)]}' { "log": [ { "commit": "dc5ca34f5e8dc10c566ef39aa3b1a201a17ca734", "tree": "da18bd63c4a5fb8d7b07e6f2bc2fbf12ac4d37ac", "parents": [ "d5acef12e819c1627c8bf6a0325845ab39d8c99d" ], "author": { "name": "Pufan Jin", "email": "cyan2254650260@gmail.com", "time": "Fri Oct 16 21:08:12 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri Oct 23 18:46:26 2026 +0100" }, "message": "spi: zynq-qspi: fix address buffer corruption and support 4-byte address\n\nIn zynq_qspi_exec_mem_op(), when transmitting address bytes, the driver\niterates over op-\u003eaddr.nbytes and populates xqspi-\u003etxbuf[i]. However,\nxqspi-\u003etxbuf is never re-assigned before populating the address, meaning\nit still points to (u8 *)\u0026op-\u003ecmd.opcode from the command phase.\n\nThis causes two severe issues:\n1. Memory corruption: Writing into xqspi-\u003etxbuf writes past the opcode\n buffer on the stack (which was passed as const struct spi_mem_op *).\n If opcode is zero, xqspi-\u003etxbuf is uninitialized.\n2. In zynq_qspi_supports_op(), operations with op-\u003eaddr.nbytes \u003e 3 are\n rejected. When paired with SPI NOR flashes larger than 16MB (such as\n Winbond W25Q256), spi_nor_spimem_check_read_pp_op() tests 4-byte address\n support, which fails and causes spi_nor_select_read() to drop all read\n capabilities, failing probe with -EINVAL (-22).\n\nThe Zynq-7000 QSPI controller hardware in manual I/O mode natively supports\ntransmitting 1 to 4 address bytes via its TXD FIFO registers\n(ZYNQ_QSPI_TXD_00_00_OFFSET).\n\nFix this by introducing a local opaddr[4] buffer in zynq_qspi_exec_mem_op()\nand explicitly setting xqspi-\u003etxbuf \u003d opaddr before populating address\nbytes. Also allow up to 4 address bytes in zynq_qspi_supports_op().\n\nFixes: 67dca5e580f1 (\"spi: spi-mem: Add support for Zynq QSPI controller\")\nCc: stable@vger.kernel.org\nSigned-off-by: Pufan Jin \u003ccyan2254650260@gmail.com\u003e\nLink: https://patch.msgid.link/20261016130812.282624-1-cyan2254650260@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "d5acef12e819c1627c8bf6a0325845ab39d8c99d", "tree": "11c79a8d95e55add7a732b346b2c634a47bd52e0", "parents": [ "84182c48999f856c3865e4a537c244f9569c9f6c", "b0f0c761ed3fa10754dc9295db85374a173123b7" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 19 18:00:23 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 19 18:00:23 2026 +0100" }, "message": "spi: Merge up fixes\n\nA small collection of driver specific fixes, all quite important if you\nhave the relevant hardware.\n" }, { "commit": "84182c48999f856c3865e4a537c244f9569c9f6c", "tree": "816bf1edd5218c0c16afad8bf8729b3b0585eae4", "parents": [ "6c59290d62e7dac745a2cbf6a40d2e1f8dedb73f" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Tue Oct 13 13:43:39 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Sun Oct 18 13:14:34 2026 +0100" }, "message": "spi: ch341: handle transfers without a TX or RX buffer\n\nch341_transfer_one() unconditionally copies from trans-\u003etx_buf into the\nTX packet and hands trans-\u003erx_buf to usb_bulk_msg() for the readback.\n\nThe SPI core allows half-duplex transfers where either of the buffers\nis NULL, so a transfer without TX data crashes the kernel on the memcpy\nand a transfer without RX data makes usb_bulk_msg() store the received\ndata at address 0.\n\nThe CH341A clocks data in both directions on every transfer; there is\nno mode to disable a direction. Set SPI_CONTROLLER_MUST_TX and\nSPI_CONTROLLER_MUST_RX so the SPI core fills in dummy buffers for\nhalf-duplex transfers.\n\nFixes: 8846739f52af (\"spi: add ch341a usb2spi driver\")\nCc: stable@vger.kernel.org # 6.11+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261013054339.77477-1-liuwb@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "6c59290d62e7dac745a2cbf6a40d2e1f8dedb73f", "tree": "aea340a016db82d001e1c8b02c7d4bb7a48802a3", "parents": [ "0b591332a2bdc13d3f9163793131fe3651d1556a" ], "author": { "name": "Kathiravan Thirumoorthy", "email": "kathiravan.thirumoorthy@oss.qualcomm.com", "time": "Fri Oct 16 12:53:04 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri Oct 16 20:34:29 2026 +0100" }, "message": "spi: dt-bindings: spi-qpic-snand: Add IPQ9650 compatible\n\nThe QPIC SPI-NAND flash controller found on IPQ9650 is identical to the\none present on IPQ9574. Add the IPQ9650 compatible and use IPQ9574 as\nthe fallback.\n\nSigned-off-by: Kathiravan Thirumoorthy \u003ckathiravan.thirumoorthy@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261016-ipq9650_spi_nand-v1-1-d341a76559b1@oss.qualcomm.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0b591332a2bdc13d3f9163793131fe3651d1556a", "tree": "4a7b176ff2f1b3e3754fa45d3753a2f00f24ca09", "parents": [ "e2f4edfc061e493fddde16c4bbe1c4f230f41e4a" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Fri Oct 16 10:00:36 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri Oct 16 12:17:50 2026 +0100" }, "message": "spi: spi-pci1xxxx: quiesce DMA engines on transfer timeout\n\nIf a DMA-mapped transfer times out waiting for DMA_TERM and neither DMA\nabort interrupt arrived, pci1xxxx_spi_transfer_with_dma() returns\nthrough the error label while both DMA engines are still enabled, the\ndone/abort interrupt status is still armed and the transfer state\n(p-\u003exfer, p-\u003etx_sgl, p-\u003erx_sgl) is still registered.\n\nThe ISRs keep firing afterwards: they reprogram the DMA engines from\np-\u003etx_sgl / p-\u003erx_sgl and signal completion through p-\u003exfer and\np-\u003espi_xfer_done, all of which the SPI core is free to unmap or reuse\nonce transfer_one() has returned, which is a use-after-free. A late\ndone interrupt can also start the next transfer queued behind the\nfailed one.\n\nStop both DMA engines, drain the pending done/abort interrupt status\nand synchronize the DMA IRQs before dropping the in-progress state and\nthe transfer pointers, and re-enable the engines afterwards so that\nsubsequent transfers keep working. The engines are only turned back on\nonce both were confirmed to have stopped: re-enabling an engine that\nfailed to stop would cancel the pending stop request and let it keep\nrunning into buffers the SPI core is about to unmap or free, which is\nexactly the window this patch closes. An engine that failed to stop is\nleft disabled, as the abort paths already do.\n\nThe DMA interrupt status and mask registers are shared between the two\nSPI instances, so the cleanup drains only this instance\u0027s done/abort\nstatus bits instead of masking the interrupt lines, which would also\nsuppress the peer instance\u0027s completion interrupts.\n\nAlso make the DMA ISRs ignore interrupts while no transfer is in\nprogress so that a stray MSI after the cleanup can no longer act on\nthe cleared state.\n\nNo PCI1XXXX hardware was available for testing and QEMU has no model\nof this PCIe part, so the timeout path was exercised with a userspace\nreplica of the timeout branch and the DMA ISRs, with the register and\ninterrupt accesses mocked: on the unfixed code both a wedged engine\nthat clears after the timeout and a late done interrupt touch the\nfreed transfer state, while with this fix applied neither does and an\nengine that failed to stop is left disabled. The module was also\nloaded and unloaded in a QEMU x86_64 guest running a kernel with this\nfix applied.\n\nFixes: 9538edeb72c9 (\"spi: mchp-pci1xxxx: DMA support for copying data to and from SPI Buf\")\nCc: stable@vger.kernel.org # 6.8+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261016020036.1333548-1-liuwb@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e2f4edfc061e493fddde16c4bbe1c4f230f41e4a", "tree": "51b00ae8bdc3bc685a2d28fe05796a1d76cca938", "parents": [ "f8334fdfd858c27f090ce597806794e4a08c9f4f" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Wed Oct 14 20:39:13 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 23:24:51 2026 +0100" }, "message": "spi: amd: fix len\u003d\u003d0 underflow and FIFO overflow\n\namd_spi_fifo_xfer() unconditionally decrements xfer-\u003elen when a tx_buf\nis present. The SPI core does not reject zero-length transfers, so a\ntransfer submitted through the SPI_IOC_MESSAGE ioctl with len \u003d\u003d 0 and\na tx_buf makes the u32 len wrap to 0xFFFFFFFF, and the following\nper-byte loop writes far past the FIFO window.\n\nThe driver also never checks the cumulative FIFO offset against\nAMD_SPI_FIFO_SIZE. The core splits each transfer down to the\ncontroller\u0027s max transfer size but does not bound the total message\nlength, so a message of several transfers whose total exceeds the FIFO\noverflows it with out-of-bounds MMIO writes (tx) and reads (rx).\n\nSkip zero-length transfers and reject any transfer that would run past\nthe end of the FIFO window.\n\nTested with a user-space replica of the fifo_xfer length arithmetic\n(ASAN build): a zero-length transfer with tx_buf makes len-- wrap to\n0xffffffff, and skipping zero-length transfers avoids the wrap. No AMD\nSPI hardware was available, so the FIFO bound check was verified by\ninspection against AMD_SPI_FIFO_SIZE.\n\nFixes: bbb336f39efc (\"spi: spi-amd: Add AMD SPI controller driver support\")\nCc: stable@vger.kernel.org # 5.8+\nReviewed-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261014-spi-amd-fifo-fix-v1-1-9fec9ab753e8@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "f8334fdfd858c27f090ce597806794e4a08c9f4f", "tree": "952b74e8302831291d85e5e8c9d0435f5692a8ce", "parents": [ "9e44f0df3fff215d9033089e85980048c3ac132a" ], "author": { "name": "Abraham Zukor", "email": "abe@maticrobots.com", "time": "Sat Oct 10 12:54:05 2026 -0700" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:49:52 2026 +0100" }, "message": "spi: tegra114: initialize native chip selects inactive\n\ntegra_spi_probe() initializes SPI_COMMAND1 with only SPI_M_S, leaving\nCS_POL_INACTIVE clear for every chip select. This drives every native\nactive-low chip select low until tegra_spi_setup() runs for that device.\n\nSPI children are registered and probed one at a time. A synchronous\nprobe of an earlier child can therefore transfer while a later child\u0027s\nchip select is still asserted. On a Tegra234 system with active-low\ndevices on CS0 and CS1, this caused both devices to be selected when the\nCS1 device probed first. Its initialization then intermittently failed.\nA logic analyzer showed CS0 remained low throughout the CS1 transfer and\nwent high only after the CS1 probe failed.\n\nWalk the controller\u0027s device tree children before SPI_COMMAND1 is\nwritten and set CS_POL_INACTIVE for each valid chip select without\nspi-cs-high. That way the line is already deasserted when the first\nchild transfers and does not change level when setup runs.\n\nDisabled children are walked too. The core only registers available\nchildren, so tegra_spi_setup() never runs for a disabled one and probe\nis the only chance to park its chip select at the level its hardware\nneeds.\n\nIf an enabled child shares a chip select with disabled ones, its\npolarity takes priority. If only disabled children use a chip select\nand they disagree, warn and leave the line inactive high.\n\nFixes: f333a331adfa (\"spi/tegra114: add spi driver\")\nAssisted-by: Claude:Opus-5\nSigned-off-by: Abraham Zukor \u003cabe@maticrobots.com\u003e\nLink: https://patch.msgid.link/20261010195503.623287-1-abe@maticrobots.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "b0f0c761ed3fa10754dc9295db85374a173123b7", "tree": "9326f59d8a86885dc2f2091d4e4480c3844a5db8", "parents": [ "4eac392e48fc0ddc6d5ac10d57aac7245c17d0d9" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Oct 09 12:16:36 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:37:15 2026 +0100" }, "message": "spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()\n\nBoth fsl_lpspi_dma_transfer() and fsl_lpspi_pio_transfer() only return\nnegative error values in case of error or 0 in case of success.\n\nDirectly return ret, there is no need to check for positive error values\nand return them as 0.\n\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nLink: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-2-2d4549d5205e@pengutronix.de\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "4eac392e48fc0ddc6d5ac10d57aac7245c17d0d9", "tree": "fe415f2d8187f9ae16c9f9d2f7a6260eca0124f8", "parents": [ "59eb22641f0c526dd064390b11cff99ae87c2858" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Oct 09 12:16:35 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:37:15 2026 +0100" }, "message": "spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible\n\nInstead of passing a spi_controller pointer to functions and using\nspi_controller_get_devdata() to get the struct fsl_lpspi_data pointer,\ndirectly pass a struct fsl_lpspi_data pointer.\n\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nLink: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-1-2d4549d5205e@pengutronix.de\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "59eb22641f0c526dd064390b11cff99ae87c2858", "tree": "e00bad447f6b723f90928c8a656cae2f7283cc28", "parents": [ "8980bc573ae2d2b9d86d76aeb86c76e1597070bf" ], "author": { "name": "Richard Leitner", "email": "richard.leitner@linux.dev", "time": "Thu Oct 15 22:58:00 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 22:26:02 2026 +0100" }, "message": "spi: imx: fix slab corruption from undersized DMA bounce buffers\n\nSince commit faa8e404ad8e (\"spi: imx: support dynamic burst length for\nECSPI DMA mode\"), the driver allocates its private DMA TX/RX buffers\nwith kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but\nmaps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e.\nrounded up to the cache line size. As a result, the DMA API operates on\nmemory beyond the end of the allocation.\n\nThis was observed on a custom i.MX8MP platform with an mcp251xfd CAN\ncontroller under heavy RPMSG load, as a series of refcount_t warnings\ntriggered from rpmsg_recv_done() in virtio_rpmsg_bus:\n\n refcount_t: addition on 0; use-after-free.\n refcount_t: underflow; use-after-free.\n refcount_t: saturated; leaking memory.\n\nLeading finally to an \"Unable to handle kernel paging request\" oops.\nReproducing this problem took between 30 minutes and roughly 30 hours\nunder the same workload.\n\nHardware watchpoints on the refcount of a struct rpmsg_endpoint showed\nit was overwritten from 2 to 1 by __pi_memcpy_generic() in the\nirq/155-spi2.0 thread. Additionally it was found that a \"normal\"\nrpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In\nthe error case the same sequence took about 215µs +/-10µs. Based on\nthis, an LLM was used to identify the size mismatch fixed here.\n\nAllocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover\nthe full mapped length, and use the same length for\ndma_sync_single_for_cpu() to stay consistent with map and unmap.\n\nWith this patch applied, the same workload ran for more than 200 hours\nwithout the problem reproducing.\n\nAssisted-by: LLM\nFixes: faa8e404ad8e (\"spi: imx: support dynamic burst length for ECSPI DMA mode\")\nCc: stable@vger.kernel.org\nSigned-off-by: Richard Leitner \u003crichard.leitner@linux.dev\u003e\nLink: https://patch.msgid.link/20261015-fix-spi-imx-dma-v1-1-e28259671392@linux.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "9e44f0df3fff215d9033089e85980048c3ac132a", "tree": "643d75463488cc8d69466e319b320e6f8994a3c2", "parents": [ "f0be928a41384ea93c876364f360779f70359249" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Thu Oct 15 10:16:12 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 19:17:17 2026 +0100" }, "message": "spi: bcm-qspi: reject oversized dummy bytes in mspi exec_mem_op\n\nbcm_qspi_mspi_exec_mem_op() builds a local command buffer cmd[6]\nholding one opcode byte, up to four address bytes and one spare\nbyte, and sets t[0].len \u003d op-\u003eaddr.nbytes + op-\u003edummy.nbytes + 1.\nbcm_qspi_exec_mem_op() only validates op-\u003eaddr.nbytes \u003c\u003d 4 and never\nbounds op-\u003edummy.nbytes, which spi_mem_check_op() also leaves\nunrestricted. With addr.nbytes \u003d 4 and dummy.nbytes \u003e\u003d 2 the length\nbecomes 7 or more, so write_to_hw() reads past cmd[] on the kernel\nstack and pushes the leaked bytes into the hardware TXRAM.\n\nReject operations whose dummy phase does not fit the remaining byte\nof cmd[] by requiring op-\u003edummy.nbytes \u003c\u003d 1, so such transfers fall\nback to the generic SPI path instead of overrunning the buffer.\n\nReviewed-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nFixes: 5f195ee7d830c (\"spi: bcm-qspi: Implement the spi_mem interface\")\nCc: stable@vger.kernel.org # 4.18+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261015-bcm-qspi-dummy-bytes-v1-1-c319da3c2497@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "f0be928a41384ea93c876364f360779f70359249", "tree": "f01bc2785bd3cfe7669d667f86b3712bbc9d70db", "parents": [ "c126e07bde21c518f1356937ac240500d1bc81c0" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Thu Oct 15 10:10:12 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 15:08:21 2026 +0100" }, "message": "spi: npcm-fiu: limit UMA data_size to the 16-byte staging buffer\n\nnpcm_fiu_uma_read() and npcm_fiu_uma_write() use a 16-byte on-stack\nstaging buffer (u32 data_reg[4]) and move data_size bytes to or from\nit. data_size comes straight from op-\u003edata.nbytes, which is supplied\nby the SPI MEM operation and is not bounded by the driver:\nnpcm_fiu_exec_op() only validates op-\u003eaddr.nbytes, and no\nadjust_op_size callback truncates the transfer to the controller FIFO\nsize.\n\nA SPI MEM operation with addr.nbytes \u003d\u003d 0 and data.nbytes \u003e 16\ntherefore overflows data_reg[] on the kernel stack (write path) or\nreads past it (read path), corrupting the stack.\n\nReject data_size larger than the staging buffer in both UMA helpers\nby returning -EOPNOTSUPP, so spi_mem falls back to the generic SPI\nmessage path. The chunked path in npcm_fiu_manualwrite() always passes\nat most CHUNK_SIZE bytes, so it is unaffected.\n\nFixes: ace55c411b11 (\"spi: npcm-fiu: add NPCM FIU controller driver\")\nCc: stable@vger.kernel.org # 5.4+\nReviewed-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261015-npcm-fiu-uma-datasize-v1-1-7dee91cadee6@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "c126e07bde21c518f1356937ac240500d1bc81c0", "tree": "c3e9877d75e91ad4ad055f417a068b5254938b77", "parents": [ "7db773075501248893c22b11bedc6745d6d0be45" ], "author": { "name": "Sahaj Chaudhari", "email": "sahaj123.sc@gmail.com", "time": "Thu Oct 15 12:13:41 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 13:51:12 2026 +0100" }, "message": "spi: omap2-mcspi: handle DMA setup failures\n\nThe DMA paths ignore failures from dmaengine_slave_config(), descriptor\npreparation and dmaengine_submit(), and carry FIXME comments about\nfalling back to PIO. A failed setup can leave a half-started transfer\nor wait for a completion that never arrives.\n\nCheck each step and clean up with dmaengine_terminate_sync() on error.\nPrepare both descriptors before issuing either channel. Fall back to\nPIO only for host-mode transfers that have a TX buffer, when no DMA has\nbeen started and cleanup succeeded. RX-only and target-mode transfers\nreturn the error instead, since the bus may already be clocking.\n\nThe FIFO is enabled before the DMA attempt, but the PIO path polls\nper-word TXS/RXS and does not expect FIFO mode. Disable the FIFO, with\nthe channel off while its bits change, before falling back.\n\nTested on an AM642 board with a TI 6.12.57 vendor kernel built with\nthis patch and booted from RAM. On a McSPI bus using DMA, 200\niterations of 4096-byte TX and 1024-byte RX spidev transfers completed\nwith no errors, timeouts or kernel warnings. With a temporary change\nthat fails every DMA-sized TX setup, 60 spidev writes fell back to PIO\nwith no errors or timeouts. That test used a bus with no device\nattached and did not show a difference with and without the FIFO\ndisable, which is based on reading the code.\n\nFixes: 53741ed8f0a3 (\"spi: omap2-mcspi: add DMA engine support\")\nLink: https://lore.kernel.org/r/20250914022132.319227-1-alex.t.tran@gmail.com\nSigned-off-by: Sahaj Chaudhari \u003csahaj123.sc@gmail.com\u003e\nLink: https://patch.msgid.link/20261015064341.1100422-1-sahaj123.sc@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "7db773075501248893c22b11bedc6745d6d0be45", "tree": "53dbac17e41c92167d7a6e263f56ecdae4851e64", "parents": [ "17515973d1e6435e6b6bf3c1ea81d28228cdb5b5" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Wed Oct 14 22:18:50 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Oct 15 12:26:16 2026 +0100" }, "message": "spi: jcore: fix divide-by-zero when speed_hz is zero\n\njcore_spi_baudrate() computes hw-\u003eclock_freq / 2 / speed without\nvalidating speed. The SPI core fills transfer.speed_hz from\nspi-\u003emax_speed_hz when it is zero, and jcore_spi_probe() never sets\nhost-\u003emax_speed_hz, so the clamp in __spi_setup() is skipped. A\nspi_device created via the sysfs new_device interface (or a DT node\nwithout spi-max-frequency) therefore has max_speed_hz \u003d\u003d 0, and any\nSPI_IOC_MESSAGE transfer reaches jcore_spi_baudrate() with speed \u003d\u003d 0,\ncausing a division by zero and a kernel panic.\n\nClamp speed to a minimum of 1 Hz before the division so the divisor is\nnever zero. The computed divider then truncates to the register field\nwidth and the transfer simply runs at the slowest supported rate.\n\nVerified by inspection of the __spi_setup() clamp and\n__spi_validate()\u0027s speed_hz handling; the division-by-zero path\nrequires the J-Core controller, which was not available.\n\nReviewed-by: Guanglei Zhu \u003czhugl3@xiaopeng.com\u003e\nFixes: 2cb1b3b3ac0a (\"spi: add driver for J-Core SPI controller\")\nCc: stable@vger.kernel.org # 4.9+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261014-spi-jcore-divzero-v1-1-a8205d30f2d1@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "17515973d1e6435e6b6bf3c1ea81d28228cdb5b5", "tree": "ae1a06e98ccda0680203db65e3d87f77a5299feb", "parents": [ "9d71f9fe5b5de916bded51343138b09b1eb103ed", "ef9690269999ddf9b204731baca1bd6b7aea1aa7" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Oct 14 16:43:40 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Oct 14 16:43:40 2026 +0100" }, "message": "spi: cadence-xspi: two memory-safety fixes in the slave-DMA paths\n\nWeibin Liu \u003cliuwb@xiaopeng.com\u003e says:\n\nWhile reviewing the slave-DMA handling of the Cadence XSPI driver I\nfound two ways in which memory the SPI core handed to the driver can be\noverrun:\n\n 1/2 both SDMA handlers copy the byte count reported by SDMA_SIZE_REG\n without checking it against the requested transfer length; a\n device reporting more bytes than were programmed makes the\n handlers walk past the end of the transfer buffers\n\n 2/2 the Marvell b0 transfer path points the SDMA buffers at a\n 10-byte stack scratch area for transfers without TX data;\n transfers longer than that overflow it in both directions and\n clock out uninitialized stack bytes to the attached device\n\nThe two patches are independent of each other and each carries its own\nFixes: tag, so they can be queued separately.\n\nTested on x86_64: with both patches applied the driver builds, loads\nand unloads cleanly; no xSPI controller is available in this\nenvironment to exercise the slave-DMA paths on hardware. Details are\nin the notes of the individual patches.\n\nLink: https://patch.msgid.link/20260929081146.41041-1-liuwb@xiaopeng.com\n" }, { "commit": "ef9690269999ddf9b204731baca1bd6b7aea1aa7", "tree": "6fb72358f657de84ce40851230bc2bd9edf95542", "parents": [ "ea9854a169e9c1437df8829bea21c2f2e80b137c" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Tue Sep 29 16:11:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Oct 14 16:43:39 2026 +0100" }, "message": "spi: cadence-xspi: fix stack buffer overflow in the Marvell b0 path\n\ntransfer_one_message_b0() falls back to a 10-byte stack buffer for\ntransfers which carry no TX data and points both in_buffer and\nout_buffer into it.\n\nWith a transfer longer than 10 bytes the SDMA branch of the loop moves\nup to MRVL_XFER_QWORD_COUNT * MRVL_XFER_QWORD_BYTECOUNT (256) bytes\nthrough those pointers and then advances them by the same amount, so\nboth directions overflow the scratch buffer: a read transaction copies\nSDMA data past the end of the buffer, a write transaction sends stack\ncontents from beyond it to the SPI bus.\n\nSize the scratch buffer for the largest chunk the loop can request,\nkeep the buffer pointers pinned to it when the message does not carry\nthe corresponding TX or RX data, and only advance the pointers which\nreference real transfer buffers. Also zero-initialize the scratch\nbuffer so that padding bytes sent for TX-less transfers no longer leak\nuninitialized stack contents.\n\nFixes: 5cb7651f78e1 (\"Marvell HW overlay support for Cadence xSPI\")\nCc: stable@vger.kernel.org # 6.11+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20260929081146.41041-3-liuwb@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ea9854a169e9c1437df8829bea21c2f2e80b137c", "tree": "e2b248b1d41e16a6f4c3d215cddfc025d1eb7063", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Tue Sep 29 16:11:44 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Oct 14 16:43:38 2026 +0100" }, "message": "spi: cadence-xspi: reject SDMA transfers larger than the requested length\n\nThe XSPI controller reports the size of the slave-DMA transaction\nthrough SDMA_SIZE_REG. Both SDMA handlers take this register at face\nvalue and copy the reported number of bytes between the SDMA FIFO and\nthe transfer buffers, without checking it against the length of the\ntransfer that was actually requested.\n\nWhile cdns_xspi_adjust_mem_op_size() clamps the size of the operations\nissued by the SPI core, the device can still report a bigger SDMA size\nthan what was programmed, which makes the handlers read from or write\nto memory beyond the end of the transfer buffers.\n\nTrack the number of bytes requested for the current data phase in a new\nsdma_xfer_len field, set by cdns_xspi_send_stig_command() and by the\nMarvell b0 transfer path, and reject any SDMA size that exceeds it.\n\nFixes: a16cc8077627 (\"spi: cadence: add support for Cadence XSPI controller\")\nCc: stable@vger.kernel.org # 5.16+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20260929081146.41041-2-liuwb@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "8980bc573ae2d2b9d86d76aeb86c76e1597070bf", "tree": "3c5acec5bc5e695414bcaddbd962858563f648e3", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Carlos Jones Jr", "email": "carlosjr.jones@analog.com", "time": "Fri Oct 02 16:55:40 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 23:19:59 2026 +0100" }, "message": "spi: tegra114: assert CS GPIO for every transfer in a message\n\nThe driver provides its own transfer_one_message() and therefore drives\nthe chip-select GPIO itself rather than through the SPI core. The GPIO is\nasserted only in the is_first_of_msg path of\ntegra_spi_setup_transfer_one(), but tegra_spi_transfer_end() deasserts it\nwhenever a transfer has cs_change set. For a multi-transfer message whose\nearlier transfers request cs_change -- for example a register read that\nsends the address in one transfer and clocks the data back in the next --\nthe CS GPIO is released after the first transfer and never re-asserted,\nso the remaining transfers are clocked with chip-select inactive and the\nperipheral never drives the bus.\n\nThis was observed with an ADIS16470 IMU (adis16475 driver), whose\nregister read is a two-transfer, cs_change-framed exchange: a logic\nanalyzer showed the data frame clocked with CS high, and the driver read\n0 while the device drove 0x4056 on the wire.\n\nRe-assert the CS GPIO for every transfer so that multi-transfer messages\nkeep chip-select active across the whole message. gpiod_set_value() is\nidempotent and polarity-aware, so this is a no-op for the first transfer\nand for messages that keep CS asserted throughout.\n\nFixes: 63c1440596ff (\"spi: tegra114: add support for gpio based CS\")\nSigned-off-by: Carlos Jones Jr \u003ccarlosjr.jones@analog.com\u003e\nLink: https://patch.msgid.link/20261002085540.1625-1-carlosjr.jones@analog.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "9d71f9fe5b5de916bded51343138b09b1eb103ed", "tree": "bd32caf4cf660132bb6919af0d52a81b76fbe6e7", "parents": [ "dcdf23067adf6ccee5c0e2649430f00f484827f0" ], "author": { "name": "Hongjian Dai", "email": "daihongjian@kylinsec.com.cn", "time": "Thu Oct 08 20:47:04 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 21:40:45 2026 +0100" }, "message": "spi: meson-spicc: fix invalid DMA unmap on mapping failure\n\nmeson_spicc_dma_unmap() decided whether a buffer had to be unmapped by\ntesting its DMA address for non-zero. On a mapping failure\ndma_map_single() returns DMA_MAPPING_ERROR (typically non-zero), so the\nerror path in meson_spicc_transfer_one() passed that error value to\ndma_unmap_single(), unmapping an address which was never mapped. The\nsame happened for t-\u003erx_dma on TX mapping failure, which is not written\nat all.\n\nInitialize both addresses to DMA_MAPPING_ERROR before mapping and use\ndma_mapping_error() to decide, so only buffers which were actually\nmapped are unmapped.\n\nFixes: 18197e98353d (\"spi: meson-spicc: add DMA support\")\nSigned-off-by: Hongjian Dai \u003cdaihongjian@kylinsec.com.cn\u003e\nLink: https://patch.msgid.link/35143466F2F5166F+20261008124704.87708-1-daihongjian@kylinsec.com.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "dcdf23067adf6ccee5c0e2649430f00f484827f0", "tree": "eff028de08ca38f69b598ad993ca74ba4e47b0ed", "parents": [ "ce80ce7e0dc981039fb77a30c54b1ce32aebfd0a", "65f9474caced3d765ccdb69d6e67641051ad3b5e" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:40 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:40 2026 +0100" }, "message": "spi: replace strcpy(), sprintf() and simple_strtoul() with strscpy(), snprintf() and kstrtoul()\n\nAayush Kumar \u003ccode@aayushk.dev\u003e says:\n\nReplace strcpy(), sprintf() and simple_strtoul() with their safer\nmodern equivalents (strscpy, snprintf, kstrtoul).\n\nLink: https://patch.msgid.link/20261009133609.579046-1-code@aayushk.dev\n" }, { "commit": "65f9474caced3d765ccdb69d6e67641051ad3b5e", "tree": "4583f5c662206e9805d172201cf2d6d8f4a233e5", "parents": [ "50f3d77e805f3d77b0037b73d536adb5f66d6298" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:09 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:39 2026 +0100" }, "message": "spi: s3c64xx: Use snprintf() instead of sprintf()\n\nUse snprintf() instead of sprintf() to avoid potential buffer\noverflows when formatting the clock name.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133609.579046-6-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "50f3d77e805f3d77b0037b73d536adb5f66d6298", "tree": "0053290cc2d0c4eb85af86a8b815288e17b28288", "parents": [ "9a6b86cee9d711178f51f7dbea6ff2cbad32bb30" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:08 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:39 2026 +0100" }, "message": "spi: omap2-mcspi: Use snprintf() instead of sprintf()\n\nUse snprintf() instead of sprintf() to avoid potential buffer\noverflows when formatting DMA channel names.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133609.579046-5-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "9a6b86cee9d711178f51f7dbea6ff2cbad32bb30", "tree": "43709969ae2ccada14d6a444cf2c2ea0e16ad4c8", "parents": [ "ae6056b248ebbcbdd0f0134678ce77b165edca1a" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:07 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:39 2026 +0100" }, "message": "spi: tle62x0: Use kstrtoul() instead of simple_strtoul()\n\nUse the recommended kstrtoul() instead of the deprecated\nsimple_strtoul(). Check the return value and reject invalid values.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133609.579046-4-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ae6056b248ebbcbdd0f0134678ce77b165edca1a", "tree": "25d2705c0b762bbb41b4414120ac2ea0dc361399", "parents": [ "e9b641d9296308ede48d4b6b4ef10061a5e86f99" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:06 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:38 2026 +0100" }, "message": "spi: lm70llp: Use strscpy() instead of strcpy()\n\nUse a safer function strscpy() instead of strcpy() for copying to\narrays. Only idiomatic code replacement, and no functional changes.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133609.579046-3-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e9b641d9296308ede48d4b6b4ef10061a5e86f99", "tree": "30608a78b549b04f5786fe92168625d1356b481a", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:05 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:51:38 2026 +0100" }, "message": "spi: butterfly: Use strscpy() instead of strcpy()\n\nUse a safer function strscpy() instead of strcpy() for copying to\narrays. Only idiomatic code replacement, and no functional changes.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133609.579046-2-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ce80ce7e0dc981039fb77a30c54b1ce32aebfd0a", "tree": "db33beb0cb17c39ed83b24f7572089f059afc1ba", "parents": [ "0fe4573c822c4c9152e2fd5269ab85410c9e458f", "a0b70663dddf64df0d4eca47127aab3c6fc670ec" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:50:16 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:50:16 2026 +0100" }, "message": "spi: use devm_platform_ioremap_resource() in sh-hspi and jcore\n\nAayush Kumar \u003ccode@aayushk.dev\u003e says:\n\nConvert these two SPI drivers to the devm_platform_ioremap_resource()\nhelper to simplify the probe paths.\n\nLink: https://patch.msgid.link/20261009132421.557758-1-code@aayushk.dev\n" }, { "commit": "a0b70663dddf64df0d4eca47127aab3c6fc670ec", "tree": "1641ab51f0c3916c98fdbd4355cd5d3b0e7cb131", "parents": [ "e796a187fbe32593c426c86777e5ee9fb65530db" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 18:54:21 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:50:15 2026 +0100" }, "message": "spi: jcore: Use devm_platform_ioremap_resource()\n\nUse the devm_platform_ioremap_resource() helper instead of calling\nplatform_get_resource(), devm_request_mem_region() and devm_ioremap()\nseparately.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009132421.557758-3-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e796a187fbe32593c426c86777e5ee9fb65530db", "tree": "6ec75a7268288c9e5c84092fffc34ac53e1dabcd", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 18:54:20 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:50:15 2026 +0100" }, "message": "spi: sh-hspi: Use devm_platform_ioremap_resource()\n\nUse the devm_platform_ioremap_resource() helper instead of calling\nplatform_get_resource() and devm_ioremap() separately.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009132421.557758-2-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0fe4573c822c4c9152e2fd5269ab85410c9e458f", "tree": "a174866e14b779afbbe0cbd6df2f35b3810d7078", "parents": [ "3716c71d1c7783c6d731092403eb9f44c2a3a995" ], "author": { "name": "Weibin Liu", "email": "liuwb@xiaopeng.com", "time": "Tue Oct 13 11:17:17 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:42:20 2026 +0100" }, "message": "spi: ljca: validate the response length before copying the data\n\nljca_spi_read_write() only checks that the response from the adapter\ncarries the packet header and a non-zero payload length before copying\nr_packet-\u003elen bytes from the response into the transfer buffer.\n\nThe payload length is taken from the packet the device sent back and is\nneither bounded by the number of bytes actually received nor by the\nsize of the requested transfer: a misbehaving adapter can announce a\npayload larger than what it actually sent, and the memcpy then reads\npast the end of the 60-byte input buffer and writes past the end of the\ncaller\u0027s transfer buffer.\n\nCheck that the response carries the full header before reading\nr_packet-\u003elen, then reject responses whose payload is not contained in\nthe data received or is longer than the requested transfer.\n\nFixes: caee8e38da67 (\"spi: Add support for Intel LJCA USB SPI driver\")\nCc: stable@vger.kernel.org # 6.8+\nSigned-off-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20261013031717.3933277-1-liuwb@xiaopeng.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "3716c71d1c7783c6d731092403eb9f44c2a3a995", "tree": "c78819e9c0b5b26d9a0f5eaaa53fe42dcbac6d37", "parents": [ "d947a804980955e9de5f15da7d638d5915371efb" ], "author": { "name": "Miquel Raynal", "email": "miquel.raynal@bootlin.com", "time": "Thu Oct 01 18:45:57 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 20:33:54 2026 +0100" }, "message": "spi: cadence-qspi: Prevent SPI NAND continuous reads\n\nTI AM62Ax errata i2351, entitled \"OSPI: Direct Access Controller (DAC)\ndoes not support Continuous Read mode with NAND Flash\", explains that\nthe CS can be deasserted almost at any time during a transfer (basically\nthere is an interconnect arbitration every 1023 byte). This is an\nexpected internal behaviour of the controller, but this leads to\nspurious CS deasserts. These are totally forbidden during SPI NAND\ncontinuous read transfers, because they indicate an end of transfer and\nthe continuous read is then stopped on the flash side.\n\nI initially tried to query the flash type and geometry to decide whether\nto apply a spi message size limit (there is a spi helper for that) but\nwe cannot reliably get up to the MTD structure to discriminate if it is\na NOR or a NAND we are playing with (it is not relevant to limit SPI NOR\ntransfers, they are not affected). If we actually take this path, what\nlimitation shall we enforce? The errata mentions 1023B, this is super\nlow, less than a typical page size (about 2k or 4k, for most of them),\nso this is not usable. On my side, I only observed this problem on a\n2-page read in octal DTR mode with more than 12 dummy cycles. The\nwritesize summed with the oobsize could be a relevant boundary, but it\nis still quite arbitrary. Hence, I opted for implementing a controller\ncapability flag, which then is used to decide whether the SPI NAND\ncontinuous read feature can be enabled.\n\nSigned-off-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://patch.msgid.link/20261001-winbond-v7-0-rc1-cadence-cont-read-v2-1-703e040b2d07@bootlin.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "d947a804980955e9de5f15da7d638d5915371efb", "tree": "ed0abb508efa61e7821c980574f692a2172d49b9", "parents": [ "c9bf2cba47d5da9fb16102c9be2a63e978523183", "18febc10a3538b9baa2f6e4481b434f20fdbd93c" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 19:09:57 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 19:09:57 2026 +0100" }, "message": "spi: axi-spi-engine: fix stale SYNC IRQ pending\n\nJonathan Santos \u003cJonathan.Santos@analog.com\u003e says:\n\nBoth spi_engine_setup() and spi_engine_trigger_enable() send a SYNC(1)\ncommand and poll SYNC_ID, but never clear INT_PENDING[SYNC] afterward.\nThis leaves a stale pending bit that fires spuriously when INT_SYNC is\nenabled later by some driver, causing premature transfer completion at\nlow SPI clock frequencies (more likely). Fix both functions by clearing\nthe pending bit after polling.\n\nLink: https://patch.msgid.link/cover.1791361360.git.Jonathan.Santos@analog.com\n" }, { "commit": "18febc10a3538b9baa2f6e4481b434f20fdbd93c", "tree": "ee9e44bc34dd19392a9fc5a69f776da99043c34e", "parents": [ "ea29c686f96adcb505071ef228ba8047dc951fac" ], "author": { "name": "Jonathan Santos", "email": "Jonathan.Santos@analog.com", "time": "Wed Oct 07 05:52:46 2026 -0300" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 19:09:56 2026 +0100" }, "message": "spi: axi-spi-engine: fix stale SYNC IRQ pending in trigger_enable\n\nspi_engine_trigger_enable() sends SYNC(1) and polls SYNC_ID, it never\nclears the INT_PENDING[SYNC] bit afterward. This leaves a stale pending\ninterrupt that can fire spuriously when INT_SYNC is later enabled.\n\nSimillarly to the fix on spi_engine_setup(), clear INT_PENDING[SYNC]\nafter polling the SYNC_ID.\n\nFixes: 8fc13b822c74 (\"spi: axi-spi-engine: don\u0027t repeat mode config for offload\")\nReviewed-by: Nuno Sá \u003cnuno.sa@analog.com\u003e\nSigned-off-by: Jonathan Santos \u003cJonathan.Santos@analog.com\u003e\nLink: https://patch.msgid.link/8d3f421e07b6114aae55f964825dba6ac9151cf5.1791361360.git.Jonathan.Santos@analog.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ea29c686f96adcb505071ef228ba8047dc951fac", "tree": "2299fffe3391c1c9d52a303a6a6ec7b68abcc4b5", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Jonathan Santos", "email": "Jonathan.Santos@analog.com", "time": "Wed Oct 07 05:52:26 2026 -0300" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 19:09:56 2026 +0100" }, "message": "spi: axi-spi-engine: fix stale SYNC IRQ pending\n\nspi_engine_setup() sends a SYNC(1) command and polls SYNC_ID to confirm\nit was parsed by the FPGA, but never clears the corresponding interrupt\npending bit (INT_PENDING[SYNC]). When the first real SPI transfer starts\nand INT_SYNC is enabled, that stale pending bit fires immediately, causing\nthe IRQ handler to see the leftover SYNC_ID from setup, match it against\nthe current transfer\u0027s ID, and prematurely signal completion before the\nhardware finishes.\n\nThis race manifests at low SPI clock frequencies (~2-3 MHz), where the\nFPGA takes long enough to execute the transfer that handler is parsed\nbefore it finishes. At higher SCLK rates the transfer completes fast\nenough that the issue is masked.\n\nFix this by clearing INT_PENDING[SYNC] after the polled SYNC, ensuring no\nstale interrupt is left pending.\n\nReported-by: Dennis Heinzel \u003cdennis.heinzel@irs.systems\u003e\nCloses: https://ez.analog.com/linux-software-drivers/f/q-a/604145/axi-spi-engine-stale-sync-pending-can-complete-first-transfer-early-at-low-spi-clock-2-3-mhz\nFixes: 1d0ee0c9df31 (\"spi: axi-spi-engine: wait for completion in setup\")\nReviewed-by: Nuno Sá \u003cnuno.sa@analog.com\u003e\nSigned-off-by: Jonathan Santos \u003cJonathan.Santos@analog.com\u003e\nLink: https://patch.msgid.link/d3033a01a695c915e4dc5952dfe0587b2f77d733.1791361360.git.Jonathan.Santos@analog.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "c9bf2cba47d5da9fb16102c9be2a63e978523183", "tree": "189a0417b5b2ee6de516b8b50ebffeeeb5fc4827", "parents": [ "2da46f1e9b980a38bc6afd417322ca4963725e16", "d9d0f5b84cc3d05e89d78a5a5440e4f3d9c5e61b" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:23 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:23 2026 +0100" }, "message": "spi: dw: use threaded interrupt\n\nJisheng Zhang \u003cjszhang@kernel.org\u003e says:\n\nTo avoid blocking for an excessive amount of time, eventually impacting\non system responsiveness, hard interrupt handlers should finish\nexecuting in as little time as possible.\n\nUse threaded interrupt and move the SPI transfer handling to an\ninterrupt thread when non-native CS and host only.\n\nAfter that, since the dw_reader() and dw_writer() are called in\nthreaded ISR now, so we can delay the unmasking interrupts until no\nrx and tx action is taken, thus reduce the interrupt numbers further.\n\nTested with below two cmds\n./spidev_test -D /dev/spidev1.3 -s 30000000 -S 327680 -I 1\n\n./spidev_test -D /dev/spidev1.3 -s 30000000 -S 327680 -I 1000\n./rtla timerlat top -q -k -P f:95\n\nThe first cmd is to check the interrupt numbers optmizaion result, the\n2nd cmd group is to check the threaded interrupt improvement.\n\nBefore the patch:\neach 320KB spi spidev_test transfer triggers 33118 interrupts\n\nspidev_test reports ~22090 kbps\nand rtla reports:\n Timer Latency\n 0 00:00:37 | IRQ Timer Latency (us) | Thread Timer Latency (us)\nCPU COUNT | cur min avg max | cur min avg max\n 0 #9958 | 1 0 67 103394 | 6 4 2198 105031\n 1 #36902 | 1 0 1 18 | 5 4 5 29\n\nAfter the patch:\neach 320KB spi spidev_test transfer only triggers 1 interrupts\nspidev_test reports ~23520 kbps\nand now rtla reports:\n Timer Latency\n 0 00:00:58 | IRQ Timer Latency (us) | Thread Timer Latency (us)\nCPU COUNT | cur min avg max | cur min avg max\n 0 #58362 | 1 0 0 29 | 6 3 4 56\n 1 #58363 | 1 0 1 23 | 6 4 5 68\n\nIn summary:\nbefore the patch\tafter the patch\n33118 interrutps\t1 interrupts\t\treduced by 33117 times!\n103394 us max latency\t29 us max latency\treduced by 3564 times!\n22090 kbps rate\t\t23520 kbps rate\t\timproved by 6.5%\n\nLink: https://patch.msgid.link/20261005151739.25233-1-jszhang@kernel.org\n" }, { "commit": "d9d0f5b84cc3d05e89d78a5a5440e4f3d9c5e61b", "tree": "885d56b8348d26c0c2aea83d4c42daaae147a77c", "parents": [ "62d2ce4ee2f26029eef69b8b853edc5c60d4e53e" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Mon Oct 05 23:17:39 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:21 2026 +0100" }, "message": "spi: dw: use threaded interrupt and optimize the threaded ISR\n\nTo avoid blocking for an excessive amount of time, eventually impacting\non system responsiveness, hard interrupt handlers should finish\nexecuting in as little time as possible.\n\nUse threaded interrupt and move the SPI transfer handling to an\ninterrupt thread when non-native CS and host only.\n\nAfter that, since the dw_reader() and dw_writer() are called in\nthreaded ISR now, so we can delay the unmasking interrupts until no\nrx and tx action is taken, thus reduce the interrupt numbers further.\n\nTested with below two cmds\n./spidev_test -D /dev/spidev1.3 -s 30000000 -S 327680 -I 1\n\n./spidev_test -D /dev/spidev1.3 -s 30000000 -S 327680 -I 1000\n./rtla timerlat top -q -k -P f:95\n\nThe first cmd is to check the interrupt numbers optmizaion result, the\n2nd cmd group is to check the threaded interrupt improvement.\n\nBefore the patch:\neach 320KB spi spidev_test transfer triggers 33118 interrupts\n\nspidev_test reports ~22090 kbps\nand rtla reports:\n Timer Latency\n 0 00:00:37 | IRQ Timer Latency (us) | Thread Timer Latency (us)\nCPU COUNT | cur min avg max | cur min avg max\n 0 #9958 | 1 0 67 103394 | 6 4 2198 105031\n 1 #36902 | 1 0 1 18 | 5 4 5 29\n\nAfter the patch:\neach 320KB spi spidev_test transfer only triggers 1 interrupts\nspidev_test reports ~23520 kbps\nand now rtla reports:\n Timer Latency\n 0 00:00:58 | IRQ Timer Latency (us) | Thread Timer Latency (us)\nCPU COUNT | cur min avg max | cur min avg max\n 0 #58362 | 1 0 0 29 | 6 3 4 56\n 1 #58363 | 1 0 1 23 | 6 4 5 68\n\nIn summary:\nbefore the patch\tafter the patch\n33118 interrutps\t1 interrupts\t\treduced by 33117 times!\n103394 us max latency\t29 us max latency\treduced by 3564 times!\n22090 kbps rate\t\t23520 kbps rate\t\timproved by 6.5%\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://patch.msgid.link/20261005151739.25233-5-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "62d2ce4ee2f26029eef69b8b853edc5c60d4e53e", "tree": "dca1755ebe502b12e9db257509c1ef634660a918", "parents": [ "ab30c5cdf45777a72f1f7facb03bfce3c1742e38" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Mon Oct 05 23:17:38 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:20 2026 +0100" }, "message": "spi: dw: restore previous irq handling behavior when !ctlr-\u003ecur_msg\n\nRecent \"enhanced\" support changes the dw_spi_irq() behavior a bit\nwhen !!ctlr-\u003ecur_msg:\n\n if (!ctlr-\u003ecur_msg \u0026\u0026 dws-\u003etransfer_handler \u003d\u003d dw_spi_transfer_handler) {\n dw_spi_mask_intr(dws, 0xff);\n return IRQ_HANDLED;\n }\n\nBut it misses the dma case, where the transfer_handler \u003d\u003d\ndw_spi_dma_transfer_handler, so this changes the previous long time\nworking behavior, let\u0027s restore the previous handling by only filtering\nout the dw_spi_enh_handler.\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nReviewed-by: Changhuang Liang \u003cchanghuang.liang@starfivetech.com\u003e\nLink: https://patch.msgid.link/20261005151739.25233-4-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ab30c5cdf45777a72f1f7facb03bfce3c1742e38", "tree": "9985b806297ac10abefa3a532824e3895a9cf3ec", "parents": [ "3e3d3f96213dbc530a122b2e66a65859b2a94d2a" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Mon Oct 05 23:17:37 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:19 2026 +0100" }, "message": "spi: dw: remove duplicated \"!rx_len \u0026\u0026 !tx_len\" handling from dw_spi_irq\n\ndw_spi_irq() need not handle enhanced-transfer\u0027s \"!rx_len \u0026\u0026 !tx_len\"\ncase as that state is already handled by dw_spi_enh_handler()\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nReviewed-by: Changhuang Liang \u003cchanghuang.liang@starfivetech.com\u003e\nLink: https://patch.msgid.link/20261005151739.25233-3-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "3e3d3f96213dbc530a122b2e66a65859b2a94d2a", "tree": "3b3aeb2e8bc212bb21eb2da0996896573bb62793", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Mon Oct 05 23:17:36 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:37:19 2026 +0100" }, "message": "spi: dw: remove useless dws-\u003etransfer_handler check\n\ntransfer_handler is initialized before any DW SPI interrupt is\nunmasked. While the IRQ is registered but the handler is NULL,\ndw_spi_hw_init() has all DW SPI interrupts disabled. Therefore\ndw_spi_irq() cannot observe a DW SPI interrupt with a NULL\ntransfer_handler.\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://patch.msgid.link/20261005151739.25233-2-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "2da46f1e9b980a38bc6afd417322ca4963725e16", "tree": "f4cbbb924c956cec54dd19db18677430881d49cb", "parents": [ "90001ddc6cbe4d3fbc69f72ca4bad54e70a4c064" ], "author": { "name": "Gabor Juhos", "email": "j4g8y7@gmail.com", "time": "Mon Oct 05 19:18:50 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 18:17:43 2026 +0100" }, "message": "spi: spi-qpic-snand: skip BBM copy on regular raw reads\n\nTrying to read the raw flash contents with nanddump, the second byte\nof the OOB area contains 0xff instead of the real data in the flash.\nThis happens because the qcom_spi_read_last_cw() function unconditionally\ncopies the bad block marker into the second byte of the output buffer.\n\nAdd a new flag to the controller\u0027s private data structure, and set it\nwhen only the first two bytes of the OOB area being read in raw mode.\nAlso change the bad block copying code to run only when the flag is set.\n\nThis ensures that the SPI NAND framework still can read the BBM bytes,\nbut on regular raw read, the output does not contain the duplicated\nmarker byte.\n\nFixes: 7304d1909080 (\"spi: spi-qpic: add driver for QCOM SPI NAND flash Interface\")\nSigned-off-by: Gabor Juhos \u003cj4g8y7@gmail.com\u003e\nLink: https://patch.msgid.link/20261005-qpic-snand-skip-bbm-copy-v1-1-04f6aeda4044@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "90001ddc6cbe4d3fbc69f72ca4bad54e70a4c064", "tree": "4faf6e3bfad3694c579f504c2260c1765b63a146", "parents": [ "88c3e297eeeaa8512964aae38e699ae0de1b3d53", "506fbac9274c0cfd3dc1b529ab5be0ddf9085e34" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 00:19:17 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 00:19:17 2026 +0100" }, "message": "spi: use kstrtoul() and snprintf()\n\nAayush Kumar \u003ccode@aayushk.dev\u003e says:\n\nReplace simple_strtoul() with kstrtoul() and sprintf() with snprintf()\nin three SPI drivers.\n\nLink: https://patch.msgid.link/20261010083504.26261-1-code@aayushk.dev\n" }, { "commit": "506fbac9274c0cfd3dc1b529ab5be0ddf9085e34", "tree": "c427f080aed0e12111fe91e7bf6754f6dffe94a7", "parents": [ "9efc388655e4abc428368b6d5f47ddc051539faf" ], "author": { "name": "Aayush Kumar", "email": "aayushkmx@gmail.com", "time": "Sat Oct 10 14:05:04 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 00:19:16 2026 +0100" }, "message": "spi: s3c64xx: Use snprintf() instead of sprintf()\n\nUse snprintf() instead of sprintf() to avoid potential buffer\noverflows when formatting the clock name.\n\nSigned-off-by: Aayush Kumar \u003caayushkmx@gmail.com\u003e\nLink: https://patch.msgid.link/20261010083504.26261-4-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "9efc388655e4abc428368b6d5f47ddc051539faf", "tree": "11b0eee7e3c132f06693ad907f110b70216501ac", "parents": [ "54f4db17f9d335bf2ed84c70906b95487d0ef1a0" ], "author": { "name": "Aayush Kumar", "email": "aayushkmx@gmail.com", "time": "Sat Oct 10 14:05:03 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 00:19:16 2026 +0100" }, "message": "spi: omap2-mcspi: Use snprintf() instead of sprintf()\n\nUse snprintf() instead of sprintf() to avoid potential buffer\noverflows when formatting DMA channel names.\n\nSigned-off-by: Aayush Kumar \u003caayushkmx@gmail.com\u003e\nLink: https://patch.msgid.link/20261010083504.26261-3-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "54f4db17f9d335bf2ed84c70906b95487d0ef1a0", "tree": "9061ff32dca897dd267c2d51d11303287055ba10", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Aayush Kumar", "email": "aayushkmx@gmail.com", "time": "Sat Oct 10 14:05:02 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Oct 13 00:19:15 2026 +0100" }, "message": "spi: tle62x0: Use kstrtoul() instead of simple_strtoul()\n\nUse the recommended kstrtoul() instead of the deprecated\nsimple_strtoul(). Check the return value and reject invalid values.\n\nSigned-off-by: Aayush Kumar \u003caayushkmx@gmail.com\u003e\nLink: https://patch.msgid.link/20261010083504.26261-2-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "88c3e297eeeaa8512964aae38e699ae0de1b3d53", "tree": "3589110087ff28ee969b514a2744bbf50bc417f5", "parents": [ "306439eed9eaa060126e0c2804f8cbeb28aaa7a8", "2bc8762642593628ecd26955617441762c972a0a" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 12 23:34:23 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 12 23:34:23 2026 +0100" }, "message": "spi: use sysfs_emit() in bcm63xx-hsspi and bcmbca-hsspi\n\nAayush Kumar \u003ccode@aayushk.dev\u003e says:\n\nConvert the sysfs show() functions to use sysfs_emit() instead of\nsprintf().\n\nLink: https://patch.msgid.link/20261009133631.579644-1-code@aayushk.dev\n" }, { "commit": "2bc8762642593628ecd26955617441762c972a0a", "tree": "d07967a7f4f8cbb2851b17ca11b4f06b0d36190f", "parents": [ "516d487c603754466aad03ebcffcd8928b40f179" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:31 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 12 23:34:22 2026 +0100" }, "message": "spi: bcmbca-hsspi: Use sysfs_emit() instead of sprintf()\n\nshow() should only use sysfs_emit() or sysfs_emit_at() when formatting\nthe value to be returned to user space.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133631.579644-3-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "516d487c603754466aad03ebcffcd8928b40f179", "tree": "97f72526df159f154d558de151d216cf9ea68483", "parents": [ "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907" ], "author": { "name": "Aayush Kumar", "email": "code@aayushk.dev", "time": "Fri Oct 09 19:06:30 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 12 23:34:22 2026 +0100" }, "message": "spi: bcm63xx-hsspi: Use sysfs_emit() instead of sprintf()\n\nshow() should only use sysfs_emit() or sysfs_emit_at() when formatting\nthe value to be returned to user space.\n\nSigned-off-by: Aayush Kumar \u003ccode@aayushk.dev\u003e\nLink: https://patch.msgid.link/20261009133631.579644-2-code@aayushk.dev\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "306439eed9eaa060126e0c2804f8cbeb28aaa7a8", "tree": "c598714d78413a9c54b36accc03d793188bca8e5", "parents": [ "0c5b0c3eb1d6daa1117dacd32589196f52109cab" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Sat Oct 10 23:14:59 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Oct 12 23:27:00 2026 +0100" }, "message": "spi: dw: Make dw_spi_update_config()\n\nAfter commit da0a672268b3 (\"spi: dw: Remove not-going-to-be-supported\ncode for Baikal SoC\"), no users of dw_spi_update_config() any more.\nUnexport it and make it static. We can also move two structure\ndefinitions to spi-dw-core.c at the same time.\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://patch.msgid.link/20261010151459.30560-1-jszhang@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "24a19b953e2a3d0ea5a8c4951a0ab8f32720c907", "tree": "35e4248213006b8c37f54118790a99b673c84fd9", "parents": [ "d6d3455d8751854e0d1820f14184682e23ac4475" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 20:04:55 2026 -0700" }, "message": "Linux 7.3-rc7\n" }, { "commit": "d6d3455d8751854e0d1820f14184682e23ac4475", "tree": "3107f1b1b6e6a358126d76304bf914f234a0124c", "parents": [ "f47959816751f02a711aab27cf1c805bd4964819", "3d8cc52db2f86b624308321c58513019f6b21eec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:49:08 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fix from Mickaël Salaün:\n \"This fixes a Clang bug by removing an annotation, which was introduced\n mostly for documentation\"\n\n* tag \u0027landlock-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Drop __counted_by from landlock_domain.handled_masks\n" }, { "commit": "f47959816751f02a711aab27cf1c805bd4964819", "tree": "83d3dedf60510bf1b1d1fa632d7f847b51ff715a", "parents": [ "5906f156e8818d29839d7d7280b691f627b59883", "00765a3467b992d0eb56704a28887256317eb4bd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:33:26 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of driver specific fixes, plus a new device ID in\n the DesignWare device tree binding.\n\n One of the sg2044 fixes which enforces clock limits properly is more\n critical than average since getting them wrong might lead to data\n corruption\"\n\n* tag \u0027spi-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi\n spi: sg2044-nor: Honor SPI clock limits\n spi: sg2044-nor: Return transfer errors\n spi: cadence-qspi: Fix status polling with octal DTR chips\n spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock\n" }, { "commit": "5906f156e8818d29839d7d7280b691f627b59883", "tree": "f53ccc2f9524159381015fe343e8768b2be80065", "parents": [ "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 11:28:36 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"There\u0027s a couple of core fixes here: there were a couple of issues\n with of_regulator_bulk_get_all() not behaving consistently with the\n other bulk regulator APIs which caused memory leaks and error handling\n issues in users.\n\n We also have a couple of fairly standard driver specific fixes\"\n\n* tag \u0027regulator-fix-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: ltc3676: don\u0027t read the write-only HRST and CLIRQ registers\n regulator: of: state who owns the array from of_regulator_bulk_get_all()\n regulator: of: fill in supply names in of_regulator_bulk_get_all()\n regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4\n" }, { "commit": "d5b6dc381db93ff2d1888f7d99c06e0bd85f4083", "tree": "428c10f5bd4c1c345642d4b48943fb2318e83b95", "parents": [ "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "469fa055664bfd8717b087a80d59c03055789c17" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:23:19 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Driver (and tape media changer) only fixes. Three of the fixes are\n about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO)\n but the unsafe MMIO is the least obvious logic change\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ\n scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()\n scsi: ch: Do not keep references to data transfer element devices\n scsi: ufs: mediatek: Handle mPHY power-on failures\n scsi: qedi: Initialize callback state before registration\n scsi: ufs: core: Hold a clock reference across the probe\n" }, { "commit": "4375b45d7060a6a3f41e14a9181c5c913ea474a4", "tree": "265c34a6704ac644eb104ea06490fd357f3f9937", "parents": [ "b7c0316c1a062dbadd0d62f1b796dd3264915242", "41cab3a71dc7be62114d91cc849424879062d324" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 09:00:33 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - Fix swapped ZRASF zone state values for full and read only\n - nvme-multipath revalidate head zones after unfreezing the head\n queue\n - Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\",\n which broke things\n - nvmet fixes for invalid NSIDs on feature 82h and using the local\n P2P device on metadata allocation failure\n\n - zloop: zero out only the unread tail of a short read\n\n* tag \u0027block-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n Revert \"nvme: do not reset controllers in NVME_CTRL_NEW state\"\n zloop: zero out only the unread tail of short reads\n nvmet: use the local P2P device on metadata allocation failure\n nvme-multipath: revalidate head zones after unfreezing the head queue\n nvme: fix swapped ZRASF zone state values for full and read only\n nvmet: return Invalid Field for invalid NSIDs feature 82h\n" }, { "commit": "3d8cc52db2f86b624308321c58513019f6b21eec", "tree": "b45592a5161df6fc99a2beaa872744a9b2bcebc4", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Nguyen Ngoc Thang", "email": "ngocthang2710.1999@gmail.com", "time": "Sat Oct 10 23:44:49 2026 +0700" }, "committer": { "name": "Mickaël Salaün", "email": "mic@digikod.net", "time": "Sun Oct 11 17:54:21 2026 +0200" }, "message": "landlock: Drop __counted_by from landlock_domain.handled_masks\n\nWith clang 22 and CONFIG_FORTIFY_SOURCE, the second\nlandlock_restrict_self() call hits a bogus fortify report in\ninherit_ruleset():\n\n memcpy: detected buffer overflow: 4 byte write of buffer size 0\n Call Trace:\n __fortify_panic\n landlock_merge_ruleset\n __se_sys_landlock_restrict_self\n\nhandled_masks[] lives in an anonymous struct inside the anonymous union\nthat overlays work_free. For such a flexible array, clang computes the\naddress of the __counted_by counter as the start of the array instead of\n\u0026num_layers. The bound is then read from handled_masks[0], i.e. from\nthe first layer\u0027s access masks, which is not a count. The same layout\ncrashes clang itself in a standalone test.\n\nThe annotation was added as documentation, so drop it rather than\nrestructure the union. Keep the information in the member comment.\n\nReported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003da0eecb22de4d821a9e5d\nFixes: bd3a19800dd1 (\"landlock: Add counted_by in landlock_domain\")\nSigned-off-by: Nguyen Ngoc Thang \u003cngocthang2710.1999@gmail.com\u003e\nLink: https://lore.kernel.org/r/20261010164450.194439-1-ngocthang2710.1999@gmail.com\nReviewed-by: Günther Noack \u003cgnoack3000@gmail.com\u003e\nReported-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nReported-by: Mike Bommarito \u003cmichael.bommarito@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20261009115108.17819-1-michael.bommarito@gmail.com\n[mic: Rebased on master, where the array is handled_masks[], updated the\nfortify report, added the clang bug link and the other reports]\nSigned-off-by: Mickaël Salaün \u003cmic@digikod.net\u003e\n" }, { "commit": "b7c0316c1a062dbadd0d62f1b796dd3264915242", "tree": "4027fdac2db753c97e0778eccd854367b4322e50", "parents": [ "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:53:11 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Don\u0027t spin on local work the exiting task can\u0027t run.\n\n For a ring still R_DISABLED when the task got its tctx node, the\n submitter is set later and may be another task, so DEFER_TASKRUN\n local work stays pending forever and the exiting task spins in\n do_exit().\n\n - Don\u0027t charge the SQ/CQ rings or provided buffer rings to\n RLIMIT_MEMLOCK. The region API conversion started charging them,\n which the rings had been exempt from.\n\n - Don\u0027t exempt disabled rings from task restrictions on register\n\n - Populate the CONNECT filter fields for a 24-byte sockaddr_in6\n\n* tag \u0027io_uring-7.3-20261010\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n io_uring/register: don\u0027t exempt disabled rings from task restrictions\n io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n" }, { "commit": "5f97a3ec36a1c2c9e4847eaf1b071707792b9035", "tree": "0c617b328e3352aa83e0e7b0c2bbe1f9e713f509", "parents": [ "4d61397c866eb1ae656c39fa9f28766e4388776b", "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:34:34 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This fixes a data corruption vector where a user could trick the\n exchange-range feature to add shared blocks beyond the file\u0027s EOF,\n which may then be used to modify data on another file\"\n\n* tag \u0027xfs-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix exchange-range-to-eof file size exchange\n xfs: stop exchanging reflink flags when exchanging mappings\n" }, { "commit": "4d61397c866eb1ae656c39fa9f28766e4388776b", "tree": "1a1aeecffd604e64e156b122da3b8776bdfac9b4", "parents": [ "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "87db7795cbaaf636ae22ae031f4906db7bb77803" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:23:06 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Work around AMD TLBI Erratum #1718 (Borislav Petkov)\n\n* tag \u0027x86-urgent-2026-10-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/CPU/AMD: Fix AMD TLBI Erratum #1718\n" }, { "commit": "b2d929a1c2a887dd046e0af2d4a06dbf4e7d87a6", "tree": "14f01a6ab6f0cb190206c1f3936392ae775da7b0", "parents": [ "b88c841d11641923fa3a4da011d7202cd89df68a", "d4f25b097e46d82718bb737d4540c99b7ab0a408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:13:52 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Several security fixes, a significant strnlen() regression fix, and\n several other miscellaneous fixes:\n\n - Fix a regression in the Zbb-enabled strnlen() implementation when\n huge counts are specified\n\n - When userspace pointer masking is enabled, strip the tag from\n user-specified pointers in two spots in the RISC-V futex code where\n this was missing\n\n - When CONFIG_SHADOW_CALL_STACK\u003dy, use a supervisor mode-only CSR bit\n to determine whether the trap came from userspace or not, rather\n than a userspace-writable register\n\n - Reset the HSTATUS.HU bit during CPU initialization to avoid\n unexpected behavior, as the RISC-V specification does not require\n this bit to be hardware-reset\n\n - Fix the T-Head GhostWrite probing code when\n !CONFIG_ERRATA_THEAD_MAE\n\n - Fix RV32 boots using 32-bit.config by constraining NR_CPUS\n\n - Implement a workaround for SiFive MAL-9092, which requires fences\n around hypervisor load/store instructions\n\n - Fix the RISC-V patch_map() code to work properly for EXECMEM\n addresses when !CONFIG_STRICT_MODULE_RWX\n\n - Fix ptrace register set access reporting when CFI landing pad or\n shadow stack support is enabled\n\n - Avoid copying garbage into the target\u0027s vstate when\n PTRACE_SETREGSET is called with a short iov_len\n\n - Fix load_unaligned_zeropad() on RV32 kernels with\n CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS\u003dy\n\n - Fix build breakage for any userspace program that includes\n uapi/asm/vendor/mips.h\n\n - Fix a build warning for 32-bit allmodconfig builds related to\n SiFive errata\n\n - Fix misspecified inline assembly constraints in the vector context\n save/restore code\"\n\n* tag \u0027riscv-for-linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: fix load_unaligned_zeropad() fixup for RV32\n riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp\n riscv: ptrace: Zero-initialize regset buffers before copyin\n riscv: ptrace: reject CFI regset access when extensions are absent\n riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds\n riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n riscv: futex: untag the user pointer before the atomic access\n riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts\n riscv: patch: fix handling of bpf-jit execmem addresses\n RISC-V: Clear HSTATUS.HU on CPU initialization\n RISC-V: errata: Add SiFive MAL-9092 workaround\n riscv: vector: Fix output operands in context save\n riscv: vector: Fix data pointer constraints in context save/restore\n riscv: limit sifive errata to CONFIG_64BIT\n riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header\n" }, { "commit": "b88c841d11641923fa3a4da011d7202cd89df68a", "tree": "5c9cec398cc29997a149322823efd5733187d8e8", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "41363c27b8509bd4efcba244803edac9ba25d1b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Oct 11 08:10:43 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - A fix for the ati_remote2 sysfs attributes handling, resolving type\n confusion after conversion to dev_groups\n\n - Updates to the xpad joystick driver adding support for the Corsair\n Novablade Pro controller (wired and 2.4 GHz wireless) and a newer\n hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox.\n\n* tag \u0027input-for-v7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n Input: xpad - add support for Corsair Novablade Pro\n Input: ati_remote2 - fix type confusion in device attribute handlers\n" }, { "commit": "7dfb218c829c1acb626e0fe92c5fddb9a26a03e9", "tree": "8f7329cadc94d2d2e9a3e8d78ec27bd53fcf54cb", "parents": [ "d84d6c1a7f1e2de9e601703a326a4c1b7b421943" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Wed Oct 07 10:02:27 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:43 2026 +0200" }, "message": "xfs: fix exchange-range-to-eof file size exchange\n\nNorbert Szetei posted a patch containing an incomplete description of a\nbug in XFS_IOC_EXCHANGE_RANGE\u0027s TO_EOF flag. The bug tricks\nexchange-range into modifying a file so that it has shared blocks\nstarting beyond EOF, which is never allowed because files never have\nwritten data beyond EOF, and you can only share written data blocks.\nThis is key to all the incorrect behavior that follows.\n\nEventually I got from Norbert a description of what\u0027s going wrong:\n\n\u003e Fair. Here it is with physical block numbers, 4k blocks. peer is the file\n\u003e that gets rewritten and file1 is the one that ends up with the flag\n\u003e cleared.\n\u003e\n\u003e Start, nothing shared:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [201] [202]\n\u003e\tdonor1 size 4096 -\u003e [300]\n\u003e\tdonor2 size 4096 -\u003e [400]\n\u003e\n\u003e 1. FICLONERANGE peer\u0027s block into file1\u0027s middle slot:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100]\n\u003e\tfile1 size 12288 -\u003e [200] [100] [202] reflink flag set\n\u003e ^^^^^ both files own block 100\n\u003e\n\u003e 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,\n\u003e file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes\n\u003e are exchanged with it:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [200] [100] [300] reflink flag set\n\u003e ^^^^^^^^^^^ still owned, now past the size\n\u003e\tdonor1 size 12288 -\u003e [202]\n\u003e\n\u003e file1 says it is one block long while it still owns three. Nothing was\n\u003e unmapped. file2_offset is block 2, so this exchange cannot clear a flag.\n\u003e\n\u003e 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.\n\u003e By i_disk_size this is two one-block files exchanging everything, so\n\u003e xmi_can_exchange_reflink_flags() agrees and the flag is cleared:\n\u003e\n\u003e\tfile1 size 4096 -\u003e [400] [100] [300] reflink flag CLEARED\n\u003e\tdonor2 size 4096 -\u003e [200]\n\u003e\n\u003e Block 100 is still shared with peer.\n\u003e\n\u003e 4. pwrite(file1, 4096, 4096), which is file1\u0027s second slot, block 100.\n\u003e xfs_is_cow_inode(file1) is false, so no CoW:\n\u003e\n\u003e\tpeer size 4096 -\u003e [100] same block, new contents\n\u003e\n\u003e Block 100 is the only one that matters here. PoC below, it reads a file\n\u003e called peer in the current directory. The filesystem needs reflink and\n\u003e exchange-range, which mkfs.xfs 7.x turns on by default.\n\nSo yes, TO_EOF is screwing up the file size even if it\u0027s actually\nexchanging the data block correctly. The following is the intended\nbehavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:\n\n\"Ignore the length parameter. All bytes in file1_fd from file1_offset\n to EOF are moved to file2_fd, and file2\u0027s size is set to\n (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in\n file2 from file2_offset to EOF are moved to file1 and file1\u0027s size is\n set to (file1_offset+(file2_length-file2_offset)).\"\n\nIn other words, if we only exchange a portion of the file data, then we\nshould only exchange the portion of the file size that relates to the\nexchanged data. Unfortunately, the code swaps the ondisk file size and\nthe incore file sizes, which is incorrect if the caller passes in a\nnonzero offset.\n\nHaving confused the file sizes, the PoC uses a second exchange-range\ncall on what looks like a non-reflinked single-block file. Because the\nfile size is set incorrectly, exchange-range thinks it\u0027s exchanging the\nfull contents of two files and clears the reflink flag on the broken\nfile. That enables an extending write of the broken file to rewrite the\nshared block that\u0027s just past EOF. This has become known colloquially\nas refluxfs.\n\nOnce the file sizes are set correctly, the second exchange-range no\nlonger thinks that it\u0027s doing a full-contents swap, so it won\u0027t clear\nthe reflink flag on either of its file arguments.\n\nNorbert followed up to an earlier version of this patch with a second\ncomplaint about us not handling the i_disk_size state correctly:\n\n\u003e The offsets are bounded against the incore i_size but subtracted from\n\u003e the ondisk i_disk_size, so a file that has not been written back gives\n\u003e xmi_isize1 \u003d 0 + (0 - 12288).\n\u003e\n\u003e For instance, you can do:\n\u003e\n\u003e $ xfs_io -f -c \"pwrite -q 0 4096\" -c fsync file1\n\u003e $ xfs_io -f -c \"pwrite -q 0 12288\" \\\n\u003e -c \"exchangerange -s 0 -d 12288 file1\" dirty\n\u003e $ stat -c %s file1\n\u003e 0\n\u003e $ stat -c %i file1\n\u003e 131\n\u003e $ sudo xfs_io -r -c \"bulkstat_single 131\" . | grep bs_size\n\u003e bs_size \u003d 18446744073709539328\n\nThat\u0027s wrong, and the new file size update logic depends on the ondisk\ni_disk_size matching the incore i_size, so flush the pagecache as needed\nto push it upwards.\n\nLink: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/\nReported-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nCc: stable@vger.kernel.org # v6.10\nFixes: 966ceafc7a4371 (\"xfs: create deferred log items for file mapping exchanges\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d84d6c1a7f1e2de9e601703a326a4c1b7b421943", "tree": "12c73b8337b4b875fd3565ce858cbbc0cc217a55", "parents": [ "a5ebb76233b79db01e82e061173cb73c6d2b5c6b" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Wed Oct 07 16:43:22 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sun Oct 11 08:23:38 2026 +0200" }, "message": "xfs: stop exchanging reflink flags when exchanging mappings\n\nWhen an exchange covers both files from offset 0 to i_disk_size,\nxmi_can_exchange_reflink_flags() assumes every mapping moved and hands\nthe reflink flag over to the other file.\n\nThat assumption is wrong. A file can still own shared blocks past\ni_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size\nwithout unmapping anything. The flag is cleared anyway, and the next\nwrite to such a block happens in place instead of CoW, corrupting the\nother file that shares it.\n\nCommit a23eca88448e (\"xfs: fix exchange-range reflink flag clearing\nissue with INO1_WRITTEN\") fixed one instance of this. Rather than add\nanother special case, stop moving the flags.\nxfs_exchmaps_ensure_reflink() already sets the flag on both inodes\nbefore the exchange, so both just keep it.\n\nNothing sets CLEAR_INO{1,2}_REFLINK anymore. Intents logged by older\nkernels may still carry them; recovery already masks them off, so they\nstay in the log format mask and are ignored.\n\nXFS_IOC_SWAPEXT has the same problem: it moves the reflink flag from\none inode to the other along with the extents. Just removing that is\nnot enough here: the exchange path flags both inodes up front in\nxfs_exchmaps_ensure_reflink(), but swapext has no such step, so the\ninode receiving the shared extents would be left without the flag.\nSet it on both inodes instead, and make sure both have a CoW fork,\nsince an inode with the reflink flag is expected to have one.\n\nThe flag now stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a\ntruncate to zero removes it.\n\nFixes: 966ceafc7a43 (\"xfs: create deferred log items for file mapping exchanges\")\nFixes: f0bc4d134b46 (\"xfs: swap inode reflink flags when swapping inode extents\")\nCc: stable@vger.kernel.org # v6.10\nAssisted-by: LLM\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "a5ebb76233b79db01e82e061173cb73c6d2b5c6b", "tree": "b493225b8e2a8f99a4a25b51c1879b0b544f4aea", "parents": [ "bb934c29fda8dcd409145a0deddc1a8095fec930", "7484bc43ba6b8e189b482db5b75e7842890a82b1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:57:30 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND\n MSR to only two bits. It is perfectly fine to do so because no system\n ever supported more than 2 bits of information (the Chip Selects used\n were only 4 maximum) and newer hardware will use only 2 bits anyway\n\n* tag \u0027edac_urgent_for_v7.3_rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/amd64: Mask UMC chip select to the four implemented selects\n" }, { "commit": "bb934c29fda8dcd409145a0deddc1a8095fec930", "tree": "5832030025fae27d15bdf8999ea7fdb61f2a8725", "parents": [ "b62f58bd7187ddbefa66913ec742137680ca5b22", "c61e23ed14359e6289c08e55940dd3401fe27db0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:50:50 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Ailie:\n \"Live from Dublin Airport, it\u0027s Saturday Night drm fixes.\n\n This week has the missing misc fixes from last week which I tracked\n down and seemed to be a race/bug in my lei setup somehow, once I asked\n lei to ignore it\u0027s cache I got the missing email. But there are more\n misc fixes this week and amd and intel ones.\n\n The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and\n imagination in the middle, with a bunch of small single fixes.\n\n Bit busier than I\u0027d like, but the missing misc might explain it,\n anyways time for me to fly home.\n\n fb:\n - defer setup when fbdev_probe() fails, not just on -EAGAIN\n\n bridge:\n - Fix unlocked list_del in drm_bridge_add()\n - Fix unlocked list access in drm_bridge_attach()\n - th1520-dw-hdmi:\n - Fix error check on dw_hdmi_probe() return value\n - Fix remove() callback\n\n aspeed:\n - Balance the display clock enable on teardown\n\n i915:\n - Fix a GT park race that could trigger spurious RPM wakelock\n warnings\n - Fix execbuffer relocation cleanup to avoid out-of-bounds free\n\n xe:\n - i2c removal\n - system Controller Maibox header handling\n - two bo pin/unpin accounting bugs\n - not emitting a w/a twice\n - xe_mmio_wait32() to honor delay/sleep maximums\n\n amdgpu:\n - Fix direct scanout alpha on some DRM_FORMATs\n - UserQ fixes\n - Fix tearing flips with PSR\n - GPU reset vblank fix\n - Debugfs register interface fix\n - Fix display mode patching\n - Expand Mac reserved memory workaround\n\n amdkfd:\n - SDMA doorbell fix\n - Fix dma-buf reference leak in error path\n\n imagination:\n - fix reference and vm_bo handling in remap()\n - size page table preallocation by device address\n\n gud:\n - don\u0027t keep a connector without a CRTC as connector_state\n\n panthor:\n - validate userspace queue count against initialized firmware\n slot count\n\n nouveau:\n - fix null ptr regression\n - skip turing CE workaround for non-GR\n\n vmwgfx:\n - validate pitch value\n - add blend mode property\n\n vc4:\n - drain hangcheck timer on unbind\n - free BO cache on teardown\n - use kvmalloc_objs for bo cache size list\n - disable V3D interrupt across runtime suspend\n - fix binner slot allocation\n - fix fw refcount leak\"\n\n* tag \u0027drm-fixes-2026-10-11\u0027 of https://gitlab.freedesktop.org/drm/kernel: (39 commits)\n drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n drm/vc4: Fix binner slot allocation failing on an idle GPU\n drm/vc4: Disable the V3D interrupt across runtime suspend\n drm/imagination: Size page table preallocation by device address\n drm/imagination: Fix reference and vm_bo handling in remap()\n drm/amdgpu: make Mac FB workaround generic\n drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info\n drm/amd/display: Don\u0027t replace a sink mode that shares the native totals\n drm/amdkfd: align SDMA doorbell base for shader doorbell writes\n drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks\n drm/amdgpu: serialize vblank counter reads against GPU reset\n drm/amd/display: disable self-refresh on tearing flips\n drm/amdgpu/userq: return the memdup_user() error for the user MQD\n drm/amdgpu/userq: only accept doorbell BOs as queue doorbell\n drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs\n drm/xe/i2c: cancel the client work on remove\n drm/xe/sysctrl: Fix mailbox header handling\n drm/i915/gt: Unmask interrupts only when ACTIVE is true\n drm/i915/gem: Prevent overstepping exec array boundary\n drm/gud: don\u0027t keep a connector without a CRTC as connector_state\n ...\n" }, { "commit": "b62f58bd7187ddbefa66913ec742137680ca5b22", "tree": "c50cd93252da977d70acd0d5aaec92ac4b52c558", "parents": [ "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "ae8364085574203e7f4ea961921a1c7493bcb6de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 16:41:28 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fix from Andi Shyti:\n \"Just one qcom-geni fix for a runtime PM reference leak\n during transfer setup\"\n\n* tag \u0027i2c-fixes-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: qcom-geni: release runtime PM reference when set_rate fails\n" }, { "commit": "c61e23ed14359e6289c08e55940dd3401fe27db0", "tree": "4daa2c2a5b8cedb6661b37d5caf224ca932e860a", "parents": [ "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "6ccf996a0dec1852dab94ad865f27b4904750e12" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:58:03 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-10-09\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA pointer assignment fix for gud, a reference fix and a preallocation\nsize fix for imagination, a suspend fix and an allocation fix when idle\nfor vc4, and a hardware variant fix for nouveau.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/asjkbknTHg2t8JGy@houat\n" }, { "commit": "492c4ded0ff7c7f162f35eea37984db5b0f2b5ba", "tree": "c8223877f505461ca772e6d8071d0d58f7c66a2c", "parents": [ "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "c7f44ec5c4ec760e74351f1843dcb8322f67cbf6" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:53:22 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:57:33 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-10-08:\n\namdgpu:\n- Fix direct scanout alpha on some DRM_FORMATs\n- UserQ fixes\n- Fix tearing flips with PSR\n- GPU reset vblank fix\n- Debugfs register interface fix\n- Fix display mode patching\n- Expand Mac reserved memory workaround\n\namdkfd:\n- SDMA doorbell fix\n- Fix dma-buf reference leak in error path\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com\n" }, { "commit": "a8013cbe8d403051aae151f9e35e5f3c8af89a02", "tree": "8f8fb8b8a41b99f6fba07efdcd146c3289f5dd9c", "parents": [ "5a768f5f76d8833b02b00f99d246cba6c463760b", "611857adc9e7b0ee1239a0baf38498922ca5a12e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:12 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sun Oct 11 04:47:37 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-10-08\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nFixes on:\n - i2c removal (Fan)\n - system Controller Maibox header handling (Mallesh)\n - two bo pin/unpin accounting bugs (Thomas)\n - not emitting a w/a twice (Tvrtko)\n - xe_mmio_wait32() to honor delay/sleep maximums (Alan)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com\n" }, { "commit": "3857c2fe5449541e24afc5efdb0f81a8a8f9a3a0", "tree": "9274ea2a042a38c82b47be3b6db224da687aa17d", "parents": [ "b71ccf604fbdf78450d3b17b5d69365caba29061", "79c168e2aa957ed0054c93db17caba653b95e377" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:30:04 2026 +0200" }, "message": "Merge tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fix from Bjorn Helgaas:\n \"This fixes some GPU initialization regressions caused by eddba19b8b5f\n (\"PCI/AER: Support Advisory Non-Fatal Errors\"), which appeared in\n v7.3-rc1.\n\n That commit also caused a MacBookPro16,1 spontaneous power-off\n regression; I expect a fix for that next week\"\n\n* tag \u0027pci-v7.3-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI/AER: Skip error recovery on false alarms\n" }, { "commit": "b71ccf604fbdf78450d3b17b5d69365caba29061", "tree": "b4920555f63456258e849269d5425044e5fd90fd", "parents": [ "f7bec60381da152e110bb71358c0903f9bc1826e", "c96ca94425b076dc398d929366e378d1e22ec794" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:26:56 2026 +0200" }, "message": "Merge tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC/MEMSTICK fixes from Ulf Hansson:\n \"MMC host:\n - cavium-octeon|thunderx: Destroy slot platform devices on remove\n - mtk-sd: Cancel request timeout work on remove\n - sdhci-sprd: Disable runtime PM on remove\n\n MEMSTICK:\n - Wait for request completion before freeing card\n - rtsx_usb_ms: Complete requests after eject instead of dropping\n them\"\n\n* tag \u0027mmc-v7.3-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n memstick: rtsx_usb_ms: complete requests after eject instead of dropping them\n memstick: core: wait for request completion before freeing card\n mmc: cavium-thunderx: destroy slot platform devices on remove\n mmc: cavium-octeon: destroy slot platform devices on remove\n mmc: sdhci-sprd: disable runtime PM on remove\n mmc: mtk-sd: Cancel request timeout work on remove\n" }, { "commit": "f7bec60381da152e110bb71358c0903f9bc1826e", "tree": "ab8d8ad8e7ea4ff8067e499e817ffc3cd13c6c7b", "parents": [ "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "2579cbe68005f46fc7f8f95364f6b101b07b9d1c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:22:38 2026 +0200" }, "message": "Merge tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fix from Mauro Carvalho Chehab:\n \"A fix for em28xx unregister code affecting devices with FM radio\n support\"\n\n* tag \u0027media/v7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: em28xx: use video_unregister_device for radio_dev\n" }, { "commit": "5f6ee187fa3a7b3cee4b9dae6c3dda6d1d3237db", "tree": "e81727e07120fe8efa9a65952edf53ddfee75032", "parents": [ "9a06d4b7c5feedea819a00af0db1629e43f3def4", "07c75552f7fe636a0695baae506a7d72fabd3be4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 01:20:08 2026 +0200" }, "message": "Merge tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A dozen of small fixes. All device-specific quirks or fixes, and\n nothing exciting is expected.\n\n - USB-audio and HD-audio quirks\n\n - HD-audio TAS2781 codec fix\n\n - ctxfi driver memory leak fix\n\n - ASoC AMD quirks\n\n - ASoC cs35l56 and adau1372 codec fixes\"\n\n* tag \u0027sound-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts\n ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA\n ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI\n ASoC: cs35l56: Add DAI for SDCA OT25 stream\n ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM\n ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes\n ASoC: adau1372: allow sleepy powerdown GPIOs\n ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)\n ALSA: hda/tas2781: Accept V1 calibration data without CRC\n ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers\n ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H\n ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers\n" }, { "commit": "9a06d4b7c5feedea819a00af0db1629e43f3def4", "tree": "1a85684baabf1cc57052ba5c94a1fe0fcff002f3", "parents": [ "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "4c66c423593e26273ea0d644906ed007630c6f6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:57:46 2026 +0200" }, "message": "Merge tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain provider fixes from Ulf Hansson:\n\n - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl\n\n - rockchip: Fix a couple of errors during probe\n\n* tag \u0027pmdomain-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: rockchip: don\u0027t ignore clock lookup errors on attach\n pmdomain: rockchip: fix clock leak on domain probe failure\n pmdomain: rockchip: propagate subdomain add errors\n pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains\n" }, { "commit": "c8d4256f1081c191773de9f46e2ad8f5e8d05d30", "tree": "a0a4249505eef08cf3f6680574c2bb3fd3564e29", "parents": [ "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "911655ab1dfb9d526978a75df3b210132620d30a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:49:55 2026 +0200" }, "message": "Merge tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two more fixes for the corner cases in the DMA-mapping SWIOTLB code\n (Peng Fan and Marek Szyprowski)\"\n\n* tag \u0027dma-mapping-7.3-2026-10-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n swiotlb: fix default_swiotlb_limit() for non-growable default pool\n iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys\n" }, { "commit": "fc1c25014ff8e416d75e8a5ba3b9c0ba5eb8e877", "tree": "310c6faafceb48f403d54f97831dcb1ac0796c06", "parents": [ "f99005fbed4e8071110faa350cc5fa453afa1455", "e58c3805ed325fe2d4ae2dd467c0486cc860b733" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Oct 10 00:01:12 2026 +0200" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Fix a regression from commit f77f281b6118 (\"fsverity: use a hashtable\n to find the fsverity_info\")\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: RCU-delay the freeing of struct fsverity_info\n" }, { "commit": "f99005fbed4e8071110faa350cc5fa453afa1455", "tree": "2e5e41e0cadba5b7c961a82a7c17d00439bf0751", "parents": [ "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "3d399224425573875b6f6f1181bd8cf9a28cc7d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:37:44 2026 +0200" }, "message": "Merge tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"This contains fixes for the current development cycle.\n\n All of them came out of a review of the mount code that started with a\n bug report. The review modeled the corner cases of mount propagation,\n unmounting and mount reference counting and turned up a lot of bugs.\n Most of them years old. Most fixes come with a selftest.\n\n - Rework connected mounts.\n\n A mount that is unmounted together with its parent can stay\n attached to the parent to keep its mountpoint covered. That happens\n when the mountpoint is removed with rmdir(), unlink() or rename(),\n when a detached tree is dissolved, and for locked mounts in any\n umount that isn\u0027t synchronous, including the teardown of their\n mount namespace. The parent then owns the child and drops it on its\n own final mntput(). So any reference from the child\u0027s superblock\n back to one of its ancestors becomes a cycle that is never freed.\n\n A loop device backed by an image on a tmpfs and mounted on that\n same tmpfs is enough. Remove the directory the tmpfs is mounted on\n from the host, let the container\u0027s mount namespace exit, and the\n loop device, the tmpfs and the filesystem on the loop device are\n leaked for good. The same works with autofs, zram, ecryptfs,\n binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,\n and the selftests have reproducers for them. This has been possible\n since v4.1. It is also why \"put_mnt_ns(): leave mounts connected\"\n was reverted in -rc5. Keeping every mount of a dying mount\n namespace connected made these cycles trivial to create.\n\n Every unmounted mount is now detached from its parent. Where the\n mountpoint has to stay covered the mount leaves a cover on the\n parent instead, allocated together with the mount. A lookup on the\n unmounted parent that hits a cover finds an empty immutable\n directory or file on the private nullfs instance. Nothing leads\n from a cover to another mount, so no unmounted mount owns another\n one and no cycle can form.\n\n This is visible to userspace. A formerly connected mount can no\n longer be reached through its unmounted parent and \"..\" inside it\n leads nowhere, as for every other lazily unmounted mount.\n\n With that the private nullfs instance becomes reachable from\n userspace, so it now refuses mounts on top, is mounted read-only,\n and refuses fsnotify marks and file locks. Its inodes are shared by\n every holder and a watch or a lock would otherwise reach across\n users. may_decode_fh() now also decides its subtree check under a\n single mount_lock hold, as a racing umount could otherwise let it\n decode into what a locked child covered.\n\n - umount:\n\n * Don\u0027t silently unmount busy mounts.\n\n Since v4.13 propagate_umount() takes down propagated copies of\n the victim with children as long as each child is an overmount or\n another copy of the victim, but propagate_mount_busy() only ever\n checked copies without children or with just an overmount. A\n container that moved a tree beneath its copy of a host mount lost\n that tree from under its open file descriptor to a plain umount()\n on the host. propagate_mount_busy() now applies the same rules,\n walking each chain of copies once.\n\n * Don\u0027t let a migrating task hide its reference from umount().\n\n mnt_get_count() sums the per-cpu counters under mount_lock but\n the mntget() and mntput() fast paths don\u0027t take it. A task that\n takes a reference on a cpu the sum has already passed and drops\n it after migrating to one the sum hasn\u0027t reached yet hides the\n reference it held to begin with, and umount() succeeds with the\n file still open. Gets and puts now live in separate per-cpu\n counters and all puts are summed before all gets with a full\n barrier in between, the way srcu_readers_active_idx_check() does\n it. mntget() is unchanged and mntput() gains an smp_wmb().\n\n * Check each submount for references right before unmounting it.\n\n shrink_submounts() and mark_mounts_for_expiry() checked all their\n victims up front. Unmounting the first could move a busy\n overmount to where the next victim\u0027s propagated copy is looked up\n and it was then unmounted without a check.\n\n * Never expire a locked mount.\n\n A shrinkable mount moved beneath a locked mount with\n MOVE_MOUNT_BENEATH takes over the lock, and umount() of an\n unlocked ancestor expired it and revealed what it covered. That\n umount() now fails with EBUSY as it does for any other locked\n child. A lazy umount still takes the whole tree.\n\n - Overmounts and locked mounts:\n\n * Unhash a dentry before detaching the mounts on it.\n\n unlink(), rmdir() and rename() detach the mounts on the victim\n but only d_delete() it once its inode is unlocked, a window that\n includes an expedited RCU grace period. In between, a lookup from\n a mount namespace in which the dentry is a mountpoint found it\n hashed, positive and uncovered. Drop the dentry first, as\n d_invalidate() already does.\n\n * Don\u0027t reveal overmounted entries in refwalk.\n\n A refwalk that had grabbed the dentry before the unlink never\n rechecked it the way rcuwalk does with d_seq and mount_lock.\n Without any artificial widening three walkers read the covered\n file 27 times in a minute. step_into() now fails an unhashed\n dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is\n retried.\n\n * Keep covered mounts covered in OPEN_TREE_NAMESPACE.\n\n Creating such a mount namespace only takes a user namespace and\n the copy followed bind mount rules: no children without\n AT_RECURSIVE and no unbindable mounts with it. An unprivileged\n user could see what mounts covered in the source, such as the\n parts of /proc and /sys that container runtimes mask. If the\n caller doesn\u0027t own the source mount namespace a non-recursive\n copy of a mount with something mounted below the requested\n directory is now refused and a recursive copy includes unbindable\n mounts, the way unshare() copies.\n\n * Keep the lock on a mount that a propagated copy is moved beneath.\n\n MNT_LOCKED moved to any mount that ended up beneath a locked\n mount, propagated copies included. A host mount and umount on a\n directory covered by a locked mount in a less privileged mount\n namespace left that cover unlocked for the namespace\u0027s owner to\n remove. Only mounts the caller places beneath take over the lock\n now.\n\n * Handle mount locking for automounts correctly. Which copies to\n lock was decided by the mount namespace of the task that\n triggered the automount. A task in a user namespace that\n triggered one on a host mount through a file descriptor got the\n host\u0027s own automount locked while its own copy stayed unlocked\n and could have nosuid, nodev and noexec cleared. Use the owner of\n the mount namespace the mount lands in.\n\n - Use-after-free and crashes:\n\n * Refuse an automount below a mount that is in no namespace.\n\n The private clones overlayfs uses for its layers have the\n MNT_NS_INTERNAL error pointer as their namespace, which\n finish_automount() let through and count_mounts() dereferenced. A\n fanotify filesystem mark on an overlayfs lower layer hands out\n file descriptors on such a clone. With debugfs as the lower layer\n opening \"tracing\" oopses with namespace_sem held for writing and\n every mount operation on the system blocks from then on.\n\n * Reset the old parent\u0027s -\u003eovermount in mnt_change_mountpoint().\n When propagate_umount() moved an overmount off a mount that a\n file descriptor kept alive, MOVE_MOUNT_BENEATH through that\n descriptor later followed the stale pointer into the freed\n overmount.\n\n * statmount() with STATMOUNT_BY_FD and pivot_root() read the parent\n of a mount that may be unmounted and only held by a file\n descriptor, while the parent\u0027s final mntput() can free it.\n statmount() now reads it under mount_lock and pivot_root() first\n checks that both mounts are in the caller\u0027s mount namespace.\n\n * Queue a mount only once for mount notifications. A mount\n reparented by one umount_tree() and taken down by the next under\n the same namespace_sem hold, as in shrink_submounts(), was queued\n twice. That cut the mounts queued in between out of notify_list\n while it still pointed at them, and once they were freed every\n later mount operation walked freed memory.\n\n * Don\u0027t let a pseudo dentry become the root of a mount. A bind\n mount of a bpf token file did that with a DCACHE_NORCU dentry,\n which is freed without an RCU grace period while lockless path\n walks may still look at it. Refuse to clone such a mount.\n\n * Don\u0027t inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily\n unmounted nsfs or pidfs mount through its file descriptor started\n out flagged as unmounted. Among other things __detach_mounts()\n then dropped the namespace\u0027s reference on it, the mount outlived\n its namespace and mount_setattr() through the descriptor read the\n freed namespace. A recursive bind mount of such a mount also\n copied the unmounted stack still attached to it. That now fails\n with EINVAL, copying the mount itself still works.\n\n * Remove the fsnotify marks of a mount namespace in free_mnt_ns()\n instead of the RCU callback that frees the namespace, where\n taking the group mutexes meant sleeping in softirq context.\n\n - Propagation and copies:\n\n * Keep a copied mount unbindable. Since v6.17 clone_mnt() didn\u0027t\n copy the unbindable flag, so every mount namespace created with\n CLONE_NEWNS had bindable copies of all unbindable mounts. This\n had been fixed once before.\n\n * Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the\n mount an unbindable slave, a state nothing else can produce, or\n silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE\n after restoring sharing and isn\u0027t affected.\n\n * Check a recursive bind mount for mount namespace loops.\n\n Recursively bind mounting a tree from another mount namespace\n could put a mount of a namespace\u0027s file inside that same\n namespace, which then pins itself and all its mounts. Repeating\n it leaks without limit, the reproducer took Shmem from 380 kB to\n 65916 kB. The copy is now checked with check_for_nsfs_mounts()\n before it is grafted, as move_mount() does.\n\n * Look at the topmost mount for a mount namespace file.\n\n attach_recursive_mnt() never looked at the topmost mount of the\n source\u0027s chain of overmounts. If that was the chain\u0027s only mount\n namespace file an existing mount at a propagated destination got\n buried below the root of the nsfs file where no path walk reaches\n it.\n\n * Don\u0027t put a mountpoint on a dentry that\u0027s being removed.\n\n attach_recursive_mnt() makes a mountpoint of the source\u0027s root\n without its inode lock, so a racing rmdir() of that directory\n could leave a mount on it that nothing ever detaches.\n d_set_mounted() now checks cant_mount() as well.\n\n - nullfs:\n\n * Take no inode lock for readdir of an immutable directory.\n\n The root of every empty mount namespace is the same nullfs\n directory and iterate_dir() held its i_rwsem across\n -\u003eiterate_shared(). A reader whose buffer faults on a FUSE mount\n of its own holds it for as long as its server wants, and with an\n exclusive locker queued behind it every lookup that misses the\n dcache, every create and every mount in that directory waits. One\n user of an empty mount namespace stalls all others. Directories\n with the new FOP_IMMUTABLE flag skip the lock.\n\n * Refuse to reconfigure internal superblocks through fspick(),\n MS_REMOUNT or the read-only remount that a synchronous umount()\n of the root does. For nullfs only root in the initial user\n namespace could do it, but the superblock is shared by every\n mount namespace and the flags showed up in statfs() for all of\n them.\n\n * Don\u0027t update the access time on nullfs and refuse F_SET_RW_HINT\n on an immutable inode.\n\n - unshare: Free an nsproxy that was never installed with\n nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped\n active references that were never taken, which triggered a warning\n and hid the caller\u0027s own namespaces from listns().\n\n - Smaller changes: mount_setattr() checks the target before it walks\n the tree to allocate peer group ids, unshare() puts the old\n fs_struct before the old namespaces, dissolve_on_fput() drops the\n file\u0027s reference to the tree itself, disconnect_mount() is\n simplified and the documentation of the propagated unmount rule is\n brought up to date\"\n\n* tag \u0027vfs-7.3-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)\n namespace: simplify disconnect_mount()\n selftests/filesystems: test covered mounts\n namespace: rework connected mounts\n nullfs: add an empty immutable regular file\n selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody\n selftests/filesystems: add a helper that holds a readdir in a page fault\n readdir: take no inode lock on an immutable directory\n nullfs: refuse file locks\n fsnotify: let a filesystem refuse marks on its objects\n namespace: nothing is mounted on or written through knullfs\n namespace: keep the private nullfs instance in knullfs\n fhandle: decide the subtree check under mount_lock\n selftests/filesystems: check that an automount below an overlay layer is refused\n selftests/filesystems: check the atime of the empty mount namespace root\n selftests/filesystems: check that a lock lands on the right mount and stays\n namespace: keep the lock on a mount that a propagated copy is moved beneath\n namespace: never expire a locked mount\n nullfs: don\u0027t update the access time\n namespace: handle mount locking for automounts correctly\n namespace: refuse an automount below a mount that is in no namespace\n ...\n" }, { "commit": "9515f634dbed2bb8928fbb3b01102dd4e64f4aeb", "tree": "0d1f379dc24d0d6a54716680535b3f62006f6fab", "parents": [ "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "a9cd14bfb0c113f1cd77be4349784663bec71bb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 23:32:55 2026 +0200" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"It finally seems to have calmed down on the arm64 fixes front, so\n please pull these two straightforward fixes for -rc7. One fixes the\n EL2 trap configuration for implementation-defined CPU PMU hardware\n during boot and the other fixes a kcov selftest failure by excluding\n our softirq early entry code:\n\n - Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU\n\n - Fix kcov boot selftest failure by excluding our early IRQ entry\n code\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: irq: exclude the softirq stack switch from KCOV\n arm64/boot: Don\u0027t set PMUv3p9 FGT2 bits without PMUv3\n" }, { "commit": "41363c27b8509bd4efcba244803edac9ba25d1b5", "tree": "b0369d2b5d7f86d94d8994b118ca0af194668798", "parents": [ "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe" ], "author": { "name": "Bihaan Sen", "email": "stevewholikesthings@gmail.com", "time": "Fri Sep 25 17:14:38 2026 +0530" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:19:05 2026 -0700" }, "message": "Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox\n\nThe 8BitDo Pro 2 Wired Controller for Xbox is already matched by the\nvendor-wide XPAD_XBOXONE_VENDOR(0x2dc8) entry, but a later hardware\nrevision reports product ID 0x201e, which has no entry in the\nxpad_device table. The device therefore binds and functions but is\nexposed to userspace as \"Generic X-Box pad\".\n\nAdd the VID/PID pair so the controller is named correctly, and set\nMAP_SHARE_BUTTON to expose the share button as KEY_RECORD.\n\nSigned-off-by: Bihaan Sen \u003cstevewholikesthings@gmail.com\u003e\nLink: https://patch.msgid.link/20260925114459.110253-1-stevewholikesthings@gmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f9282b8aa85a8c97c50d656db75feb6d76fc7cbe", "tree": "7a5e79c3ff12c16f15021e19a187459d54dcc1b8", "parents": [ "f321cc430c49b6c1be0d53f2ef19d8342d8029cc" ], "author": { "name": "Krzysztof Furman", "email": "krisfur@proton.me", "time": "Fri Oct 09 15:47:10 2026 +0100" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 12:15:35 2026 -0700" }, "message": "Input: xpad - add support for Corsair Novablade Pro\n\nAdd device IDs for the Corsair Novablade Pro leverless fight controller\nin both wired (0x2b1f) and 2.4 GHz receiver (0x2b2b) modes, and add\nCorsair\u0027s vendor ID to the Xbox 360 vendor match list.\n\nOutside of its PS4/PS5 modes the controller uses the Xbox 360 protocol\n(vendor-specific class, subclass 93, protocol 1) on interface 0, which\nxpad does not currently bind, so no gamepad device is created. The\nPS4/PS5 modes present a standard HID gamepad and already work with\nhid-generic.\n\nTested on 7.2.5 with the 2.4 GHz receiver and wired.\n\nAssisted-by: Claude Opus 5.5\nSigned-off-by: Krzysztof Furman \u003ckrisfur@proton.me\u003e\nLink: https://patch.msgid.link/20261009-xpad-corsair-novablade-v1-1-e58746bef99f@proton.me\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "f321cc430c49b6c1be0d53f2ef19d8342d8029cc", "tree": "eb5dd4fd022b53887e9eabed4d1cb7c91b568d23", "parents": [ "3bf8d603fd45649c106cae6290a10f20b1bbb569" ], "author": { "name": "Haotian Zhang", "email": "vulab@iscas.ac.cn", "time": "Fri Oct 09 10:48:25 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Oct 09 10:58:35 2026 -0700" }, "message": "Input: ati_remote2 - fix type confusion in device attribute handlers\n\nPreviously, the channel_mask and mode_mask attributes were registered on\nthe parent usb_device via sysfs_create_group(). When commit b20d6bf8014b\n(\"Input: ati-remote2 - use driver core to instantiate device\nattributes\") converted the driver to let the driver core manage them via\ndev_groups in struct usb_driver, the attributes moved to the bound\nusb_interface devices, but the show and store callbacks were not updated\naccordingly.\n\nAs a result, the callbacks still invoked to_usb_device() on a device\npointer belonging to a struct usb_interface, producing an invalid\nusb_device pointer.\n\nUse to_usb_interface() directly in the attribute handlers to obtain the\ninterface and its driver data.\n\nFixes: b20d6bf8014b (\"Input: ati-remote2 - use driver core to instantiate device attributes\")\nAssisted-by: DeepSeek-V4.1-Flash\nSigned-off-by: Haotian Zhang \u003cvulab@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20261009040302.3087205-1-vulab@iscas.ac.cn\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "fddcf4c5321b3ea5f72166c3fd36a9d1c34f80c7", "tree": "b1379df89b350034d5593dc13d2355dd7675a684", "parents": [ "aa5d5f8e502318e783545ba5d04bb40130b83e20" ], "author": { "name": "Cen Zhang (Microsoft Security FORGE Labs)", "email": "cenzhang@linux.microsoft.com", "time": "Thu Oct 08 15:16:02 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/cancel: don\u0027t spin on local work the task can\u0027t run\n\nio_uring_cancel_generic() refuses to sleep while any ring on the exiting\ntask\u0027s tctx has local work pending. It assumes the task is that ring\u0027s\nsubmitter and that the next io_uring_try_cancel_requests() pass will run\nthe work. This does not hold for a ring that was still\nIORING_SETUP_R_DISABLED when the task got its tctx node from\nio_uring_create() or io_ringfd_register(). The submitter is set later by\nIORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the\nsubmitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To\nthe exiting task the work stays pending forever, the loop never reaches\nschedule(), and the task trips the WARN_ON_ONCE() once and then spins in\ndo_exit().\n\nAn unprivileged user can set this up at will by creating a disabled\nring, having a child enable it and stop, posting to the ring with\nIORING_OP_MSG_RING and exiting with a request in flight that only the\nchild can complete. The exiting thread burns a CPU until the child runs\nor dies, and with panic_on_warn set the WARN panics the kernel.\n\nFix by skipping the sleep only when io_allowed_defer_tw_run() allows the\ntask to run the work. This is reasonable since work it cannot run cannot\ncomplete any of its requests either, so nothing is lost by sleeping.\nDrop the WARN_ON_ONCE() since handing a disabled ring to another thread\nis a supported scenario, not a bug state.\n\nFixes: 360cd42c4e95 (\"io_uring: optimise io_req_local_work_add\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Cen Zhang (Microsoft Security FORGE Labs) \u003ccenzhang@linux.microsoft.com\u003e\nLink: https://patch.msgid.link/20261008191602.45101-1-cenzhang@linux.microsoft.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "aa5d5f8e502318e783545ba5d04bb40130b83e20", "tree": "67c6256f0e53e7a056e8240e01f87bf773f5d16c", "parents": [ "6da8f402e362b2f546e2efb7167fc9597aef6faf" ], "author": { "name": "Natasha Klaus", "email": "natalie.klaus@runtimeverification.com", "time": "Fri Oct 09 16:38:07 2026 +0300" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:33:09 2026 -0600" }, "message": "io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len \u003e\u003d sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port \u003d\u003d P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.\n\nFixes: 899bea8248ce (\"io_uring/net: allow filtering on IORING_OP_CONNECT\")\nCc: stable@vger.kernel.org # 7.2\nSigned-off-by: Natasha Klaus \u003cnatalie.klaus@runtimeverification.com\u003e\nLink: https://patch.msgid.link/20261009133807.730724-1-natalie.klaus@runtimeverification.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "6da8f402e362b2f546e2efb7167fc9597aef6faf", "tree": "549fbcfcac9ac4135e5ce4878f2fd125954aed5b", "parents": [ "cde56daf4b93f474dc256dbcc5205035223ae6f5" ], "author": { "name": "Eugene Gvozdetsky", "email": "gvozdet@gmail.com", "time": "Fri Oct 09 01:08:49 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:32:55 2026 -0600" }, "message": "io_uring/register: don\u0027t exempt disabled rings from task restrictions\n\nA ring created with IORING_SETUP_R_DISABLED is exempt from its register\nrestrictions until it is enabled. This lets the creator register the\nrestrictions and then enable the ring with IORING_REGISTER_ENABLE_RINGS,\nwhether or not that opcode is in the allowed set.\n\nSince commit ed82f35b926b (\"io_uring: allow registration of per-task\nrestrictions\"), a ring also inherits restrictions from the task that\ncreates it, and the same exemption applies to those. A task whose\nregister opcodes are restricted can therefore create a disabled ring,\nissue any register opcode on it, and then enable it.\n\nMark rings whose restrictions were inherited from the task, and keep\nchecking register opcodes for them while the ring is disabled. Enabling\nsuch a ring now requires IORING_REGISTER_ENABLE_RINGS to be in the\ntask\u0027s allowed set. Per-ring restrictions registered on a disabled ring\nwork as before.\n\nFixes: ed82f35b926b (\"io_uring: allow registration of per-task restrictions\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5-5\nSigned-off-by: Eugene Gvozdetsky \u003cgvozdet@gmail.com\u003e\nLink: https://patch.msgid.link/20261009-iouring-task-restrict-fix-v1-1-a49daf55a12c@gmail.com\n[axboe: amend with inheritance flag fixup]\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "cde56daf4b93f474dc256dbcc5205035223ae6f5", "tree": "26080bca928a985c1fa634edff765e481ea3e40e", "parents": [ "b59cabf9b4acb65f3f9968087ca0e18010d85076" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Oct 09 08:20:41 2026 -0600" }, "message": "io_uring/kbuf: don\u0027t charge provided buffer rings to RLIMIT_MEMLOCK\n\nJust like with the SQ and CQ rings, the provided buffer rings were also\nnot charged against the memlock limit prior to the below mentioned\ncommit. Restore that behavior.\n\nFixes: ef62de3c4ad5 (\"io_uring/kbuf: use region api for pbuf rings\")\nReported-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nCc: stable@vger.kernel.org\nTested-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "tree": "1908c1d636394d7ab56ed3e469eb41e9cd357fd6", "parents": [ "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "37f12441f557468a56c1e27790413aa78c82afa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "message": "Merge tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless, wireguard, CAN and Bluetooth.\n We have one known regression to wrap up in VLAN handling.\n\n Current release - regressions:\n\n - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex\n\n Previous releases - regressions:\n\n - can: fix regression in handling RPS after migrating metadata to skb_ext\n\n - eth:\n - iavf: fix regressions in reconfig impacting bonding\n - mana: fix packet forwarding performance regression\n - stmmac: remove buggy VLAN acceleration support\n\n Previous releases - always broken:\n\n - a few high prio fixes for tun, and af_packet\n\n - amt: fix a UaF on tunnel teardown\n\n - eth:\n - bnxt: fix PCIe AER recovery and FLR handling issues\n - macb: don\u0027t modify Tx skbs before taking ownership\n - axienet: don\u0027t leak Tx skbs on interface stop\n\n - wifi:\n - nxpwifi: number of LLM-ish fixes\n - assorted mt76 fixes\"\n\n* tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)\n net: macb: copy shared skbs before appending the FCS\n net: macb: check TX ring before modifying skb\n vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n wireguard: noise: reject response consumption after intermediate initiation\n wireguard: queueing: preserve tstamp_type when encapsulating packet\n net: openvswitch: validate transport header presence in set_ipv6_addr\n net/smc: protect clcsock lifetime in smc_getname\n ipv6: do not warn on route notification size race\n ipv4: do not warn on route notification size race\n ipv4: validate checksum_start before completing checksum\n ptp: ocp: fix PCIe delay estimation calculation\n xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n xen/netfront: drop RX packets with a short Ethernet header\n net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n net: sparx5: free the matchall entry on destroy\n selftests: mlxsw: Test port range occupancy on template create\n mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n net: dsa: microchip: fix KSZ8765 fiber detection\n net/mlx5e: Order ICOSQ cc update after CQ doorbell\n ...\n" }, { "commit": "6ccf996a0dec1852dab94ad865f27b4904750e12", "tree": "99390fd342d15271103c45caad0cde813093052a", "parents": [ "cca01232d94adcb10f7c8c5bb8ce072b045fcb58" ], "author": { "name": "Mary Guillemard", "email": "mary@mary.zone", "time": "Wed Oct 07 16:30:15 2026 +0200" }, "committer": { "name": "Lyude Paul", "email": "lyude@redhat.com", "time": "Thu Oct 08 18:14:46 2026 -0400" }, "message": "drm/nouveau: Skip the Turing CE workaround object for non-GR channels\n\nThis workaround is here for the old Gallium driver and predate async CE\nand NVDEC. Instead of only skipping it for NVDEC, let\u0027s only apply it\nin case of GR channels.\n\nThis should make async CE work properly on Turing by stopping the assign\nof a GRCE. (here CE0)\n\nSigned-off-by: Mary Guillemard \u003cmary@mary.zone\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nReviewed-by: Daniel Almeida \u003cdaniel.almeida@collabora.com\u003e\nSigned-off-by: Lyude Paul \u003clyude@redhat.com\u003e\nLink: https://patch.msgid.link/20261007-turing-async-ce-fix-v1-1-12ee6ccd1a3c@mary.zone\n" }, { "commit": "79c168e2aa957ed0054c93db17caba653b95e377", "tree": "254c799e92bc304ba52721cf1d85d90d2020626e", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Thu Oct 08 14:26:00 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Thu Oct 08 14:33:04 2026 -0500" }, "message": "PCI/AER: Skip error recovery on false alarms\n\nAlex is seeing a probe failure of the amdgpu driver after the Root Port\nabove an AMD Navi10 GPU has been reset. The reset was performed to recover\nfrom a Firmware First reported Fatal Error.\n\nHowever all status registers in the Root Port\u0027s AER Extended Capability are\nblank, so apparently the platform firmware raised a false alarm.\n\nThe issue is only occurring since commit eddba19b8b5f (\"PCI/AER: Support\nAdvisory Non-Fatal Errors\"). It looks like enabling Advisory Non-Fatal\nErrors causes code paths to be exercised in platform firmware which were\nnever validated before.\n\nSkip error recovery on false alarms, i.e. if no unmasked errors were\nactually signaled.\n\nNote that this will also skip recovery if both the Status and Mask\nregisters are \"all ones\", as would be the case for inaccessible devices.\nHowever that seems justified because it would imply either a hot-unplug\nevent or a Surprise Down Error further up in the hierarchy. Interfering\nwith recovery from that seems uncalled for.\n\nFixes: eddba19b8b5f (\"PCI/AER: Support Advisory Non-Fatal Errors\")\nReported-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d222095\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/0552ed277e40a288e0157af799257ee6ec722534.1791460615.git.lukas@wunner.de\n" }, { "commit": "cca01232d94adcb10f7c8c5bb8ce072b045fcb58", "tree": "08a173557f1c3eb715599ffa6e160bb0407dacba", "parents": [ "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Wed Sep 30 15:20:44 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:21:07 2026 -0300" }, "message": "drm/vc4: Fix binner slot allocation failing on an idle GPU\n\nA job\u0027s binner slots are returned to bin_alloc_used by vc4_complete_exec(),\nwhich runs from the job_done workqueue, but the seqno\nvc4_v3d_get_bin_slot() waits on is incremented earlier, in the function\nvc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still\nfind the pool full because the worker has not run. By then, the job might\nhave left the render_job_list, so no seqno remains to wait on and the\nallocation fails returning -ENOMEM.\n\nThis scenario can be reproduced on a Raspberry Pi 3 by using a burst of\nsmall jobs (e.g. Piglit\u0027s `quick_gl` suite), with userspace seeing a\nrejected submit for a pool about to become free.\n\nNote that the slots are held from validation until the render completes,\nso the pool can also be exhausted by jobs still queued on bin_job_list,\nleaving render_job_list empty and nothing to wait on.\n\nRelease the slots from the FRDONE handler and wait on the pool instead of\non one job\u0027s seqno. This bounds the wait to the actual resource. Also, by\nclaiming the slot inside the wait condition, another submit is unable to\ntake the slot between the wakeup and the retry. vc4_complete_exec() keeps\nclearing the slots for jobs that never completed, and now wakes the\nwaiters too.\n\nNote that the wait takes a deadline, since the two callers need different\nones. The submit path is a user task and can be interrupted, so it waits\nwithout one. On the other hand, vc4_overflow_mem_work() runs on a worker\nand never sees a signal, so it needs a deadline. During a reset,\nvc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and\nwith those masked nothing can release a slot. This deadlocks: the worker\nwould wait for slots that only the reset can free, while the reset waits\nin cancel_work_sync() for the worker.\n\nFixes: 553c942f8b2c (\"drm/vc4: Allow using more than 256MB of CMA memory.\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260930182204.1877361-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f", "tree": "b721b4c7c31f55d2a856c401909df001ae0b0d67", "parents": [ "789f290b2e81d42820bddcb4010ffbc2ae2ded54" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Sep 25 16:10:19 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Oct 08 16:20:06 2026 -0300" }, "message": "drm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn\u0027t\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume.\n\nFixes: 9b6f461582e6 (\"drm/vc4: v3d: Stop disabling interrupts\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260925191318.541938-1-mcanal@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "b59cabf9b4acb65f3f9968087ca0e18010d85076", "tree": "b96b8138447ea250ae4932cf6298671d4375861d", "parents": [ "a92193c91e8839fe5fc209616ea95465ae4b919d" ], "author": { "name": "Hengyu Liang", "email": "hengyul@cs.unc.edu", "time": "Tue Oct 06 08:57:32 2026 -0400" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Oct 08 13:07:38 2026 -0600" }, "message": "io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK\n\nCommit 8078486e1d53 (\"io_uring: use region api for SQ\") and commit\n81a4058e0cd0 (\"io_uring: use region api for CQ\") made io_uring_setup()\nallocate the rings with io_create_region().\n\nHowever, io_create_region() charges the memory to RLIMIT_MEMLOCK, and\nthe rings had been exempt from that limit since commit 26bfa89e25f4\n(\"io_uring: place ring SQ/CQ arrays under memcg memory limits\"). As of\nnow, a user without CAP_IPC_LOCK gets ENOMEM from io_uring_setup() when\ntheir rings exceed the limit, which is 8 MiB by default. PostgreSQL\ndevelopers have already hit this in their io_uring tests [1].\n\nThe issue can be reproduced with a simple liburing program, run as an\nunprivileged user:\n\n #include \u003cliburing.h\u003e\n #include \u003cstdio.h\u003e\n\n int main(void)\n {\n static struct io_uring ring[64];\n int i;\n\n for (i \u003d 0; i \u003c 64; i++)\n if (io_uring_queue_init(4096, \u0026ring[i], 0) \u003c 0)\n break;\n printf(\"%d rings\\n\", i);\n return 0;\n }\n\nBefore those commits (v6.13), it prints \"64 rings\". After those commits\n(v6.14), it prints \"21 rings\".\n\nThis patch makes io_create_region() take the user to charge, and passes\nno user for the SQ/CQ rings.\n\nLink: https://www.postgresql.org/message-id/flat/667f7dcf-404b-4898-a426-57ca6e0617f6@gmail.com [1]\nFixes: 8078486e1d53 (\"io_uring: use region api for SQ\")\nFixes: 81a4058e0cd0 (\"io_uring: use region api for CQ\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hengyu Liang \u003chengyul@cs.unc.edu\u003e\nLink: https://lore.kernel.org/io-uring/20261006125732.3425762-1-hengyul@cs.unc.edu/\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "37f12441f557468a56c1e27790413aa78c82afa2", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3", "9151d6c42799105e109c8b54dbaad91ce0e17c47" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:54 2026 -0700" }, "message": "Merge branch \u0027net-macb-fix-software-fcs-handling-of-shared-and-requeued-skbs\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: fix software FCS handling of shared and requeued skbs\n\nWhile testing the genet MTU series I used a Raspberry Pi CM5 (RP1 GEM)\nas pktgen source for the CM4. With clone_skb the CM5 rebooted after a\nfew seconds. Further investigation showed that macb_pad_and_fcs()\nappends the FCS in place, so the shared skb grows with every transmit\nuntil BQL completes more than was queued and dql_completed() hits its\nBUG_ON.\n\nThe same code also modifies the skb before the TX ring check, so a\nNETDEV_TX_BUSY retry gets an skb that was already replaced or grown.\n\nPatch 1 checks the ring first, patch 2 copies shared skbs.\n\nTested on Raspberry CM5 with pktgen at 60/20000 bytes, clone_skb 0/\n1000, burst 1/32.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-0-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9151d6c42799105e109c8b54dbaad91ce0e17c47", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "6b48ed85ae0ca37c7403ef5d512be75975844f2f" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: copy shared skbs before appending the FCS\n\nmacb_pad_and_fcs() appends the FCS in place when the skb has tailroom.\nA shared skb, as pktgen sends in clone_skb mode, grows by one FCS per\ntransmit. BQL then completes more bytes than were queued and\ndql_completed() hits its BUG_ON.\n\nOn a Raspberry Pi CM5 (RP1 GEM) pktgen with clone_skb 1000 burst 32 at\n60 bytes kills the box within seconds.\n\nCopy shared skbs before appending the FCS. Clearing IFF_TX_SKB_SHARING\nwould also fix it but makes pktgen refuse clone_skb on macb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-2-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6b48ed85ae0ca37c7403ef5d512be75975844f2f", "tree": "009f5227692a79a54dc6d9f5da534e11059f1f99", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: check TX ring before modifying skb\n\nmacb_pad_and_fcs() replaces or extends the skb before the ring space\ncheck. On NETDEV_TX_BUSY the stack requeues an skb that is already freed\nor grown.\n\nCheck the ring first, using the padded length for the descriptor count.\nNonlinear skbs always take the copy path so the count can assume a\nlinear skb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-1-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c24a4e87e219072e5e106f6791146cbf3b056b3", "tree": "c2a0498021ae56990a1be3cd207ba25477c780b7", "parents": [ "fe4167bf53b61405f97614f644f6a63a5d6ad034" ], "author": { "name": "Ilia Gavrilov", "email": "Ilia.Gavrilov@infotecs.ru", "time": "Thu Oct 08 14:41:17 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:46:13 2026 -0700" }, "message": "vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket\u0027s backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket\u0027s\nbacklog to the receive queue, which will lead to a memory leak.\n\nsock_close\n __sock_release\n __vsock_release\n // take ownership by user-space\n lock_sock_nested\n sock_set_flag(sk, SOCK_DEAD)\n vmci_transport_release\n vmci_dispatch_dgs\n vmci_datagram_invoke_guest_handler\n vmci_transport_recv_dgram_cb\n sk_receive_skb\n if (!sock_owned_by_user(sk))\n [...]\n (!) else if sk_add_backlog()\n [...]\n (!) skb_queue_purge(\u0026sk-\u003esk_receive_queue)\n\n release_sock\n __release_sock\n // move all packets from the backlog\n // to the receive queue\n (!) sk_backlog_rcv\n vsock_queue_rcv_skb\n [...]\n __sock_queue_rcv_skb\n if (!sock_flag(sk, SOCK_DEAD))\n // Since the socket is \"dead\", the function will not\n // be called\n sk-\u003esk_data_ready(sk)\n sock_release_ownership(sk);\n sock_put\n\nAdd a receive queue cleanup in the socket destructor to fix this.\n\nsyzkaller report:\n\nunreferenced object 0xffff8880117bfb80 (size 240):\n comm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\n hex dump (first 32 bytes):\n 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.\u0026.....x.\u0026.....\n 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........\u0026.....\n backtrace:\n [\u003cffffffff82be8d97\u003e] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n [\u003cffffffffa114bcbd\u003e] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n [\u003cffffffffa05072c6\u003e] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n [\u003cffffffffa050ad75\u003e] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n [\u003cffffffffa050b025\u003e] vmci_interrupt+0x55/0x290 [vmw_vmci]\n [\u003cffffffff8137ad2b\u003e] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n [\u003cffffffff8137c7ae\u003e] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n [\u003cffffffff81253dd6\u003e] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n [\u003cffffffff81004392\u003e] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.\n\nFixes: d021c344051a (\"VSOCK: Introduce VM Sockets\")\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Ilia Gavrilov \u003cIlia.Gavrilov@infotecs.ru\u003e\nLink: https://patch.msgid.link/20261008144046.90853-1-Ilia.Gavrilov@infotecs.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe4167bf53b61405f97614f644f6a63a5d6ad034", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "d0305f8d90029556260c6824b61c493c424eba9e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "message": "Merge branch \u0027wireguard-fixes-for-7-3-rc7\u0027\n\nJason A. Donenfeld says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWireGuard fixes for 7.3-rc7\n\nThis series contains two important WireGuard fixes\n\n1) Stop zeroing out skb-\u003etstamp_type when encapsulating packets, so that\n fq behaves correctly, from Ramses de Norre.\n\n2) Make sure handshake state isn\u0027t swapped out while locks are\n released, reported by Jérémy Jean.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261008130124.724119-1-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d0305f8d90029556260c6824b61c493c424eba9e", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897" ], "author": { "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "time": "Thu Oct 08 14:59:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it\u0027s running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that\u0027s already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA \u003d handshake-\u003estate\n memcpy(cA, handshake-\u003ecrypto)\nup_read()\nif (sA !\u003d 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB \u003d handshake-\u003estate\n\t\t\t\t memcpy(cB, handshake-\u003ecrypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB !\u003d 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA !\u003d handshake-\u003estate)\n goto fail\n memcpy(handshake-\u003ecrypto, cA)\n handshake-\u003estate \u003d 2\nup_write()\ndown_write()\n if (handshake-\u003estate !\u003d 2)\n goto fail\n derive_session(handshake-\u003ecrypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake-\u003ecrypto)\n\t\t\t\t\t\t\t\t handshake-\u003estate \u003d 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB !\u003d handshake-\u003estate)\n\t\t\t\t goto fail\n\t\t\t\t memcpy(handshake-\u003ecrypto, cB)\n\t\t\t\t handshake-\u003estate \u003d 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake-\u003estate !\u003d 2)\n\t\t\t\t goto fail\n\t\t\t\t derive_session(handshake-\u003ecrypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that\u0027s on the stack with the latest one that the peer\u0027s\nhandshake state has.\n\nCc: stable@vger.kernel.org\nFixes: e7096c131e51 (\"net: WireGuard secure network tunnel\")\nReported-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-4-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897", "tree": "9d95e48bcea0bdea94c5a0f6a64f51eae07abd4b", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313" ], "author": { "name": "Ramses de Norre", "email": "ramses@well-founded.dev", "time": "Thu Oct 08 14:59:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: queueing: preserve tstamp_type when encapsulating packet\n\nSending traffic through a wireguard tunnel on a host using the fq\nqdisc fills the log with:\n\n fq: likely mono tstamp with tstamp_type 0\n\nAn skb carries a timestamp in skb-\u003etstamp and, separately, a\nskb-\u003etstamp_type field recording which clock that timestamp came from.\nThe two have to agree.\n\nWhen wireguard encapsulates a packet it calls wg_reset_packet(), which\nclears the fields that must not leak from the inner packet into the\ntunnel packet. It does so in two steps:\n\n skb_scrub_packet(skb, true);\n memset(\u0026skb-\u003eheaders, 0, sizeof(skb-\u003eheaders));\n\nskb_scrub_packet() deliberately keeps skb-\u003etstamp when it holds a\nmonotonic timestamp: that value is the time the packet is scheduled to\nbe sent, and the qdisc still needs it. The memset then zeroes\nskb-\u003etstamp_type, because that field sits inside the headers group\nwhile skb-\u003etstamp does not. The packet therefore leaves wireguard\ncarrying a monotonic timestamp labelled as a realtime one.\n\nNothing noticed until commit c4f796c4f16b (\"net_sched: sch_fq: convert\nskb-\u003etstamp if not monotonic\"): fq used to assume every timestamp was\nmonotonic. It now consults tstamp_type, spots the mismatch, warns, and\nfalls back to treating the value as monotonic. Pacing still ends up\ncorrect, so the log spam is the actual problem.\n\nSave tstamp_type before the memset and restore it when encapsulating,\nnext to the hash fields that are already carried over this way. When\ndecapsulating it stays zeroed, which is right: an incoming packet\u0027s\ntimestamp is a realtime receive timestamp.\n\nFixes: d98d58a00261 (\"net: Set skb-\u003emono_delivery_time and clear it after sch_handle_ingress()\")\nSigned-off-by: Ramses de Norre \u003cramses@well-founded.dev\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-3-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "tree": "204be600ed191b6c040ac994154190bc882a4798", "parents": [ "64a6b36b0e1855288080bc5f89769f27d6dc03c8" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Thu Oct 08 12:41:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:38 2026 -0700" }, "message": "net: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key-\u003eip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto. Because skb-\u003etransport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET\u003dy although\nit is completely harmless.\n\nFix this by returning early in update_ipv6_checksum() if l4_proto is\nNEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset\nfor fragments while preserving the debug warning for any other protocol\nwhere the transport header is unexpectedly missing.\n\nSee the syzbot trace:\n\n!skb_transport_header_was_set(skb)\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635\n[...]\nRIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]\nRIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]\nRIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399\n[...]\nCall Trace:\n \u003cTASK\u003e\n set_ipv6 net/openvswitch/actions.c:531 [inline]\n do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366\n ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592\n ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705\n genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114\n genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800\n\nReported-by: syzbot+4cc63fcfb3845e149969@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d4cc63fcfb3845e149969\nFixes: 3fdbd1ce11e5 (\"openvswitch: add ipv6 \u0027set\u0027 action\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20261008104135.4722-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "64a6b36b0e1855288080bc5f89769f27d6dc03c8", "tree": "23b3e56944f4ebff357aa5e1d7f6b9306d601553", "parents": [ "d5788029c34fa7f27ab23f88a4f878e8913042a9" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Thu Oct 08 16:44:44 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:12 2026 -0700" }, "message": "net/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc-\u003eclcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc-\u003eclcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock-\u003eops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall\u0027s file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n Read of size 8 at addr ffff888109abb4e0 by task poc/103\n Call Trace:\n smc_getname+0x19e/0x1b0\n do_getsockname+0xe5/0x170\n __sys_getsockname+0x8c/0x100\n\n Allocated by task 95:\n sock_alloc_inode+0x1e/0x280\n sock_alloc+0x3d/0x240\n __sock_create+0x7e/0x430\n smc_create+0x121/0x240\n\n Freed by task 0:\n kmem_cache_free+0xcc/0x340\n rcu_core+0x50a/0x1850\n\n Last potentially related work creation:\n evict+0x446/0x6c0\n smc_clcsock_release+0xa8/0xd0\n smc_close_active_abort+0x26a/0x3a0\n __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback\u0027s return value otherwise.\n\nFixes: b03faa1fafc8 (\"net/smc: postpone release of clcsock\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20261008084444.787449-1-nicoyip.dev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5788029c34fa7f27ab23f88a4f878e8913042a9", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "6785011f8b16abf40b1e9d8b2e332232b3e68822", "c97426ec649d99596d8969e1a052c16b14b7b485" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "message": "Merge branch \u0027ipv4-ipv6-do-not-warn-on-route-notification-size-races\u0027\n\nDaehyeon Ko says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: do not warn on route notification size races\n\nA nexthop group can grow between route notification sizing and filling.\nBoth IPv4 and IPv6 can then legitimately return -EMSGSIZE, so remove the\nstale warnings while preserving their existing error paths.\n\nPatch 1 is unchanged from v1. Patch 2 adds the IPv6 counterpart requested\nby Ido. No new build or runtime test was run; both changes only delete the\nstale comment and WARN_ON().\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c97426ec649d99596d8969e1a052c16b14b7b485", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "e02a5b6588161673ef75a4bc5cdfb62bd493374d" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Thu Oct 08 14:29:23 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:36 2026 -0700" }, "message": "ipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.\n\nFixes: 907eea486888 (\"net: ipv6: Emit notification when fib hardware flags are changed\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261007114003.GA1011260@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/4012604727e5ba80b69ccd4d08796511397ddaef.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "e02a5b6588161673ef75a4bc5cdfb62bd493374d" }