": "03f55039c530c47a91cec7f445e880c47ca818c1", "parents": [ "d594cc6f2c588810888df70c83a9654b6bc7942d" ], "author": { "name": "Baochen Qiang", "email": "baochen.qiang@oss.qualcomm.com", "time": "Mon Dec 22 10:29:07 2025 +0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:11 2026 +0100" }, "message": "wifi: mac80211: collect station statistics earlier when disconnect\n\nIn __sta_info_destroy_part2(), station statistics are requested after the\nIEEE80211_STA_NONE -\u003e IEEE80211_STA_NOTEXIST transition. This is\nproblematic because the driver may be unable to handle the request due to\nthe STA being in the NOTEXIST state (i.e. if the driver destroys the\nunderlying data when transitioning to NOTEXIST).\n\nMove the statistics collection to before the state transition to avoid\nthis issue.\n\nSigned-off-by: Baochen Qiang \u003cbaochen.qiang@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20251222-mac80211-move-station-stats-collection-earlier-v1-1-12cd4e42c633@oss.qualcomm.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d594cc6f2c588810888df70c83a9654b6bc7942d", "tree": "2d8741940fc18c320fbccc788da8a7c1cc2c64e2", "parents": [ "6f385937160174b31a5e4105e759406f0b128494" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Dec 16 11:52:42 2025 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211: restore non-chanctx injection behaviour\n\nDuring the transition to use channel contexts throughout, the\nability to do injection while in monitor mode concurrent with\nanother interface was lost, since the (virtual) monitor won\u0027t\nhave a chanctx assigned in this scenario.\n\nIt\u0027s harder to fix drivers that actually transitioned to using\nchannel contexts themselves, such as mt76, but it\u0027s easy to do\nthose that are (still) just using the emulation. Do that.\n\nCc: stable@vger.kernel.org\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d218763\nReported-and-tested-by: Oscar Alfonso Diaz \u003coscar.alfonso.diaz@gmail.com\u003e\nFixes: 0a44dfc07074 (\"wifi: mac80211: simplify non-chanctx drivers\")\nLink: https://patch.msgid.link/20251216105242.18366-2-johannes@sipsolutions.net\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "6f385937160174b31a5e4105e759406f0b128494", "tree": "ed26c1facce049797488f95a1f9ccca95631e6ba", "parents": [ "c0d82ba9612fb65a8394af639f1427dbe87fb788" ], "author": { "name": "Benjamin Berg", "email": "benjamin.berg@intel.com", "time": "Wed Jan 07 14:38:05 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211_hwsim: disable BHs for hwsim_radio_lock\n\nThe hwsim_radio_lock spinlock expects bottom-half to be disabled, fix\nthe call in mac80211_hwsim_nan_stop to ensure BHs are disabled.\n\nSigned-off-by: Benjamin Berg \u003cbenjamin.berg@intel.com\u003e\nLink: https://patch.msgid.link/20260107143805.ce7406511608.I688f8b19346e94c1f8de0cdadde072054d4b861c@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "c0d82ba9612fb65a8394af639f1427dbe87fb788", "tree": "9294abbc7963621e360cb3122812c165a5866b59", "parents": [ "333418872bfecf4843f1ded7a4151685dfcf07d5" ], "author": { "name": "Miri Korenblit", "email": "miriam.rachel.korenblit@intel.com", "time": "Wed Jan 07 14:37:36 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211: don\u0027t iterate not running interfaces\n\nfor_each_chanctx_user_* was introdcued as a replacement for\nfor_each_sdata_link, which visits also other chanctx users that are not\nlink.\nfor_each_sdata_link skips not running interfaces, do the same for\nfor_each_chanctx_user_*\n\nFixes: 1ce954c98b89 (\"wifi: mac80211: add and use chanctx usage iteration\")\nSigned-off-by: Miri Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260107143736.55c084e2a976.I38b7b904a135dadca339321923b501b2c2c5c8c0@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "333418872bfecf4843f1ded7a4151685dfcf07d5", "tree": "0bc7c2a6b9cd0faec48144547f8ad1d8bcf3b30a", "parents": [ "21cbf883d073abbfe09e3924466aa5e0449e7261" ], "author": { "name": "Benjamin Berg", "email": "benjamin.berg@intel.com", "time": "Wed Jan 07 14:36:51 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:10 2026 +0100" }, "message": "wifi: mac80211_hwsim: fix typo in frequency notification\n\nThe NAN notification is for 5745 MHz which corresponds to channel 149\nand not 5475 which is not actually a valid channel. This could result in\na NULL pointer dereference in cfg80211_next_nan_dw_notif.\n\nFixes: a37a6f54439b (\"wifi: mac80211_hwsim: Add simulation support for NAN device\")\nSigned-off-by: Benjamin Berg \u003cbenjamin.berg@intel.com\u003e\nReviewed-by: Ilan Peer \u003cilan.peer@intel.com\u003e\nReviewed-by: Miriam Rachel Korenblit \u003cmiriam.rachel.korenblit@intel.com\u003e\nLink: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "21cbf883d073abbfe09e3924466aa5e0449e7261", "tree": "0812cb683f541bcd151bba1d1726198f9123cb18", "parents": [ "dbf8fe85a16a33d6b6bd01f2bc606fc017771465" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Jan 08 10:19:27 2026 +0000" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Thu Jan 08 13:33:05 2026 +0100" }, "message": "wifi: avoid kernel-infoleak from struct iw_point\n\nstruct iw_point has a 32bit hole on 64bit arches.\n\nstruct iw_point {\n void __user *pointer; /* Pointer to the data (in user space) */\n __u16 length; /* number of fields or size in bytes */\n __u16 flags; /* Optional params */\n};\n\nMake sure to zero the structure to avoid disclosing 32bits of kernel data\nto user space.\n\nFixes: 87de87d5e47f (\"wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c\")\nReported-by: syzbot+bfc7323743ca6dbcc3d3@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com/T/#u\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "d7f6629bffdcb962d383ef8c9a30afef81e997fe", "tree": "1ff78171d08711f346e67baf344249c6bbbcb5a1", "parents": [ "12adb969658ec39265eb8c7ea9e1856867fb9ceb" ], "author": { "name": "Dennis Marttinen", "email": "twelho@welho.tech", "time": "Sun Jan 04 13:00:51 2026 +0000" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Thu Jan 08 12:22:01 2026 +0100" }, "message": "HID: logitech: add HID++ support for Logitech MX Anywhere 3S\n\nI\u0027ve acquired a Logitech MX Anywhere 3S mouse, which supports HID++ over\nBluetooth. Adding its PID 0xb037 to the allowlist enables the additional\nfeatures, such as high-resolution scrolling. Tested working across multiple\nmachines, with a mix of Intel and Mediatek Bluetooth chips.\n\n[jkosina@suse.com: standardize shortlog]\nSigned-off-by: Dennis Marttinen \u003ctwelho@welho.tech\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "6abcf751bc084804a9e5b3051442e8a2ce67f48a", "tree": "d647c01fe4d3060a0ba35439d8c9d72c0dfa019a", "parents": [ "653267321f05316f159e05b3ef562aa700632db6" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Mon Jan 05 09:43:31 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jan 08 11:23:20 2026 +0100" }, "message": "net: airoha: Fix schedule while atomic in airoha_ppe_deinit()\n\nairoha_ppe_deinit() runs airoha_npu_ppe_deinit() in atomic context.\nairoha_npu_ppe_deinit routine allocates ppe_data buffer with GFP_KERNEL\nflag. Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order\nto fix schedule while atomic issue in airoha_npu_ppe_deinit() since we\ndo not need atomic context there.\n\nFixes: 00a7678310fe3 (\"net: airoha: Introduce flowtable offload support\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260105-airoha-fw-ethtool-v2-1-3b32b158cc31@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "f6eac56d6bf2026437b606a69aff903941282f9a", "tree": "50057afca34ba16f4519c2f8e5c99f0a411d84c5", "parents": [ "a5f207e27207fbd3e4b5b466c73a6f9b1170fcf3", "6b2989ac5e8c496c1814d7961bee6f2d05382b3e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 09:50:08 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 10:34:27 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.19-2026-01-06\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.19-2026-01-06:\n\namdgpu:\n- Clang fixes\n- Navi1x PCIe DPM fixes\n- Ring reset fixes\n- ISP suspend fix\n- Analog DC fixes\n- VPE fixes\n- Mode1 reset fix\n\nradeon:\n- Variable sized array fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260107223315.16095-1-alexander.deucher@amd.com\n" }, { "commit": "12adb969658ec39265eb8c7ea9e1856867fb9ceb", "tree": "b6637740af23e4dc4f103101168ab2df468dc972", "parents": [ "c7fabe4ad9219866c203164a214c474c95b36bf2" ], "author": { "name": "Arnoud Willemsen", "email": "mail@lynthium.com", "time": "Sun Dec 07 03:43:19 2025 +0100" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: Elecom: Add support for ELECOM M-XT3DRBK (018C)\n\nWireless/new version of the Elecom trackball mouse M-XT3DRBK has a\nproduct id that differs from the existing M-XT3DRBK.\nThe report descriptor format also seems to have changed and matches\nother (newer?) models instead (except for six buttons instead of eight).\nThis patch follows the same format as the patch for the M-XT3URBK (018F)\nby Naoki Ueki (Nov 3rd 2025) to enable the sixth mouse button.\n\ndmesg output:\n[ 292.074664] usb 1-2: new full-speed USB device number 7 using xhci_hcd\n[ 292.218667] usb 1-2: New USB device found, idVendor\u003d056e, idProduct\u003d018c, bcdDevice\u003d 1.00\n[ 292.218676] usb 1-2: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d0\n[ 292.218679] usb 1-2: Product: ELECOM TrackBall Mouse\n[ 292.218681] usb 1-2: Manufacturer: ELECOM\n\nusbhid-dump output:\n001:006:000:DESCRIPTOR 1765072638.050578\n 05 01 09 02 A1 01 09 01 A1 00 85 01 05 09 19 01\n 29 05 15 00 25 01 95 08 75 01 81 02 95 01 75 00\n 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10\n 95 02 81 06 C0 A1 00 05 01 09 38 15 81 25 7F 75\n 08 95 01 81 06 C0 A1 00 05 0C 0A 38 02 95 01 75\n 08 15 81 25 7F 81 06 C0 C0 06 01 FF 09 00 A1 01\n 85 02 09 00 15 00 26 FF 00 75 08 95 07 81 02 C0\n 05 0C 09 01 A1 01 85 05 15 00 26 3C 02 19 00 2A\n 3C 02 75 10 95 01 81 00 C0 05 01 09 80 A1 01 85\n 03 19 81 29 83 15 00 25 01 95 03 75 01 81 02 95\n 01 75 05 81 01 C0 06 BC FF 09 88 A1 01 85 04 95\n 01 75 08 15 00 26 FF 00 19 00 2A FF 00 81 00 C0\n 06 02 FF 09 02 A1 01 85 06 09 02 15 00 26 FF 00\n 75 08 95 07 B1 02 C0\n\nSigned-off-by: Arnoud Willemsen \u003cmail@lynthium.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "c7fabe4ad9219866c203164a214c474c95b36bf2", "tree": "847b8e8056e0c43ea44c5d4518fa92c32f8b0f59", "parents": [ "85a866809333cd2bf8ddac93d9a3e3ba8e4f807d" ], "author": { "name": "René Rebe", "email": "rene@exactco.de", "time": "Fri Nov 28 13:46:41 2025 +0100" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: quirks: work around VID/PID conflict for appledisplay\n\nFor years I wondered why the Apple Cinema Display driver would not\njust work for me. Turns out the hidraw driver instantly takes it\nover. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.\n\nFixes: 069e8a65cd79 (\"Driver for Apple Cinema Display\")\nSigned-off-by: René Rebe \u003crene@exactco.de\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "85a866809333cd2bf8ddac93d9a3e3ba8e4f807d", "tree": "f43b6e8018e0ad6d9e2b7689fd5506459a772b77", "parents": [ "2497ff38c530b1af0df5130ca9f5ab22c5e92f29" ], "author": { "name": "Rodrigo Lugathe da Conceição Alves", "email": "lugathe2@gmail.com", "time": "Thu Nov 27 19:03:57 2025 -0300" }, "committer": { "name": "Jiri Kosina", "email": "jkosina@suse.com", "time": "Wed Jan 07 23:36:58 2026 +0100" }, "message": "HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101)\n\nThe USB speaker has a bug that causes it to reboot when changing the\nbrightness using the physical knob.\n\nAdd a new vendor and product ID entry in hid-ids.h, and register\nthe corresponding device in hid-quirks.c with the required quirk.\n\nSigned-off-by: Rodrigo Lugathe da Conceição Alves \u003clugathe2@gmail.com\u003e\nReviewed-by: Terry Junge \u003clinuxhid@cosmicgizmosystems.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.com\u003e\n" }, { "commit": "6b2989ac5e8c496c1814d7961bee6f2d05382b3e", "tree": "27d64503965c5439a2c3e330187e2c01c9f1ceb0", "parents": [ "eb236fb911ca0f4243124d8a285ec0453a99a8b4" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Sat Nov 29 19:46:31 2025 -0600" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:16 2026 -0500" }, "message": "Reapply \"Revert \"drm/amd: Skip power ungate during suspend for VPE\"\"\n\nSkipping power ungate exposed some scenarios that will fail\nlike below:\n\n```\namdgpu: Register(0) [regVPEC_QUEUE_RESET_REQ] failed to reach value 0x00000000 !\u003d 0x00000001n\namdgpu 0000:c1:00.0: amdgpu: VPE queue reset failed\n...\namdgpu: [drm] *ERROR* wait_for_completion_timeout timeout!\n```\n\nThe underlying s2idle issue that prompted this commit is going to\nbe fixed in BIOS.\nThis reverts commit 2a6c826cfeedd7714611ac115371a959ead55bda.\n\nThis was lost in the 6.19 merge so reapply it.\n\nFixes: 2a6c826cfeed (\"drm/amd: Skip power ungate during suspend for VPE\")\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nReported-by: Konstantin \u003canswer2019@yandex.ru\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d220812\nReported-by: Matthew Schwartz \u003cmatthew.schwartz@linux.dev\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 3925683515e93844be204381d2d5a1df5de34f31)\n" }, { "commit": "eb236fb911ca0f4243124d8a285ec0453a99a8b4", "tree": "3b32de02ea7ce891dc5c5572096670ed099a8ab6", "parents": [ "0de604d0357d0d22cbf03af1077d174b641707b6" ], "author": { "name": "Alex Hung", "email": "alex.hung@amd.com", "time": "Mon Dec 08 12:11:43 2025 -0700" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:16 2026 -0500" }, "message": "drm/amd/display: Check NULL before calling dac_load_detection\n\ndac_load_detection can be NULL in some scenario, so checking it before\ncalling.\n\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Chenyu Chen \u003cchen-yu.chen@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 179176134b535246f0b368b30e8ecad50066f896)\n" }, { "commit": "0de604d0357d0d22cbf03af1077d174b641707b6", "tree": "2b330df004067851605a1cdd383206048afe666b", "parents": [ "72d7f4573660287f1b66c30319efecd6fcde92ee" ], "author": { "name": "Perry Yuan", "email": "perry.yuan@amd.com", "time": "Thu Dec 25 16:43:49 2025 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jan 07 17:24:10 2026 -0500" }, "message": "drm/amd/pm: Disable MMIO access during SMU Mode 1 reset\n\nDuring Mode 1 reset, the ASIC undergoes a reset cycle and becomes\ntemporarily inaccessible via PCIe. Any attempt to access MMIO registers\nduring this window (e.g., from interrupt handlers or other driver threads)\ncan result in uncompleted PCIe transactions, leading to NMI panics or\nsystem hangs.\n\nTo prevent this, set the `no_hw_access` flag to true immediately after\ntriggering the reset. This signals other driver components to skip\nregister accesses while the device is offline.\n\nA memory barrier `smp_mb()` is added to ensure the flag update is\nglobally visible to all cores before the driver enters the sleep/wait\nstate.\n\nSigned-off-by: Perry Yuan \u003cperry.yuan@amd.com\u003e\nReviewed-by: Yifan Zhang \u003cyifan1.zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)\n" }, { "commit": "a5f207e27207fbd3e4b5b466c73a6f9b1170fcf3", "tree": "50702bb9e7ea88f5220cf77c255e3be566bd1054", "parents": [ "50cf611b0bfa6c5bccfcd28dba32837c18ee3083", "d5bdf88d1f9d1e4808177f03d89de3d0ba6c6e84" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:40:42 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:41:00 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-01-07\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v6.19-rc5:\n\npl111:\n- Fix error handling in probe\n\nmediatek/atomic/tidss:\n- Fix tidss in another way and revert reordering of pre-enable and post-disable operations,\n as it breaks other bridge drivers.\n\nnouveau:\n- Fix regression from fwsec s/r fix.\n\npci/vga:\n- Fix multiple gpu\u0027s being reported a \u0027boot_display\u0027\n\nfb-helper:\n- Fix vblank timeout during suspend/reset\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/f50067e6-243a-4ed8-9781-1e4e4fdebc8e@linux.intel.com\n" }, { "commit": "50cf611b0bfa6c5bccfcd28dba32837c18ee3083", "tree": "ecb35ebd6a9cfd095cd37f7b2f41ac6de70ee4ea", "parents": [ "c4f2ae53863de2b5d125c3cdc9ff12668868a74a", "8e6ad0dac6266c5e13874e816b016759d7145500" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:34:36 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Jan 08 07:34:42 2026 +1000" }, "message": "Merge tag \u0027exynos-drm-fixes-v6.19-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes\n\nOne code cleanup\n. Replace system_wq with system_percpu_wq in the Exynos HDMI driver.\n system_wq is effectively a per-cpu workqueue, but its name does not make\n this explicit. Recent workqueue changes introduced system_percpu_wq to clarify\n semantics and support ongoing workqueue API refactoring.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Inki Dae \u003cinki.dae@samsung.com\u003e\nLink: https://patch.msgid.link/20260107091154.27436-1-inki.dae@samsung.com\n" }, { "commit": "b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0", "tree": "4fca374bb2a3328819704721379961fe42e4e809", "parents": [ "957afeb99b111b672b3529a737fe19b95daaf1a2" ], "author": { "name": "Martin Kaiser", "email": "martin@kaiser.cx", "time": "Tue Dec 23 14:50:06 2025 +0100" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:25:56 2026 -0700" }, "message": "riscv: trace: fix snapshot deadlock with sbi ecall\n\nIf sbi_ecall.c\u0027s functions are traceable,\n\necho \"__sbi_ecall:snapshot\" \u003e /sys/kernel/tracing/set_ftrace_filter\n\nmay get the kernel into a deadlock.\n\n(Functions in sbi_ecall.c are excluded from tracing if\nCONFIG_RISCV_ALTERNATIVE_EARLY is set.)\n\n__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code\nraises an IPI interrupt, which results in another call to __sbi_ecall\nand another snapshot...\n\nAll it takes to get into this endless loop is one initial __sbi_ecall.\nOn RISC-V systems without SSTC extension, the clock events in\ntimer-riscv.c issue periodic sbi ecalls, making the problem easy to\ntrigger.\n\nAlways exclude the sbi_ecall.c functions from tracing to fix the\npotential deadlock.\n\nsbi ecalls can easiliy be logged via trace events, excluding ecall\nfunctions from function tracing is not a big limitation.\n\nSigned-off-by: Martin Kaiser \u003cmartin@kaiser.cx\u003e\nLink: https://patch.msgid.link/20251223135043.1336524-1-martin@kaiser.cx\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "bdb32359eab94013e80cf7e3d40a3fd4972da93a", "tree": "dd92ada8d66c331ded118a298f020661b4a13b31", "parents": [ "df27c03b9e3ef2baa9e9c9f56a771d463a84489d" ], "author": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Mon Nov 24 19:04:11 2025 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Wed Jan 07 14:22:32 2026 -0600" }, "message": "sparc/PCI: Correct 64-bit non-pref -\u003e pref BAR resources\n\nSPARC T5-2 dts describes some PCI BARs as 64-bit resources without the\npref(etchable) bit (0x83... vs 0xc3... in assigned-addresses) for address\nranges above the 4G threshold. Such resources cannot be placed into a\nnon-prefetchable PCI bridge window that is capable only of 32-bit\naddressing. As such, it looks like the platform is improperly described by\nthe dts.\n\nThe kernel detects this problem (see the IORESOURCE_PREFETCH check in\npci_find_parent_resource()) and fails to assign these BAR resources to the\nresource tree due to lack of a compatible bridge window.\n\nPrior to 754babaaf333 (\"sparc/PCI: Remove pcibios_enable_device() as they\ndo nothing extra\") SPARC arch code did not test whether device resources\nwere successfully in the resource tree when enabling a device, effectively\nhiding the problem. After removing the arch-specific enable code,\npci_enable_resources() refuses to enable the device when it finds not all\nmem resources are assigned, and therefore mpt3sas can\u0027t be enabled:\n\n pci 0001:04:00.0: reg 0x14: [mem 0x801110000000-0x80111000ffff 64bit]\n pci 0001:04:00.0: reg 0x1c: [mem 0x801110040000-0x80111007ffff 64bit]\n pci 0001:04:00.0: BAR 1 [mem 0x801110000000-0x80111000ffff 64bit]: can\u0027t claim; no compatible bridge window\n pci 0001:04:00.0: BAR 3 [mem 0x801110040000-0x80111007ffff 64bit]: can\u0027t claim; no compatible bridge window\n mpt3sas 0001:04:00.0: BAR 1 [mem size 0x00010000 64bit]: not assigned; can\u0027t enable device\n\nFor clarity, this filtered log only shows failures for one mpt3sas device\nbut other devices fail similarly. In the reported case, the end result with\nall the failures is an unbootable system.\n\nThings appeared to \"work\" before 754babaaf333 (\"sparc/PCI: Remove\npcibios_enable_device() as they do nothing extra\") because the resource\ntree is agnostic to whether PCI BAR resources are properly in the tree or\nnot. So as long as there was a parent resource (e.g. a root bus resource)\nthat contains the address range, the resource tree code just places\nresource request underneath it without any consideration to the\nintermediate BAR resource. While it worked, it\u0027s incorrect setup still.\n\nAdd an OF fixup to set the IORESOURCE_PREFETCH flag for a 64-bit PCI\nresource that has the end address above 4G requiring placement into the\nprefetchable window. Also log the issue.\n\nFixes: 754babaaf333 (\"sparc/PCI: Remove pcibios_enable_device() as they do nothing extra\")\nReported-by: Nathaniel Roach \u003cnroach44@gmail.com\u003e\nCloses: https://github.com/sparclinux/issues/issues/22\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Nathaniel Roach \u003cnroach44@gmail.com\u003e\nLink: https://patch.msgid.link/20251124170411.3709-1-ilpo.jarvinen@linux.intel.com\n" }, { "commit": "957afeb99b111b672b3529a737fe19b95daaf1a2", "tree": "ac7ae7a11c424cd2afc1acfc9ef0f9a7f8830c6b", "parents": [ "2ca5bb54bde739b32ed42758fff8dc1025c1225f" ], "author": { "name": "Yunhui Cui", "email": "cuiyunhui@bytedance.com", "time": "Tue Dec 16 09:47:19 2025 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:16:38 2026 -0700" }, "message": "riscv: remove irqflags.h inclusion in asm/bitops.h\n\nThe arch/riscv/include/asm/bitops.h does not functionally require\nincluding /linux/irqflags.h. Additionally, adding\narch/riscv/include/asm/percpu.h causes a circular inclusion:\nkernel/bounds.c\n-\u003einclude/linux/log2.h\n-\u003einclude/linux/bitops.h\n-\u003earch/riscv/include/asm/bitops.h\n-\u003einclude/linux/irqflags.h\n-\u003einclude/linux/find.h\n-\u003ereturn val ? __ffs(val) : size;\n-\u003earch/riscv/include/asm/bitops.h\n\nThe compilation log is as follows:\nCC kernel/bounds.s\nIn file included from ./include/linux/bitmap.h:11,\n from ./include/linux/cpumask.h:12,\n from ./arch/riscv/include/asm/processor.h:55,\n from ./arch/riscv/include/asm/thread_info.h:42,\n from ./include/linux/thread_info.h:60,\n from ./include/asm-generic/preempt.h:5,\n from ./arch/riscv/include/generated/asm/preempt.h:1,\n from ./include/linux/preempt.h:79,\n from ./arch/riscv/include/asm/percpu.h:8,\n from ./include/linux/irqflags.h:19,\n from ./arch/riscv/include/asm/bitops.h:14,\n from ./include/linux/bitops.h:68,\n from ./include/linux/log2.h:12,\n from kernel/bounds.c:13:\n./include/linux/find.h: In function \u0027find_next_bit\u0027:\n./include/linux/find.h:66:30: error: implicit declaration of function \u0027__ffs\u0027 [-Wimplicit-function-declaration]\n 66 | return val ? __ffs(val) : size;\n | ^~~~~\n\nSigned-off-by: Yunhui Cui \u003ccuiyunhui@bytedance.com\u003e\nAcked-by: Yury Norov (NVIDIA) \u003cyury.norov@gmail.com\u003e\nLink: https://patch.msgid.link/20251216014721.42262-2-cuiyunhui@bytedance.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "2ca5bb54bde739b32ed42758fff8dc1025c1225f", "tree": "3cf6b72f8edd9a8893663deeea82a889e459a211", "parents": [ "003c03a4b40085784d5b661133d1124f7e587e02" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Fri Jan 02 14:58:39 2026 +0000" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 13:03:16 2026 -0700" }, "message": "riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int\n\nThe print in sbi_cpu_stop() assumes smp_processor_id() returns an\nunsigned int, when it is actually an int. Fix the format string to\navoid mismatch type warnings in rht pr_crit().\n\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nLink: https://patch.msgid.link/20260102145839.657864-1-ben.dooks@codethink.co.uk\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0", "tree": "af0e0524b92e97e56a709aaa5263e63731e74392", "parents": [ "5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Tue Jan 06 23:10:54 2026 +0000" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Jan 07 14:52:22 2026 -0500" }, "message": "trace: ftrace_dump_on_oops[] is not exported, make it static\n\nThe ftrace_dump_on_oops string is not used outside of trace.c so\nmake it static to avoid the export warning from sparse:\n\nkernel/trace/trace.c:141:6: warning: symbol \u0027ftrace_dump_on_oops\u0027 was not declared. Should it be static?\n\nFixes: dd293df6395a2 (\"tracing: Move trace sysctls into trace.c\")\nLink: https://patch.msgid.link/20260106231054.84270-1-ben.dooks@codethink.co.uk\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb", "tree": "7ca2e2fbc9bca44bd243dc8eac56c02e43c78579", "parents": [ "5232196ff49be08350b27f1ba8e1fad87afc9cdf" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Mon Jan 05 20:31:41 2026 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Jan 07 14:52:22 2026 -0500" }, "message": "tracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.\n\nLink: https://lore.kernel.org/all/20260102122807.7025fc87@gandalf.local.home/\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Joel Fernandes \u003cjoel@joelfernandes.org\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@kernel.org\u003e\nCc: Boqun Feng \u003cboqun.feng@gmail.com\u003e\nLink: https://patch.msgid.link/20260105203141.515cd49f@gandalf.local.home\nReported-by: Yao Kai \u003cyaokai34@huawei.com\u003e\nTested-by: Yao Kai \u003cyaokai34@huawei.com\u003e\nFixes: 5f5fa7ea89dc (\"rcu: Don\u0027t use negative nesting depth in __rcu_read_unlock()\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "5232196ff49be08350b27f1ba8e1fad87afc9cdf", "tree": "178d8e7e4b328950073b9149d95711aff46a53ea", "parents": [ "6435ffd6c7fcba330dfa91c58dc30aed2df3d0bf" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jan 02 14:31:48 2026 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Jan 07 14:52:22 2026 -0500" }, "message": "ftrace: Make ftrace_graph_ent depth field signed\n\nThe code has integrity checks to make sure that depth never goes below\nzero. But the depth field has recently been converted to unsigned long\nfrom \"int\" (for alignment reasons). As unsigned long can never be less\nthan zero, the integrity checks no longer work.\n\nConvert depth to long from unsigned long to allow the integrity checks to\nwork again.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: pengdonglin \u003cpengdonglin@xiaomi.com\u003e\nLink: https://patch.msgid.link/20260102143148.251c2e16@gandalf.local.home\nReported-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCloses: https://lore.kernel.org/all/aS6kGi0maWBl-MjZ@stanley.mountain/\nFixes: f83ac7544fbf7 (\"function_graph: Enable funcgraph-args and funcgraph-retaddr to work simultaneously\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "6435ffd6c7fcba330dfa91c58dc30aed2df3d0bf", "tree": "9acedab21c1c5e016fc550244564730f587d79dd", "parents": [ "7cc3fe8e754eb1b7d9876c8ae2ee77dd2fb47b6d" ], "author": { "name": "Wupeng Ma", "email": "mawupeng1@huawei.com", "time": "Sun Dec 28 14:50:07 2025 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Jan 07 14:52:22 2026 -0500" }, "message": "ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free\n\nWhen user resize all trace ring buffer through file \u0027buffer_size_kb\u0027,\nthen in ring_buffer_resize(), kernel allocates buffer pages for each\ncpu in a loop.\n\nIf the kernel preemption model is PREEMPT_NONE and there are many cpus\nand there are many buffer pages to be freed, it may not give up cpu\nfor a long time and finally cause a softlockup.\n\nTo avoid it, call cond_resched() after each cpu buffer free as Commit\nf6bd2c92488c (\"ring-buffer: Avoid softlockup in ring_buffer_resize()\")\ndoes.\n\nDetailed call trace as follow:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu: \t24-....: (14837 ticks this GP) idle\u003d521c/1/0x4000000000000000 softirq\u003d230597/230597 fqs\u003d5329\n rcu: \t(t\u003d15004 jiffies g\u003d26003221 q\u003d211022 ncpus\u003d96)\n CPU: 24 UID: 0 PID: 11253 Comm: bash Kdump: loaded Tainted: G EL 6.18.2+ #278 NONE\n pc : arch_local_irq_restore+0x8/0x20\n arch_local_irq_restore+0x8/0x20 (P)\n free_frozen_page_commit+0x28c/0x3b0\n __free_frozen_pages+0x1c0/0x678\n ___free_pages+0xc0/0xe0\n free_pages+0x3c/0x50\n ring_buffer_resize.part.0+0x6a8/0x880\n ring_buffer_resize+0x3c/0x58\n __tracing_resize_ring_buffer.part.0+0x34/0xd8\n tracing_resize_ring_buffer+0x8c/0xd0\n tracing_entries_write+0x74/0xd8\n vfs_write+0xcc/0x288\n ksys_write+0x74/0x118\n __arm64_sys_write+0x24/0x38\n\nCc: \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20251228065008.2396573-1-mawupeng1@huawei.com\nSigned-off-by: Wupeng Ma \u003cmawupeng1@huawei.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "7cc3fe8e754eb1b7d9876c8ae2ee77dd2fb47b6d", "tree": "61bd59cf3ae023d196e284ae17e5a47efc5c123b", "parents": [ "9ace4753a5202b02191d54e9fdf7f9e3d02b85eb" ], "author": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Fri Dec 26 12:05:31 2025 +0100" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Wed Jan 07 14:52:22 2026 -0500" }, "message": "tracing: Drop unneeded assignment to soft_mode\n\nsoft_mode is not read in the enable case, so drop the assignment.\nDrop also the comment text that refers to the assignment and realign\nthe comment.\n\nCc: \"Paul E . McKenney\" \u003cpaulmck@kernel.org\u003e\nCc: Gabriele Paoloni \u003cgpaoloni@redhat.com\u003e\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20251226110531.4129794-1-Julia.Lawall@inria.fr\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "003c03a4b40085784d5b661133d1124f7e587e02", "tree": "a4ba6d20c0310e962ffddb904580123fa4239250", "parents": [ "938d79ec2b059fea2f3bf0f53107650a64372acf" ], "author": { "name": "Lukas Bulwahn", "email": "lukas.bulwahn@redhat.com", "time": "Wed Jan 07 10:24:25 2026 +0100" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed Jan 07 12:49:06 2026 -0700" }, "message": "riscv: configs: Clean up references to non-existing configs\n\n - Drop \u0027CONFIG_I2C_COMPAT is not set\u0027 (removed in commit 7e722083fcc3\n (\"i2c: Remove I2C_COMPAT config symbol and related code\"))\n - Drop \u0027CONFIG_SCHED_DEBUG is not set\u0027 (removed in commit b52173065e0a\n (\"sched/debug: Remove CONFIG_SCHED_DEBUG\"))\n\nSigned-off-by: Lukas Bulwahn \u003clukas.bulwahn@redhat.com\u003e\nLink: https://patch.msgid.link/20260107092425.24737-1-lukas.bulwahn@redhat.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "2497ff38c530b1af0df5130ca9f5ab22c5e92f29", "tree": "4ceb17903fdf8cfb24a83b0fd3fefd45ec90cac3", "parents": [ "f287ba5951a4b3a47305b64a3fcde5d0911adb9b" ], "author": { "name": "Kwok Kin Ming", "email": "kenkinming2002@gmail.com", "time": "Thu Jan 01 02:18:26 2026 +0800" }, "committer": { "name": "Benjamin Tissoires", "email": "bentiss@kernel.org", "time": "Wed Jan 07 18:35:58 2026 +0100" }, "message": "HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()\n\n`i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data\ninto `ihid-\u003erawbuf`.\n\nThe former can come from the userspace in the hidraw driver and is only\nbounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set\n`max_buffer_size` field of `struct hid_ll_driver` which we do not).\n\nThe latter has size determined at runtime by the maximum size of\ndifferent report types you could receive on any particular device and\ncan be a much smaller value.\n\nFix this by truncating `recv_len` to `ihid-\u003ebufsize - sizeof(__le16)`.\n\nThe impact is low since access to hidraw devices requires root.\n\nSigned-off-by: Kwok Kin Ming \u003ckenkinming2002@gmail.com\u003e\nSigned-off-by: Benjamin Tissoires \u003cbentiss@kernel.org\u003e\n" }, { "commit": "bf104037ebd5c1774fa736050a484c1f28cb2e6b", "tree": "b3f08dd4c3af104f8ec2c7fb87b1123f32a5ea14", "parents": [ "c221cc877bd2e25fb496895f00eb21fbef1e9231" ], "author": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Mon Jan 05 11:40:02 2026 -0600" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Jan 07 17:55:19 2026 +0100" }, "message": "arm64: dts: hisilicon: hikey960: Drop \"snps,gctl-reset-quirk\" and \"snps,tx_de_emphasis*\" properties\n\n\"snps,tx_de_emphasis\" is supposed to be a u8, not a u32. Since it is big\nendian, 0 will be read rather than 1. The DWC3 Linux driver simply ORs\nthe value if \"snps,tx_de_emphasis_quirk\" is set, so the 2 properties\nhave no effect. (The driver doesn\u0027t clear the field either which is\nanother problem).\n\n\"snps,gctl-reset-quirk\" is not documented nor used in the driver, so\ndrop it as well.\n\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260105174002.2997615-1-robh@kernel.org\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "c221cc877bd2e25fb496895f00eb21fbef1e9231", "tree": "1b327c6715940c2830810b7e663ffb6323abef1e", "parents": [ "51183d3ff553e6bd101034e4c20bd20029316eba", "89e87d0dc87eb3654c9ae01afc4a18c1c6d1e523" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Jan 07 17:48:59 2026 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Jan 07 17:49:00 2026 +0100" }, "message": "Merge tag \u0027imx-fixes-6.19\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes\n\ni.MX fixes for 6.19:\n\n- A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger\n type\n- An i.MX95 fix from Carlos Song to correct I3C2 pclk\n- A couple of imx8qm-mek changes from Haibo Chen to fix light sensor\n interrupt type and usdhc2 regulator configuration\n- An imx6q-ba16 change from Ian Ray to fix RTC interrupt level\n- An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet\n link bouncing caused by interruptions on the PHY reference clock\n- A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible\n and eqos nvmem-cells\n- An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names\n- An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for\n LPUART\n- A couple of imx95-toradex-smarc changes from Vitor Soares to fix\n ethphy1 interrupt and SMARC_SDIO_WP label position\n\n* tag \u0027imx-fixes-6.19\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:\n arm64: dts: mba8mx: Fix Ethernet PHY IRQ support\n arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart\n arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM\n arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells\n arm64: dts: freescale: moduline-display: fix compatible\n dt-bindings: arm: fsl: moduline-display: fix compatible\n ARM: dts: imx6q-ba16: fix RTC interrupt level\n arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position\n arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt\n arm64: dts: add off-on-delay-us for usdhc2 regulator\n arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level\n ARM: dts: nxp: imx: Fix mc13xxx LED node names\n arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP\n\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "51183d3ff553e6bd101034e4c20bd20029316eba", "tree": "957e4e7691198bff6c70ea9fdb61b66ab3a20835", "parents": [ "6efe5322f060099c8bc51aaee83b857394e42dd5" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@oss.qualcomm.com", "time": "Tue Dec 23 15:27:28 2025 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Jan 07 17:47:43 2026 +0100" }, "message": "Documentation/process: maintainer-soc: Mark \u0027make\u0027 as commands\n\nImprove readability of the docs by marking \u0027make dtbs/dtbs_check\u0027 as\nshell commands.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://lore.kernel.org/r/20251223142726.73417-4-krzysztof.kozlowski@oss.qualcomm.com\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" }, { "commit": "6efe5322f060099c8bc51aaee83b857394e42dd5", "tree": "637f3bf6e456f935f18144a6d31125d5fb16208d", "parents": [ "902300d332a951b68dc1d75a2b55922f71dd36d5" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@oss.qualcomm.com", "time": "Tue Dec 23 15:27:27 2025 +0100" }, "committer": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Jan 07 17:47:43 2026 +0100" }, "message": "Documentation/process: maintainer-soc: Be more explicit about defconfig\n\nIt is already documented but people still send noticeable amount of\npatches ignoring the rule - get_maintainers.pl does not work on\narm64/configs/defconfig or any other shared ARM defconfig.\n\nBe more explicit, that one must not rely on typical/simple approach\nhere for getting To/Cc list.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://lore.kernel.org/r/20251223142726.73417-3-krzysztof.kozlowski@oss.qualcomm.com\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n" } ], "next": "902300d332a951b68dc1d75a2b55922f71dd36d5" }