)]}' { "log": [ { "commit": "011cd366a4c6d821d8b46d4ebeb2e3d8b7860856", "tree": "1e04ae563be14a63ea6e504e1e5ca018073097f5", "parents": [ "79378db6a86c7014cce40b65252e6c18f5b8bcc2", "82056957e5c42c4060a1d8b1576aad2dfe54e568" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 29 15:16:53 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 29 15:16:53 2026 +0100" }, "message": "Merge remote-tracking branch \u0027spi/for-7.2\u0027 into spi-next\n" }, { "commit": "79378db6a86c7014cce40b65252e6c18f5b8bcc2", "tree": "74dcdd5a8cf386a8c421031ffacbb011f8f53496", "parents": [ "60474437af5fe12abd20607766c809e0ad4e7245" ], "author": { "name": "Santhosh Kumar K", "email": "s-k6@ti.com", "time": "Wed May 27 23:07:36 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 28 13:49:00 2026 +0100" }, "message": "spi: spi-mem: avoid mutating op template in spi_mem_supports_op()\n\nspi_mem_supports_op() accepts a const struct spi_mem_op pointer but\ncasts away const internally to call spi_mem_adjust_op_freq(). This\nmutates the caller\u0027s op template, which causes stale max_freq values\nwhen callers reuse persistent templates - subsequent calls won\u0027t\nre-apply the device frequency cap since spi_mem_adjust_op_freq()\nskips non-zero values.\n\nFix by operating on a stack-local copy instead.\n\nFixes: a4f8e70d75dd (\"spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op()\")\nCc: Tianyu Xu \u003cxtydtc@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Santhosh Kumar K \u003cs-k6@ti.com\u003e\nReviewed-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://patch.msgid.link/20260527173736.2243004-1-s-k6@ti.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "60474437af5fe12abd20607766c809e0ad4e7245", "tree": "c612dbf73f36eb4bc4f815ae7abcbb5eed6b4821", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d" ], "author": { "name": "Varadarajan Narayanan", "email": "varadarajan.narayanan@oss.qualcomm.com", "time": "Thu May 14 12:15:31 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue May 26 19:38:46 2026 +0100" }, "message": "spi: dt-bindings: spi-qpic-snand: Add ipq5210 compatible\n\nSince the QPIC-SPI-NAND flash controller present in ipq5210 is the same\nas the one found in ipq9574, document the ipq5210 compatible and with\nipq9574 as the fallback.\n\nSigned-off-by: Varadarajan Narayanan \u003cvaradarajan.narayanan@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260514-ipq5210-nand-v1-1-cbdd7492e826@oss.qualcomm.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "82056957e5c42c4060a1d8b1576aad2dfe54e568", "tree": "e75b27b377b0b37eb321c6aee45ae67d9a2e31c9", "parents": [ "84bfaa6ceed629cbaeaccf03c4b287c719663284" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Mon May 18 17:43:52 2026 -0700" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon May 25 13:33:57 2026 +0100" }, "message": "spi: omap2-mcspi: Use of_device_get_match_data()\n\nUse of_device_get_match_data() to fetch platform match data directly\ninstead of open-coding an of_match_device() lookup.\n\nThis also lets the driver drop the of_device.h include.\n\nAssisted-by: Codex:GPT-5.5\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nLink: https://patch.msgid.link/20260519004352.627148-1-rosenp@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "tree": "2d7df7d7acab76095da5d5f02fa43bce11231a30", "parents": [ "6a97c4d5262d02f04d1f41113b0d090ea51f08dd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 13:48:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 13:48:06 2026 -0700" }, "message": "Linux 7.1-rc5\n" }, { "commit": "6a97c4d5262d02f04d1f41113b0d090ea51f08dd", "tree": "d8fc003a82eedbba37b878c6eacbe17e12e53c8c", "parents": [ "3526d7462355c4df269d4a87eed53dbd48a1df02", "9a12fa5213cfc391e0eed63902d3be98f0913765" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 12:50:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 12:50:36 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"arm64:\n\n - Fix ITS EventID sanitisation when restoring an interrupt\n translation table.\n\n - Fix PPI memory leak when failing to initialise a vcpu.\n\n - Correctly return an error when the validation of a hypervisor trace\n descriptor fails, and limit this validation to protected mode only.\n\n RISC-V:\n\n - Fix invalid HVA warning in steal-time recording\n\n - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and\n pmu_snapshot_set_shmem()\n\n - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n\n - Fix sign extension of value for MMIO loads\n\n s390:\n\n - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by\n the page table rewrite.\n\n x86:\n\n - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on\n Hygon Family 18h, just like on AMD Family 17h.\n\n - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM,\n return the VM\u0027s configured APIC bus frequency instead of the\n default. This is less confusing (read: not wrong) and makes it\n easier to fill in CPUID information that communicates the APIC bus\n frequency to the guest.\n\n Selftests:\n\n - Do not include glibc-internal \u003cbits/endian.h\u003e; it worked by chance\n and broke building KVM selftests with musl\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n KVM: selftests: Verify that KVM returns the configured APIC cycle length\n KVM: x86: Return the VM\u0027s configured APIC bus frequency when queried\n KVM: selftests: elf: Include \u003cendian.h\u003e instead of \u003cbits/endian.h\u003e\n KVM: s390: Properly reset zero bit in PGSTE\n KVM: s390: vsie: Fix redundant rmap entries\n KVM: s390: vsie: Fix unshadowing logic\n KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors\n KVM: s390: vsie: Fix memory leak when unshadowing\n KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc\n KVM: arm64: vgic: Free private_irqs when init fails after allocation\n KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits\n RISC-V: KVM: Fix sign extension for MMIO loads\n RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM\n riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM\n RISC-V: KVM: Fix invalid HVA warning in steal-time recording\n" }, { "commit": "3526d7462355c4df269d4a87eed53dbd48a1df02", "tree": "9eee3b40fda02b288aa3cbcb27bab3fe5e2523a7", "parents": [ "a674bf74b31079782d7d8f333c8d832374f0b65c", "fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 11:00:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 11:00:45 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - On SEV guests, handle set_memory_{encrypted,decrypted}() failures\n more conservatively by assuming that all affected pages are\n unencrypted (Carlos López)\n\n - Disable broadcast TLB flush when PCID is disabled (Tom Lendacky)\n\n - Fix VMX vs. hrtimer_rearm_deferred() regression (Peter Zijlstra)\n\n - Move IRQ/NMI dispatch code from KVM into x86 core, to prepare for a\n KVM x2apic fix (Peter Zijlstra)\n\n - Fix incorrect munmap() size on map_vdso() failure (Guilherme Giacomo\n Simoes)\n\n* tag \u0027x86-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n virt: sev-guest: Explicitly leak pages in unknown state\n x86/mm: Disable broadcast TLB flush when PCID is disabled\n x86/kvm/vmx: Fix VMX vs hrtimer_rearm_deferred()\n x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core\n x86/vdso: Fix incorrect size in munmap() on map_vdso() failure\n" }, { "commit": "a674bf74b31079782d7d8f333c8d832374f0b65c", "tree": "af47de05fff297bc7e6e58472a2987677c500e8d", "parents": [ "ee651da6d3e1e3c57d22dd6f03850af980b7cd10", "c9b7598eb013c6dbf2526dc050364bd8dc24f0d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:55:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:55:21 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irqchip driver fixes from Ingo Molnar:\n\n - Fix the hardware probing error path of the renesas-rzt2h\n irqchip driver\n\n - Fix the exynos-combiner irqchip driver on -rt kernels\n by turning the IRQ controller spinlock into a raw spinlock\n\n* tag \u0027irq-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path\n irqchip/exynos-combiner: Switch to raw_spinlock\n" }, { "commit": "ee651da6d3e1e3c57d22dd6f03850af980b7cd10", "tree": "8c2bcd61a715f17f3c68b857440119c6e4603de2", "parents": [ "2be86a8c57773bce1b5c845c49e0bfa3caac838c", "5f41161059fd0f1bbf18c90f3180e38cc45a14eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:48:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:48:55 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull debugobjects fix from Ingo Molnar::\n\n - Fix debugobjects regression on -rt kernels: don\u0027t fill the pool\n (which uses a coarse lock) if -\u003epi_blocked_on, because that messes up\n the priority inheritance of callers\n\n* tag \u0027core-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n debugobjects: Do not fill_pool() if pi_blocked_on\n" }, { "commit": "2be86a8c57773bce1b5c845c49e0bfa3caac838c", "tree": "c66c8e3bb96422cd855d06a22e98dfb72eb08311", "parents": [ "53676e4d44d6b38c8a0d9bff331f170ae2e41bbe", "4e4af55aaca7f6d7673d5f9889ad0529db86a048" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:37:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:37:55 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - adm1266: Various fixes from Abdurrahman Hussain\n\n The fixed issues were reported by Sashiko as part of a code review of\n a functional change in the driver.\n\n - lenovo-ec-sensors: Convert to devm_request_region() to fix\n release_region cleanup, and fix EC \"MCHP\" signature validation logic,\n from Kean Ren\n\n* tag \u0027hwmon-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock\n hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock\n hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock\n hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()\n hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()\n hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors\n hwmon: (pmbus/adm1266) don\u0027t clobber GPIO bits before PDIO read in get_multiple\n hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR\n hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer\n hwmon: (pmbus/adm1266) include adapter number in GPIO line label\n hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer\n hwmon: (pmbus/adm1266) reject implausible blackbox record_count\n hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX\n hwmon: (pmbus/adm1266) seed timestamp from the real-time clock\n hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic\n hwmon: (lenovo-ec-sensors): Convert to devm_request_region()\n" }, { "commit": "53676e4d44d6b38c8a0d9bff331f170ae2e41bbe", "tree": "47b6871f3557fa8dfe2c0d508f07fe64078aa004", "parents": [ "f0e77c598ebbb1ae055b156aaa33b7433ae45e51" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Mon May 18 15:17:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:31:24 2026 -0700" }, "message": "drm/msm: Restore second parameter name in purge() and evict()\n\nAfter commit 3392291fc509 (\"drm/msm: Fix shrinker deadlock\"), all\nsupported versions of clang warn (or error with CONFIG_WERROR\u003dy):\n\n drivers/gpu/drm/msm/msm_gem_shrinker.c:105:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]\n 105 | purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n | ^\n drivers/gpu/drm/msm/msm_gem_shrinker.c:117:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]\n 117 | evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n | ^\n 2 errors generated.\n\nWith older but supported versions of GCC, this is an unconditional hard error:\n\n drivers/gpu/drm/msm/msm_gem_shrinker.c: In function \u0027purge\u0027:\n drivers/gpu/drm/msm/msm_gem_shrinker.c:105:35: error: parameter name omitted\n purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n ^~~~~~~~~~~~~~~~~~~~~~~\n drivers/gpu/drm/msm/msm_gem_shrinker.c: In function \u0027evict\u0027:\n drivers/gpu/drm/msm/msm_gem_shrinker.c:117:35: error: parameter name omitted\n evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n ^~~~~~~~~~~~~~~~~~~~~~~\n\nRestore the parameter name to clear up the warnings, renaming it\n\"unused\" to make it clear it is only needed to satisfy the prototype of\ndrm_gem_lru_scan().\n\nCc: stable@vger.kernel.org\nFixes: 3392291fc509 (\"drm/msm: Fix shrinker deadlock\")\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f0e77c598ebbb1ae055b156aaa33b7433ae45e51", "tree": "101355b4a44c992e2d7d2b7938b0517428a259a4", "parents": [ "4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90", "7dd62566e0d108d29034bcff8503b827f8763320" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 09:53:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 09:53:17 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix bpf_throw() and global subprog combination (Kumar Kartikeya\n Dwivedi)\n\n - Fix out of bounds access in BPF interpreter (Yazhou Tang)\n\n - Fix potential out of bounds access in inner per-cpu array map\n (Guannan Wang)\n\n - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n libbpf: fix off-by-one in emit_signature_match jump offset\n bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature\n selftests/bpf: Cover global subprog exception leaks\n bpf: Check global subprog exception paths\n bpf: make bpf_session_is_return() reference optional\n bpf: Use array_map_meta_equal for percpu array inner map replacement\n selftests/bpf: Add test for large offset bpf-to-bpf call\n bpf: Fix s16 truncation for large bpf-to-bpf call offsets\n bpf: Fix out-of-bounds read in bpf_patch_call_args()\n" }, { "commit": "4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90", "tree": "f1d70b1952fe86d8b72a765506b7a5663919bf04", "parents": [ "400544639d2a11a9c1e276a912a9dff8fe4107dc", "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - fix for creating tmpfiles\n\n - fix durable reconnect error path\n\n - validate SID in security descriptor when inheriting DACL\n\n* tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n ksmbd: validate SID in parent security descriptor during ACL inheritance\n ksmbd: fix durable reconnect error path file lifetime\n" }, { "commit": "400544639d2a11a9c1e276a912a9dff8fe4107dc", "tree": "587237ffcddde9bdde29ec58d8e182d12046fb7e", "parents": [ "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "f13342e15deafb7538a7a8577ed5f4c33c56f64e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A batch of fixes to simple quotas:\n\n - add conditional rescheduling point not dependent on the lock during\n inode iterations to avoid delays with PREEMPT_NONE enabled\n\n - fix subvolume deletion so it does not break the squota invariants\n\n - properly handle enabling squota, tracking extents in the initial\n transaction\n\n - catch and warn about underflows, clamp to zero to avoid further\n problems\n\n And one fix to inode size handling:\n\n - fix handling of preallocated extents beyond i_size when not using\n the no-holes feature\"\n\n* tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: swallow btrfs_record_squota_delta() ENOENT\n btrfs: clamp to avoid squota underflow\n btrfs: fix squota accounting during enable generation\n btrfs: check for subvolume before deleting squota qgroup\n btrfs: always drop root-\u003einodes lock before cond_resched()\n btrfs: mark file extent range dirty after converting prealloc extents\n" }, { "commit": "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "tree": "fa9f7b0ff70d88e7ccbed16200f44e8dd5a62e26", "parents": [ "eed108edc1170404bbef9e7d0189d18a3cc354f5", "8339dd0e5090f092c525c5e04b2a75ec5e5305a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fix from Carlos Maiolino:\n \"A single fix for a race in xfs buffer cache which may lead to\n filesystem shutdown due to inconsistent metadata if the buffer\n lookup happens to find an old dead buffer still in the cache\"\n\n* tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix a buffer lookup against removal race\n" }, { "commit": "eed108edc1170404bbef9e7d0189d18a3cc354f5", "tree": "b719bfa55f4f4394d3e017c5b9dc99f074a64311", "parents": [ "95e6d3ba0571330df866911da9dedd83e05417ca", "e90ef85ada857819313000cc50c6edfcddec6850" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "message": "Merge tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux\n\nPull nios2 fixes from Dinh Nguyen:\n\n - Implement _THIS_IP_ for inline asm\n\n - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported\n\n* tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:\n nios2: Implement _THIS_IP_ using inline asm\n MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n" }, { "commit": "95e6d3ba0571330df866911da9dedd83e05417ca", "tree": "10f93942d6fb2daa7fc91edc87a41376f06aa822", "parents": [ "c8561c73b4a8669bb13c57a5853318cd02655f9b", "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Rework KASLR to avoid initrd overlap, remove some unused code to avoid\n a build warning, fix some bugs in kprobes and KVM\"\n\n* tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Move some variable declarations to paravirt.h\n LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n LoongArch: Remove unused code to avoid build warning\n LoongArch: Avoid initrd overlap during kernel relocation\n LoongArch: Skip relocation-time KASLR if already applied\n efi/loongarch: Randomize kernel preferred address for KASLR\n" }, { "commit": "7dd62566e0d108d29034bcff8503b827f8763320", "tree": "38c0df3e5d603d41840f6c66b46e15625c111d7a", "parents": [ "49b18315be4eecfc36b75f4aecb4d40a87d68a20" ], "author": { "name": "KP Singh", "email": "kpsingh@kernel.org", "time": "Fri May 22 23:53:36 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat May 23 07:49:22 2026 -0700" }, "message": "libbpf: fix off-by-one in emit_signature_match jump offset\n\nThe offset for the cleanup-label jump is computed before the MOV R7\ninstruction is emitted, but the JMP lands after it. Account for the\nextra insn in the offset calculation (-2 instead of -1). Drop the\nredundant self-loop in the else branch; gen-\u003eerror \u003d -ERANGE already\nmarks the generation as failed.\n\nFixes: fb2b0e290147 (\"libbpf: Update light skeleton for signing\")\nSigned-off-by: KP Singh \u003ckpsingh@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260522215337.662271-2-kpsingh@kernel.org\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "c8561c73b4a8669bb13c57a5853318cd02655f9b", "tree": "a9ac004283e3930c47a717576756b8d4a44857dd", "parents": [ "3f264650ca7d2a2d6de86234d919f305211632cd", "215c90ee656114f5e8c32408228d97082f8e0eef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Remove the software node on platform device release(); without this,\n the software node remains registered after the device is gone and a\n subsequent platform_device_register_full() reusing the same node\n fails with -EBUSY\n\n - In sysfs_update_group(), do not remove a pre-existing directory when\n create_files() fails; the previous code would silently destroy a\n sysfs group that the caller did not create\n\n - Set fwnode-\u003esecondary to NULL in fwnode_init() to avoid dereferencing\n uninitialized memory (e.g. in dev_to_swnode()) when the firmware node\n is allocated on the stack or via a non-zeroing allocator\n\n* tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n sysfs: don\u0027t remove existing directory on update failure\n driver core: platform: remove software node on release()\n" }, { "commit": "3f264650ca7d2a2d6de86234d919f305211632cd", "tree": "b440c7d62949730c6772d1698dafbba3152da9fe", "parents": [ "ab868c10971c5d2cd27b3709d11225941eabe78e", "023453cb7eb0f53c5dc36babed8e706c1b0b0187" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Core:\n - smbus: fix a potential uninitialization bug\n\n Tegra:\n - drop runtime PM reference when exiting on mutex_lock failure\n - preserve transfer errors when releasing the mutex\"\n\n* tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: smbus: fix a potential uninitialization bug\n i2c: tegra: make tegra_i2c_mutex_unlock() return void\n i2c: tegra: fix pm_runtime leak on mutex_lock failure\n" }, { "commit": "ab868c10971c5d2cd27b3709d11225941eabe78e", "tree": "78b438df7cde483d4aa05f28acc6004447e2df17", "parents": [ "f53a244224ec0304209917e3f4d68dc83b1967db", "5b74373390113fba798a76b483837029ab010fef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n\n - syzbot triggred crash in rxe due to concurrent plug/unplug\n\n - Possible non-zero\u0027d memory exposed to userspace in bnxt_re\n\n - Malicous \u0027magic packet\u0027 with SIW causes a buffer overflow\n\n - Tighten the new uAPI validation code to not crash in debugging prints\n and have the right module dependencies in drivers\n\n - mana was missing the max_msg_sz report to userspace\n\n - UAF in rtrs on an error path\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/rtrs: Fix use-after-free in path file creation cleanup\n RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port\n RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()\n RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs\n RDMA/siw: Reject MPA FPDU length underflow before signed receive math\n RDMA/bnxt_re: zero shared page before exposing to userspace\n selftests/rdma: explicitly skip tests when required modules are missing\n RDMA/nldev: Add mutual exclusion in nldev_dellink()\n" }, { "commit": "8339dd0e5090f092c525c5e04b2a75ec5e5305a6", "tree": "85f3a7a35a37edd40803494b5789707e6a87ce82", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "c69439a891ccb37ede5d68539636337c6bd92fab" ], "author": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux into test_merge\n\nxfs: fixes for v7.1-rc5\n\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n Lines starting with \u0027#\u0027 will be ignored.\n" }, { "commit": "f53a244224ec0304209917e3f4d68dc83b1967db", "tree": "fe19f266c5edbf2ce37ef1adef2188add9c8d32b", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "message": "Merge tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl\n\nPull fwctl fix from Jason Gunthorpe:\n\n - Buffer overflow due to missing input validation in pds\n\n* tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:\n fwctl: pds: Validate RPC input size before parsing\n" }, { "commit": "9a12fa5213cfc391e0eed63902d3be98f0913765", "tree": "bef8dcc25a2efd9153e7da972121b8becd710978", "parents": [ "d9c41dc531b0e8feb046ee3d31ce37657101b137" ], "author": { "name": "Tina Zhang", "email": "zhang_wei@open-hieco.net", "time": "Fri May 22 12:00:14 2026 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:09:04 2026 +0200" }, "message": "KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n\nHygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and\nshare the same erratum #1235: hardware may read a stale IsRunning\u003d1 bit\nduring ICR write emulation and silently fail to generate an\nAVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.\n\nThe absence of the VM-Exit causes KVM to miss the required wakeup of\nblocking target vCPUs, leading to hung vCPUs and unbounded delays in\nguest execution.\n\nExtend the existing AMD Family 17h erratum #1235 workaround to also cover\nHygon Family 18h. With IPI virtualization disabled, KVM never sets\nIsRunning\u003d1 in the Physical ID table, so every non-self IPI generates a\nVM-Exit and is correctly emulated.\n\nFixes: 8de4a1c8164e (\"KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Tina Zhang \u003czhang_wei@open-hieco.net\u003e\nMessage-ID: \u003c20260522040014.3380201-1-zhang_wei@open-hieco.net\u003e\n" }, { "commit": "d9c41dc531b0e8feb046ee3d31ce37657101b137", "tree": "932e0126afef4181c6d03f316a8deb8c987a4614", "parents": [ "86e2de10eb14446a49019791bd0674faa5fae088" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 22 10:35:26 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:07:40 2026 +0200" }, "message": "KVM: selftests: Verify that KVM returns the configured APIC cycle length\n\nAdd checks in the APIC bus clock test to verify that querying\nKVM_CAP_X86_APIC_BUS_CYCLES_NS on the VM after changing the frequency\nreturns the VM\u0027s actual APIC cycle length, not KVM\u0027s default. For\ngiggles, verify that KVM still returns its default frequency for the\nsystem-scoped check.\n\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260522173526.3539407-3-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "86e2de10eb14446a49019791bd0674faa5fae088", "tree": "9dbaaf7db2147410080b986cd88125ea943dc305", "parents": [ "2d42c7cf1a2dad694db0c518b0e004502859f11c" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 22 10:35:25 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:07:29 2026 +0200" }, "message": "KVM: x86: Return the VM\u0027s configured APIC bus frequency when queried\n\nWhen KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return the\nVM\u0027s configured APIC bus frequency, not KVM\u0027s default. Aside from the fact\nthat returning the default frequency is blatantly wrong if userspace has\nchanged the frequency, returning the configured frequency means userspace\ncan blindly trust the result, e.g. when filling PV CPUID information that\ncommunicates the APIC bus frequency to the guest.\n\nFixes: 6fef518594bc (\"KVM: x86: Add a capability to configure bus frequency for APIC timer\")\nReported-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCloses: https://lore.kernel.org/all/ab84153e33fbe7c25667f595c56b310d4d5a93ef.camel@infradead.org\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260522173526.3539407-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "2d42c7cf1a2dad694db0c518b0e004502859f11c", "tree": "f470008de25117373a234b8e43133c61be891b4e", "parents": [ "06c4f99526784938663a5e82b1ea1b67a4794491" ], "author": { "name": "Hisam Mehboob", "email": "hisamshar@gmail.com", "time": "Thu Apr 09 21:40:22 2026 +0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:05:26 2026 +0200" }, "message": "KVM: selftests: elf: Include \u003cendian.h\u003e instead of \u003cbits/endian.h\u003e\n\n\u003cbits/endian.h\u003e is a glibc-internal header that explicitly states it\nshould never be included directly:\n\n #error \"Never use \u003cbits/endian.h\u003e directly; include \u003cendian.h\u003e instead.\"\n\nReplace it with the correct public header \u003cendian.h\u003e which works on\nall C libraries including musl. Building KVM selftests with musl-gcc\nfails with:\n\n lib/elf.c:10:10: fatal error: bits/endian.h: No such file or directory\n\nFixes: 6089ae0bd5e1 (\"kvm: selftests: add sync_regs_test\")\nSigned-off-by: Hisam Mehboob \u003chisamshar@gmail.com\u003e\nMessage-ID: \u003c20260409164020.1575176-4-hisamshar@gmail.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "06c4f99526784938663a5e82b1ea1b67a4794491", "tree": "d3ed6cdcceb83d01ecdf641585fb814fd0043ab0", "parents": [ "37f32d5ab83968d63cfba6092ecaae3e582db964", "c7832534a8160276cccb9a8cc8cafb5614c579d0" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:04:35 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:04:35 2026 +0200" }, "message": "Merge tag \u0027kvm-riscv-fixes-7.1-1\u0027 of https://github.com/kvm-riscv/linux into HEAD\n\nKVM/riscv fixes for 7.1, take #1\n\n- Fix invalid HVA warning in steal-time recording\n- Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info()\n and pmu_snapshot_set_shmem()\n- Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n- Fix sign extension of value for MMIO loads\n" }, { "commit": "37f32d5ab83968d63cfba6092ecaae3e582db964", "tree": "89302eb3515325d10aa669e592c3d1fe0ca29c95", "parents": [ "e23844b2ddbdd004285f14bdc672b4d854ad4c4e", "9029496abfae3c208336855ae6f3e1f5f881ef76" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:58 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:58 2026 +0200" }, "message": "Merge tag \u0027kvm-s390-master-7.1-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD\n\nKVM: s390: some vSIE and UCONTROL fixes\n\nFix some memory issues and some hangs in vSIE.\n" }, { "commit": "e23844b2ddbdd004285f14bdc672b4d854ad4c4e", "tree": "3456738aee9bc04f692ddcf4ae338bb6ece7229c", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "1702da76e017ae0fbe1a92b07bc332972c293e89" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:10 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:10 2026 +0200" }, "message": "Merge tag \u0027kvmarm-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.1, take #3\n\n- Fix ITS EventID sanitisation when restoring an interrupt translation\n table.\n\n- Fix PPI memory leak when failing to initialise a vcpu.\n\n- Correctly return an error when the validation of a hypervisor trace\n descriptor fails, and limit this validation to protected mode only.\n" }, { "commit": "79bd2dded182b1d458b18e62684b7f82ffc682e5", "tree": "e11cab84e200dac97bef26a2c880d1fea8caf36d", "parents": [ "de37e502a315677138009d2965f87e2c0721e76f", "0c1a9dce208b4dc265925898e5da98934f7f9266" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Spurious WARN in ops_dequeue() racing with concurrent dispatch\n\n - Self-deadlock between scheduler disable and a concurrent sub-sched\n enable\n\n* tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()\n sched_ext: Fix deadlock between scx_root_disable() and concurrent forks\n" }, { "commit": "de37e502a315677138009d2965f87e2c0721e76f", "tree": "0012bea881280a202ccb1a3c6620ed1493a0e202", "parents": [ "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "22572dbcd3486e6c4dced877125bbf50e4e24edf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n \"Two rstat fixes:\n\n - Out-of-bounds access in the css_rstat_updated() BPF kfunc when\n called with an unchecked user-supplied cpu\n\n - Over-strict NMI guard after the recent switch to try_cmpxchg left\n sparc and ppc64 unable to queue rstat updates from NMI\"\n\n* tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: rstat: relax NMI guard after switch to try_cmpxchg\n cgroup/rstat: validate cpu before css_rstat_cpu() access\n" }, { "commit": "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "tree": "f06a88c6b9511d40464a6cd5ef9f7c2062bed8db", "parents": [ "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "84335a9985867c1a6cd28c693ffbedc4ef1caa39" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular fixes pull, amdgpu/xe being the usual, with bonus msm content\n to bulk things out, otherwise it has the usual scattered changes, with\n amdxdna dropping a badly thought out userspace api.\n\n gem:\n - clean up LRU locking\n\n msm:\n - Core:\n - Fixed bindings for SM8650, SM8750 and Eliza\n - Don\u0027t use UTS_RELEASE directly\n - Fix typo in clock-names property\n - DPU:\n - Fixed CWB description on Kaanapali\n - Fixed scanline strides for YUV UBWC formats\n - Stopped DSI register dumping to access past the end of region\n - DSI:\n - Fix dumping unaligned regions\n - GPU:\n - Fix GMEM_BASE for a6xx gen3\n - Fix userspace reachable crash on a2xx-a4xx\n - Fix sysprof_active for counter collection with IFPC enabled GPUs\n - Fix shrinker lockdep\n\n amdgpu:\n - Userq fixes\n - VPE fix\n - SMU 15 fix\n - Misc fixes\n - VCE fixes\n - DC bios parsing fixes\n - DC aux fix\n - Mode1 reset fix\n - RAS fixes\n\n amdkfd:\n - Misc fixes\n\n radeon:\n - CS parser fix\n\n xe:\n - SRIOV related fixes\n - Fix leak and double-free\n - Multi-cast register fixes\n - Multi-queue fix\n\n i915:\n - Fix joiner color pipeline selection [display]\n - Fix readback for target_rr in Adaptive Sync SDP [dp]\n - Apply Intel DPCD workaround when SDP on prior line used [psr]\n\n amdxdna:\n - remove mmap and export for ubuf\n\n bridge:\n - chipone-icn6211: managed bridge cleanup\n - lt66121: acquire reset GPIO\n - megachips: fix clean up on failed IRQ requests\n\n v3d:\n - fix UAF in error code paths\n - release GEM-object ref on free\u0027d jobs\n\n virtio:\n - use uninterruptible resv locking in plane updates\n\n mediatek:\n - fix sparse warnings\"\n\n* tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel: (78 commits)\n drm/xe/oa: Fix exec_queue leak on width check in stream open\n drm/virtio: use uninterruptible resv lock for plane updates\n drm/amdgpu: fix handling in amdgpu_userq_create\n drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check\n drm/amdgpu: userq_va_mapped should remain true once done\n drm/amdgpu: avoid integer overflow in VA range check\n drm/amd/ras: Fix UMC error address allocation leak\n drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset\n drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n drm/amd/display: Validate GPIO pin LUT table size before iterating\n drm/amd/display: Fix integer overflow in bios_get_image()\n drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id\n drm/amdgpu: use atomic operation to achieve lockless serialization\n drm/amdkfd: Check bounds on allocate_doorbell\n drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets\n drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets\n drm/amdgpu/vce1: Stop using amdgpu_vce_resume\n drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n drm/amdgpu/vce1: Don\u0027t repeat GTT MGR node allocation\n drm/amdgpu/vce1: Check if VRAM address is lower than GART.\n ...\n" }, { "commit": "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "tree": "2be0879a817e091f8e6c9cf24e1d0158de4490eb", "parents": [ "59825bc9ce06281224c15c51ec535bf339112d8c", "b71cb088b2e3427924a470fc43e7aedb8a40d2e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Small fixes, two in drivers and the remaining a sign conversion probem\n in sd with no user visible consequences (non-zero is error)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: tcm_loop: Fix NULL ptr dereference\n scsi: isci: Fix use-after-free in device removal path\n scsi: sd: Fix return code handling in sd_spinup_disk()\n" }, { "commit": "59825bc9ce06281224c15c51ec535bf339112d8c", "tree": "6098b6c20171c7bff75d2e8d1e543b389e25d681", "parents": [ "cca95436be15d00ddac02d73054b612649485495", "654ddf855bebd8d45a6e707f5dc2344921f5e0cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from\n\n - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to\n handle match overrides gracefully\n\n - asus-armoury:\n - Fix mini-LED mode get/set\n - Add support for FA401EA, FX607VU, G614FR, and GU605CP\n\n - bitland-mifs-wmi:\n - Add CONFIG_LEDS_CLASS dependency\n\n - hp-wmi:\n - Add thermal support for Omen 16-c0xxx (board 8902)\n\n - intel/vsec:\n - Fix enable_cnt imbalance due to PCIe error recovery\n\n - surface/aggregator_registry:\n - Remove battery \u0026 AC nodes on Surface Laptop 7 to avoid duplicated\n devices\n\n - uniwill-laptop:\n - Handle uninitialized and invalid charging threshold values\n - Accept charging threshold of 0 through power supply sysfs ABI and\n clamp it to 1\n - Make \u0027force\u0027 parameter to work also when device descriptor is\n found\n - Do not enable charging limit despite the \u0027force\u0027 parameter to\n avoid permanent damage to battery\n\n* tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)\n platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL\n platform/x86: system76: Check ACPI_COMPANION() against NULL\n platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL\n platform/x86: intel/rst: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu: Check ACPI_COMPANION() against NULL\n platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL\n platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL\n platform/x86: asus-armoury: add support for GU605CP\n platform/x86: asus-armoury: add support for FA401EA\n platform/x86: asus-armoury: add support for G614FR\n ...\n" }, { "commit": "84335a9985867c1a6cd28c693ffbedc4ef1caa39", "tree": "aef06d4fb220a4eca0c01cbb5087201e640ba8f2", "parents": [ "4378a4116567887066011b8e0cd443241609e467", "4d25342543c01310fc4e0cba7cb17c775e2421e2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:50:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:57:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- SRIOV related fixes (Wajdeczko, Mohanram)\n- Fix leak and double-free (Lin)\n- Multi-cast register fixes (Gustavo)\n- Multi-queue fix (Niranjana)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com\n" }, { "commit": "cca95436be15d00ddac02d73054b612649485495", "tree": "b99552f9fe51620b5a71e682057e808abc63c1d8", "parents": [ "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "ea17fc4d7dc2ba6459b1a318962960520201baf1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "message": "Merge tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy fixes from Vinod Koul:\n\n - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL\n lock failure fix\n\n - Apple typec switch/mux leak fix\n\n - Marvell incoorect register fix for mvebu utmi phy\n\n - Tegra per-pad calibration fix\n\n* tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:\n phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config\n phy: apple: atc: Fix typec switch/mux leak on unbind\n phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()\n phy: eswin: Fix incorrect error check in probe()\n phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix\n phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870\n phy: tegra: xusb: Fix per-pad high-speed termination calibration\n phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access\n phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff\n phy: qcom: edp: Fix AUX_CFG8 programming for DP mode\n phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables\n phy: qcom: edp: Add eDP/DP mode switch support\n phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables\n" }, { "commit": "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "tree": "b6fbef7d38212c0844bc2be04a2a09cf4d137d2e", "parents": [ "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"Another batch of driver fixes from Johan fixing error handling paths,\n plus another from Felix. We also have a new device ID added in the DT\n bindings for SpacemiT K3\"\n\n* tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: fsl-qspi: support SpacemiT K3\n spi: ti-qspi: fix use-after-free after DMA setup failure\n spi: sprd: fix error pointer deref after DMA setup failure\n spi: qup: fix error pointer deref after DMA setup failure\n spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()\n spi: ep93xx: fix error pointer deref after DMA setup failure\n" }, { "commit": "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "tree": "b35aec61f5ad38649275a6967f64fd29323bff2f", "parents": [ "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "f9b2d3b703d13df50c630997dfdc25648e96db0d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of fixes here, one very minor Kconfig fix and a fix for a\n nasty issue with error reporting in the tps65219 driver\"\n\n* tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: tps65219: fix irq_data.rdev not being assigned\n regulator: Kconfig: fix a typo in help\n" }, { "commit": "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "tree": "ef266fd1c05fe6752830fac5a3d0c67ea480972e", "parents": [ "99e08debac1a381d57bd50a26e377e27674d91b7", "3812a9e84265a5cdd90d29fe8d97a023e91fb945" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Implement the GPIO .get_direction() callback in the Mediatek driver\n to rid dmesg warnings\n\n - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin\n function, so there is no conflict with orthogonal muxing\n\n - Fix incorrect settings of the \"PUPD\" (pull-up-pull-down) register\n during suspend/resume in the Renesas RZG2L\n\n - Fix the SMT register cache to be per-bank in the Renesas RZG2L\n\n - Fix the QDSS track clock and control pin group names in the Qualcomm\n Eliza driver\n\n - Fix a deadlock in the Amlogic driver, caused by playing around in\n sysfs\n\n - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a\n similar fix for the Qualcomm SM8150\n\n - Allow parsing DTs without explicit function nodes in the Freescale\n i.MX1 driver\n\n - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk\n\n* tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\n pinctrl: imx1: Allow parsing DT without function nodes\n pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150\n pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615\n pinctrl: meson: amlogic-a4: fix deadlock issue\n pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names\n pinctrl: renesas: rzg2l: Fix SMT register cache handling\n pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume\n pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function\n pinctrl: mediatek: moore: implement gpio_chip::get_direction()\n" }, { "commit": "99e08debac1a381d57bd50a26e377e27674d91b7", "tree": "8c8e5bb8a6fdb4693d7bc7881ad1f6f3dd62351c", "parents": [ "c22407252a2421286998323831095e6b8a1d9532", "a4fa45c1d980bc2b9837f469119af24a9304a1fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - propagate the error code from regulator_enable() in resume path in\n gpio-pca953x\n\n - take the device lock when calling device_is_bound() in virtual GPIO\n drivers\n\n - fix software node leak in remove path in gpio-aggregator\n\n - fix a potential use-after-free in gpio-aggregator\n\n - harden the GPIO character device uAPI: check that line config\n attributes are correctly zeroed\n\n* tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: virtuser: lock device when calling device_is_bound()\n gpio: aggregator: lock device when calling device_is_bound()\n gpio: sim: lock device when calling device_is_bound()\n gpio: aggregator: remove the software node when deactivating the aggregator\n gpio: aggregator: fix a potential use-after-free\n gpio: cdev: check if uAPI v2 config attributes are correctly zeroed\n gpio: pca953x: propagate regulator_enable() error from resume\n" }, { "commit": "c22407252a2421286998323831095e6b8a1d9532", "tree": "1874b784b3391147fe004219ce3acee58924741a", "parents": [ "3997e3bb1d30a426c0599918ebaac51698fcc959", "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"As expected, we still continue receiving lots of small fixes.\n\n One major change is about HD-audio pending IRQ handling, but this\n would influence only on odd machines or slow VMs. There are a few\n other fixes for the core part, but most of them are not-too-serious\n UAF fixes, while the rest are mostly device-specific fixes and quirks.\n\n ALSA Core:\n - Fix for PCM silencing with bogus iov_iter\n - Fixes for past-the-end iterators in timer and seq\n - Serialization of UMP output teardown\n - Rate-limit ELD parsing errors\n\n HD-audio:\n - Fixes for IRQ work handling and SSID matching\n - Various Realtek quirks for HP and ASUS laptops, including LED fixes\n\n ASoC:\n - Intel: ACPI match table updates for PTL, NVL, and ARL platforms\n - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs\n - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm\n - DT-binding fix for MediaTek\n\n Others:\n - USB ua101: Reject too-short USB descriptors\n - Scarlett2: Fix for flash writes\n - ASIHPI: Fix for potential OOB access\n - AMD SPI: Fix for bus number in ACPI probe\n\n MAINTAINERS:\n - Updates for SOF and TI maintainers\"\n\n* tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits)\n ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional\n ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.\n ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform\n ASoC: cs-amp-lib: Fix typo in error message: write -\u003e read\n ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()\n ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data()\n ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()\n MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer\n ALSA: seq: Serialize UMP output teardown with event_input\n ALSA: scarlett2: Allow flash writes ending at segment boundary\n ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6\n ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream\n ALSA: hda: Move irq pending work into hda-intel stream\n ASoC: soc-utils: Add missing va_end in snd_soc_ret()\n ALSA: ua101: Reject too-short USB descriptors\n ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X\n ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()\n ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register()\n ...\n" }, { "commit": "3997e3bb1d30a426c0599918ebaac51698fcc959", "tree": "3fa748f59fd1af865c612a24367d5ba957887585", "parents": [ "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "f6982769910ecddabdb5b8b9afdab0bb8b6668ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n - Fix memory leak for peer-to-peer addresses\n - Fix dma map leaks on resource errors\n\n - Another bio integrity fix, fixing a recent regression\n\n - Fix for an issue with the request pre-allocation and caching when IO\n is queued, where if a bio split occurred and ended up blocking, the\n list could be corrupted\n\n* tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: avoid use-after-free in disk_free_zone_resources()\n blk-mq: pop cached request if it is usable\n nvme-pci: fix dma mapping leak on data setup error\n nvme-pci: fix dma_vecs leak on p2p memory\n bio-integrity-fs: pass data iter to bio_integrity_verify()\n" }, { "commit": "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "tree": "5280f6293c32b1f21d8d4cad148828f7b2a615ab", "parents": [ "558c3eca715ea0110fe6fce38b063a6f9936188c", "e97ff8b62d4690c69297f0f6de874f0564cc01a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix for an issue with IORING_OP_NOP and using injection results\n\n - Fix for an issue in IORING_OP_WAITID, where the info state was\n assumed cleared by the lower level syscall handler, but for some\n cases it is not. Just clear the data upfront, so that non-initialized\n data isn\u0027t copied back to userspace\n\n - Fix for a lockdep reported issue, where IORING_OP_BIND enters file\n create and hence hits mnt_want_write(), which creates a three part\n lockdep cycle between the super lock, io_uring\u0027s uring_lock, and the\n cred mutex\n\n - Fix a regression introduced in this cycle with how linked timeouts\n are deleted\n\n - Ensure that the -\u003eopcode nospec indexing on the opcode issue side\n covers all the cases\n\n* tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/nop: pass all errors to userspace\n io_uring/timeout: splice timed out link in timeout handler\n io_uring: propagate array_index_nospec opcode into req-\u003eopcode\n io_uring/waitid: clear waitid info before copying it to userspace\n io_uring/net: punt IORING_OP_BIND async if it needs file create\n" }, { "commit": "558c3eca715ea0110fe6fce38b063a6f9936188c", "tree": "c3ef3073c7b18bd51fe30cd95833d4fd3a63a66e", "parents": [ "632360e8f5fce2eee720e952fd84e8cefb5749b6", "dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - Fix missing lock\n - Fix dentry in use after unmounting\n - cifs.upcall security fix\n - require CAP_NET_ADMIN for swn netlink\n - change allocation in DUP_CTX_STR to GFP_KERNEL\n - minor smbdirect debug fix\n - handle_read_data() folio fix\n\n* tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: change allocation requirements in DUP_CTX_STR macro\n smb: client: require net admin for CIFS SWN netlink\n smb: smbdirect: divide, not multiply, milliseconds by 1000\n cifs: Fix busy dentry used after unmounting\n smb: client: use data_len for SMB2 READ encrypted folioq copy\n smb: client: reject userspace cifs.spnego descriptions\n smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n" }, { "commit": "632360e8f5fce2eee720e952fd84e8cefb5749b6", "tree": "e97c99601ce85d5e65e2bb2d8ce8733a87b10ba1", "parents": [ "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "3a8389d42bdf4213730f4067f8bfa78bae6564ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "message": "Merge tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs\n\nPull zonefs fix from Damien Le Moal:\n\n - Avoid potential overflow when converting a zonefs file number string\n to an inode number (from Johannes)\n\n* tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:\n zonefs: handle integer overflow in zonefs_fname_to_fno\n" }, { "commit": "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "tree": "7f1c03f6a6e9a4f477eda27186717fde6b7c8a1b", "parents": [ "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "a67f3113331d9fb3eb0664602d9b581cb2df7294" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix maximum frequency computation in the intel_pstate driver for\n two processor models, update its documentation and fix issues related\n to the dynamic EPP support (added during the current development\n cycle) in the amd-pstate driver:\n\n - Fix maximum frequency computation in the intel_pstate driver for\n Raptor Lake-E and Bartlett Lake that are SMP platforms derived from\n hybrid ones (Rafael Wysocki, Henry Tseng)\n\n - Fix the description of asymmetric packing with SMT in the\n intel_pstate driver documentation (Ricardo Neri)\n\n - Fix multiple amd-pstate driver issues related to dynamic EPP\n support added recently, including making it opt-in only (K Prateek\n Nayak, Mario Limonciello)\"\n\n* tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP\n cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake\n cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E\n Documentation: intel_pstate: Fix description of asymmetric packing with SMT\n cpufreq/amd-pstate-ut: Drop policy reference before driver switch\n cpufreq/amd-pstate: Use \"epp_default_dc\" as default when dynamic_epp is disabled\n cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset\n cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn\u0027t modified\n cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name\n cpufreq/amd-pstate: Grab \"amd_pstate_driver_lock\" when toggling dynamic_epp\n" }, { "commit": "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "tree": "901e80297d94498b21b988894d13e027aab0cfb4", "parents": [ "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "c35cb4fc7231702d1e9952aec1a442f3e27df6f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"Unbreak system wakeup on critical battery status in the ACPI battery\n driver inadvertently broken during the 7.0 development cycle\"\n\n* tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: battery: Fix system wakeup on critical battery status\n" }, { "commit": "f6982769910ecddabdb5b8b9afdab0bb8b6668ac", "tree": "da723edd043ab3d628732506f724b795a4931e75", "parents": [ "dc278e9bf2b9513a763353e6b9cc21e0f532954e" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri May 22 20:56:22 2026 +0900" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 22 08:01:52 2026 -0600" }, "message": "block: avoid use-after-free in disk_free_zone_resources()\n\nThe function disk_update_zone_resources() may call\ndisk_free_zone_resources() in case of error, and following this,\nblk_revalidate_disk_zones() will again calls disk_free_zone_resources() if\ndisk_update_zone_resources() failed. If a zone worker thread is being used\n(which is the default for a rotational media zoned device),\ndisk_free_zone_resources() will try to stop the zone worker thread twice\nbecause disk-\u003ezone_wplugs_worker is not reset to NULL when the worker\nthread is stopped the first time.\n\nIn disk_free_zone_resources(), fix this by correctly clearing\ndisk-\u003ezone_wplugs_worker to NULL when the worker thread is stopped.\n\nAnd while at it, since disk_free_zone_resources() is always called after a\nfailed call to disk_update_zone_resources(), remove the unnecessary call\nto disk_free_zone_resources() in disk_update_zone_resources().\n\nFixes: 1365b6904fd0 (\"block: allow submitting all zone writes from a single context\")\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/20260522115622.588535-1-dlemoal@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "tree": "7d2acd2bfc3a23d50420e60426a630d44f3daad1", "parents": [ "cbadb98b7cb017b6b7376940781cb108f7baac71", "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Handle probe on hinted conditional branch instructions.\n\n BC.cond instructions can be simulated in the same way as B.cond\n instructions, so extend the decode mask for B.cond to cover BC.cond\n\n - Flush the walk cache when unsharing PMD tables. Recent changes to\n huge_pmd_unshare() introduced mmu_gather::unshared_tables but the\n arm64 code was still treating the TLB flushing as only targeting leaf\n entries (TLBI VALE1IS).\n\n Fix it by using non-leaf-only instructions (TLBI VAE1IS) when\n tlb-\u003eunshared_tables is set\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: tlb: Flush walk cache when unsharing PMD tables\n arm64: probes: Handle probes on hinted conditional branch instructions\n" }, { "commit": "cbadb98b7cb017b6b7376940781cb108f7baac71", "tree": "f2e31ea57834aa968cca61f2b657aa92a0ea097c", "parents": [ "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "540f4a4f6ef806a28e794001bb4beac4840a6090" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - Fix PAI NNPA mismatch between counting and recording, where sampling\n reports twice the value\n\n - Fix loss of PAI counter increments during recording on systems with\n many CPUs under heavy load, while counting is not affected\n\n - On some supported machines, CHSC cannot access memory outside the DMA\n zone, causing CHSC command failures. Restore GFP_DMA flag when\n allocating memory for CHSC control blocks\n\n - Align the numbering scheme for higher-level topology structures like\n socket, book, drawer with other hardware identifiers e.g. in sysfs,\n procfs and tools like lscpu\n\n* tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/topology: Use zero-based numbering for containing entities\n s390/cio: Restore GFP_DMA for CHSC allocation\n s390/pai: Fix missing PAI counter increments under heavy load\n s390/pai: Disable duplicate read of kernel PAI counter value\n" }, { "commit": "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "tree": "39b3f3f45fb91213139aba5232909214792905aa", "parents": [ "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "67ea9d353d0ba12bdbc9183ff568dead9e949b80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - Stable fix for a missing cpus_read_lock in one of the cpu sheaves\n flushing paths (Qing Wang)\n\n* tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()\n" }, { "commit": "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "tree": "e18468dd6caf762b046a7d1310fa9b704ce85c9d", "parents": [ "23884007afe901352349e709e33eb19373a842d7", "af0c3f05866237f7592219bfe05387bc3bfc99b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two minor updates for the DMA-mapping code, mainly fixing some rare\n corner cases (Petr Tesarik, Jianpeng Chang)\"\n\n* tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma-mapping: move dma_map_resource() sanity check into debug code\n dma-direct: fix use of max_pfn\n" }, { "commit": "23884007afe901352349e709e33eb19373a842d7", "tree": "e698633fffae9e8d69b3f459bc0d07e1896e4d06", "parents": [ "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Avoid NULL return from hist_field_name()\n\n The function hist_field_name() is directly passed to a strcat() which\n does not handle \"NULL\" characters. Return a zero length string when\n size is greater than the limit.\n\n This is used only to output already created histograms and no field\n currently is greater than the limit. But it should still not return\n NULL.\n\n - Do not call map-\u003eops-\u003eelt_free() on allocation failure\n\n When elt_alloc() fails, it should not call the map-\u003eops-\u003eelt_free()\n function if it exists, as that function may not be able to handle the\n free on allocation failures. The -\u003eelt_free() should only be called\n when elt_alloc() succeeds.\n\n* tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails\n tracing: Avoid NULL return from hist_field_name() on truncation\n" }, { "commit": "654ddf855bebd8d45a6e707f5dc2344921f5e0cf", "tree": "f80a3430c0823873130732f8200e6cde7ca5a4b9", "parents": [ "53a8f95cbb407608ef77a864ad4a59f25ddd906c" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Tue May 19 22:28:01 2026 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Fri May 22 15:48:41 2026 +0300" }, "message": "platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n\nThe newly added driver requires the LED classdev support\nand causes a link failure when that is disabled:\n\nx86_64-linux-ld: vmlinux.o: in function `bitland_mifs_wmi_probe\u0027:\nbitland-mifs-wmi.c:(.text+0xede02a): undefined reference to `devm_led_classdev_register_ext\u0027\n\nFixes: dc1ec4fa86b2 (\"platform/x86: bitland-mifs-wmi: Add new Bitland MIFS WMI driver\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260519202804.1339581-1-arnd@kernel.org\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "84bfaa6ceed629cbaeaccf03c4b287c719663284", "tree": "7a0f32338102364b3255d13c28493c4362014471", "parents": [ "ae14c160f4bd6713d2910e86218ff4da8892c9e3" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Mon May 18 19:05:41 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 22 12:12:11 2026 +0100" }, "message": "spi: Use named initializers for arrays of i2c_device_data\n\nWhile being less compact, using named initializers allows to more easily\nsee which members of the structs are assigned which value without having\nto lookup the declaration of the struct. And it\u0027s also more robust\nagainst changes to the struct definition.\n\nThe mentioned robustness is relevant for a planned change to struct\ni2c_device_id that replaces .driver_data by an anonymous union.\n\nWhile touching these arrays, drop a comma after the list terminator.\n\nThis patch doesn\u0027t modify the compiled arrays, only their representation\nin source form benefits. The former was confirmed with x86 and arm64\nbuilds.\n\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\nLink: https://patch.msgid.link/20260518170542.807843-2-u.kleine-koenig@baylibre.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "ae14c160f4bd6713d2910e86218ff4da8892c9e3", "tree": "e049c3a7ae69aecfd39bcde6e7a15ea868bd47c5", "parents": [ "90330ae4e0d891ecb4879d03cbdd6bdca062c7a0", "94f5efbaa7518cfa0f9c684be85d66bd005cfbe3" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 22 11:55:30 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 22 11:55:30 2026 +0100" }, "message": "spi: aspeed: Fix __iomem annotation and VLA parameter\n\nChin-Ting Kuo \u003cchin-ting_kuo@aspeedtech.com\u003e says:\n\nThis series fixes two sparse warnings reported by the kernel test robot.\nThe first patch fixes missing __iomem annotation on an MMIO pointer\nparameter, which also caused a redundant cast at the call site.\nA VLA function parameter warning is also fixed in this patch series.\n\nLink: https://patch.msgid.link/20260522071621.102507-1-chin-ting_kuo@aspeedtech.com\n" }, { "commit": "94f5efbaa7518cfa0f9c684be85d66bd005cfbe3", "tree": "529db50ada0e3fe6ff7c95bd640a1e19b00daffd", "parents": [ "5c3091e23f8fc2bdb6d85ca23b6097f05f3f0467" ], "author": { "name": "Chin-Ting Kuo", "email": "chin-ting_kuo@aspeedtech.com", "time": "Fri May 22 15:16:21 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 22 11:55:28 2026 +0100" }, "message": "spi: aspeed: Replace VLA parameter with flat pointer in calibration helper\n\naspeed_spi_ast2600_optimized_timing() declared its buffer argument as a\nvariable-length array parameter (u8 buf[rows][cols]), which causes a\nsparse warning. Replace the VLA parameter with a plain u8 * and compute\nthe 2-D index manually. The corresponding call site is also updated.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605180441.uD3toFRJ-lkp@intel.com/\nSigned-off-by: Chin-Ting Kuo \u003cchin-ting_kuo@aspeedtech.com\u003e\nReviewed-by: Cédric Le Goater \u003cclg@kaod.org\u003e\nLink: https://patch.msgid.link/20260522071621.102507-3-chin-ting_kuo@aspeedtech.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "5c3091e23f8fc2bdb6d85ca23b6097f05f3f0467", "tree": "72a0088f4b75cc4529b4d8c6ec01ef7527ed230d", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8" ], "author": { "name": "Chin-Ting Kuo", "email": "chin-ting_kuo@aspeedtech.com", "time": "Fri May 22 15:16:20 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 22 11:55:27 2026 +0100" }, "message": "spi: aspeed: Fix missing __iomem annotation in output transfer path\n\nThe dst parameter of aspeed_spi_user_transfer_tx() is an MMIO address\nobtained from chip-\u003eahb_base, but it was typed as void * instead of\nvoid __iomem *. This caused a sparse warning report. Fix the\nparameter type to void __iomem * and drop the now-unnecessary\ncast at the call site.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605180441.uD3toFRJ-lkp@intel.com/\nSigned-off-by: Chin-Ting Kuo \u003cchin-ting_kuo@aspeedtech.com\u003e\nReviewed-by: Cédric Le Goater \u003cclg@kaod.org\u003e\nLink: https://patch.msgid.link/20260522071621.102507-2-chin-ting_kuo@aspeedtech.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "215c90ee656114f5e8c32408228d97082f8e0eef", "tree": "ed95e062785ed5a085f9df266badf9b877dc6f7c", "parents": [ "237557b8a81ab948e8332f7c0058e758f081c0a3" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed May 06 13:57:00 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 22 12:24:08 2026 +0200" }, "message": "device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n\nIf a firmware node is allocated on the stack (for instance: temporary\nsoftware node whose life-time we control) or on the heap - but using a\nnon-zeroing allocation function - and initialized using fwnode_init(),\nits secondary pointer will contain uninitalized memory which likely will\nbe neither NULL nor IS_ERR() and so may end up being dereferenced (for\nexample: in dev_to_swnode()). Set fwnode-\u003esecondary to NULL on\ninitialization.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: 01bb86b380a3 (\"driver core: Add fwnode_init()\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Rafael J. Wysocki (Intel) \u003crafael@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260506115701.23035-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "tree": "3d3aa4f6a2ceb7f9fcfbdb54101ed579b6b7243f", "parents": [ "2ccd8ff980b50e842481bae71102fa3883fc4377" ], "author": { "name": "Zeng Heng", "email": "zengheng4@huawei.com", "time": "Thu May 21 15:30:11 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 22 11:13:51 2026 +0100" }, "message": "arm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables\u003dtrue\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL\u003d`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL\u003d`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL\u003d`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL\u003d`2` (L2) | Leaf entry at Level 2 only |\n\nSigned-off-by: Zeng Heng \u003czengheng4@huawei.com\u003e\nFixes: 8ce720d5bd91 (\"mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "9029496abfae3c208336855ae6f3e1f5f881ef76", "tree": "024d26f661f5a35801e01a0aac191607964cb43f", "parents": [ "a488e753de5853bec2e2e4d0c5a73f25d464bd2e" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:14 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:11 2026 +0200" }, "message": "KVM: s390: Properly reset zero bit in PGSTE\n\nIn case of memory pressure, it\u0027s possible that a guest page gets freed\nand then almost immediately reused by the guest. If CMMA is enabled,\n_essa_clear_cbrl() will discard all pages that are either unused or\nzero. If a discarded page is reused before _essa_clear_cbrl() is called,\nand the pgste.zero bit is not cleared, the page will be discarded\ndespite not being unused.\n\nWhen calling _gmap_ptep_xchg(), always clear the pgste.zero bit. This\nprevents the page from being accidentally discarded when not unused.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Steffen Eiden \u003cseiden@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "a488e753de5853bec2e2e4d0c5a73f25d464bd2e", "tree": "82a0dcaab52f34e4d9b8cfcc22e91d6577a33264", "parents": [ "2d505c290667eba67352c5db303ec92b7de860ad" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:13 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:11 2026 +0200" }, "message": "KVM: s390: vsie: Fix redundant rmap entries\n\nThe address passed to the gmap rmap was not being masked. As a\nconsequence several different (but functionally equivalent) rmap\nentries were being created for each shadowed table.\n\nFix this by properly masking the address depending on the table level.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "2d505c290667eba67352c5db303ec92b7de860ad", "tree": "dac1ad5d429e552dbd9642fedc01740cd51edba7", "parents": [ "4df4b7cdf54620aa848e7d83d253bb944313f7bd" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:12 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: vsie: Fix unshadowing logic\n\nIn some cases (i.e. under extreme memory pressure on the host),\nattempting to shadow memory will result in the same memory being\nunshadowed, causing a loop.\n\nAdd a PGSTE bit to distinguish between shadowed memory and shadowed DAT\ntables, fix the unshadowing logic in _gmap_ptep_xchg() to prevent\nunnecessary unshadowing and perform better checks.\n\nAlso fix the unshadowing logic in _gmap_crstep_xchg_atomic() which did\nnot unshadow properly when the large page would become unprotected.\n\nOpportunistically add a check in gmap_protect_rmap() to make sure it\nwon\u0027t be called with level \u003d\u003d TABLE_TYPE_PAGE_TABLE.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "4df4b7cdf54620aa848e7d83d253bb944313f7bd", "tree": "a379ce32e63419b0ce5c3880b45f7fa36313feee", "parents": [ "d0f2eb4493d1c3c8fecb5eadb5c1382074873ef9" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:11 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors\n\nFix a memory leak that can happen if gmap_ucas_map_one() or\nkvm_s390_mmu_cache_topup() return error values.\n\nAlso fix a similar issue in gmap_set_limit().\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReported-by: Jiaxin Fan \u003cjiaxin.fan@ibm.com\u003e\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "d0f2eb4493d1c3c8fecb5eadb5c1382074873ef9", "tree": "3582b08b264de7d287c704dec2625f47c74edf23", "parents": [ "6779b50faa562e6cca1aa6a4649a4d764c6c7e28" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:10 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: vsie: Fix memory leak when unshadowing\n\nWhen performing a partial unshadowing, the rmap was being leaked.\n\nAdd the missing kfree().\n\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nReviewed-by: Christoph Schlameuss \u003cschlameuss@linux.ibm.com\u003e\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b", "tree": "d8af4f1f69384bae692b0dc56158140d27ceaf14", "parents": [ "1c856e158fd34ef2c4475a81c1dc386329989938" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "message": "LoongArch: KVM: Move some variable declarations to paravirt.h\n\nSome variables relative with paravirt feature are declared in the header\nfile asm/qspinlock.h, however this file can be included only when option\nCONFIG_SMP is on. There is compiling warnings if CONFIG_SMP is off since\nvariables are not declared.\n\nMove these variable declarations to header file asm/paravirt.h to avoid\ncompiling warnings.\n\nFixes: c43dce6f13fb (\"LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605061313.O8Hswm2b-lkp@intel.com/\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "1c856e158fd34ef2c4475a81c1dc386329989938", "tree": "13cde94f56edfcfed3b279d0d7b1e7d11486b0c0", "parents": [ "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n\nKPROBE_HIT_SS and KPROBE_REENTER are two types of fatal recursions that\ncan not be safely recovered in kprobes.\n\nKPROBE_HIT_SS means that a kprobe is hit during single-stepping. At\nthis point, the architecture-specific single-step context is already\nactive. Nested single-stepping would corrupt the state, as the kprobe\ncontrol block (kcb) and hardware registers cannot safely store multiple\nlevels of stepping state.\n\nKPROBE_REENTER means that a third-level recursion occurs when a probe\nis hit while the system is already handling a nested probe (second-\nlevel). The kcb only provides a single slot (prev_kprobe) to backup the\nstate. When a third probe is hit, there is no more space to save the\nstate without corrupting the first-level backup.\n\nKprobes work by replacing instructions with breakpoints. In order to\nexecute the original instruction and continue, it must be moved to a\ntemporary \"single-step\" slot. Since there is no backup space left to\nset up this slot safely, the CPU would be forced to return to the same\noriginal breakpoint address, triggering an endless loop.\n\nCurrently, the code only prints a warning and returns. This leads to\nan infinite re-entry loop as the CPU repeatedly hits the same trap and\na \"stuck\" CPU core because preemption was disabled at the start of the\nhandler and never re-enabled in this early return path.\n\nFix the logic by:\n1. Merging KPROBE_HIT_SS and KPROBE_REENTER cases, as both represent\n fatal recursions that cannot be safely recovered.\n2. Replacing WARN_ON_ONCE() with BUG() to terminate the system. This\n aligns LoongArch with other architectures (x86, arm64, riscv) and\n prevents stack overflow while providing diagnostic information.\n\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b", "tree": "07d56e7418b69f9a6ef254f23d267fa6f58feb16", "parents": [ "0ccc9d47cf020994097ff51827cebd04aa2b0bf4" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n\nOn SMP systems, kprobe handlers would occasionally fail to execute on\ncertain CPU cores. The issue is hard to reproduce and typically occurs\nrandomly under high system load.\n\nThe root cause is a software-side instruction hazard. According to the\nLoongArch Reference Manual, while the cache coherency is maintained by\nhardware, software must explicitly use the \"IBAR\" instruction to ensure\nthe instruction fetch unit (IFU) observes the effects of recent stores.\n\nThe current arch_arm_kprobe() and arch_disarm_kprobe() only execute the\n\"IBAR\" barrier (via flush_insn_slot -\u003e local_flush_icache_range) on the\nlocal CPU. This leaves a vulnerable window where remote CPU cores may\ncontinue executing stale instructions from their pipelines or prefetch\nbuffers, as they have not executed an \"IBAR\" since the code modification.\n\nSwitch to larch_insn_text_copy() to fix this:\n1. Synchronization: It uses stop_machine_cpuslocked() to synchronize all\n online CPUs, ensuring no CPU is executing the target code area during\n modification.\n2. Visibility: By passing cpu_online_mask to stop_machine_cpuslocked(),\n the callback text_copy_cb() is executed on all online cores. Each CPU\n core invokes local_flush_icache_range() to execute \"IBAR\", clearing\n instruction hazards system-wide and ensuring the \"break\" instruction\n is visible to the fetch units of all cores.\n3. Robustness: It properly manages memory write permissions (ROX/RW) for\n the kernel text segment during patching, ensuring compatibility with\n CONFIG_STRICT_KERNEL_RWX.\n\nCc: \u003cstable@vger.kernel.org\u003e # 6.18+\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816", "tree": "5c0bfe48f868799e25f70faddc3718e0ef531726", "parents": [ "60a1969fae6209644698fca91c185d153674f631", "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA bigger batch of fixes than usual due to -next not happeing last week,\nthis is mostly stuff for laptops - a lot of quirks and small fixes,\nmainly for x86 and SoundWire. Nothing too big or exciting individually,\njust two week\u0027s worth.\n" }, { "commit": "e90ef85ada857819313000cc50c6edfcddec6850", "tree": "dac30ecccddc3779d08024193672c8ab409ec4b0", "parents": [ "7734b168cad167a43e5bda19bc8ccc65669ec964" ], "author": { "name": "Marco Elver", "email": "elver@google.com", "time": "Thu May 21 14:23:55 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:50:46 2026 -0500" }, "message": "nios2: Implement _THIS_IP_ using inline asm\n\nBoth GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to\nbe broken:\n\n #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; })\n\nIn particular, the address of a label is only expected to be used with a\ncomputed goto.\n\nWhile the generic version more or less works today, it is known to be\nbrittle and may break with current and future optimizations. For\nexample, Clang -O2 always returns 1 when this function is inlined:\n\n static inline unsigned long get_ip(void)\n { return ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; }); }\n\nFix it by overriding _THIS_IP_ in \u003casm/linkage.h\u003e (which is included by\n\u003clinux/instruction_pointer.h\u003e) using an architecture-specific inline asm\nversion. Additionally, avoiding taking the address of a label prevents\ncompilers from emitting spurious indirect branch targets (e.g. ENDBR or\nBTI) under control-flow integrity schemes.\n\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id\u003d120071 [1]\nLink: https://github.com/llvm/llvm-project/issues/138272 [2]\nSigned-off-by: Marco Elver \u003celver@google.com\u003e\nReviewed-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "7734b168cad167a43e5bda19bc8ccc65669ec964", "tree": "7d628cd58e688e1be667549406cd7c6a678cbc68", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Simon Schuster", "email": "schuster.simon@siemens-energy.com", "time": "Thu May 21 14:46:28 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:48:24 2026 -0500" }, "message": "MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n\nAdd Simon Schuster as a co-maintainer for the nios2 architecture and\nmark it as supported.\n\nSigned-off-by: Simon Schuster \u003cschuster.simon@siemens-energy.com\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44", "tree": "ef3a3d8c16fc4d0473fb3bd5e642fc122d8254a7", "parents": [ "69f030cf95488ae1186c72ac8c66fd279664ea7f" ], "author": { "name": "ChenXiaoSong", "email": "chenxiaosong@kylinos.cn", "time": "Mon May 18 15:23:22 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:20:24 2026 -0500" }, "message": "smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n\nReproducer:\n\n 1. server: systemctl start ksmbd\n 2. client: mount -t cifs //${server_ip}/export /mnt\n 3. client: C program: openat(AT_FDCWD, \"/mnt\", O_RDWR | O_TMPFILE, 0600)\n\nDo not treat `FILE_DELETE_ON_CLOSE_LE` as delete pending while files\nremain open.\n\nThis patch fixes xfstests generic/004.\n\nCc: stable@vger.kernel.org\nLink: https://chenxiaosong.com/en/smb-xfstests-generic-004.html\nCo-developed-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nTested-by: Steve French \u003cstfrench@microsoft.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "69f030cf95488ae1186c72ac8c66fd279664ea7f", "tree": "d8536854cc7ad089f924001b7a8ddb03dcad6558", "parents": [ "3515503322f4819277091839eed46b695096aca5" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Tue May 19 16:12:04 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: validate SID in parent security descriptor during ACL inheritance\n\nIntroduce smb_validate_ntsd_sid() helper to safely validate Owner SID\nand Group SID inside the NT Security Descriptor (smb_ntsd) retrieved\nfrom the parent directory.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "3515503322f4819277091839eed46b695096aca5", "tree": "3ba1480aea9cefbdbd9b26aaa2389a28c437ba63", "parents": [ "1a2ab0feaa23147e347b4d4cb79cb3fc392118eb" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Mon May 18 23:27:19 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: fix durable reconnect error path file lifetime\n\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\n\nIn this case fp and dh_info.fp are the same object. The first put drops the\nreconnect lookup reference, but the final durable put can run\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\nit can free the file object without removing the volatile-id entry that was\njust published into the session table.\n\nUse the session-aware put for the final reconnect drop when the reconnect\nhad already succeeded and the error path is cleaning up the republished\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\nusing the durable-only put path.\n\nFixes: 1baff47b81f9 (\"ksmbd: fix use-after-free in smb2_open during durable reconnect\")\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "4378a4116567887066011b8e0cd443241609e467", "tree": "52fad68b4ca8d4bd0bf265c8a7217f76cb702598", "parents": [ "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "87ed4e845d5a90bba1a56c0a5c580a13982e8648" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:30:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:31:08 2026 +1000" }, "message": "Merge tag \u0027mediatek-drm-fixes-20260521\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes\n\nMediatek DRM Fixes - 20260521\n\n1. fix sparse warnings\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\nLink: https://patch.msgid.link/20260521135649.4681-1-chunkuang.hu@kernel.org\n" }, { "commit": "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "tree": "c50f50098c31bb77c5078ac553bb4d531425c1a8", "parents": [ "68993ced0f618e36cf33388f1e50223e5e6e78cc", "ed831e7ea1a860bdbab3eadeb95f7f73e9d212df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Remove obsolete PCIe maintainer addresses (Florian Eckert, Hans\n Zhang)\n\n - Restore a brcmstb link speed assignment that was inadvertently\n removed, reducing bcm2712 performance (Florian Fainelli)\n\n* tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: brcmstb: Assign pcie-\u003egen from of_pci_get_max_link_speed()\n MAINTAINERS: Remove Jianjun Wang as PCIe mediatek maintainer\n MAINTAINERS: Remove Chuanhua Lei as PCIe intel-gw maintainer\n" }, { "commit": "68993ced0f618e36cf33388f1e50223e5e6e78cc", "tree": "eeecfdda57b25b9e73bd3684ccabee83132edfea", "parents": [ "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, wireless and netfilter.\n\n Craziness continues with no end in sight. Even discounting the driver\n revert this is a pretty huge PR for standards of the previous era. I\u0027d\n speculate - we haven\u0027t seen the worst of it, yet. Good news, I guess,\n is that so far we haven\u0027t seen many (any?) cases of \"AI reported a\n bug, we fixed it and a real user regressed\".\n\n Current release - fix to a fix:\n\n - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events\n\n - vsock/virtio: relax the recently added memory limit a little\n\n Current release - regressions:\n\n - IB/IPoIB: make sure IB drivers always use async set_rx_mode since\n some (mlx5) are now required to use it due to locking changes\n\n Previous releases - regressions:\n\n - udp: fix UDP length on last GSO_PARTIAL segment\n\n - af_unix: fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\n - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\n - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP\n\n Previous releases - always broken:\n\n - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\n - ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\n - Bluetooth: a lot of locking and concurrency fixes (as always)\n\n - batman-adv (mesh wireless networking): a lot of random fixes for\n issues reported by security researchers and Sashiko\n\n - netfilter: same thing, a lot of small security-ish fixes all over\n the place, nothing really stands out\n\n Misc:\n\n - bring back the old 3c509 driver, Maciej wants to maintain it\"\n\n* tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits)\n net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n net: enetc: fix init and teardown order to prevent use of unsafe resources\n net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n net: enetc: fix race condition in VF MAC address configuration\n net: enetc: fix TOCTOU race and validate VF MAC address\n net: enetc: add ratelimiting to VF mailbox error messages\n net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n net: enetc: fix incorrect mailbox message status returned to VFs\n net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n l2tp: use list_del_rcu in l2tp_session_unhash\n net: bcmgenet: keep RBUF EEE/PM disabled\n ethernet: 3c509: Fix most coding style issues\n ethernet: 3c509: Update documentation to match MAINTAINERS\n ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n ethernet: 3c509: Fix AUI transceiver type selection\n Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n tools: ynl: support listening on all nsids\n net: gro: don\u0027t merge zcopy skbs\n pds_core: ensure null-termination for firmware version strings\n ...\n" }, { "commit": "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "tree": "f5bfe0752de92f43bc01f17f3b9581a90d5a7583", "parents": [ "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fix from Ilya Dryomov:\n \"A fix for an \u0027rbd unmap\u0027 race condition which popped up on a\n production setup where many RBD devices are frequently mapped and\n unmapped, marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client:\n rbd: eliminate a race in lock_dwork draining on unmap\n" }, { "commit": "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "tree": "e91cf187e8c5f748a06c0195b8f97fee74a5a362", "parents": [ "758c807bb943138f887d42d986b645e12446ba9c", "057caace5214da3b457bbd295e1a2ad34d3685ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "message": "Merge tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fixes from Steven Rostedt:\n\n - Fix reporting MISSED EVENTS in trace iterator\n\n When the \"trace\" file is read with tracing enabled, if the writer\n were to pass the iterator reader, it resets, sets a \"missed_events\"\n flag and continues. The tracing output checks for missed events and\n if there are some, it prints out \"[LOST EVENTS]\" to let the user know\n events were dropped.\n\n But the clearing of the missed_events happened when the tracing\n system queried the ring buffer iterator about missed events. This was\n premature as the ring buffer is per CPU, and the tracing code reads\n all the CPU buffers and checks for missed events when it is read. If\n the CPU iterator that had missed events isn\u0027t printed next, the\n output for the LOST EVENTS is lost.\n\n Clear the missed_events flag when the iterator moves to the next\n event and not when the missed_events flag is queried. Also clear it\n on reset.\n\n - Flush and stop the persistent ring buffer on panic\n\n On panic the persistent ring buffer is used to debug what caused the\n panic. But on some architectures, it requires flushing the memory\n from cache, otherwise, the ring buffer persistent memory may not have\n the last events and this could also cause the ring buffer to be\n corrupted on the next boot.\n\n - Fix nr_subbufs initialization in simple_ring_buffer_init_mm\n\n The remote simple ring buffer meta data nr_subbufs is initialized too\n early and gets cleared later on, making it zero and not reflect the\n actual number of sub-buffers.\n\n - Fix unload_page for simple_ring_buffer init rollback\n\n On error, the pages loaded need to be unloaded. To unload a page it\n is expected that: page \u003d load_page(va); -\u003e unload_page(page). But the\n code was doing: unload_page(va) and not unload_page(page).\n\n - Create output file from cmd_check_undefined\n\n The check for undefined symbols checks if the file *.o.checked exists\n and if so it skips doing the work. But the *.o.checked file never was\n created making every build do the work even when it was already done\n previously.\n\n* tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Create output file from cmd_check_undefined\n tracing: Fix unload_page for simple_ring_buffer init rollback\n tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm()\n ring-buffer: Flush and stop persistent ring buffer on panic\n ring-buffer: Fix reporting of missed events in iterator\n" }, { "commit": "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "tree": "9e06fe4d90a39b436cfca417fc6d0f525a839482", "parents": [ "aee43aaf26c7f162780ab77ce952bae6a1b354bd", "9af1b6e175c82daf4b423da339a722d8e67a735a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:00:45 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:01:04 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namdxdna:\n- remove mmap and export for ubuf\n\nbridge:\n- chipone-icn6211: managed bridge cleanup\n- lt66121: acquire reset GPIO\n- megachips: fix clean up on failed IRQ requests\n\ngem:\n- clean up LRU locking\n\nv3d:\n- fix UAF in error code paths\n- release GEM-object ref on free\u0027d jobs\n\nvirtio:\n- use uninterruptible resv locking in plane updates\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260521071456.GA14644@localhost.localdomain\n" }, { "commit": "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1", "tree": "411f9e78571a4a30261672c6264cbc6e27f85775", "parents": [ "ea6ec3343e05f7937a53eb6d7617b3abdb4abc19" ], "author": { "name": "Zhengyu He", "email": "hezhy472013@gmail.com", "time": "Thu May 21 22:44:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 21:56:07 2026 +0100" }, "message": "spi: dt-bindings: fsl-qspi: support SpacemiT K3\n\nAdd the SpacemiT K3 QSPI compatible to the fsl-qspi binding.\n\nK3 and K1 use the same QSPI controller, so document the K3 compatible\nwith \"spacemit,k1-qspi\" as fallback.\n\nSigned-off-by: Cody Kang \u003ccody.kang.hk@outlook.com\u003e\nSigned-off-by: Zhengyu He \u003chezhy472013@gmail.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260521-k3-pico-itx-qspi-v2-for-next-20260521-v2-1-52bce26e5fd8@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "dc278e9bf2b9513a763353e6b9cc21e0f532954e", "tree": "e43d8e1f3ddbca290546c7759432cb9a6eee3468", "parents": [ "94449463d2ab125067adccc2b0c2d7cd753edfb4" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 21 12:02:53 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 13:04:11 2026 -0600" }, "message": "blk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.\n\nFixes: b0077e269f6c1 (\"blk-mq: make sure active queue usage is held for bio_integrity_prep()\")\nFixes: 7b4f36cd22a65 (\"block: ensure we hold a queue reference when using queue limits\")\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\nLink: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660", "tree": "ed94992134f52d1f99c7b002ca34f1414f779e7c", "parents": [ "45cf24da0a10203890fae4bd10ca5dbfca430324" ], "author": { "name": "Jeongjun Park", "email": "aha310510@gmail.com", "time": "Thu May 21 20:37:12 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:28:24 2026 +0100" }, "message": "ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n\nIn the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as\na general mixer kcontrol instead of a DAPM kcontrol, so struct\nsnd_soc_dapm_context must not be accessed via\nsnd_soc_dapm_kcontrol_to_dapm().\n\nThis causes a NULL pointer dereference, so it must be modified to use\nsnd_soc_component_to_dapm().\n\nCc: stable@kernel.org\nCloses: https://github.com/raspberrypi/linux/issues/7242\nFixes: 02dbbb7e982a (\"ASoC: codecs: pcm512x: convert to snd_soc_dapm_xxx()\")\nSigned-off-by: Jeongjun Park \u003caha310510@gmail.com\u003e\nLink: https://patch.msgid.link/20260521113712.227438-1-aha310510@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "45cf24da0a10203890fae4bd10ca5dbfca430324", "tree": "2a7ed82c1010f7baea62acad07bddf667ebce0a1", "parents": [ "e0fb794d67f86726817756bcc25c628f4894df29" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.cirrus.com", "time": "Wed May 20 17:36:30 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:18:01 2026 +0100" }, "message": "ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n\nFor PTL onwards Cirrus are intending to rely on function topologies,\nrather than using a match table for each system type. Remove this\nunnecessary match table entry. Having the match entries can\nmean that systems match when they should use function topologies\ninstead, resulting in incorrect audio configurations. Although,\nadmittedly this is not too likely with this 6x amp configuration\nas those are quite rare, but best to follow best practice.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260520163631.3300102-3-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e0fb794d67f86726817756bcc25c628f4894df29", "tree": "f4823ab8dba81af5d2fae5633fba98d13dd15b55", "parents": [ "2b8305f24a61b290f3258a3368be548f17451533" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.cirrus.com", "time": "Wed May 20 17:36:29 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:18:00 2026 +0100" }, "message": "ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional\n\nFor PTL onwards Cirrus are intending to rely on function\ntopologies, rather than using a match table for each system\ntype. Chrome systems tend to have custom magic in the topology\nand thus need to load a specific file. This causes problems as\nthese system can have the same layout as generic laptops causing\nthe match to apply to other laptops. Add a DMI quirk that forces\nthese matches to only apply to specific devices.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260520163631.3300102-2-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "2b8305f24a61b290f3258a3368be548f17451533", "tree": "bf0606ac3c70611d02f098f07bbad05b47a37da9", "parents": [ "fd9b9204f30e0463e1abec222aeec33b98571b71" ], "author": { "name": "Balamurugan C", "email": "balamurugan.c@intel.com", "time": "Wed May 20 14:11:43 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:13:25 2026 +0100" }, "message": "ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.\n\nAdding ES83x6 I2S codec support for NVL platforms and entry in match table.\n\nSigned-off-by: Balamurugan C \u003cbalamurugan.c@intel.com\u003e\nReviewed-by: Liam Girdwood \u003cliam.r.girdwood@intel.com\u003e\nSigned-off-by: Bard Liao \u003cyung-chuan.liao@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260520061143.2024963-1-yung-chuan.liao@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "fd9b9204f30e0463e1abec222aeec33b98571b71", "tree": "adb18df13fea118c0080b820e45799222270b8fd", "parents": [ "1129c0011b90f0d0453dadac4d1e81824aac07ff" ], "author": { "name": "Jairaj Arava", "email": "jairaj.arava@intel.com", "time": "Wed May 20 14:08:13 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:12:11 2026 +0100" }, "message": "ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform\n\nAdd an entry in the soundwire quirk table for novalake boards to support\nNVL RVP\n\nSigned-off-by: Jairaj Arava \u003cjairaj.arava@intel.com\u003e\nReviewed-by: Péter Ujfalusi \u003cpeter.ujfalusi@linux.intel.com\u003e\nReviewed-by: Ranjani Sridharan \u003cranjani.sridharan@linux.intel.com\u003e\nSigned-off-by: Bard Liao \u003cyung-chuan.liao@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260520060814.2024852-1-yung-chuan.liao@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "c9b7598eb013c6dbf2526dc050364bd8dc24f0d3", "tree": "4a940df02a3c89212b5b3fba5aedfc144c2579a9", "parents": [ "96031b31a4b3b6ec836b9fe7be8f6e6ebcfe8d67" ], "author": { "name": "Cosmin Tanislav", "email": "cosmin-gabriel.tanislav.xa@renesas.com", "time": "Wed May 20 23:31:15 2026 +0300" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Thu May 21 20:11:29 2026 +0200" }, "message": "irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path\n\npm_runtime_put() may trigger the idle check after pm_runtime_disable()\nis run as part of devm_pm_runtime_enable()\u0027s cleanup action, leaving\nruntime PM active.\n\nUse pm_runtime_put_sync() to ensure the idle check runs synchronously.\n\nFixes: 13e7b3305b64 (\"irqchip: Add RZ/{T2H,N2H} Interrupt Controller (ICU) driver\")\nSigned-off-by: Cosmin Tanislav \u003ccosmin-gabriel.tanislav.xa@renesas.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nLink: https://patch.msgid.link/20260520203117.1516442-2-cosmin-gabriel.tanislav.xa@renesas.com\n" }, { "commit": "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1", "tree": "e4de5b98b10601922652fc18b89c083c6ecd6860", "parents": [ "c33f944a33d63c65f3506eee6f2ca3771b68454f", "dc14686f27df6454b13b16ad1c9203ab3e9b0375" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nQuite a few more updates:\n - cfg80211/mac80211:\n - various security(-ish) fixes\n - fix A-MSDU subframe handling\n - fix multi-link element parsing\n - ath10: avoid sending commands to dead device\n - ath11k:\n - fix WMI buffer leaks on error conditions\n - fix UAF in RX MSDU coalesce path\n - allow peer ID 0 on RX path (legal for mobile devices)\n - reinitialize shared SRNG pointers on restart\n - ath12k:\n - fix 20 MHz-only parsing of EHT-MCS map\n - iwlwifi:\n - fix TSO segmentation explosion\n - don\u0027t TX to dead device\n - fix warning in WoWLAN\n - fix TX rates on old devices\n - disconnect on beacon loss only if also no other traffic\n - fill NULL-ptr deref\n - fix STEP_URM hardware access\n\n* tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (24 commits)\n wifi: cfg80211: wext: validate chandef in monitor mode\n wifi: mac80211: consume only present negotiated TTLM maps\n wifi: wilc1000: fix dma_buffer leak on bus acquire failure\n wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n wifi: mac80211: fix multi-link element inheritance\n wifi: mac80211: fix MLE defragmentation\n wifi: mac80211: don\u0027t override max_amsdu_subframes\n wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs\n wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing\n wifi: ath11k: clear shared SRNG pointer state on restart\n wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()\n wifi: ath11k: fix peer resolution on rx path when peer_id\u003d0\n wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx\n wifi: iwlwifi: mld: don\u0027t WARN on WoWLAN suspend w/o BSS vif\n wifi: iwlwifi: use correct function to read STEP_URM register\n wifi: iwlwifi: mvm: fix driver-set TX rates on old devices\n wifi: iwlwifi: mld: don\u0027t dereference a pointer before NULL checking it\n wifi: iwlwifi: mld: stop TX during firmware restart\n wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n wifi: ath10k: skip WMI and beacon transmission when device is wedged\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521152903.374070-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e97ff8b62d4690c69297f0f6de874f0564cc01a4", "tree": "fc46f173746f9d2127ffe63ef7e4f275af6ebf9d", "parents": [ "3d879647fb03dab6fe6e1dd9404a2dd324096218" ], "author": { "name": "Alexander A. Klimov", "email": "grandmaster@al2klimov.de", "time": "Wed May 20 20:00:44 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 11:10:56 2026 -0600" }, "message": "io_uring/nop: pass all errors to userspace\n\nThis fixes an inconsistency where io_nop() called req_set_fail()\nbased on ret, but passed just nop-\u003eresult to userspace.\nOriginally, ret is a even copy of nop-\u003eresult, but is set to an error\nwhen such happens subsequently. Now that\u0027s also passed to userspace.\n\nFixes: a85f31052bce (\"io_uring/nop: add support for testing registered files and buffers\")\nSigned-off-by: Alexander A. Klimov \u003cgrandmaster@al2klimov.de\u003e\nLink: https://patch.msgid.link/20260520180045.538533-1-grandmaster@al2klimov.de\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "0c1a9dce208b4dc265925898e5da98934f7f9266", "tree": "665a1e64dd268f46959c4225e78f374ef78d2e73", "parents": [ "515e3996a4c26e7f955c13b3b19522a2c8642af9" ], "author": { "name": "Samuele Mariotti", "email": "smariotti@disroot.org", "time": "Thu May 21 12:59:11 2026 +0200" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu May 21 06:27:44 2026 -1000" }, "message": "sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()\n\nops_dequeue() can race with finish_dispatch() and spuriously trigger the\n\"queued task must be in BPF scheduler\u0027s custody\" warning.\n\nops_dequeue() snapshots p-\u003escx.ops_state via atomic_long_read_acquire()\nand then, in the SCX_OPSS_QUEUED arm, asserts that SCX_TASK_IN_CUSTODY\nis set. The two reads are not atomic w.r.t. a concurrent\nfinish_dispatch() running on another CPU:\n\nCPU 1 CPU 2\n\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\n dequeue_task_scx()\n ops_dequeue()\n opss \u003d read_acquire(ops_state)\n \u003d SCX_OPSS_QUEUED\nfinish_dispatch()\n cmpxchg ops_state:\n SCX_OPSS_QUEUED -\u003e SCX_OPSS_DISPATCHING [succeeds]\n dispatch_enqueue(SCX_DSQ_GLOBAL,\n SCX_ENQ_CLEAR_OPSS)\n call_task_dequeue()\n p-\u003escx.flags \u0026\u003d ~SCX_TASK_IN_CUSTODY\n WARN_ON_ONCE(!(p-\u003escx.flags \u0026\n SCX_TASK_IN_CUSTODY))\n /* opss is stale: QUEUED,\n * but task already claimed */\n set_release(ops_state, SCX_OPSS_NONE)\n\nThe race has been observed via two distinct call chains: the most common\ngoes through sched_setaffinity(), a rarer variant through\nsched_change_begin().\n\nFor SCX_DSQ_GLOBAL / SCX_DSQ_BYPASS, dispatch_enqueue() clears\nSCX_TASK_IN_CUSTODY before clearing ops_state to SCX_OPSS_NONE\n(intentional, to avoid concurrent non-atomic RMW of p-\u003escx.flags against\nops_dequeue()). The window between those two writes is exactly what\nops_dequeue() observes as \"QUEUED without custody\".\n\nThe observed state is not actually inconsistent, it just means CPU 1 has\nalready claimed the task and the QUEUED value held by CPU 2 is stale.\nRe-read ops_state in that case; the next read is guaranteed to return\nSCX_OPSS_DISPATCHING or SCX_OPSS_NONE, both of which exit the switch\ncleanly. The retry is bounded: once IN_CUSTODY is cleared, ops_state has\nalready advanced past QUEUED for this dispatch cycle, and a fresh QUEUED\nwould require re-enqueue under p\u0027s rq lock, which CPU 2 holds.\n\nChanges in v2:\n- Use READ_ONCE() for p-\u003escx.flags to ensure fresh reads and prevent\n compiler reordering in the lockless path\n- Add cpu_relax() to reduce power consumption and improve performance\n during the spin-wait\n- Use unlikely() to optimize branch prediction for the common case\n- Expand the in-code comment to document the race condition and\n bounded retry guarantee\n\nFixes: ebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\")\nSuggested-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Samuele Mariotti \u003csmariotti@disroot.org\u003e\nSigned-off-by: Paolo Valente \u003cpaolo.valente@unimore.it\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e", "tree": "dcb93846e6f507044784ad347651a83a9e47883e", "parents": [ "d1ebfce2c1d161186a82e77590bf7da2ea1bce91" ], "author": { "name": "Fredric Cover", "email": "fredric.cover.lkernel@gmail.com", "time": "Wed May 13 13:19:15 2026 -0700" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 11:16:09 2026 -0500" }, "message": "smb: client: change allocation requirements in DUP_CTX_STR macro\n\nCurrently, the macro DUP_CTX_STR allocates new_ctx-\u003efield using\nGFP_ATOMIC. DUP_CTX_STR is only used in smb3_fs_context_dup(), which\nis never called in an atomic context. Using GFP_ATOMIC puts unnecessary\npressure on emergency memory pools.\n\nChange GFP_ATOMIC to GFP_KERNEL.\n\nSigned-off-by: Fredric Cover \u003cfredric.cover.lkernel@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "tree": "88ead13c19d29b03988f296b511884c23e176511", "parents": [ "fbc15231181669b51c0103fd74c9c2ac2756ab56" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Sun May 17 20:11:50 2026 -0400" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 11:15:17 2026 -0500" }, "message": "smb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations.\n\nFixes: fed979a7e082 (\"cifs: Set witness notification handler for messages from userspace daemon\")\nCc: stable@vger.kernel.org\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "758c807bb943138f887d42d986b645e12446ba9c", "tree": "8df52c99c7bd9ba3f388bb3c756481ce8bb7abab", "parents": [ "dd3802fc4f6b52201a93330d44981a66bd6ef883", "d8809f6931065cbbf3554647a50a65a471ab5983" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fixes from Ard Biesheuvel:\n\n - Permit ACPI PRM runtime firmware calls when acpi_init() runs\n\n - Add another Lenovo Ideapad framebuffer quirk\n\n - Cosmetic tweak\n\n* tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n efi: sysfb_efi: Extend quirk to cover IdeaPad Duet 3 10IGL5-LTE\n efi: efi.h: Remove extra semicolon\n efi: Allocate runtime workqueue before ACPI init\n" }, { "commit": "90330ae4e0d891ecb4879d03cbdd6bdca062c7a0", "tree": "0ce550a994511ebac2c56e79b7a46934e6308e3a", "parents": [ "16ba3b0c66ef1d16bce2e99d787d7d12281bb2de" ], "author": { "name": "Lad Prabhakar", "email": "prabhakar.mahadev-lad.rj@bp.renesas.com", "time": "Wed May 20 10:13:42 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 16:58:01 2026 +0100" }, "message": "spi: Drop redundant \u0027cs\u0027 variable declaration in __spi_add_device()\n\nRemove the redundant local variable \u0027cs\u0027 definition declared within the\nchipselect GPIO configuration block.\n\nSigned-off-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nLink: https://patch.msgid.link/20260520091342.68029-1-prabhakar.mahadev-lad.rj@bp.renesas.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "c33f944a33d63c65f3506eee6f2ca3771b68454f", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "bdd39576bf50a50bdafe3da968fd271bc674a48f", "9e68817f12d5935dbf73f2fe6e6299644f6de1b6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:02 2026 -0700" }, "message": "Merge branch \u0027net-enetc-sr-iov-robustness-and-security-fixes\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: SR-IOV robustness and security fixes\n\nThis patch series addresses a number of robustness, security, and\ncorrectness issues in the ENETC driver\u0027s SR-IOV subsystem, focusing\nprimarily on the VF-to-PF mailbox communication path.\n\nThe series can be grouped into the following categories:\n\n1. DoS and security fixes:\n - Prevent an unbounded loop DoS in the VF-to-PF message handler,\n which could be triggered by a malicious or misbehaving VF.\n - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper\n validation of VF MAC addresses to prevent spoofing or invalid\n configuration from being applied.\n\n2. Race condition fixes:\n - Fix a race condition in VF MAC address configuration that could\n lead to inconsistent state between the VF request and PF\n application.\n - Fix a race condition during SR-IOV teardown that could cause\n VF-\u003ePF mailbox operations to time out, resulting in unnecessary\n errors during shutdown.\n\n3. Memory safety fixes:\n - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which\n could cause silent memory corruption or system instability.\n\n4. Error handling and initialization fixes:\n - Fix missing error code propagation when pf-\u003evf_state allocation\n fails, ensuring callers receive a proper errno instead of\n succeeding silently.\n - Fix incorrect mailbox message status values returned to VFs,\n which could cause VFs to misinterpret PF responses.\n - Fix initialization order to prevent the use of uninitialized\n resources during driver probe, which could cause undefined\n behavior on certain configurations.\n\n5. Diagnostics improvement:\n - Add rate limiting to VF mailbox error messages to prevent log\n flooding in the presence of a misbehaving VF.\n\nThese fixes improve the overall stability and security of the ENETC\nSR-IOV implementation, particularly in multi-tenant environments where\nVFs may be assigned to untrusted guests.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260520064421.91569-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e68817f12d5935dbf73f2fe6e6299644f6de1b6", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "54362b0176080b905dbd0651ee3dbb295da41541" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:21 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:00 2026 -0700" }, "message": "net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n\nDuring SR-IOV teardown, enetc_msg_psi_free() disables the MR interrupt\nbefore pci_disable_sriov() removes the VFs. If a VF sends a mailbox\nmessage during this window, the PF cannot receive it, causing the VF to\ntimeout waiting for a reply.\n\nSince the timeout occurs during SR-IOV teardown when the VF is about to\nbe removed anyway, it has no functional impact on operation. However,\nmore messages will be added in the future, some visible error logs may\nconfuse users. So fix it by calling pci_disable_sriov() first to remove\nall VFs, then safely clean up the mailbox resources. This eliminates the\nrace window where VFs could send messages to an unresponsive PF.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-10-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "54362b0176080b905dbd0651ee3dbb295da41541", "tree": "c289870991105875375e53fccc4bc2b294cbd8b8", "parents": [ "f8ae63de2a872fa3b68c287c35379f6d73d38a5d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix init and teardown order to prevent use of unsafe resources\n\nSashiko reported a potential issue in enetc_msg_psi_init() where the IRQ\nhandler is registered before DMA resources are fully initialized [1].\n\nThe current initialization sequence is:\n\n 1. request_irq(enetc_msg_psi_msix) \u003c- IRQ handler registered\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- work_struct initialized\n 3. enetc_msg_alloc_mbx() \u003c- mailbox DMA allocated\n\nThis ordering is unsafe because if a spurious interrupt or pending\ninterrupt from a previous device state fires immediately after\nrequest_irq() returns, the registered ISR enetc_msg_psi_msix() will\nexecute and unconditionally call:\n\n schedule_work(\u0026pf-\u003emsg_task)\n\nAt this point, pf-\u003emsg_task has not been initialized by INIT_WORK(), so\nthe work_struct contains garbage values in its internal linked list\npointers (work_struct-\u003eentry). Passing an uninitialized work_struct to\nschedule_work() could corrupt the kernel\u0027s workqueue linked lists,\npotentially leading to:\n\n - Kernel panic in __queue_work()\n - Memory corruption in workqueue data structures\n - System deadlock or undefined behavior\n\nAdditionally, even if the work_struct was initialized, the mailbox DMA\nbuffers (pf-\u003erxmsg[]) may not yet be allocated when the work handler\nenetc_msg_task() runs, resulting in NULL pointer dereference.\n\nFix by reordering the initialization sequence to ensure all resources are\nproperly initialized before the interrupt handler can execute:\n\n 1. enetc_msg_alloc_mbx() \u003c- Allocate all mailboxes\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- Initialize work first\n 3. request_irq(enetc_msg_psi_msix) \u003c- Register IRQ last\n 4. Configure hardware \u0026 enable MR interrupts\n\nThis guarantees that when enetc_msg_psi_msix() runs:\n - pf-\u003emsg_task is properly initialized (safe for schedule_work)\n - pf-\u003erxmsg[] buffers are allocated (safe for work handler access)\n - Hardware is configured appropriately\n\nAs the inverse of enetc_msg_psi_init(), enetc_msg_psi_free() also has\nsimilar problems. For example, if a pending interrupt fires between\nenetc_msg_free_mbx() and free_irq(), the ISR enetc_msg_psi_msix() may\nschedule the work handler again via schedule_work(), which could then\naccess already-freed DMA buffers (pf-\u003erxmsg[]), leading to use-after-free\nand potential memory corruption.\n\nTherefore, the order of enetc_msg_psi_free() is adjusted:\n 1. enetc_msg_disable_mr_int() \u003c- Stop new interrupts first\n 2. free_irq() \u003c- Ensure no IRQ handler can run\n 3. cancel_work_sync() \u003c- Wait for any pending work\n 4. enetc_msg_disable_mr_int() \u003c- Re-disable in case work\n\t\t\t\t\t re-enabled it\n 5. enetc_msg_free_mbx() \u003c- Safe to free DMA buffers now\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-9-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8ae63de2a872fa3b68c287c35379f6d73d38a5d", "tree": "3ebc1539b28452d3078eaff84d81e65453b02c76", "parents": [ "adb4599979cd00d5d426f26cf78b65264217e35b" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:19 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n\nThe enetc_msg_task() function has several issues that need to be addressed:\n\n1. Unbounded loop causing potential DoS:\n\nenetc_msg_task() processes VF-to-PF mailbox messages in an unbounded\nfor(;;) loop that keeps polling ENETC_PSIMSGRR until no MR bits are set.\nA malicious guest VM can exploit this by continuously sending messages at\na high rate - immediately sending a new message as soon as the PF\nacknowledges the previous one. Since the worker thread never yields or\nenforces a processing budget, the mr_mask check frequently evaluates to\nnon-zero, causing the PF to spin indefinitely and starving other tasks.\n\nFix this by replacing the unbounded loop with a single snapshot read at\ntask entry. The task processes only the VFs whose MR bits were set at\nthat point, then re-enables message interrupts before returning. This\nbounds work per invocation to at most num_vfs iterations. No messages are\nlost because the message interrupt is disabled in enetc_msg_psi_msix()\nbefore scheduling enetc_msg_task(), so any new messages arriving during\nprocessing will trigger a fresh interrupt once re-enabled, scheduling\nanother task invocation.\n\n2. Write order of ENETC_PSIIDR and ENETC_PSIMSGRR:\n\nBoth ENETC_PSIIDR and ENETC_PSIMSGRR contain MR bits indicating messages\nhave been received from VSIs, but only ENETC_PSIIDR trigger the CPU\ninterrupt. Previously, ENETC_PSIMSGRR was written before ENETC_PSIIDR.\nWriting ENETC_PSIMSGRR returns the message code to the VSI in its upper\n16 bits, signaling to the VF that message processing is complete and it\nmay send the next message. If the VF sends a new message before\nENETC_PSIIDR is written, the subsequent w1c write to ENETC_PSIIDR would\ninadvertently clear the MR bit set by the new message, causing the\ninterrupt to be lost and the new message to go unprocessed.\n\nTherefore, write ENETC_PSIIDR first to clear the interrupt source, then\nwrite ENETC_PSIMSGRR to acknowledge the message to the VSI.\n\n3. Check both ENETC_PSIMSGRR and ENETC_PSIIDR for mr_status:\n\nThe write order change above introduces a potential race: if a VF sends\na new message in the window between the ENETC_PSIIDR w1c and the\nENETC_PSIMSGRR w1c, the ENETC_PSIMSGRR MR bit for the new message may\nnot be set. If mr_status was derived solely from ENETC_PSIMSGRR, this\nmessage would never be detected despite ENETC_PSIIDR retaining its MR\nbit, leading to an unacknowledged interrupt storm.\n\nFix this by computing mr_status as the union of both ENETC_PSIMSGRR and\nENETC_PSIIDR MR bits, ensuring all pending messages are detected\nregardless of which register reflects the new message state.\n\nAdditionally, rename the per-register MR macros (ENETC_PSI*_MR_MASK,\nENETC_PSI*_MR) to register-agnostic names (ENETC_PSIMR_MASK,\nENETC_PSIMR_BIT) since the MR bit layout is shared across ENETC_PSIMSGRR,\nENETC_PSIIER, and ENETC_PSIIDR. Make the mask macro dynamic based on\nthe actual number of active VFs rather than hardcoded.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-8-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "adb4599979cd00d5d426f26cf78b65264217e35b" }