)]}' { "log": [ { "commit": "8d6584f5c2475a616861f61b15060f7e9efa962f", "tree": "98ff2035d2a2b0f2394c179162f8034b2f474022", "parents": [ "59e1be1278f064d7172b00473b7e0c453cb1ec52", "abe572f630bc1f0e77041012ab075869036ede4f" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Apr 02 15:20:23 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Apr 02 15:20:23 2026 +0100" }, "message": "Merge remote-tracking branch \u0027spi/for-7.1\u0027 into spi-next\n" }, { "commit": "abe572f630bc1f0e77041012ab075869036ede4f", "tree": "23263f62438afc5cc7605692d7faa5ce4ebc6386", "parents": [ "b99e3ddb91b499d920e63a2daff8880be68cfe9e" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Fri Mar 27 11:43:05 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 01 18:21:09 2026 +0100" }, "message": "spi: ch341: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the controller and driver data lifetime so that they are released\non driver unbind.\n\nNote that this also makes sure that the SPI controller is placed\ncorrectly under the USB interface in the device tree.\n\nFixes: 8846739f52af (\"spi: add ch341a usb2spi driver\")\nCc: stable@vger.kernel.org\t# 6.11\nCc: Johannes Thumshirn \u003cjth@kernel.org\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20260327104305.1309915-3-johan@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "b99e3ddb91b499d920e63a2daff8880be68cfe9e", "tree": "ad951e031c431d7b02b6834a434d7365892807e1", "parents": [ "762a3847a05c5c229009d36fbd0e2feee9dff81a" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Fri Mar 27 11:43:04 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 01 18:21:09 2026 +0100" }, "message": "spi: ch341: fix memory leaks on probe failures\n\nMake sure to deregister the controller, disable pins, and kill and free\nthe RX URB on probe failures to mirror disconnect and avoid memory\nleaks and use-after-free.\n\nAlso add an explicit URB kill on disconnect for symmetry (even if that\nis not strictly required as USB core would have stopped it in the\ncurrent setup).\n\nFixes: 8846739f52af (\"spi: add ch341a usb2spi driver\")\nCc: stable@vger.kernel.org\t# 6.11\nCc: Johannes Thumshirn \u003cjth@kernel.org\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20260327104305.1309915-2-johan@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "59e1be1278f064d7172b00473b7e0c453cb1ec52", "tree": "bba6ff4ac570b669fd360a768514e019ad28388f", "parents": [ "b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f" ], "author": { "name": "Emanuele Ghidoli", "email": "emanuele.ghidoli@toradex.com", "time": "Fri Mar 13 14:52:31 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Mar 30 21:34:53 2026 +0100" }, "message": "spi: cadence-qspi: Fix exec_mem_op error handling\n\ncqspi_exec_mem_op() increments the runtime PM usage counter before all\nrefcount checks are performed. If one of these checks fails, the function\nreturns without dropping the PM reference.\n\nMove the pm_runtime_resume_and_get() call after the refcount checks so\nthat runtime PM is only acquired when the operation can proceed and\ndrop the inflight_ops refcount if the PM resume fails.\n\nCc: stable@vger.kernel.org\nFixes: 7446284023e8 (\"spi: cadence-quadspi: Implement refcount to handle unbind during busy\")\nSigned-off-by: Emanuele Ghidoli \u003cemanuele.ghidoli@toradex.com\u003e\nLink: https://patch.msgid.link/20260313135236.46642-1-ghidoliemanuele@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f", "tree": "2f7b4f63cd6f88ad5ce4f1e7e2b403b7c588f5aa", "parents": [ "534025950c9fe4dfbe476b3938d73a26814047d1" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Sun Mar 22 22:28:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Mar 30 18:53:06 2026 +0100" }, "message": "spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback\n\naml_sfc_probe() registers the on-host NAND ECC engine, but teardown was\nmissing from both probe unwind and remove-time cleanup. Add a devm cleanup\naction after successful registration so\nnand_ecc_unregister_on_host_hw_engine() runs automatically on probe\nfailures and during device removal.\n\nFixes: 4670db6f32e9 (\"spi: amlogic: add driver for Amlogic SPI Flash Controller\")\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nLink: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "534025950c9fe4dfbe476b3938d73a26814047d1", "tree": "93267014eaa5b6f078253b847f8ce97463e0f545", "parents": [ "5a570c8d6e55689253f6fcc4a198c56cca7e39d6" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Sun Mar 29 00:07:07 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Mar 30 13:46:30 2026 +0100" }, "message": "spi: stm32-ospi: Fix DMA channel leak on stm32_ospi_dma_setup() failure\n\nWhen stm32_ospi_dma_setup() fails, the DMA channels allocated by\nstm32_ospi_get_resources() were never released. Add proper cleanup\nin the error path.\n\nFixes: e35a7607e05d (\"spi: stm32-ospi: Set DMA maxburst dynamically\")\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Patrice Chotard \u003cpatrice.chotard@foss.st.com\u003e\nLink: https://patch.msgid.link/20260329-stm32-ospi-v1-2-142122466412@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "5a570c8d6e55689253f6fcc4a198c56cca7e39d6", "tree": "70210c8c3d970056dd16becbde0115b08233a0c7", "parents": [ "73cd1f97946ae3796544448ff12c07f399bb2881" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Sun Mar 29 00:07:06 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Mar 30 13:46:29 2026 +0100" }, "message": "spi: stm32-ospi: Fix reset control leak on probe error\n\nWhen spi_register_controller() fails after reset_control_acquire()\nsucceeds, the reset control is never released. This causes a resource\nleak in the error path.\n\nAdd the missing reset_control_release() call in the error path.\n\nFixes: cf2c3eceb757 (\"spi: stm32-ospi: Make usage of reset_control_acquire/release() API\")\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Patrice Chotard \u003cpatrice.chotard@foss.st.com\u003e\nLink: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "73cd1f97946ae3796544448ff12c07f399bb2881", "tree": "41c17b7d40cc42cc339fbd4d5468205860fbd5c4", "parents": [ "7aaa8047eafd0bd628065b15757d9b48c5f9c07d" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Sun Mar 29 19:14:05 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Mon Mar 30 13:22:18 2026 +0100" }, "message": "spi: stm32-ospi: Fix resource leak in remove() callback\n\nThe remove() callback returned early if pm_runtime_resume_and_get()\nfailed, skipping the cleanup of spi controller and other resources.\n\nRemove the early return so cleanup completes regardless of PM resume\nresult.\n\nFixes: 79b8a705e26c (\"spi: stm32: Add OSPI driver\")\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Patrice Chotard \u003cpatrice.chotard@foss.st.com\u003e\nLink: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "7aaa8047eafd0bd628065b15757d9b48c5f9c07d", "tree": "8e8a5ad51e6755b929299e7f8a3524bc90e536d3", "parents": [ "d1384f70b2e3162786bc73b8f86c27417803bd57" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 15:40:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 15:40:00 2026 -0700" }, "message": "Linux 7.0-rc6\n" }, { "commit": "d1384f70b2e3162786bc73b8f86c27417803bd57", "tree": "bc9cf036d1e544a8b3662682ef88117b270e02a3", "parents": [ "fc9eae25ecb769e0c03a1383c677e2ddc1de8adf", "0e764b9d46071668969410ec5429be0e2f38c6d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 15:24:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 15:24:28 2026 -0700" }, "message": "Merge tag \u0027vfs-7.0-rc6.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Fix netfs_limit_iter() hitting BUG() when an ITER_KVEC iterator\n reaches it via core dump writes to 9P filesystems. Add ITER_KVEC\n handling following the same pattern as the existing ITER_BVEC code.\n\n - Fix a NULL pointer dereference in the netfs unbuffered write retry\n path when the filesystem (e.g., 9P) doesn\u0027t set the prepare_write\n operation.\n\n - Clear I_DIRTY_TIME in sync_lazytime for filesystems implementing\n -\u003esync_lazytime. Without this the flag stays set and may cause\n additional unnecessary calls during inode deactivation.\n\n - Increase tmpfs size in mount_setattr selftests. A recent commit\n bumped the ext4 image size to 2 GB but didn\u0027t adjust the tmpfs\n backing store, so mkfs.ext4 fails with ENOSPC writing metadata.\n\n - Fix an invalid folio access in iomap when i_blkbits matches the folio\n size but differs from the I/O granularity. The cur_folio pointer\n would not get invalidated and iomap_read_end() would still be called\n on it despite the IO helper owning it.\n\n - Fix hash_name() docstring.\n\n - Fix read abandonment during netfs retry where the subreq variable\n used for abandonment could be uninitialized on the first pass or\n point to a deleted subrequest on later passes.\n\n - Don\u0027t block sync for filesystems with no data integrity guarantees.\n Add a SB_I_NO_DATA_INTEGRITY superblock flag replacing the per-inode\n AS_NO_DATA_INTEGRITY mapping flag so sync kicks off writeback but\n doesn\u0027t wait for flusher threads. This fixes a suspend-to-RAM hang on\n fuse-overlayfs where the flusher thread blocks when the fuse daemon\n is frozen.\n\n - Fix a lockdep splat in iomap when reads fail. iomap_read_end_io()\n invokes fserror_report() which calls igrab() taking i_lock in hardirq\n context while i_lock is normally held with interrupts enabled. Kick\n failed read handling to a workqueue.\n\n - Remove the redundant netfs_io_stream::front member and use\n stream-\u003esubrequests.next instead, fixing a potential issue in the\n direct write code path.\n\n* tag \u0027vfs-7.0-rc6.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n netfs: Fix the handling of stream-\u003efront by removing it\n iomap: fix lockdep complaint when reads fail\n writeback: don\u0027t block sync for filesystems with no data integrity guarantees\n netfs: Fix read abandonment during retry\n vfs: fix docstring of hash_name()\n iomap: fix invalid folio access when i_blkbits differs from I/O granularity\n selftests/mount_setattr: increase tmpfs size for idmapped mount tests\n fs: clear I_DIRTY_TIME in sync_lazytime\n netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry\n netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators\n" }, { "commit": "fc9eae25ecb769e0c03a1383c677e2ddc1de8adf", "tree": "b532365fcef0898c9601f0a92f6b57f4f376d472", "parents": [ "a516c618a627e30b5613fadd264d4b4498254aeb", "81af9e40e2e4e1aa95f09fb34811760be6742c58" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:48:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:48:52 2026 -0700" }, "message": "Merge tag \u0027phy-fixes-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy fixes from Vinod Koul:\n\n - Qualcomm PCS table fix for ufs phy\n\n - TI device node reference fix\n\n - Common prop kconfig fix\n\n - lynx CDR lock workaround for lanes disabled\n\n - usb disconnect function fix of k1 driver\n\n* tag \u0027phy-fixes-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:\n phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4\n phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types()\n phy: k1-usb: add disconnect function support\n phy: lynx-28g: skip CDR lock workaround for lanes disabled in the device tree\n phy: make PHY_COMMON_PROPS Kconfig symbol conditionally user-selectable\n" }, { "commit": "a516c618a627e30b5613fadd264d4b4498254aeb", "tree": "c388a77d617017c0c37b3348a864e6ece15a2892", "parents": [ "32ee88daf78b69a95d21ba9ead55da8469ede1c9", "a17ce4bc6f4f9acf77ba416c36791a15602e53aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:42:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:42:31 2026 -0700" }, "message": "Merge tag \u0027dmaengine-fix-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine\n\nPull dmaengine fixes from Vinod Koul:\n \"A bunch of driver fixes with idxd ones being the biggest:\n\n - Xilinx regmap init error handling, dma_device directions, residue\n calculation, and reset related timeout fixes\n\n - Renesas CHCTRL updates and driver list fixes\n\n - DW HDMA cycle bits and MSI data programming fix\n\n - IDXD pile of fixes for memeory leak and FLR fixes\"\n\n* tag \u0027dmaengine-fix-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (21 commits)\n dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA\n dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction\n dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA\n dmaengine: xilinx: xilinx_dma: Fix dma_device directions\n dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock\n dmaengine: sh: rz-dmac: Protect the driver specific lists\n dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n dmaengine: xilinx: xdma: Fix regmap init error handling\n dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA.\n dmaengine: idxd: Fix leaking event log memory\n dmaengine: idxd: Fix freeing the allocated ida too late\n dmaengine: idxd: Fix memory leak when a wq is reset\n dmaengine: idxd: Fix not releasing workqueue on .release()\n dmaengine: idxd: Wait for submitted operations on .device_synchronize()\n dmaengine: idxd: Flush all pending descriptors\n dmaengine: idxd: Flush kernel workqueues on Function Level Reset\n dmaengine: idxd: Fix possible invalid memory access after FLR\n dmaengine: idxd: Fix crash when the event log is disabled\n dmaengine: idxd: Fix lockdep warnings when calling idxd_device_config()\n dmaengine: dw-edma: fix MSI data programming for multi-IRQ case\n ...\n" }, { "commit": "32ee88daf78b69a95d21ba9ead55da8469ede1c9", "tree": "3aa369d3f6b9eceb0a24bbb639fe7ba2461009a1", "parents": [ "ac354b5cb04d2077c3821a6cbfbc7981ad45f84a", "b0faf733fc1cf7f198c299dcc1638571d7cfd0f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:27:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 12:27:13 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - designware: fix resume-probe race causing NULL-deref in amdisp\n\n - imx: fix timeout on repeated reads and extra clock at end\n\n - MAINTAINERS: drop outdated I2C website\n\n* tag \u0027i2c-for-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n MAINTAINERS: drop outdated I2C website\n i2c: designware: amdisp: Fix resume-probe race condition issue\n i2c: imx: ensure no clock is generated after last read\n i2c: imx: fix i2c issue when reading multiple messages\n" }, { "commit": "ac354b5cb04d2077c3821a6cbfbc7981ad45f84a", "tree": "dab00d2a926334dc7db86fdec6e910f1515bda30", "parents": [ "b8a3bc856735a53269270bc4c7ccd04ad2355069", "df83746075778958954aa0460cca55f4b3fc9c02" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 11:58:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 11:58:47 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"s390:\n\n - Lots of small and not-so-small fixes for the newly rewritten gmap,\n mostly affecting the handling of nested guests.\n\n x86:\n\n - Fix an issue with shadow paging, which causes KVM to install an\n MMIO PTE in the shadow page tables without first zapping a non-MMIO\n SPTE if KVM didn\u0027t see the write that modified the shadowed guest\n PTE.\n\n While commit a54aa15c6bda3 (\"KVM: x86/mmu: Handle MMIO SPTEs\n directly in mmu_set_spte()\") was right about it being impossible to\n miss such a write if it was coming from the guest, it failed to\n account for writes to guest memory that are outside the scope of\n KVM: if userspace modifies the guest PTE, and then the guest hits a\n relevant page fault, KVM will get confused\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE\n KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE\n KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl\n KVM: s390: vsie: Fix guest page tables protection\n KVM: s390: vsie: Fix unshadowing while shadowing\n KVM: s390: vsie: Fix refcount overflow for shadow gmaps\n KVM: s390: vsie: Fix nested guest memory shadowing\n KVM: s390: Correctly handle guest mappings without struct page\n KVM: s390: Fix gmap_link()\n KVM: s390: vsie: Fix check for pre-existing shadow mapping\n KVM: s390: Remove non-atomic dat_crstep_xchg()\n KVM: s390: vsie: Fix dat_split_ste()\n" }, { "commit": "b8a3bc856735a53269270bc4c7ccd04ad2355069", "tree": "eea3465c36febaa3e82b7ddaca70513f11e91346", "parents": [ "f242ac4a09443c6e2e0ec03d7e2a21b00cbb3907", "cd7e1fef5a1ca1c4fcd232211962ac2395601636" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 11:51:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 11:51:37 2026 -0700" }, "message": "Merge tag \u0027for-linus-7.0a-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fix from Juergen Gross:\n \"A single fix for a very rare bug introduced in rc5\"\n\n* tag \u0027for-linus-7.0a-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen/privcmd: unregister xenstore notifier on module exit\n" }, { "commit": "f242ac4a09443c6e2e0ec03d7e2a21b00cbb3907", "tree": "09d8b02ccdc98ea322fd9d7219e887ae78036269", "parents": [ "47e3f23f0e1c64ec44e657534532678b604ad99d", "a3e93cac25316aad03bf561e3c205f4ca0b8f452" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 10:04:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 10:04:37 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix an early boot crash in AMD SEV-SNP guests, caused by incorrect\n FSGSBASE init ordering (Nikunj A Dadhania)\n\n - Remove X86_CR4_FRED from the CR4 pinned bits mask, to fix a race\n window during the bootup of SEV-{ES,SNP} or TDX guests, which can\n crash them if they trigger exceptions in that window (Borislav\n Petkov)\n\n - Fix early boot failures on SEV-ES/SNP guests, due to incorrect early\n GHCB access (Nikunj A Dadhania)\n\n - Add clarifying comment to the CRn pinning logic, to avoid future\n confusion \u0026 bugs (Peter Zijlstra)\n\n* tag \u0027x86-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/cpu: Add comment clarifying CRn pinning\n x86/fred: Fix early boot failures on SEV-ES/SNP guests\n x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling()\n" }, { "commit": "47e3f23f0e1c64ec44e657534532678b604ad99d", "tree": "c5aad714725cfa1eb6721d9ea5b018ce8b1abd35", "parents": [ "f087b0bad454a91c7d1615f82954a4752843560d", "5d16467ae56343b9205caedf85e3a131e0914ad8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 10:02:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 10:02:38 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Fix an argument order bug in the alarm timer forwarding logic, which\n may cause missed expirations or incorrect overrun accounting\"\n\n* tag \u0027timers-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n alarmtimer: Fix argument order in alarm_timer_forward()\n" }, { "commit": "f087b0bad454a91c7d1615f82954a4752843560d", "tree": "40617634f8a45a6fc4ea7dc320f270df6e125f2c", "parents": [ "21047b17b3ab2977f8331b444249364cac3da66c", "210d36d892de5195e6766c45519dfb1e65f3eb83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:59:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:59:46 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull futex fixes from Ingo Molnar:\n\n - Tighten up the sys_futex_requeue() ABI a bit, to disallow dissimilar\n futex flags and potential UaF access (Peter Zijlstra)\n\n - Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n (Hao-Yu Yang)\n\n - Clear stale exiting pointer in futex_lock_pi() retry path, which\n triggered a warning (and potential misbehavior) in stress-testing\n (Davidlohr Bueso)\n\n* tag \u0027locking-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n futex: Clear stale exiting pointer in futex_lock_pi() retry path\n futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n futex: Require sys_futex_requeue() to have identical flags\n" }, { "commit": "21047b17b3ab2977f8331b444249364cac3da66c", "tree": "7374714de5c2caf4ec151563d3e8df515f7b2f64", "parents": [ "a3d97d1d3fa68253927a6e6c2fdfe7c039073af7", "897cf98926429c8671a9009442883c2f62deae96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:53:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:53:01 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fixes from Ingo Molnar:\n\n - Fix TX completion signaling bug in the Qualcomm MPM irqchip driver\n\n - Fix probe error handling in the Renesas RZ/V2H(P) irqchip driver\n\n* tag \u0027irq-urgent-2026-03-29\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common()\n irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment\n" }, { "commit": "a3d97d1d3fa68253927a6e6c2fdfe7c039073af7", "tree": "442a09adfce72a98f13f9ac26157617d9d877b44", "parents": [ "241d4ca15de9bf2cc04bdec466a6a2b0bd5dbc19", "1f6ee9be92f8df85a8c9a5a78c20fd39c0c21a95" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:34:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:34:50 2026 -0700" }, "message": "Merge tag \u0027ovl-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs\n\nPull overlayfs fixes from Amir Goldstein:\n\n - Fix regression in \u0027xino\u0027 feature detection\n\n I clumsily introduced this regression myself when working on another\n subsystem (fsnotify). Both the regression and the fix have almost no\n visible impact on users except for some kmsg prints.\n\n - Fix to performance regression in v6.12.\n\n This regression was reported by Google COS developers.\n\n It is not uncommon these days for the year-old mature LTS to get\n adopted by distros and get exposed to many new workloads. We made a\n sub-smart move of making a behavior change in v6.12 which could\n impact performance, without making it opt-in. Fixing this mistake\n retroactively, to be picked by LTS.\n\n* tag \u0027ovl-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:\n ovl: make fsync after metadata copy-up opt-in mount option\n ovl: fix wrong detection of 32bit inode numbers\n" }, { "commit": "241d4ca15de9bf2cc04bdec466a6a2b0bd5dbc19", "tree": "a323dc75cb2c52c505d5d6ba28f48ea7fe190e9e", "parents": [ "b51ad67773fbe9a03945843215b2cabffafa4084", "9ee29d20aab228adfb02ca93f87fb53c56c2f3af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:30:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 29 09:30:06 2026 -0700" }, "message": "Merge tag \u0027ext4_for_linus-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4\n\nPull ext4 fixes from Ted Ts\u0027o:\n\n - Update the MAINTAINERS file to add reviewers for the ext4 file system\n\n - Add a test issue an ext4 warning (not a WARN_ON) if there are still\n dirty pages attached to an evicted inode.\n\n - Fix a number of Syzkaller issues\n\n - Fix memory leaks on error paths\n\n - Replace some BUG and WARN with EFSCORRUPTED reporting\n\n - Fix a potential crash when disabling discard via remount followed by\n an immediate unmount. (Found by Sashiko)\n\n - Fix a corner case which could lead to allocating blocks for an\n indirect-mapped inode block numbers \u003e 2**32\n\n - Fix a race when reallocating a freed inode that could result in a\n deadlock\n\n - Fix a user-after-free in update_super_work when racing with umount\n\n - Fix build issues when trying to build ext4\u0027s kunit tests as a module\n\n - Fix a bug where ext4_split_extent_zeroout() could fail to pass back\n an error from ext4_ext_dirty()\n\n - Avoid allocating blocks from a corrupted block group in\n ext4_mb_find_by_goal()\n\n - Fix a percpu_counters list corruption BUG triggered by an ext4\n extents kunit\n\n - Fix a potetial crash caused by the fast commit flush path potentially\n accessing the jinode structure before it is fully initialized\n\n - Fix fsync(2) in no-journal mode to make sure the dirtied inode is\n write to storage\n\n - Fix a bug when in no-journal mode, when ext4 tries to avoid using\n recently deleted inodes, if lazy itable initialization is enabled,\n can lead to an unitialized inode getting skipped and triggering an\n e2fsck complaint\n\n - Fix journal credit calculation when setting an xattr when both the\n encryption and ea_inode feeatures are enabled\n\n - Fix corner cases which could result in stale xarray tags after\n writeback\n\n - Fix generic/475 failures caused by ENOSPC errors while creating a\n symlink when the system crashes resulting to a file system\n inconsistency when replaying the fast commit journal\n\n* tag \u0027ext4_for_linus-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (27 commits)\n ext4: always drain queued discard work in ext4_mb_release()\n ext4: handle wraparound when searching for blocks for indirect mapped blocks\n ext4: skip split extent recovery on corruption\n ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths\n ext4: fix deadlock on inode reallocation\n ext4: fix use-after-free in update_super_work when racing with umount\n ext4: fix the might_sleep() warnings in kvfree()\n ext4: reject mount if bigalloc with s_first_data_block !\u003d 0\n ext4: fix extents-test.c is not compiled when EXT4_KUNIT_TESTS\u003dM\n ext4: fix mballoc-test.c is not compiled when EXT4_KUNIT_TESTS\u003dM\n ext4: introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper\n jbd2: gracefully abort on checkpointing state corruptions\n ext4: avoid infinite loops caused by residual data\n ext4: validate p_idx bounds in ext4_ext_correct_indexes\n ext4: test if inode\u0027s all dirty pages are submitted to disk\n ext4: minor fix for ext4_split_extent_zeroout()\n ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()\n ext4: kunit: extents-test: lix percpu_counters list corruption\n ext4: publish jinode after initialization\n ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n ...\n" }, { "commit": "b51ad67773fbe9a03945843215b2cabffafa4084", "tree": "b91d5eb9298187b0ec0b1effae662155f32ac31b", "parents": [ "0bcb517f0a70ae4fc59ce87bd27573043416aa94", "1c37d896b12dfd0d4c96e310b0033c6676933917" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 15:23:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 15:23:03 2026 -0700" }, "message": "Merge tag \u0027for-7.0-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A few more fixes. There\u0027s one that stands out in size as it fixes an\n edge case in fsync.\n\n - fix issue on fsync where file with zero size appears as a non-zero\n after log replay\n\n - in zlib compression, handle a crash when data alignment causes\n folio reference issues\n\n - fix possible crash with enabled tracepoints on a overlayfs mount\n\n - handle device stats update error\n\n - on zoned filesystems, fix kobject leak on sub-block groups\n\n - fix super block offset in an error message in validation\"\n\n* tag \u0027for-7.0-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix lost error when running device stats on multiple devices fs\n btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n btrfs: zlib: handle page aligned compressed size correctly\n btrfs: fix leak of kobject name for sub-group space_info\n btrfs: fix zero size inode with non-zero size after log replay\n btrfs: fix super block offset in error message in btrfs_validate_super()\n" }, { "commit": "0bcb517f0a70ae4fc59ce87bd27573043416aa94", "tree": "4d82e71b51f4985ea8c2c9c1fc9fcfd370e60531", "parents": [ "cbfffcca2bf0622b601b7eaf477aa29035169184", "2697dd8ae721db4f6a53d4f4cbd438212a80f8dc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 14:19:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 14:19:55 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-03-28-10-45\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"10 hotfixes. 8 are cc:stable. 9 are for MM.\n\n There\u0027s a 3-patch series of DAMON fixes from Josh Law and SeongJae\n Park. The rest are singletons - please see the changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-03-28-10-45\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/mseal: update VMA end correctly on merge\n bug: avoid format attribute warning for clang as well\n mm/pagewalk: fix race between concurrent split and refault\n mm/memory: fix PMD/PUD checks in follow_pfnmap_start()\n mm/damon/sysfs: check contexts-\u003enr in repeat_call_fn\n mm/damon/sysfs: check contexts-\u003enr before accessing contexts_arr[0]\n mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure\n mm/swap: fix swap cache memcg accounting\n MAINTAINERS, mailmap: update email address for Harry Yoo\n mm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()\n" }, { "commit": "b0faf733fc1cf7f198c299dcc1638571d7cfd0f7", "tree": "c5bec3669128c26601a501589d4964fdc01b336b", "parents": [ "4c10830fda045e255f4eaa81a362bd357e19c3ea" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Mar 27 16:18:24 2026 +0100" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Sat Mar 28 20:31:33 2026 +0100" }, "message": "MAINTAINERS: drop outdated I2C website\n\nAs stated on the website: \"This wiki has been archived and the content\nis no longer updated.\" No need to reference it.\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\n" }, { "commit": "cbfffcca2bf0622b601b7eaf477aa29035169184", "tree": "73b3785022f986dcf5b2963764ebe6428d3816e4", "parents": [ "e522b75c44f580ba8a58e8d9f263643c7936ddeb", "250ab25391edeeab8462b68be42e4904506c409c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 09:59:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 09:59:09 2026 -0700" }, "message": "Merge tag \u0027trace-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix potential deadlock in osnoise and hotplug\n\n The interface_lock can be called by a osnoise thread and the CPU\n shutdown logic of osnoise can wait for this thread to finish. But\n cpus_read_lock() can also be taken while holding the interface_lock.\n This produces a circular lock dependency and can cause a deadlock.\n\n Swap the ordering of cpus_read_lock() and the interface_lock to have\n interface_lock taken within the cpus_read_lock() context to prevent\n this circular dependency.\n\n - Fix freeing of event triggers in early boot up\n\n If the same trigger is added on the kernel command line, the second\n one will fail to be applied and the trigger created will be freed.\n This calls into the deferred logic and creates a kernel thread to do\n the freeing. But the command line logic is called before kernel\n threads can be created and this leads to a NULL pointer dereference.\n\n Delay freeing event triggers until late init.\n\n* tag \u0027trace-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Drain deferred trigger frees if kthread creation fails\n tracing: Fix potential deadlock in cpu hotplug with osnoise\n" }, { "commit": "e522b75c44f580ba8a58e8d9f263643c7936ddeb", "tree": "967b7c217041fae1851a5f6a32e401094396e343", "parents": [ "be762d8b6dd7efacb61937d20f8475db8f207655", "0738d395aab8fae3b5a3ad3fc640630c91693c27" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 09:50:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 28 09:50:11 2026 -0700" }, "message": "Merge tag \u0027s390-7.0-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Add array_index_nospec() to syscall dispatch table lookup to prevent\n limited speculative out-of-bounds access with user-controlled syscall\n number\n\n - Mark array_index_mask_nospec() __always_inline since GCC may emit an\n out-of-line call instead of the inline data dependency sequence the\n mitigation relies on\n\n - Clear r12 on kernel entry to prevent potential speculative use of\n user value in system_call, ext/io/mcck interrupt handlers\n\n* tag \u0027s390-7.0-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/entry: Scrub r12 register on kernel entry\n s390/syscalls: Add spectre boundary for syscall dispatch table\n s390/barrier: Make array_index_mask_nospec() __always_inline\n" }, { "commit": "210d36d892de5195e6766c45519dfb1e65f3eb83", "tree": "5b4ce8d94910551e0ba0d88c7ae563a68aafb9e1", "parents": [ "190a8c48ff623c3d67cb295b4536a660db2012aa" ], "author": { "name": "Davidlohr Bueso", "email": "dave@stgolabs.net", "time": "Wed Mar 25 17:17:59 2026 -0700" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Sat Mar 28 13:54:02 2026 +0100" }, "message": "futex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in \u0027exiting\u0027.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // acquires the PI futex\n exit()\n futex_cleanup_begin()\n futex_state \u003d EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observes EXITING\n\t\t\t\t *exiting \u003d owner; // takes ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // drops ref\n\t\t\t // exiting still points to owner\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^\u003d WAITERS // whatever\n\t\t\t\t // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.\n\nFixes: 3ef240eaff36 (\"futex: Prevent exit livelock\")\nSigned-off-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260326001759.4129680-1-dave@stgolabs.net\n" }, { "commit": "250ab25391edeeab8462b68be42e4904506c409c", "tree": "1e8486c4194147b8c1496ba466c48e886994d326", "parents": [ "1f9885732248d22f788e4992c739a98c88ab8a55" ], "author": { "name": "Wesley Atwell", "email": "atwellwea@gmail.com", "time": "Tue Mar 24 16:13:26 2026 -0600" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Sat Mar 28 08:32:44 2026 -0400" }, "message": "tracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event\u003dsched_switch trace_trigger\u003dsched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either.\n\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260324221326.1395799-3-atwellwea@gmail.com\nFixes: 61d445af0a7c (\"tracing: Add bulk garbage collection of freeing event_trigger_data\")\nSigned-off-by: Wesley Atwell \u003catwellwea@gmail.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "2697dd8ae721db4f6a53d4f4cbd438212a80f8dc", "tree": "c22067728047a7c8453efe4020924f62a52253c1", "parents": [ "2598ab9d63f41160c7081998857fef409182933d" ], "author": { "name": "Lorenzo Stoakes (Oracle)", "email": "ljs@kernel.org", "time": "Fri Mar 27 17:31:04 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "mm/mseal: update VMA end correctly on merge\n\nPreviously we stored the end of the current VMA in curr_end, and then upon\niterating to the next VMA updated curr_start to curr_end to advance to the\nnext VMA.\n\nHowever, this doesn\u0027t take into account the fact that a VMA might be\nupdated due to a merge by vma_modify_flags(), which can result in curr_end\nbeing stale and thus, upon setting curr_start to curr_end, ending up with\nan incorrect curr_start on the next iteration.\n\nResolve the issue by setting curr_end to vma-\u003evm_end unconditionally to\nensure this value remains updated should this occur.\n\nWhile we\u0027re here, eliminate this entire class of bug by simply setting\nconst curr_[start/end] to be clamped to the input range and VMAs, which\nalso happens to simplify the logic.\n\nLink: https://lkml.kernel.org/r/20260327173104.322405-1-ljs@kernel.org\nFixes: 6c2da14ae1e0 (\"mm/mseal: rework mseal apply logic\")\nSigned-off-by: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nReported-by: Antonius \u003cantonius@bluedragonsec.com\u003e\nCloses: https://lore.kernel.org/linux-mm/CAK8a0jwWGj9-SgFk0yKFh7i8jMkwKm5b0ao9\u003dkmXWjO54veX2g@mail.gmail.com/\nSuggested-by: David Hildenbrand (ARM) \u003cdavid@kernel.org\u003e\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Jeff Xu \u003cjeffxu@chromium.org\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "2598ab9d63f41160c7081998857fef409182933d", "tree": "8fa8c7ff01375fee85f14fbb1a1f86aceb7fea8d", "parents": [ "3b89863c3fa482912911cd65a12a3aeef662c250" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Mon Mar 23 21:55:16 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "bug: avoid format attribute warning for clang as well\n\nLike gcc, clang-22 now also warns about a function that it incorrectly\nidentifies as a printf-style format:\n\nlib/bug.c:190:22: error: diagnostic behavior may be improved by adding the \u0027format(printf, 1, 0)\u0027 attribute to the declaration of \u0027__warn_printf\u0027 [-Werror,-Wmissing-format-attribute]\n 179 | static void __warn_printf(const char *fmt, struct pt_regs *regs)\n | __attribute__((format(printf, 1, 0)))\n 180 | {\n 181 | if (!fmt)\n 182 | return;\n 183 |\n 184 | #ifdef HAVE_ARCH_BUG_FORMAT_ARGS\n 185 | if (regs) {\n 186 | struct arch_va_list _args;\n 187 | va_list *args \u003d __warn_args(\u0026_args, regs);\n 188 |\n 189 | if (args) {\n 190 | vprintk(fmt, *args);\n | ^\n\nRevert the change that added a gcc-specific workaround, and instead add\nthe generic annotation that avoid the warning.\n\nLink: https://lkml.kernel.org/r/20260323205534.1284284-1-arnd@kernel.org\nFixes: d36067d6ea00 (\"bug: Hush suggest-attribute\u003dformat for __warn_printf()\")\nSuggested-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSuggested-by: Brendan Jackman \u003cjackmanb@google.com\u003e\nLink: https://lore.kernel.org/all/20251208141618.2805983-1-andriy.shevchenko@linux.intel.com/T/#u\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReviewed-by: Brendan Jackman \u003cjackmanb@google.com\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nCc: Bill Wendling \u003cmorbo@google.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Justin Stitt \u003cjustinstitt@google.com\u003e\nCc: Nathan Chancellor \u003cnathan@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "3b89863c3fa482912911cd65a12a3aeef662c250", "tree": "d40b05f0142baddfb18a346010efa7e45ae942f9", "parents": [ "ffef67b93aa352b34e6aeba3d52c19a63885409a" ], "author": { "name": "Max Boone", "email": "mboone@akamai.com", "time": "Wed Mar 25 10:59:16 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "mm/pagewalk: fix race between concurrent split and refault\n\nThe splitting of a PUD entry in walk_pud_range() can race with a\nconcurrent thread refaulting the PUD leaf entry causing it to try walking\na PMD range that has disappeared.\n\nAn example and reproduction of this is to try reading numa_maps of a\nprocess while VFIO-PCI is setting up DMA (specifically the\nvfio_pin_pages_remote call) on a large BAR for that process.\n\nThis will trigger a kernel BUG:\nvfio-pci 0000:03:00.0: enabling device (0000 -\u003e 0002)\nBUG: unable to handle page fault for address: ffffa23980000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\n...\nRIP: 0010:walk_pgd_range+0x3b5/0x7a0\nCode: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24\n28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 \u003c49\u003e f7 06\n 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74\nRSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287\nRAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff\nRDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0\nRBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000\nR10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000\nR13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000\nFS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n __walk_page_range+0x195/0x1b0\n walk_page_vma+0x62/0xc0\n show_numa_map+0x12b/0x3b0\n seq_read_iter+0x297/0x440\n seq_read+0x11d/0x140\n vfs_read+0xc2/0x340\n ksys_read+0x5f/0xe0\n do_syscall_64+0x68/0x130\n ? get_page_from_freelist+0x5c2/0x17e0\n ? mas_store_prealloc+0x17e/0x360\n ? vma_set_page_prot+0x4c/0xa0\n ? __alloc_pages_noprof+0x14e/0x2d0\n ? __mod_memcg_lruvec_state+0x8d/0x140\n ? __lruvec_stat_mod_folio+0x76/0xb0\n ? __folio_mod_stat+0x26/0x80\n ? do_anonymous_page+0x705/0x900\n ? __handle_mm_fault+0xa8d/0x1000\n ? __count_memcg_events+0x53/0xf0\n ? handle_mm_fault+0xa5/0x360\n ? do_user_addr_fault+0x342/0x640\n ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0\n ? irqentry_exit_to_user_mode+0x24/0x100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fe88464f47e\nCode: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f\n84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 \u003c48\u003e 3d 00\n f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28\nRSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e\nRDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003\nRBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000\nR10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n \u003c/TASK\u003e\n\nFix this by validating the PUD entry in walk_pmd_range() using a stable\nsnapshot (pudp_get()). If the PUD is not present or is a leaf, retry the\nwalk via ACTION_AGAIN instead of descending further. This mirrors the\nretry logic in walk_pte_range(), which lets walk_pmd_range() retry if the\nPTE is not being got by pte_offset_map_lock().\n\nLink: https://lkml.kernel.org/r/20260325-pagewalk-check-pmd-refault-v2-1-707bff33bc60@akamai.com\nFixes: f9e54c3a2f5b (\"vfio/pci: implement huge_fault support\")\nCo-developed-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSigned-off-by: Max Boone \u003cmboone@akamai.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "ffef67b93aa352b34e6aeba3d52c19a63885409a", "tree": "559ae5aae50fa71a4136ba3836fce98bd3df43eb", "parents": [ "6557004a8b59c7701e695f02be03c7e20ed1cc15" ], "author": { "name": "David Hildenbrand (Arm)", "email": "david@kernel.org", "time": "Mon Mar 23 21:20:18 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "mm/memory: fix PMD/PUD checks in follow_pfnmap_start()\n\nfollow_pfnmap_start() suffers from two problems:\n\n(1) We are not re-fetching the pmd/pud after taking the PTL\n\nTherefore, we are not properly stabilizing what the lock actually\nprotects. If there is concurrent zapping, we would indicate to the\ncaller that we found an entry, however, that entry might already have\nbeen invalidated, or contain a different PFN after taking the lock.\n\nProperly use pmdp_get() / pudp_get() after taking the lock.\n\n(2) pmd_leaf() / pud_leaf() are not well defined on non-present entries\n\npmd_leaf()/pud_leaf() could wrongly trigger on non-present entries.\n\nThere is no real guarantee that pmd_leaf()/pud_leaf() returns something\nreasonable on non-present entries. Most architectures indeed either\nperform a present check or make it work by smart use of flags.\n\nHowever, for example loongarch checks the _PAGE_HUGE flag in pmd_leaf(),\nand always sets the _PAGE_HUGE flag in __swp_entry_to_pmd(). Whereby\npmd_trans_huge() explicitly checks pmd_present(), pmd_leaf() does not do\nthat.\n\nLet\u0027s check pmd_present()/pud_present() before assuming \"the is a present\nPMD leaf\" when spotting pmd_leaf()/pud_leaf(), like other page table\nhandling code that traverses user page tables does.\n\nGiven that non-present PMD entries are likely rare in VM_IO|VM_PFNMAP, (1)\nis likely more relevant than (2). It is questionable how often (1) would\nactually trigger, but let\u0027s CC stable to be sure.\n\nThis was found by code inspection.\n\nLink: https://lkml.kernel.org/r/20260323-follow_pfnmap_fix-v1-1-5b0ec10872b3@kernel.org\nFixes: 6da8e9634bb7 (\"mm: new follow_pfnmap API\")\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAcked-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "6557004a8b59c7701e695f02be03c7e20ed1cc15", "tree": "ad2b97b0f1d75519d085c29f93edada6766d76a4", "parents": [ "1bfe9fb5ed2667fb075682408b776b5273162615" ], "author": { "name": "Josh Law", "email": "objecting@objecting.org", "time": "Sat Mar 21 10:54:26 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "mm/damon/sysfs: check contexts-\u003enr in repeat_call_fn\n\ndamon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(),\ndamon_sysfs_upd_schemes_stats(), and\ndamon_sysfs_upd_schemes_effective_quotas() without checking contexts-\u003enr. \nIf nr_contexts is set to 0 via sysfs while DAMON is running, these\nfunctions dereference contexts_arr[0] and cause a NULL pointer\ndereference. Add the missing check.\n\nFor example, the issue can be reproduced using DAMON sysfs interface and\nDAMON user-space tool (damo) [1] like below.\n\n $ sudo damo start --refresh_interval 1s\n $ echo 0 | sudo tee \\\n /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts\n\nLink: https://patch.msgid.link/20260320163559.178101-3-objecting@objecting.org\nLink: https://lkml.kernel.org/r/20260321175427.86000-4-sj@kernel.org\nLink: https://github.com/damonitor/damo [1]\nFixes: d809a7c64ba8 (\"mm/damon/sysfs: implement refresh_ms file internal work\")\nSigned-off-by: Josh Law \u003cobjecting@objecting.org\u003e\nReviewed-by: SeongJae Park \u003csj@kernel.org\u003e\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[6.17+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "1bfe9fb5ed2667fb075682408b776b5273162615", "tree": "e1f2835ade248c3502aec2a3b92ee5c672ce13d6", "parents": [ "7fe000eb32904758a85e62f6ea9483f89d5dabfc" ], "author": { "name": "Josh Law", "email": "objecting@objecting.org", "time": "Sat Mar 21 10:54:25 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:38 2026 -0700" }, "message": "mm/damon/sysfs: check contexts-\u003enr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond-\u003econtexts-\u003enr \u003d\u003d 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond-\u003econtexts-\u003enr \u003d\u003d 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 \u003e contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats \u003e state\n # echo update_schemes_tried_regions \u003e state\n # echo update_schemes_tried_bytes \u003e state\n # echo update_schemes_effective_quotas \u003e state\n # echo update_tuned_intervals \u003e state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd().\n\nLink: https://lkml.kernel.org/r/20260321175427.86000-3-sj@kernel.org\nFixes: 0ac32b8affb5 (\"mm/damon/sysfs: support DAMOS stats\")\nSigned-off-by: Josh Law \u003cobjecting@objecting.org\u003e\nReviewed-by: SeongJae Park \u003csj@kernel.org\u003e\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.18+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "7fe000eb32904758a85e62f6ea9483f89d5dabfc", "tree": "539d9a89b49fdce04f6dda8bb80273d510e4e7f1", "parents": [ "9e0d0ddfbc0e3491da7e2db73faa08d8d4f322b2" ], "author": { "name": "Josh Law", "email": "objecting@objecting.org", "time": "Sat Mar 21 10:54:24 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:37 2026 -0700" }, "message": "mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure\n\nPatch series \"mm/damon/sysfs: fix memory leak and NULL dereference\nissues\", v4.\n\nDAMON_SYSFS can leak memory under allocation failure, and do NULL pointer\ndereference when a privileged user make wrong sequences of control. Fix\nthose.\n\n\nThis patch (of 3):\n\nWhen damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(),\nparam_ctx is leaked because the early return skips the cleanup at the out\nlabel. Destroy param_ctx before returning.\n\nLink: https://lkml.kernel.org/r/20260321175427.86000-1-sj@kernel.org\nLink: https://lkml.kernel.org/r/20260321175427.86000-2-sj@kernel.org\nFixes: f0c5118ebb0e (\"mm/damon/sysfs: catch commit test ctx alloc failure\")\nSigned-off-by: Josh Law \u003cobjecting@objecting.org\u003e\nReviewed-by: SeongJae Park \u003csj@kernel.org\u003e\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[6.18+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "9e0d0ddfbc0e3491da7e2db73faa08d8d4f322b2", "tree": "5f4c11b634ccb9e518bdc5e0d3794dbbfeeb2a2a", "parents": [ "26d3dca201f3662e51d25022cfce0f642a150a90" ], "author": { "name": "Alexandre Ghiti", "email": "alex@ghiti.fr", "time": "Fri Mar 20 06:05:59 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:37 2026 -0700" }, "message": "mm/swap: fix swap cache memcg accounting\n\nThe swap readahead path was recently refactored and while doing this, the\norder between the charging of the folio in the memcg and the addition of\nthe folio in the swap cache was inverted.\n\nSince the accounting of the folio is done while adding the folio to the\nswap cache and the folio is not charged in the memcg yet, the accounting\nis then done at the node level, which is wrong.\n\nFix this by charging the folio in the memcg before adding it to the swap cache.\n\nLink: https://lkml.kernel.org/r/20260320050601.1833108-1-alex@ghiti.fr\nFixes: 2732acda82c9 (\"mm, swap: use swap cache as the swap in synchronize layer\")\nSigned-off-by: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nAcked-by: Kairui Song \u003ckasong@tencent.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReviewed-by: Nhat Pham \u003cnphamcs@gmail.com\u003e\nAcked-by: Chris Li \u003cchrisl@kernel.org\u003e\nCc: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nCc: Baoquan He \u003cbhe@redhat.com\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "26d3dca201f3662e51d25022cfce0f642a150a90", "tree": "215f7cdaf4242b54367ae91e95027f5916257e02", "parents": [ "4c5e7f0fcd592801c9cc18f29f80fbee84eb8669" ], "author": { "name": "Harry Yoo (Oracle)", "email": "harry@kernel.org", "time": "Fri Mar 20 21:59:25 2026 +0900" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:37 2026 -0700" }, "message": "MAINTAINERS, mailmap: update email address for Harry Yoo\n\nUpdate my email address to harry@kernel.org.\n\nLink: https://lkml.kernel.org/r/20260320125925.2259998-1-harry@kernel.org\nSigned-off-by: Harry Yoo (Oracle) \u003charry@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "4c5e7f0fcd592801c9cc18f29f80fbee84eb8669", "tree": "3f848169a71097c67bf215f6ede81875735b83ff", "parents": [ "24f9515de8778410e4b84c85b196c9850d2c1e18" ], "author": { "name": "Jinjiang Tu", "email": "tujinjiang@huawei.com", "time": "Thu Mar 19 09:25:41 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Fri Mar 27 20:48:37 2026 -0700" }, "message": "mm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn\u0027t locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio \u003d pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page-\u003eflags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]\n Link: https://lkml.kernel.org/r/20260321075214.3305564-1-tujinjiang@huawei.com\nLink: https://lkml.kernel.org/r/20260319012541.4158561-1-tujinjiang@huawei.com\nFixes: e9b61f19858a (\"thp: reintroduce split_huge_page()\")\nSigned-off-by: Jinjiang Tu \u003ctujinjiang@huawei.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Nanyong Sun \u003csunnanyong@huawei.com\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "9ee29d20aab228adfb02ca93f87fb53c56c2f3af", "tree": "d23704927b4fb967a47df0403b6f4f01c90c5eea", "parents": [ "bb81702370fad22c06ca12b6e1648754dbc37e0f" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 02:13:15 2026 -0400" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:39:10 2026 -0400" }, "message": "ext4: always drain queued discard work in ext4_mb_release()\n\nWhile reviewing recent ext4 patch[1], Sashiko raised the following\nconcern[2]:\n\n\u003e If the filesystem is initially mounted with the discard option,\n\u003e deleting files will populate sbi-\u003es_discard_list and queue\n\u003e s_discard_work. If it is then remounted with nodiscard, the\n\u003e EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is\n\u003e neither cancelled nor flushed.\n\n[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/\n[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev\n\nThe concern was valid, but it had nothing to do with the patch[1].\nOne of the problems with Sashiko in its current (early) form is that\nit will detect pre-existing issues and report it as a problem with the\npatch that it is reviewing.\n\nIn practice, it would be hard to hit deliberately (unless you are a\nmalicious syzkaller fuzzer), since it would involve mounting the file\nsystem with -o discard, and then deleting a large number of files,\nremounting the file system with -o nodiscard, and then immediately\nunmounting the file system before the queued discard work has a change\nto drain on its own.\n\nFix it because it\u0027s a real bug, and to avoid Sashiko from raising this\nconcern when analyzing future patches to mballoc.c.\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nFixes: 55cdd0af2bc5 (\"ext4: get discard out of jbd2 commit kthread contex\")\nCc: stable@kernel.org\n" }, { "commit": "bb81702370fad22c06ca12b6e1648754dbc37e0f", "tree": "90c82430a907c434de29498cfdb96be68d37e886", "parents": [ "3ceda17325fc2600f66fd85b526592bc8a9dfb9d" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Mar 26 00:58:34 2026 -0400" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:39:02 2026 -0400" }, "message": "ext4: handle wraparound when searching for blocks for indirect mapped blocks\n\nCommit 4865c768b563 (\"ext4: always allocate blocks only from groups\ninode can use\") restricts what blocks will be allocated for indirect\nblock based files to block numbers that fit within 32-bit block\nnumbers.\n\nHowever, when using a review bot running on the latest Gemini LLM to\ncheck this commit when backporting into an LTS based kernel, it raised\nthis concern:\n\n If ac-\u003eac_g_ex.fe_group is \u003e\u003d ngroups (for instance, if the goal\n group was populated via stream allocation from s_mb_last_groups),\n then start will be \u003e\u003d ngroups.\n\n Does this allow allocating blocks beyond the 32-bit limit for\n indirect block mapped files? The commit message mentions that\n ext4_mb_scan_groups_linear() takes care to not select unsupported\n groups. However, its loop uses group \u003d *start, and the very first\n iteration will call ext4_mb_scan_group() with this unsupported\n group because next_linear_group() is only called at the end of the\n iteration.\n\nAfter reviewing the code paths involved and considering the LLM\nreview, I determined that this can happen when there is a file system\nwhere some files/directories are extent-mapped and others are\nindirect-block mapped. To address this, add a safety clamp in\next4_mb_scan_groups().\n\nFixes: 4865c768b563 (\"ext4: always allocate blocks only from groups inode can use\")\nCc: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nLink: https://patch.msgid.link/20260326045834.1175822-1-tytso@mit.edu\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "3ceda17325fc2600f66fd85b526592bc8a9dfb9d", "tree": "0bf935fc70f7c476ec10f361d85d0d49541c7c33", "parents": [ "ec0a7500d8eace5b4f305fa0c594dd148f0e8d29" ], "author": { "name": "hongao", "email": "hongao@uniontech.com", "time": "Tue Mar 24 09:58:15 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:38:52 2026 -0400" }, "message": "ext4: skip split extent recovery on corruption\n\next4_split_extent_at() retries after ext4_ext_insert_extent() fails by\nrefinding the original extent and restoring its length. That recovery is\nonly safe for transient resource failures such as -ENOSPC, -EDQUOT, and\n-ENOMEM.\n\nWhen ext4_ext_insert_extent() fails because the extent tree is already\ncorrupted, ext4_find_extent() can return a leaf path without p_ext.\next4_split_extent_at() then dereferences path[depth].p_ext while trying to\nfix up the original extent length, causing a NULL pointer dereference while\nhandling a pre-existing filesystem corruption.\n\nDo not enter the recovery path for corruption errors, and validate p_ext\nafter refinding the extent before touching it. This keeps the recovery path\nlimited to cases it can actually repair and turns the syzbot-triggered crash\ninto a proper corruption report.\n\nFixes: 716b9c23b862 (\"ext4: refactor split and convert extents\")\nReported-by: syzbot+1ffa5d865557e51cb604@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d1ffa5d865557e51cb604\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nSigned-off-by: hongao \u003chongao@uniontech.com\u003e\nLink: https://patch.msgid.link/EF77870F23FF9C90+20260324015815.35248-1-hongao@uniontech.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "ec0a7500d8eace5b4f305fa0c594dd148f0e8d29", "tree": "0d3bd2961d6d1113246a2c8e4ba14ea64fb5430f", "parents": [ "0c90eed1b95335eba4f546e6742a8e4503d79349" ], "author": { "name": "Baokun Li", "email": "libaokun@linux.alibaba.com", "time": "Mon Mar 23 14:08:36 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:38:01 2026 -0400" }, "message": "ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths\n\nDuring code review, Joseph found that ext4_fc_replay_inode() calls\next4_get_fc_inode_loc() to get the inode location, which holds a\nreference to iloc.bh that must be released via brelse().\n\nHowever, several error paths jump to the \u0027out\u0027 label without\nreleasing iloc.bh:\n\n - ext4_handle_dirty_metadata() failure\n - sync_dirty_buffer() failure\n - ext4_mark_inode_used() failure\n - ext4_iget() failure\n\nFix this by introducing an \u0027out_brelse\u0027 label placed just before\nthe existing \u0027out\u0027 label to ensure iloc.bh is always released.\n\nAdditionally, make ext4_fc_replay_inode() propagate errors\nproperly instead of always returning 0.\n\nReported-by: Joseph Qi \u003cjoseph.qi@linux.alibaba.com\u003e\nFixes: 8016e29f4362 (\"ext4: fast commit recovery path\")\nSigned-off-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260323060836.3452660-1-libaokun@linux.alibaba.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "0c90eed1b95335eba4f546e6742a8e4503d79349", "tree": "794c12d6ea7d215ed397e39ab9ace6ddcce8868b", "parents": [ "d15e4b0a418537aafa56b2cb80d44add83e83697" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Mar 20 10:04:29 2026 +0100" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:37:48 2026 -0400" }, "message": "ext4: fix deadlock on inode reallocation\n\nCurrently there is a race in ext4 when reallocating freed inode\nresulting in a deadlock:\n\nTask1\t\t\t\t\tTask2\next4_evict_inode()\n handle \u003d ext4_journal_start();\n ...\n if (IS_SYNC(inode))\n handle-\u003eh_sync \u003d 1;\n ext4_free_inode()\n\t\t\t\t\text4_new_inode()\n\t\t\t\t\t handle \u003d ext4_journal_start()\n\t\t\t\t\t finds the bit in inode bitmap\n\t\t\t\t\t already clear\n\t\t\t\t\t insert_inode_locked()\n\t\t\t\t\t waits for inode to be\n\t\t\t\t\t removed from the hash.\n ext4_journal_stop(handle)\n jbd2_journal_stop(handle)\n jbd2_log_wait_commit(journal, tid);\n - deadlocks waiting for transaction handle Task2 holds\n\nFix the problem by removing inode from the hash already in\next4_clear_inode() by which time all IO for the inode is done so reuse\nis already fine but we are still before possibly blocking on transaction\ncommit.\n\nReported-by: \"Lai, Yi\" \u003cyi1.lai@linux.intel.com\u003e\nLink: https://lore.kernel.org/all/abNvb2PcrKj1FBeC@ly-workstation\nFixes: 88ec797c4680 (\"fs: make insert_inode_locked() wait for inode destruction\")\nCC: stable@vger.kernel.org\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260320090428.24899-2-jack@suse.cz\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "d15e4b0a418537aafa56b2cb80d44add83e83697", "tree": "a0b56eacbee0feee8940f0ba1c689fd76273e890", "parents": [ "496bb99b7e66f48b178126626f47e9ba79e2d0fa" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Thu Mar 19 20:03:35 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:37:39 2026 -0400" }, "message": "ext4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount\nfilesystem\") moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -\u003e sysfs_notify() which\naccesses the kobject\u0027s kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n ----------------- --------------\n ext4_unregister_sysfs(sb)\n kobject_del(\u0026sbi-\u003es_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj-\u003esd \u003d NULL\n sysfs_put(sd)\n kernfs_put() // RCU free\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(\u0026sbi-\u003es_kobj)\n kn \u003d kobj-\u003esd // stale pointer\n kernfs_get(kn) // UAF on freed kernfs_node\n ext4_journal_destroy()\n flush_work(\u0026sbi-\u003es_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call.\n\nFixes: b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount filesystem\")\nCc: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nSuggested-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260319120336.157873-1-jiayuan.chen@linux.dev\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "496bb99b7e66f48b178126626f47e9ba79e2d0fa", "tree": "50901af9c8a2a8402e83786e52d96cc84ee07e8a", "parents": [ "3822743dc20386d9897e999dbb990befa3a5b3f8" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Thu Mar 19 17:45:45 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:36:20 2026 -0400" }, "message": "ext4: fix the might_sleep() warnings in kvfree()\n\nUse the kvfree() in the RCU read critical section can trigger\nthe following warnings:\n\nEXT4-fs (vdb): unmounting filesystem cd983e5b-3c83-4f5a-a136-17b00eb9d018.\n\nWARNING: suspicious RCU usage\n\n./include/linux/rcupdate.h:409 Illegal context switch in RCU read-side critical section!\n\nother info that might help us debug this:\n\nrcu_scheduler_active \u003d 2, debug_locks \u003d 1\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xbb/0xd0\n dump_stack+0x14/0x20\n lockdep_rcu_suspicious+0x15a/0x1b0\n __might_resched+0x375/0x4d0\n ? put_object.part.0+0x2c/0x50\n __might_sleep+0x108/0x160\n vfree+0x58/0x910\n ? ext4_group_desc_free+0x27/0x270\n kvfree+0x23/0x40\n ext4_group_desc_free+0x111/0x270\n ext4_put_super+0x3c8/0xd40\n generic_shutdown_super+0x14c/0x4a0\n ? __pfx_shrinker_free+0x10/0x10\n kill_block_super+0x40/0x90\n ext4_kill_sb+0x6d/0xb0\n deactivate_locked_super+0xb4/0x180\n deactivate_super+0x7e/0xa0\n cleanup_mnt+0x296/0x3e0\n __cleanup_mnt+0x16/0x20\n task_work_run+0x157/0x250\n ? __pfx_task_work_run+0x10/0x10\n ? exit_to_user_mode_loop+0x6a/0x550\n exit_to_user_mode_loop+0x102/0x550\n do_syscall_64+0x44a/0x500\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nBUG: sleeping function called from invalid context at mm/vmalloc.c:3441\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556, name: umount\npreempt_count: 1, expected: 0\nCPU: 3 UID: 0 PID: 556 Comm: umount\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xbb/0xd0\n dump_stack+0x14/0x20\n __might_resched+0x275/0x4d0\n ? put_object.part.0+0x2c/0x50\n __might_sleep+0x108/0x160\n vfree+0x58/0x910\n ? ext4_group_desc_free+0x27/0x270\n kvfree+0x23/0x40\n ext4_group_desc_free+0x111/0x270\n ext4_put_super+0x3c8/0xd40\n generic_shutdown_super+0x14c/0x4a0\n ? __pfx_shrinker_free+0x10/0x10\n kill_block_super+0x40/0x90\n ext4_kill_sb+0x6d/0xb0\n deactivate_locked_super+0xb4/0x180\n deactivate_super+0x7e/0xa0\n cleanup_mnt+0x296/0x3e0\n __cleanup_mnt+0x16/0x20\n task_work_run+0x157/0x250\n ? __pfx_task_work_run+0x10/0x10\n ? exit_to_user_mode_loop+0x6a/0x550\n exit_to_user_mode_loop+0x102/0x550\n do_syscall_64+0x44a/0x500\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe above scenarios occur in initialization failures and teardown\npaths, there are no parallel operations on the resources released\nby kvfree(), this commit therefore remove rcu_read_lock/unlock() and\nuse rcu_access_pointer() instead of rcu_dereference() operations.\n\nFixes: 7c990728b99e (\"ext4: fix potential race between s_flex_groups online resizing and access\")\nFixes: df3da4ea5a0f (\"ext4: fix potential race between s_group_info online resizing and access\")\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nReviewed-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260319094545.19291-1-qiang.zhang@linux.dev\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "3822743dc20386d9897e999dbb990befa3a5b3f8", "tree": "2e1c8ecf3a414ec8a877346978d494533667b5d4", "parents": [ "9e1b14320b154094bb2c1bee6d8c6cb851fc3215" ], "author": { "name": "Helen Koike", "email": "koike@igalia.com", "time": "Tue Mar 17 11:23:10 2026 -0300" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:36:11 2026 -0400" }, "message": "ext4: reject mount if bigalloc with s_first_data_block !\u003d 0\n\nbigalloc with s_first_data_block !\u003d 0 is not supported, reject mounting\nit.\n\nSigned-off-by: Helen Koike \u003ckoike@igalia.com\u003e\nSuggested-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReported-by: syzbot+b73703b873a33d8eb8f6@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003db73703b873a33d8eb8f6\nLink: https://patch.msgid.link/20260317142325.135074-1-koike@igalia.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "9e1b14320b154094bb2c1bee6d8c6cb851fc3215", "tree": "c68ab635a8160edf98d18cf580e95c3bf9880af7", "parents": [ "519b76ac0b31d86b45784735d4ef964e8efdc56b" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Sat Mar 14 15:52:58 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:36:06 2026 -0400" }, "message": "ext4: fix extents-test.c is not compiled when EXT4_KUNIT_TESTS\u003dM\n\nNow, only EXT4_KUNIT_TESTS\u003dY testcase will be compiled in \u0027extents.c\u0027.\nTo solve this issue, the ext4 test code needs to be decoupled. The\n\u0027extents-test\u0027 module is compiled into \u0027ext4-test\u0027 module.\n\nFixes: cb1e0c1d1fad (\"ext4: kunit tests for extent splitting and conversion\")\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260314075258.1317579-4-yebin@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "519b76ac0b31d86b45784735d4ef964e8efdc56b", "tree": "052bfc25643ab03442cd0b5c593d14469c9d3324", "parents": [ "49504a512587147dd6da3b4b08832ccc157b97dc" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Sat Mar 14 15:52:57 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:36:02 2026 -0400" }, "message": "ext4: fix mballoc-test.c is not compiled when EXT4_KUNIT_TESTS\u003dM\n\nNow, only EXT4_KUNIT_TESTS\u003dY testcase will be compiled in \u0027mballoc.c\u0027.\nTo solve this issue, the ext4 test code needs to be decoupled. The ext4\ntest module is compiled into a separate module.\n\nReported-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nCloses: https://patchwork.kernel.org/project/cifs-client/patch/20260118091313.1988168-2-chenxiaosong.chenxiaosong@linux.dev/\nFixes: 7c9fa399a369 (\"ext4: add first unit test for ext4_mb_new_blocks_simple in mballoc\")\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260314075258.1317579-3-yebin@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "49504a512587147dd6da3b4b08832ccc157b97dc", "tree": "c72c4b88b9bb93fcc96af3227b3684fc16c58cbb", "parents": [ "bac3190a8e79beff6ed221975e0c9b1b5f2a21da" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Sat Mar 14 15:52:56 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:34:19 2026 -0400" }, "message": "ext4: introduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper\n\nIntroduce EXPORT_SYMBOL_FOR_EXT4_TEST() helper for kuint test.\n\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260314075258.1317579-2-yebin@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "bac3190a8e79beff6ed221975e0c9b1b5f2a21da", "tree": "9bb5f001ce534dd8ed0eeecdac1cd0ac1452cf9d", "parents": [ "5422fe71d26d42af6c454ca9527faaad4e677d6c" ], "author": { "name": "Milos Nikic", "email": "nikic.milos@gmail.com", "time": "Tue Mar 10 21:15:48 2026 -0700" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:34:09 2026 -0400" }, "message": "jbd2: gracefully abort on checkpointing state corruptions\n\nThis patch targets two internal state machine invariants in checkpoint.c\nresiding inside functions that natively return integer error codes.\n\n- In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely\ncorrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE\nand a graceful journal abort, returning -EFSCORRUPTED.\n\n- In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for\nan unexpected buffer_jwrite state. If the warning triggers, we\nexplicitly drop the just-taken get_bh() reference and call __flush_batch()\nto safely clean up any previously queued buffers in the j_chkpt_bhs array,\npreventing a memory leak before returning -EFSCORRUPTED.\n\nSigned-off-by: Milos Nikic \u003cnikic.milos@gmail.com\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260311041548.159424-1-nikic.milos@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "5422fe71d26d42af6c454ca9527faaad4e677d6c", "tree": "77d6397efd9a279aa23c9db045371fa9613912ee", "parents": [ "2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8" ], "author": { "name": "Edward Adam Davis", "email": "eadavis@qq.com", "time": "Fri Mar 06 09:31:58 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:33:56 2026 -0400" }, "message": "ext4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we\u0027ve\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I\u0027d just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]\n\nReported-by: syzbot+512459401510e2a9a39f@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d1659aaaaa8d9d11265d7\nTested-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com\nReported-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d512459401510e2a9a39f\nTested-by: syzbot+1659aaaaa8d9d11265d7@syzkaller.appspotmail.com\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nTested-by: syzbot+512459401510e2a9a39f@syzkaller.appspotmail.com\nLink: https://patch.msgid.link/tencent_43696283A68450B761D76866C6F360E36705@qq.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8", "tree": "28e15cdc68b982d6b6423b5f66ddab4a18da8310", "parents": [ "73bf12adbea10b13647864cd1c62410d19e21086" ], "author": { "name": "Tejas Bharambe", "email": "tejas.bharambe@outlook.com", "time": "Tue Mar 03 23:14:34 2026 -0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:33:46 2026 -0400" }, "message": "ext4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx-\u003eei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.\n\nReported-by: syzbot+04c4e65cab786a2e5b7e@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d04c4e65cab786a2e5b7e\nSigned-off-by: Tejas Bharambe \u003ctejas.bharambe@outlook.com\u003e\nLink: https://patch.msgid.link/JH0PR06MB66326016F9B6AD24097D232B897CA@JH0PR06MB6632.apcprd06.prod.outlook.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "73bf12adbea10b13647864cd1c62410d19e21086", "tree": "aecc387d20983b536354217d3cc4d62ee795f0d9", "parents": [ "c4a48e9eeefd610ae0d26e9ff085277f751c8e53" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Tue Mar 03 09:22:42 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:33:34 2026 -0400" }, "message": "ext4: test if inode\u0027s all dirty pages are submitted to disk\n\nThe commit aa373cf55099 (\"writeback: stop background/kupdate works from\nlivelocking other works\") introduced an issue where unmounting a filesystem\nin a multi-logical-partition scenario could lead to batch file data loss.\nThis problem was not fixed until the commit d92109891f21 (\"fs/writeback:\nbail out if there is no more inodes for IO and queued once\"). It took\nconsiderable time to identify the root cause. Additionally, in actual\nproduction environments, we frequently encountered file data loss after\nnormal system reboots. Therefore, we are adding a check in the inode\nrelease flow to verify whether all dirty pages have been flushed to disk,\nin order to determine whether the data loss is caused by a logic issue in\nthe filesystem code.\n\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260303012242.3206465-1-yebin@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "c4a48e9eeefd610ae0d26e9ff085277f751c8e53", "tree": "42dbae9ef370e29177a787b22273981412f1c1d5", "parents": [ "46066e3a06647c5b186cc6334409722622d05c44" ], "author": { "name": "Ojaswin Mujoo", "email": "ojaswin@linux.ibm.com", "time": "Mon Mar 02 20:08:11 2026 +0530" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:33:22 2026 -0400" }, "message": "ext4: minor fix for ext4_split_extent_zeroout()\n\nWe missed storing the error which triggerd smatch warning:\n\n\tfs/ext4/extents.c:3369 ext4_split_extent_zeroout()\n\twarn: duplicate zero check \u0027err\u0027 (previous on line 3363)\n\nfs/ext4/extents.c\n 3361\n 3362 err \u003d ext4_ext_get_access(handle, inode, path + depth);\n 3363 if (err)\n 3364 return err;\n 3365\n 3366 ext4_ext_mark_initialized(ex);\n 3367\n 3368 ext4_ext_dirty(handle, inode, path + depth);\n--\u003e 3369 if (err)\n 3370 return err;\n 3371\n 3372 return 0;\n 3373 }\n\nFix it by correctly storing the err value from ext4_ext_dirty().\n\nLink: https://lore.kernel.org/all/aYXvVgPnKltX79KE@stanley.mountain/\nReported-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nFixes: a985e07c26455 (\"ext4: refactor zeroout path and handle all cases\")\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nSigned-off-by: Ojaswin Mujoo \u003cojaswin@linux.ibm.com\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Baokun Li \u003clibaokun@linux.alibaba.com\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\nLink: https://patch.msgid.link/20260302143811.605174-1-ojaswin@linux.ibm.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "46066e3a06647c5b186cc6334409722622d05c44", "tree": "e8122223411f660e2f9352a6a380b99fb0411147", "parents": [ "afe376d2c1fa78c8a1063a357c6971bba3f6da91" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Mon Mar 02 21:46:19 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:33:08 2026 -0400" }, "message": "ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()\n\nThere\u0027s issue as follows:\n...\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): error count since last fsck: 1\nEXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760\nEXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760\n...\n\nAccording to the log analysis, blocks are always requested from the\ncorrupted block group. This may happen as follows:\next4_mb_find_by_goal\n ext4_mb_load_buddy\n ext4_mb_load_buddy_gfp\n ext4_mb_init_cache\n ext4_read_block_bitmap_nowait\n ext4_wait_block_bitmap\n ext4_validate_block_bitmap\n if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))\n return -EFSCORRUPTED; // There\u0027s no logs.\n if (err)\n return err; // Will return error\next4_lock_group(ac-\u003eac_sb, group);\n if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b-\u003ebd_info))) // Unreachable\n goto out;\n\nAfter commit 9008a58e5dce (\"ext4: make the bitmap read routines return\nreal error codes\") merged, Commit 163a203ddb36 (\"ext4: mark block group\nas corrupt on block bitmap error\") is no real solution for allocating\nblocks from corrupted block groups. This is because if\n\u0027EXT4_MB_GRP_BBITMAP_CORRUPT(e4b-\u003ebd_info)\u0027 is true, then\n\u0027ext4_mb_load_buddy()\u0027 may return an error. This means that the block\nallocation will fail.\nTherefore, check block group if corrupted when ext4_mb_load_buddy()\nreturns error.\n\nFixes: 163a203ddb36 (\"ext4: mark block group as corrupt on block bitmap error\")\nFixes: 9008a58e5dce (\"ext4: make the bitmap read routines return real error codes\")\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260302134619.3145520-1-yebin@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "afe376d2c1fa78c8a1063a357c6971bba3f6da91", "tree": "f4df30b1d95851ed37a4f644e257c0d416a6670e", "parents": [ "1aec30021edd410b986c156f195f3d23959a9d11" ], "author": { "name": "Ritesh Harjani (IBM)", "email": "ritesh.list@gmail.com", "time": "Sun Mar 01 21:44:26 2026 +0530" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:32:23 2026 -0400" }, "message": "ext4: kunit: extents-test: lix percpu_counters list corruption\n\ncommit 82f80e2e3b23 (\"ext4: add extent status cache support to kunit tests\"),\nadded ext4_es_register_shrinker() in extents_kunit_init() function but\nfailed to add the unregister shrinker routine in extents_kunit_exit().\n\nThis could cause the following percpu_counters list corruption bug.\n\n ok 1 split unwrit extent to 2 extents and convert 1st half writ\n slab kmalloc-4k start c0000002007ff000 pointer offset 1448 size 4096\n list_add corruption. next-\u003eprev should be prev (c000000004bc9e60), but was 0000000000000000. (next\u003dc0000002007ff5a8).\n ------------[ cut here ]------------\n kernel BUG at lib/list_debug.c:29!\ncpu 0x2: Vector: 700 (Program Check) at [c000000241927a30]\n pc: c000000000f26ed0: __list_add_valid_or_report+0x120/0x164\n lr: c000000000f26ecc: __list_add_valid_or_report+0x11c/0x164\n sp: c000000241927cd0\n msr: 800000000282b033\n current \u003d 0xc000000241215200\n paca \u003d 0xc0000003fffff300 irqmask: 0x03 irq_happened: 0x09\n pid \u003d 258, comm \u003d kunit_try_catch\nkernel BUG at lib/list_debug.c:29!\nenter ? for help\n __percpu_counter_init_many+0x148/0x184\n ext4_es_register_shrinker+0x74/0x23c\n extents_kunit_init+0x100/0x308\n kunit_try_run_case+0x78/0x1f8\n kunit_generic_run_threadfn_adapter+0x40/0x70\n kthread+0x190/0x1a0\n start_kernel_thread+0x14/0x18\n2:mon\u003e\n\nThis happens because:\n\nextents_kunit_init(test N):\n ext4_es_register_shrinker(sbi)\n percpu_counters_init() x 4; // this adds 4 list nodes to global percpu_counters list\n list_add(\u0026fbc-\u003elist, \u0026percpu_counters);\n shrinker_register();\n\nextents_kunit_exit(test N):\n kfree(sbi);\t\t\t// frees sbi w/o removing those 4 list nodes.\n \t\t\t\t// So, those list node now becomes dangling pointers\n\nextents_kunit_init(test N+1):\n kzalloc_obj(ext4_sb_info)\t// allocator returns same page, but zeroed.\n ext4_es_register_shrinker(sbi)\n percpu_counters_init()\n list_add(\u0026fbc-\u003elist, \u0026percpu_counters);\n __list_add_valid(new, prev, next);\n\tnext-\u003eprev !\u003d prev \t\t// list corruption bug detected, since next-\u003eprev \u003d NULL\n\nFixes: 82f80e2e3b23 (\"ext4: add extent status cache support to kunit tests\")\nSigned-off-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nReviewed-by: Ojaswin Mujoo \u003cojaswin@linux.ibm.com\u003e\nLink: https://patch.msgid.link/5bb9041471dab8ce870c191c19cbe4df57473be8.1772381213.git.ritesh.list@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "1aec30021edd410b986c156f195f3d23959a9d11", "tree": "c733094c1a33ae7c441a8a9d64f57f5cfa72682a", "parents": [ "356227096eb66e41b23caf7045e6304877322edf" ], "author": { "name": "Li Chen", "email": "me@linux.beauty", "time": "Wed Feb 25 16:26:16 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:32:07 2026 -0400" }, "message": "ext4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u003ejinode to concurrent users.\nIt used to set ei-\u003ejinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u003ei_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u003c49\u003e 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u003ejinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer.\n\nFixes: a361293f5fede (\"jbd2: Fix oops in jbd2_journal_file_inode()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Li Chen \u003cme@linux.beauty\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260225082617.147957-1-me@linux.beauty\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "356227096eb66e41b23caf7045e6304877322edf", "tree": "ca1c93573c471519476540eefbe10069d71f2ab7", "parents": [ "1308255bbf8452762f89f44f7447ce137ecdbcff" ], "author": { "name": "Yuto Ohnuki", "email": "ytohnuki@amazon.com", "time": "Mon Feb 23 12:33:46 2026 +0000" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:31:52 2026 -0400" }, "message": "ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption.\n\nSigned-off-by: Yuto Ohnuki \u003cytohnuki@amazon.com\u003e\nLink: https://patch.msgid.link/20260223123345.14838-2-ytohnuki@amazon.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "1308255bbf8452762f89f44f7447ce137ecdbcff", "tree": "41638eb923eb978ca1f132087dd6aa42b9183646", "parents": [ "bd060afa7cc3e0ad30afa9ecc544a78638498555" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Feb 16 17:48:44 2026 +0100" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:31:43 2026 -0400" }, "message": "ext4: fix fsync(2) for nojournal mode\n\nWhen inode metadata is changed, we sometimes just call\next4_mark_inode_dirty() to track modified metadata. This copies inode\nmetadata into block buffer which is enough when we are journalling\nmetadata. However when we are running in nojournal mode we currently\nfail to write the dirtied inode buffer during fsync(2) because the inode\nis not marked as dirty. Use explicit ext4_write_inode() call to make\nsure the inode table buffer is written to the disk. This is a band aid\nsolution but proper solution requires a much larger rewrite including\nchanges in metadata bh tracking infrastructure.\n\nReported-by: Free Ekanayaka \u003cfree.ekanayaka@gmail.com\u003e\nLink: https://lore.kernel.org/all/87il8nhxdm.fsf@x1.mail-host-address-is-not-set/\nCC: stable@vger.kernel.org\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nLink: https://patch.msgid.link/20260216164848.3074-4-jack@suse.cz\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "bd060afa7cc3e0ad30afa9ecc544a78638498555", "tree": "9291e62e5b67b16c99b5f6f8dcc6303ab7cefcee", "parents": [ "b1d682f1990c19fb1d5b97d13266210457092bcd" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Feb 16 17:48:43 2026 +0100" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:30:37 2026 -0400" }, "message": "ext4: make recently_deleted() properly work with lazy itable initialization\n\nrecently_deleted() checks whether inode has been used in the near past.\nHowever this can give false positive result when inode table is not\ninitialized yet and we are in fact comparing to random garbage (or stale\nitable block of a filesystem before mkfs). Ultimately this results in\nuninitialized inodes being skipped during inode allocation and possibly\nthey are never initialized and thus e2fsck complains. Verify if the\ninode has been initialized before checking for dtime.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nLink: https://patch.msgid.link/20260216164848.3074-3-jack@suse.cz\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "b1d682f1990c19fb1d5b97d13266210457092bcd", "tree": "9548b028ad84b70528477a6f9c52f5176c4650be", "parents": [ "ed9356a30e59c7cc3198e7fc46cfedf3767b9b17" ], "author": { "name": "Simon Weber", "email": "simon.weber.39@gmail.com", "time": "Sat Feb 07 10:53:03 2026 +0100" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:30:25 2026 -0400" }, "message": "ext4: fix journal credit check when setting fscrypt context\n\nFix an issue arising when ext4 features has_journal, ea_inode, and encrypt\nare activated simultaneously, leading to ENOSPC when creating an encrypted\nfile.\n\nFix by passing XATTR_CREATE flag to xattr_set_handle function if a handle\nis specified, i.e., when the function is called in the control flow of\ncreating a new inode. This aligns the number of jbd2 credits set_handle\nchecks for with the number allocated for creating a new inode.\n\next4_set_context must not be called with a non-null handle (fs_data) if\nfscrypt context xattr is not guaranteed to not exist yet. The only other\nusage of this function currently is when handling the ioctl\nFS_IOC_SET_ENCRYPTION_POLICY, which calls it with fs_data\u003dNULL.\n\nFixes: c1a5d5f6ab21eb7e (\"ext4: improve journal credit handling in set xattr paths\")\n\nCo-developed-by: Anthony Durrer \u003canthonydev@fastmail.com\u003e\nSigned-off-by: Anthony Durrer \u003canthonydev@fastmail.com\u003e\nSigned-off-by: Simon Weber \u003csimon.weber.39@gmail.com\u003e\nReviewed-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260207100148.724275-4-simon.weber.39@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "ed9356a30e59c7cc3198e7fc46cfedf3767b9b17", "tree": "0ef43f4184f06d0454c3ad07ada212b7f675e32f", "parents": [ "f4a2b42e78914ff15630e71289adc589c3a8eb45" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Sat Feb 07 10:06:07 2026 +0530" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:29:54 2026 -0400" }, "message": "ext4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u003e inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0027s actual\ninline capacity (EXT4_I(inode)-\u003ei_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.\n\nReported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d7de5fe447862fc37576f\nTested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com\nSigned-off-by: Deepanshu Kartikey \u003cKartikey406@gmail.com\u003e\nLink: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "f4a2b42e78914ff15630e71289adc589c3a8eb45", "tree": "db938cff0cf37f5efaf5aa4e2f78e37126e62da8", "parents": [ "84e21e3fb8fd99ea460eb7274584750d11cf3e9f" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Feb 05 10:22:24 2026 +0100" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:29:39 2026 -0400" }, "message": "ext4: fix stale xarray tags after writeback\n\nThere are cases where ext4_bio_write_page() gets called for a page which\nhas no buffers to submit. This happens e.g. when the part of the file is\nactually a hole, when we cannot allocate blocks due to being called from\njbd2, or in data\u003djournal mode when checkpointing writes the buffers\nearlier. In these cases we just return from ext4_bio_write_page()\nhowever if the page didn\u0027t need redirtying, we will leave stale DIRTY\nand/or TOWRITE tags in xarray because those get cleared only in\n__folio_start_writeback(). As a result we can leave these tags set in\nmappings even after a final sync on filesystem that\u0027s getting remounted\nread-only or that\u0027s being frozen. Various assertions can then get upset\nwhen writeback is started on such filesystems (Gerald reported assertion\nin ext4_journal_check_start() firing).\n\nFix the problem by cycling the page through writeback state even if we\ndecide nothing needs to be written for it so that xarray tags get\nproperly updated. This is slightly silly (we could update the xarray\ntags directly) but I don\u0027t think a special helper messing with xarray\ntags is really worth it in this relatively rare corner case.\n\nReported-by: Gerald Yang \u003cgerald.yang@canonical.com\u003e\nLink: https://lore.kernel.org/all/20260128074515.2028982-1-gerald.yang@canonical.com\nFixes: dff4ac75eeee (\"ext4: move keep_towrite handling to ext4_bio_write_page()\")\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260205092223.21287-2-jack@suse.cz\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "84e21e3fb8fd99ea460eb7274584750d11cf3e9f", "tree": "ecd846d32697c6a0fb6b1ac1766619385b9b9295", "parents": [ "82c4f23d2757c2fc6751a5805c1feecdd4c430fb" ], "author": { "name": "Zhang Yi", "email": "yi.zhang@huawei.com", "time": "Sat Jan 31 17:11:56 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:14:25 2026 -0400" }, "message": "ext4: do not check fast symlink during orphan recovery\n\nCommit \u00275f920d5d6083 (\"ext4: verify fast symlink length\")\u0027 causes the\ngeneric/475 test to fail during orphan cleanup of zero-length symlinks.\n\n generic/475 84s ... _check_generic_filesystem: filesystem on /dev/vde is inconsistent\n\nThe fsck reports are provided below:\n\n Deleted inode 9686 has zero dtime.\n Deleted inode 158230 has zero dtime.\n ...\n Inode bitmap differences: -9686 -158230\n Orphan file (inode 12) block 13 is not clean.\n Failed to initialize orphan file.\n\nIn ext4_symlink(), a newly created symlink can be added to the orphan\nlist due to ENOSPC. Its data has not been initialized, and its size is\nzero. Therefore, we need to disregard the length check of the symbolic\nlink when cleaning up orphan inodes. Instead, we should ensure that the\nnlink count is zero.\n\nFixes: 5f920d5d6083 (\"ext4: verify fast symlink length\")\nSigned-off-by: Zhang Yi \u003cyi.zhang@huawei.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260131091156.1733648-1-yi.zhang@huaweicloud.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nCc: stable@kernel.org\n" }, { "commit": "82c4f23d2757c2fc6751a5805c1feecdd4c430fb", "tree": "f8c8fce9bd7014973c084cd61779c88723e54fa2", "parents": [ "f338e77383789c0cae23ca3d48adcc5e9e137e3c" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Feb 19 10:22:18 2026 -0500" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Mar 27 23:14:20 2026 -0400" }, "message": "Update MAINTAINERS file to add reviewers for ext4\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nReviewed-by: Ojaswin Mujoo \u003cojaswin@linux.ibm.com\u003e\n" }, { "commit": "be762d8b6dd7efacb61937d20f8475db8f207655", "tree": "ebe9898064b8fa9594d4d1df38dc4d541142fae4", "parents": [ "afb54c14047780b97719e8b6e4ea11a0cecc2739", "754bd2b4a084b90b5e7b630e1f423061a9b9b761" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 20:02:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 20:02:34 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - PMBus driver fixes:\n - Add mutex protection for regulator operations\n - Fix reading from \"write-only\" attributes\n - Mark lowest/average/highest/rated attributes as read-only\n - isl68137: Add mutex protection for AVS enable sysfs attributes\n - ina233: Fix error handling and sign extension when reading shunt voltage\n\n - adm1177: Fix sysfs ABI violation and current unit conversion\n\n - peci: Fix off-by-one in cputemp_is_visible(), and crit_hyst returning\n delta instead of absolute temperature\n\n* tag \u0027hwmon-for-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (pmbus/core) Protect regulator operations with mutex\n hwmon: (pmbus) Introduce the concept of \"write-only\" attributes\n hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only\n hwmon: (adm1177) fix sysfs ABI violation and current unit conversion\n hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible()\n hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature\n hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes\n hwmon: (pmbus/ina233) Fix error handling and sign extension in shunt voltage read\n" }, { "commit": "afb54c14047780b97719e8b6e4ea11a0cecc2739", "tree": "ba58a92b26a2f3f8fe08b8dfc82c2d04ca9e9888", "parents": [ "26df51adf30b3d440293eed38d01f953ae0bb6f4", "01f784fc9d0ab2a6dac45ee443620e517cb2a19b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 19:58:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 19:58:22 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Driver (and enclosure) only fixes. Most are obvious. The big change is\n in the tcm_loop driver to add command draining to error handling (the\n lack of which was causing hangs with the potential for double use\n crashes)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: file: Use kzalloc_flex for aio_cmd\n scsi: scsi_transport_sas: Fix the maximum channel scanning issue\n scsi: target: tcm_loop: Drain commands in target_reset handler\n scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n scsi: ses: Handle positive SCSI error from ses_recv_diag()\n" }, { "commit": "26df51adf30b3d440293eed38d01f953ae0bb6f4", "tree": "0c98bbde811a0eaaea75b328bb0c774ed038e055", "parents": [ "335c9017e333894c39853f6fc27db9f0ce44f48b", "5ba61d8a25ddf89915f71bf8b63c06d6ffdf06cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 17:21:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 17:21:37 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-03-28-1\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes, still a bit busy, but the usual suspects amdgpu and\n i915/xe have a bunch of small fixes, and otherwise it\u0027s just a few\n minor driver fixes.\n\n loognsoon:\n - update MAINTAINERS\n\n shmem:\n - fault handler fix\n\n syncobj:\n - fix GFP flags\n\n amdgpu:\n - DSC fix\n - Module parameter parsing fix\n - PASID reuse fix\n - drm_edid leak fix\n - SMU 13.x fixes\n - SMU 14.x fix\n - Fence fix in amdgpu_amdkfd_submit_ib()\n - LVDS fixes\n - GPU page fault fix for non-4K pages\n\n amdkfd:\n - Ordering fix in kfd_ioctl_create_process()\n\n i915/display:\n - DP tunnel error handling fix\n - Spurious GMBUS timeout fix\n - Unlink NV12 planes earlier\n - Order OP vs. timeout correctly in __wait_for()\n\n xe:\n - Fix UAF in SRIOV migration restore\n - Updates to HW W/a\n - VMBind remap fix\n\n ivpu:\n - poweroff fix\n\n mediatek:\n - fix register ordering\"\n\n* tag \u0027drm-fixes-2026-03-28-1\u0027 of https://gitlab.freedesktop.org/drm/kernel: (25 commits)\n MAINTAINERS: Update GPU driver maintainer information\n drm/xe: always keep track of remap prev/next\n drm/syncobj: Fix xa_alloc allocation flags\n drm/amd/display: Fix DCE LVDS handling\n drm/amdgpu: Handle GPU page faults correctly on non-4K page systems\n drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v14\n drm/amdkfd: Fix NULL pointer check order in kfd_ioctl_create_process\n drm/amd/display: check if ext_caps is valid in BL setup\n drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n drm/xe: Implement recent spec updates to Wa_16025250150\n accel/ivpu: Add disable clock relinquish workaround for NVL-A0\n drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state\n drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13\n drm/amd/pm: Return -EOPNOTSUPP for unsupported OD_MCLK on smu_v13_0_6\n drm/amd/pm: Skip redundant UCLK restore in smu_v13_0_6\n drm/amd/display: Fix drm_edid leak in amdgpu_dm\n drm/amdgpu: prevent immediate PASID reuse case\n drm/amdgpu: fix strsep() corrupting lockup_timeout on multi-GPU (v3)\n drm/amd/display: Do not skip unrelated mode changes in DSC validation\n drm/xe/pf: Fix use-after-free in migration restore\n ...\n" }, { "commit": "0738d395aab8fae3b5a3ad3fc640630c91693c27", "tree": "920b9cdeaedf892b846a9b0bdce638356b506bc0", "parents": [ "48b8814e25d073dd84daf990a879a820bad2bcbd" ], "author": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Thu Mar 26 19:50:14 2026 +0100" }, "committer": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Sat Mar 28 00:43:39 2026 +0100" }, "message": "s390/entry: Scrub r12 register on kernel entry\n\nBefore commit f33f2d4c7c80 (\"s390/bp: remove TIF_ISOLATE_BP\"),\nall entry handlers loaded r12 with the current task pointer\n(lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That\ncommit removed TIF_ISOLATE_BP, dropping both the branch prediction\nmacros and the r12 load, but did not add r12 to the register clearing\nsequence.\n\nAdd the missing xgr %r12,%r12 to make the register scrub consistent\nacross all entry points.\n\nFixes: f33f2d4c7c80 (\"s390/bp: remove TIF_ISOLATE_BP\")\nCc: stable@kernel.org\nReviewed-by: Ilya Leoshkevich \u003ciii@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\n" }, { "commit": "48b8814e25d073dd84daf990a879a820bad2bcbd", "tree": "7d7e252e0bce901bc143e78a42e8435c7e13e438", "parents": [ "c5c0a268b38adffbb2e70e6957017537ff54c157" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 24 17:34:05 2026 +0100" }, "committer": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Sat Mar 28 00:43:39 2026 +0100" }, "message": "s390/syscalls: Add spectre boundary for syscall dispatch table\n\nThe s390 syscall number is directly controlled by userspace, but does\nnot have an array_index_nospec() boundary to prevent access past the\nsyscall function pointer tables.\n\nCc: Heiko Carstens \u003chca@linux.ibm.com\u003e\nCc: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nCc: Alexander Gordeev \u003cagordeev@linux.ibm.com\u003e\nCc: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nCc: Sven Schnelle \u003csvens@linux.ibm.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nFixes: 56e62a737028 (\"s390: convert to generic entry\")\nCc: stable@kernel.org\nAssisted-by: gkh_clanker_2000\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nLink: https://lore.kernel.org/r/2026032404-sterling-swoosh-43e6@gregkh\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\n" }, { "commit": "c5c0a268b38adffbb2e70e6957017537ff54c157", "tree": "43396ada44769c6ce7e4481888a0418d7be53c01", "parents": [ "c369299895a591d96745d6492d4888259b004a9e" ], "author": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Thu Mar 26 14:38:44 2026 +0100" }, "committer": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Sat Mar 28 00:43:24 2026 +0100" }, "message": "s390/barrier: Make array_index_mask_nospec() __always_inline\n\nMark array_index_mask_nospec() as __always_inline to guarantee the\nmitigation is emitted inline regardless of compiler inlining decisions.\n\nFixes: e2dd833389cc (\"s390: add optimized array_index_mask_nospec\")\nCc: stable@kernel.org\nReviewed-by: Ilya Leoshkevich \u003ciii@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\n" }, { "commit": "335c9017e333894c39853f6fc27db9f0ce44f48b", "tree": "f0aa2732479261358bd482e8776802fad322da3c", "parents": [ "cd0bbd5a664f44c9430cb392ce03e6b74a2fa78f", "b341c1176f2e001b3adf0b47154fc31589f7410e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:38:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:38:55 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"There are two core fixes here. One is from Johan dealing with an issue\n introduced by a devm_ API usage update causing things to be freed\n earlier than they had earlier when we fail to register a device,\n another from Danilo avoids unlocked acccess to data by converting to\n use a driver core API.\n\n We also have a few relatively minor driver specific fixes\"\n\n* tag \u0027spi-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: spi-fsl-lpspi: fix teardown order issue (UAF)\n spi: fix use-after-free on managed registration failure\n spi: use generic driver_override infrastructure\n spi: meson-spicc: Fix double-put in remove path\n spi: sn-f-ospi: Use devm_mutex_init() to simplify code\n spi: sn-f-ospi: Fix resource leak in f_ospi_probe()\n" }, { "commit": "cd0bbd5a664f44c9430cb392ce03e6b74a2fa78f", "tree": "3a15d4433a1234b374ae6f36be3f54a3d3ae73e4", "parents": [ "30052002e6bce7fe7f316ddd8dbea4943bd82dae", "8121353a4bf8e38afee26299419a78ec108e14a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:36:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:36:23 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"A fix from Alice for the rust bindings, they didn\u0027t handle the stub\n implementation of the C API used when CONFIG_REGULATOR is disabled\n leading to undefined behaviour\"\n\n* tag \u0027regulator-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n rust: regulator: do not assume that regulator_get() returns non-null\n" }, { "commit": "30052002e6bce7fe7f316ddd8dbea4943bd82dae", "tree": "4047c572234c8e2a5b3450b34960d9518bb49ab3", "parents": [ "dd09eb443372f9390d36051d86ebe06e9919aeec", "09e70e4f119ff650d24c96161fd2f62ac7e424b0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:34:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:34:25 2026 -0700" }, "message": "Merge tag \u0027regmap-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fix from Mark Brown:\n \"A fix from Andy Shevchenko for an issue with caching of page selector\n registers which are located inside the page they are switching\"\n\n* tag \u0027regmap-fix-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: Synchronize cache for the page selector\n" }, { "commit": "dd09eb443372f9390d36051d86ebe06e9919aeec", "tree": "18d82c6e8799c74a017f6aa0615f4600000f3739", "parents": [ "faf44e54f6def4dd85b2ae35d6b332f81f9d7e91", "c3fd16c3b98ed726294feab2f94f876290bf7b61" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:19:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 16:19:51 2026 -0700" }, "message": "Merge tag \u0027tsm-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm\n\nPull tsm fix from Dan Williams:\n\n - Fix a VMM controlled buffer length used to emit TDX attestation\n reports\n\n* tag \u0027tsm-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:\n virt: tdx-guest: Fix handling of host controlled \u0027quote\u0027 buffer length\n" }, { "commit": "faf44e54f6def4dd85b2ae35d6b332f81f9d7e91", "tree": "f8bcc55db8d01059436ef0a673540e02f2855abe", "parents": [ "56bea424158f6b99a452ab9410092d72b03f8545", "e98137f0a874ab36d0946de4707aa48cb7137d1c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:59:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:59:30 2026 -0700" }, "message": "Merge tag \u0027vfio-v7.0-rc6\u0027 of https://github.com/awilliam/linux-vfio\n\nPull VFIO fix from Alex Williamson:\n\n - Fix double-free and reference count underflow if dma-buf file\n allocation fails (Alex Williamson)\n\n* tag \u0027vfio-v7.0-rc6\u0027 of https://github.com/awilliam/linux-vfio:\n vfio/pci: Fix double free in dma-buf feature\n" }, { "commit": "56bea424158f6b99a452ab9410092d72b03f8545", "tree": "832be134cd2b08a12ba3fed9c2dcd718711d74f5", "parents": [ "a361474ba3b3c6bdca7bad72dfd2ffb4f11e8e1d", "217c0a5c177a3d4f7c8497950cbf5c36756e8bbb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:55:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:55:25 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.0-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"Fix a potential buffer overrun issue introduced by the previous fix\n for EFI boot services region reservations on x86\"\n\n* tag \u0027efi-fixes-for-v7.0-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size\n" }, { "commit": "a361474ba3b3c6bdca7bad72dfd2ffb4f11e8e1d", "tree": "9355e1d93431cb6cf1e83a73bba4e0a1aec21f0b", "parents": [ "196ef74abd3abb97a97fcf416ca9d59851fd1d08", "6bcfb7f46d667b04bd1a1169ccedf5fb699c60df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:39:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:39:41 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Fix missing NULL checks for kstrdup(), workaround LS2K/LS7A GPU\n DMA hang bug, emit GNU_EH_FRAME for vDSO correctly, and fix some\n KVM-related bugs\"\n\n* tag \u0027loongarch-fixes-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()\n LoongArch: KVM: Handle the case that EIOINTC\u0027s coremap is empty\n LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust\n LoongArch: vDSO: Emit GNU_EH_FRAME correctly\n LoongArch: Workaround LS2K/LS7A GPU DMA hang bug\n LoongArch: Fix missing NULL checks for kstrdup()\n" }, { "commit": "196ef74abd3abb97a97fcf416ca9d59851fd1d08", "tree": "df902a5462b9577ffe06dcc8b5a3e29648b8740a", "parents": [ "7df48e36313029e4c0907b2023905dd7213fd678", "5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:35:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 15:35:38 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.0-20260327\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n \"Just two small fixes, both fixing regressions added in the fdinfo code\n in 6.19 with the SQE mixed size support\"\n\n* tag \u0027io_uring-7.0-20260327\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check\n io_uring/fdinfo: fix SQE_MIXED SQE displaying\n" }, { "commit": "5ba61d8a25ddf89915f71bf8b63c06d6ffdf06cc", "tree": "bd2fe4db193c3d4dd13950aff9a0bb959773fa9f", "parents": [ "83318d0c1f5fd3a5eae41bc4e5dc110d5be4907c", "4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Mar 28 08:05:29 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Mar 28 08:05:36 2026 +1000" }, "message": "Merge tag \u0027mediatek-drm-fixes-20260323\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes\n\nMediatek DRM Fixes - 20260323\n\n1. dsi: Store driver data before invoking mipi_dsi_host_register\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\nLink: https://patch.msgid.link/20260323160135.39609-1-chunkuang.hu@kernel.org\n" }, { "commit": "df83746075778958954aa0460cca55f4b3fc9c02", "tree": "fa7dc3930c5aa07216a4c07ea95cf842f1566cf4", "parents": [ "aad885e774966e97b675dfe928da164214a71605" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Thu Mar 05 17:42:14 2026 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Mar 27 22:33:33 2026 +0100" }, "message": "KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE\n\nAdjust KVM\u0027s sanity check against overwriting a shadow-present SPTE with a\nanother SPTE with a different target PFN to only apply to direct MMUs,\ni.e. only to MMUs without shadowed gPTEs. While it\u0027s impossible for KVM\nto overwrite a shadow-present SPTE in response to a guest write, writes\nfrom outside the scope of KVM, e.g. from host userspace, aren\u0027t detected\nby KVM\u0027s write tracking and so can break KVM\u0027s shadow paging rules.\n\n ------------[ cut here ]------------\n pfn !\u003d spte_to_pfn(*sptep)\n WARNING: arch/x86/kvm/mmu/mmu.c:3069 at mmu_set_spte+0x1e4/0x440 [kvm], CPU#0: vmx_ept_stale_r/872\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 0 UID: 1000 PID: 872 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:mmu_set_spte+0x1e4/0x440 [kvm]\n Call Trace:\n \u003cTASK\u003e\n ept_page_fault+0x535/0x7f0 [kvm]\n kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]\n kvm_mmu_page_fault+0x8d/0x620 [kvm]\n vmx_handle_exit+0x18c/0x5a0 [kvm_intel]\n kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb5/0x730\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nFixes: 11d45175111d (\"KVM: x86/mmu: Warn if PFN changes on shadow-present SPTE in shadow MMU\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\n" }, { "commit": "aad885e774966e97b675dfe928da164214a71605", "tree": "b030dc892f4e3a18823fd9af70519b62836936eb", "parents": [ "6c6ba5489586b6458980fc988736d7fb1be44f30" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Thu Mar 05 17:28:04 2026 -0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Mar 27 22:33:33 2026 +0100" }, "message": "KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE\n\nWhen installing an emulated MMIO SPTE, do so *after* dropping/zapping the\nexisting SPTE (if it\u0027s shadow-present). While commit a54aa15c6bda3 was\nright about it being impossible to convert a shadow-present SPTE to an\nMMIO SPTE due to a _guest_ write, it failed to account for writes to guest\nmemory that are outside the scope of KVM.\n\nE.g. if host userspace modifies a shadowed gPTE to switch from a memslot\nto emulted MMIO and then the guest hits a relevant page fault, KVM will\ninstall the MMIO SPTE without first zapping the shadow-present SPTE.\n\n ------------[ cut here ]------------\n is_shadow_present_pte(*sptep)\n WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]\n Call Trace:\n \u003cTASK\u003e\n mmu_set_spte+0x237/0x440 [kvm]\n ept_page_fault+0x535/0x7f0 [kvm]\n kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]\n kvm_mmu_page_fault+0x8d/0x620 [kvm]\n vmx_handle_exit+0x18c/0x5a0 [kvm_intel]\n kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb5/0x730\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x47fa3f\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nReported-by: Alexander Bulekov \u003cbkov@amazon.com\u003e\nDebugged-by: Alexander Bulekov \u003cbkov@amazon.com\u003e\nSuggested-by: Fred Griffoul \u003cfgriffo@amazon.co.uk\u003e\nFixes: a54aa15c6bda3 (\"KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\n" }, { "commit": "6c6ba5489586b6458980fc988736d7fb1be44f30", "tree": "fed1a9144a9a62b819a8a7d7ac7716b66dc37f47", "parents": [ "0138af2472dfdef0d56fc4697416eaa0ff2589bd", "0a28e06575b3f3b30c1e99fc08fa0907956f35a4" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Mar 27 22:30:44 2026 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Mar 27 22:30:44 2026 +0100" }, "message": "Merge tag \u0027kvm-s390-master-7.0-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD\n\nKVM: s390: More memory management fixes\n\nLots of small and not-so-small fixes for the newly rewritten gmap,\nmostly affecting the handling of nested guests.\n" }, { "commit": "7df48e36313029e4c0907b2023905dd7213fd678", "tree": "0e1abe0db9315df72f65259bb567769fb886c0e4", "parents": [ "8af4fad545fa4df358c8e4d12f269e460717e514", "e37afcb56ae070477741fe2d6e61fc0c542cce2d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:30:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:30:04 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n\n - Quite a few irdma bug fixes, several user triggerable\n\n - Fix a 0 SMAC header in ionic\n\n - Tolerate FW errors for RAAS in bng_re\n\n - Don\u0027t UAF in efa when printing error events\n\n - Better handle pool exhaustion in the new bvec paths\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/irdma: Harden depth calculation functions\n RDMA/irdma: Return EINVAL for invalid arp index error\n RDMA/irdma: Fix deadlock during netdev reset with active connections\n RDMA/irdma: Remove reset check from irdma_modify_qp_to_err()\n RDMA/irdma: Clean up unnecessary dereference of event-\u003ecm_node\n RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce()\n RDMA/irdma: Update ibqp state to error if QP is already in error state\n RDMA/irdma: Initialize free_qp completion before using it\n RDMA/efa: Fix possible deadlock\n RDMA/rw: Fix MR pool exhaustion in bvec RDMA READ path\n RDMA/rw: Fall back to direct SGE on MR pool exhaustion\n RDMA/efa: Fix use of completion ctx after free\n RDMA/bng_re: Fix silent failure in HWRM version query\n RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()\n RDMA/irdma: Fix double free related to rereg_user_mr\n" }, { "commit": "8af4fad545fa4df358c8e4d12f269e460717e514", "tree": "3a504e5f0e752ff50bfbf51556ad310551776a32", "parents": [ "83ce1c753f5789167f52df59d3ea64f01b3f77ba", "05f643d6f7e699198ccc47e634de3879a8ec26a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:25:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:25:58 2026 -0700" }, "message": "Merge tag \u0027pci-v7.0-fixes-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fixes from Bjorn Helgaas:\n\n - Remove power-off from pwrctrl drivers since this is now done directly\n by the PCI controller drivers (Chen-Yu Tsai)\n\n - Fix pwrctrl device node leak (Felix Gu)\n\n - Document a TLP header decoder for AER log messages (Lukas Wunner)\n\n* tag \u0027pci-v7.0-fixes-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n Documentation: PCI: Document PCIe TLP Header decoder for AER messages\n PCI/pwrctrl: Fix pci_pwrctrl_is_required() device node leak\n PCI/pwrctrl: Do not power off on pwrctrl device removal\n" }, { "commit": "83ce1c753f5789167f52df59d3ea64f01b3f77ba", "tree": "53bbbfab43abc64e21b3daf36469d3250abcb806", "parents": [ "f44c65111e9da0fa378ddf832c90e93855628dc9", "ed4da361bf943b9041fc63e5cb6af01b3c0de978" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:16:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:16:40 2026 -0700" }, "message": "Merge tag \u0027sound-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"This became slightly big partly due to my time off in the last week.\n But all changes are about device-specific fixes, so it should be\n safely applicable.\n\n ASoC:\n - Fix double free in sma1307\n - Fix uninitialized variables in simple-card-utils/imx-card\n - Address clock leaks and error propagation in ADAU1372\n - Add DMI quirks and ACP/SDW support for ASUS\n - Fix Intel CATPT DMA mask\n - Fix SOF topology parsing\n - Fix DT bindings for RK3576 SPDIF, STM32 SAI and WCD934x\n\n HD-audio:\n - Quirks for Lenovo, ASUS, and various HP models, as well as\n a speaker pop fix on Star Labs StarFighter\n - Revert MSI X870E Tomahawk denylist again\n\n USB-Audio:\n - Fix distorted audio on Focusrite Scarlett 2i2/2i4 1st Gen\n - Add iface reset quirk for AB17X\n - Update Qualcomm USB audio Kconfig dependencies and license\n\n Misc:\n - Fix minor compile warnings for firewire and asihpi drivers\"\n\n* tag \u0027sound-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits)\n Revert \"ALSA: hda/intel: Add MSI X870E Tomahawk to denylist\"\n ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio\n ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk\n ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx\n ALSA: hda/realtek - Fixed Speaker Mute LED for HP EliteBoard G1a platform\n ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload\n ASoC: adau1372: Fix clock leak on PLL lock failure\n ASoC: adau1372: Fix unchecked clk_prepare_enable() return value\n ASoC: SDCA: fix finding wrong entity\n ASoC: SDCA: remove the max count of initialization table\n ASoC: codecs: wcd934x: fix typo in dt parsing\n ASoC: dt-bindings: stm32: Fix incorrect compatible string in stm32h7-sai match\n ASoC: Intel: catpt: Fix the device initialization\n ASoC: amd: acp: add ASUS HN7306EA quirk for legacy SDW machine\n ASoC: SOF: topology: reject invalid vendor array size in token parser\n ASoC: tas2781: Add null check for calibration data\n ALSA: asihpi: avoid write overflow check warning\n ASoC: fsl: imx-card: initialize playback_only and capture_only\n ASoC: simple-card-utils: Check value of is_playback_only and is_capture_only\n ...\n" }, { "commit": "f44c65111e9da0fa378ddf832c90e93855628dc9", "tree": "0d0734fb615cad177ada01d8d6c53d0cb406a7b5", "parents": [ "0b8bf3b64eee8470d27a62a7923af3058125c7ca", "7587fbf5adc23d180a5ea9aa6944292c22328703" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:10:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:10:49 2026 -0700" }, "message": "Merge tag \u0027media/v7.0-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n\n - uvcvideo may cause OOPS when out of memory\n\n - remove a deadlock in the ccs driver\n\n* tag \u0027media/v7.0-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: ccs: Avoid deadlock in ccs_init_state()\n media: uvcvideo: Fix bug in error path of uvc_alloc_urb_buffers\n" }, { "commit": "0b8bf3b64eee8470d27a62a7923af3058125c7ca", "tree": "34e3e3029eb53fbb4925fdbf7cf614cd6b2a177d", "parents": [ "3577cfd738e29b3d54cdb10c45a56730346dfe8b", "f63a9df7e3f9f842945d292a19d9938924f066f9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:04:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 13:04:34 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.00-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fix from Joel Granados:\n \"Fix uninitialized variable error when writing to a sysctl bitmap\n\n Removed the possibility of returning an unjustified -EINVAL when\n writing to a sysctl bitmap\"\n\n* tag \u0027sysctl-7.00-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n sysctl: fix uninitialized variable in proc_do_large_bitmap\n" }, { "commit": "3577cfd738e29b3d54cdb10c45a56730346dfe8b", "tree": "e4e48a452d8afd8fd9ca3622f2de6773a912aeed", "parents": [ "34892992d0ed45b4b0547f25e01887b56959fd5f", "e31c53a8060e134111ed095783fee0aa0c43b080" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 12:22:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 12:22:45 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This includes a few important bug fixes, and some code refactoring\n that was necessary for one of the fixes\"\n\n* tag \u0027xfs-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: remove file_path tracepoint data\n xfs: don\u0027t irele after failing to iget in xfs_attri_recover_work\n xfs: remove redundant validation in xlog_recover_attri_commit_pass2\n xfs: fix ri_total validation in xlog_recover_attri_commit_pass2\n xfs: close crash window in attr dabtree inactivation\n xfs: factor out xfs_attr3_leaf_init\n xfs: factor out xfs_attr3_node_entry_remove\n xfs: only assert new size for datafork during truncate extents\n xfs: annotate struct xfs_attr_list_context with __counted_by_ptr\n xfs: cleanup buftarg handling in XFS_IOC_VERIFY_MEDIA\n xfs: scrub: unlock dquot before early return in quota scrub\n xfs: refactor xfsaild_push loop into helper\n xfs: save ailp before dropping the AIL lock in push callbacks\n xfs: avoid dereferencing log items after push callbacks\n xfs: stop reclaim before pushing AIL during unmount\n" }, { "commit": "1f9885732248d22f788e4992c739a98c88ab8a55", "tree": "f3133fc89c30261d8d0d9901c970e63767478440", "parents": [ "50b35c9e50a865600344ab1d8f9a8b3384d7e63d" ], "author": { "name": "Luo Haiyang", "email": "luo.haiyang@zte.com.cn", "time": "Thu Mar 26 14:19:53 2026 +0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Fri Mar 27 15:18:06 2026 -0400" }, "message": "tracing: Fix potential deadlock in cpu hotplug with osnoise\n\nThe following sequence may leads deadlock in cpu hotplug:\n\n task1 task2 task3\n ----- ----- -----\n\n mutex_lock(\u0026interface_lock)\n\n [CPU GOING OFFLINE]\n\n cpus_write_lock();\n osnoise_cpu_die();\n kthread_stop(task3);\n wait_for_completion();\n\n osnoise_sleep();\n mutex_lock(\u0026interface_lock);\n\n cpus_read_lock();\n\n [DEAD LOCK]\n\nFix by swap the order of cpus_read_lock() and mutex_lock(\u0026interface_lock).\n\nCc: stable@vger.kernel.org\nCc: \u003cmathieu.desnoyers@efficios.com\u003e\nCc: \u003czhang.run@zte.com.cn\u003e\nCc: \u003cyang.tao172@zte.com.cn\u003e\nCc: \u003cran.xiaokai@zte.com.cn\u003e\nFixes: bce29ac9ce0bb (\"trace: Add osnoise tracer\")\nLink: https://patch.msgid.link/20260326141953414bVSj33dAYktqp9Oiyizq8@zte.com.cn\nReviewed-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Luo Haiyang \u003cluo.haiyang@zte.com.cn\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "34892992d0ed45b4b0547f25e01887b56959fd5f", "tree": "4ef1fbbc8978f459d9ec38df8019ebbc2a455a1a", "parents": [ "46b513250491a7bfc97d98791dbe6a10bcc8129d", "beef2634f81f1c086208191f7228bce1d366493d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 12:03:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 27 12:03:39 2026 -0700" }, "message": "Merge tag \u0027v7.0-rc5-ksmbd-srv-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix out of bounds write\n\n - Fix for better calculating max output buffers\n\n - Fix memory leaks in SMB2/SMB3 lock\n\n - Fix use after free\n\n - Multichannel fix\n\n* tag \u0027v7.0-rc5-ksmbd-srv-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix potencial OOB in get_file_all_info() for compound requests\n ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()\n ksmbd: fix memory leaks and NULL deref in smb2_lock()\n ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n ksmbd: do not expire session on binding failure\n" }, { "commit": "4c10830fda045e255f4eaa81a362bd357e19c3ea", "tree": "75a78e6ea02bc8eefbeff7674465254d2da9a31a", "parents": [ "c369299895a591d96745d6492d4888259b004a9e", "e2f1ada8e089dd5a331bcd8b88125ae2af8d188f" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Mar 27 16:20:24 2026 +0100" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Mar 27 16:20:24 2026 +0100" }, "message": "Merge tag \u0027i2c-host-fixes-7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-fixes for v7.0-rc6\n\ndesignware: fix resume-probe race causing NULL-deref in amdisp\nimx: fix timeout on repeated reads and extra clock at end\n" }, { "commit": "e2f1ada8e089dd5a331bcd8b88125ae2af8d188f", "tree": "75a78e6ea02bc8eefbeff7674465254d2da9a31a", "parents": [ "13101db735bdb29c5f60e95fb578690bd178b30f" ], "author": { "name": "Pratap Nirujogi", "email": "pratap.nirujogi@amd.com", "time": "Fri Mar 20 16:12:22 2026 -0400" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Mar 27 13:51:21 2026 +0100" }, "message": "i2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized\n\nFixes: d6263c468a761 (\"i2c: amd-isp: Add ISP i2c-designware driver\")\nCo-developed-by: Bin Du \u003cbin.du@amd.com\u003e\nSigned-off-by: Bin Du \u003cbin.du@amd.com\u003e\nSigned-off-by: Pratap Nirujogi \u003cpratap.nirujogi@amd.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.16+\nAcked-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260320201302.3490570-1-pratap.nirujogi@amd.com\n" }, { "commit": "13101db735bdb29c5f60e95fb578690bd178b30f", "tree": "c2580e001b777e3af4344d36144f4c634e08d694", "parents": [ "f88e2e748a1fc3cb4b8d163a9be790812f578850" ], "author": { "name": "Stefan Eichenberger", "email": "stefan.eichenberger@toradex.com", "time": "Wed Feb 18 16:08:50 2026 +0100" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Mar 27 13:51:21 2026 +0100" }, "message": "i2c: imx: ensure no clock is generated after last read\n\nWhen reading from the I2DR register, right after releasing the bus by\nclearing MSTA and MTX, the I2C controller might still generate an\nadditional clock cycle which can cause devices to misbehave. Ensure to\nonly read from I2DR after the bus is not busy anymore. Because this\nrequires polling, the read of the last byte is moved outside of the\ninterrupt handler.\n\nAn example for such a failing transfer is this:\ni2ctransfer -y -a 0 w1@0x00 0x02 r1\nError: Sending messages failed: Connection timed out\nIt does not happen with every device because not all devices react to\nthe additional clock cycle.\n\nFixes: 5f5c2d4579ca (\"i2c: imx: prevent rescheduling in non dma mode\")\nCc: stable@vger.kernel.org # v6.13+\nSigned-off-by: Stefan Eichenberger \u003cstefan.eichenberger@toradex.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260218150940.131354-3-eichest@gmail.com\n" }, { "commit": "f88e2e748a1fc3cb4b8d163a9be790812f578850", "tree": "f9e27c46bc718fa64915938565528f06d4098200", "parents": [ "c369299895a591d96745d6492d4888259b004a9e" ], "author": { "name": "Stefan Eichenberger", "email": "stefan.eichenberger@toradex.com", "time": "Wed Feb 18 16:08:49 2026 +0100" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Mar 27 13:51:20 2026 +0100" }, "message": "i2c: imx: fix i2c issue when reading multiple messages\n\nWhen reading multiple messages, meaning a repeated start is required,\npolling the bus busy bit must be avoided. This must only be done for\nthe last message. Otherwise, the driver will timeout.\n\nHere an example of such a sequence that fails with an error:\ni2ctransfer -y -a 0 w1@0x00 0x02 r1 w1@0x00 0x02 r1\nError: Sending messages failed: Connection timed out\n\nFixes: 5f5c2d4579ca (\"i2c: imx: prevent rescheduling in non dma mode\")\nCc: stable@vger.kernel.org # v6.13+\nSigned-off-by: Stefan Eichenberger \u003cstefan.eichenberger@toradex.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260218150940.131354-2-eichest@gmail.com\n" }, { "commit": "1f6ee9be92f8df85a8c9a5a78c20fd39c0c21a95", "tree": "1942a1a902720e5e6f25e612eb468a1f229400e2", "parents": [ "53a7c171e9dd833f0a96b545adcb89bd57387239" ], "author": { "name": "Fei Lv", "email": "feilv@asrmicro.com", "time": "Mon Jul 22 18:14:43 2024 +0800" }, "committer": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Fri Mar 27 12:48:10 2026 +0100" }, "message": "ovl: make fsync after metadata copy-up opt-in mount option\n\nCommit 7d6899fb69d25 (\"ovl: fsync after metadata copy-up\") was done to\nfix durability of overlayfs copy up on an upper filesystem which does\nnot enforce ordering on storing of metadata changes (e.g. ubifs).\n\nIn an earlier revision of the regressing commit by Lei Lv, the metadata\nfsync behavior was opt-in via a new \"fsync\u003dstrict\" mount option.\nWe were hoping that the opt-in mount option could be avoided, so the\nchange was only made to depend on metacopy\u003doff, in the hope of not\nhurting performance of metadata heavy workloads, which are more likely\nto be using metacopy\u003don.\n\nThis hope was proven wrong by a performance regression report from Google\nCOS workload after upgrade to kernel 6.12.\n\nThis is an adaptation of Lei\u0027s original \"fsync\u003dstrict\" mount option\nto the existing upstream code.\n\nThe new mount option is mutually exclusive with the \"volatile\" mount\noption, so the latter is now an alias to the \"fsync\u003dvolatile\" mount\noption.\n\nReported-by: Chenglong Tang \u003cchenglongtang@google.com\u003e\nCloses: https://lore.kernel.org/linux-unionfs/CAOdxtTadAFH01Vui1FvWfcmQ8jH1O45owTzUcpYbNvBxnLeM7Q@mail.gmail.com/\nLink: https://lore.kernel.org/linux-unionfs/CAOQ4uxgKC1SgjMWre\u003dfUb00v8rxtd6sQi-S+dxR8oDzAuiGu8g@mail.gmail.com/\nFixes: 7d6899fb69d25 (\"ovl: fsync after metadata copy-up\")\nDepends: 50e638beb67e0 (\"ovl: Use str_on_off() helper in ovl_show_options()\")\nCc: stable@vger.kernel.org # v6.12+\nSigned-off-by: Fei Lv \u003cfeilv@asrmicro.com\u003e\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\n" }, { "commit": "ed4da361bf943b9041fc63e5cb6af01b3c0de978", "tree": "ff9a4bcfa45ab599839ee09db06ce6e5de544099", "parents": [ "ee6c551a7d84fde084e10cc02fa8c7d03e6438f9" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Thu Mar 26 14:05:38 2026 -0500" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Mar 27 10:54:04 2026 +0100" }, "message": "Revert \"ALSA: hda/intel: Add MSI X870E Tomahawk to denylist\"\n\ncommit 30b3211aa2416 (\"ALSA: hda/intel: Add MSI X870E Tomahawk\nto denylist\") was added to silence a warning, but this effectively\nreintroduced commit df42ee7e22f03 (\"ALSA: hda: Add ASRock\nX670E Taichi to denylist\") which was already reported to cause\nproblems and reverted in commit ee8f1613596ad (\"Revert \"ALSA: hda:\nAdd ASRock X670E Taichi to denylist\"\")\n\nRevert it yet again.\n\nCc: stable@vger.kernel.org\nReported-by: Juhyun Song \u003cjuju6985@outlook.kr\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221274\nCc: Stuart Hayhurst \u003cstuart.a.hayhurst@gmail.com\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nLink: https://patch.msgid.link/20260326190542.524515-1-mario.limonciello@amd.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "ee6c551a7d84fde084e10cc02fa8c7d03e6438f9", "tree": "ac6b5c1266d183f863cb78fa0f0bc550428950cb", "parents": [ "faceb5cf5d7a08f4a40335d22d833bb75f05d99e" ], "author": { "name": "Lianqin Hu", "email": "hulianqin@vivo.com", "time": "Wed Mar 25 06:26:48 2026 +0000" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Mar 27 10:50:57 2026 +0100" }, "message": "ALSA: usb-audio: Add iface reset and delay quirk for AB17X USB Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: new full-speed USB device number 2 using xhci-hcd\nusb 1-1: New USB device found, idVendor\u003d001f, idProduct\u003d0b23\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: AB17X USB Audio\nusb 1-1: Manufacturer: Generic\nusb 1-1: SerialNumber: 20241228172028\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/PUZPR06MB6224CA59AD2B26054120B276D249A@PUZPR06MB6224.apcprd06.prod.outlook.com\n" }, { "commit": "faceb5cf5d7a08f4a40335d22d833bb75f05d99e", "tree": "cff981a578c0f28b782a1eb05c7dbb8415cca342", "parents": [ "990a8b0732cf899d4a0f847b0a67efeb9a384c82" ], "author": { "name": "Kshamendra Kumar Mishra", "email": "kshamendrakumarmishra@gmail.com", "time": "Mon Mar 23 22:07:50 2026 +0530" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Mar 27 10:43:56 2026 +0100" }, "message": "ALSA: hda/realtek: add HP Laptop 15-fd0xxx mute LED quirk\n\nHP Laptop 15-fd0xxx with ALC236 codec does not handle the toggling of\nthe mute LED.\nThis patch adds a quirk entry for subsystem ID 0x8dd7 using\nALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup, enabling correct mute LED\nbehavior.\n\nSigned-off-by: Kshamendra Kumar Mishra \u003ckshamendrakumarmishra@gmail.com\u003e\nLink: https://patch.msgid.link/DHAB51ISUM96.2K9SZIABIDEQ0@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "990a8b0732cf899d4a0f847b0a67efeb9a384c82", "tree": "998a7ad180ea7f7ed3cece22fc6d59a2cbf85f7a", "parents": [ "2f388b4e8fdd6b0f27cafd281658daacfd85807e" ], "author": { "name": "Geoffrey D. Bennett", "email": "g@b4.vu", "time": "Mon Mar 23 21:59:21 2026 +1030" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Mar 27 10:43:14 2026 +0100" }, "message": "ALSA: usb-audio: Exclude Scarlett 2i4 1st Gen from SKIP_IFACE_SETUP\n\nSame issue that the Scarlett 2i2 1st Gen had:\nQUIRK_FLAG_SKIP_IFACE_SETUP causes distorted/flanging audio on the\nScarlett 2i4 1st Gen (1235:800a).\n\nFixes: 38c322068a26 (\"ALSA: usb-audio: Add QUIRK_FLAG_SKIP_IFACE_SETUP\")\nReported-by: dcferreira [https://github.com/geoffreybennett/linux-fcp/issues/54]\nSigned-off-by: Geoffrey D. Bennett \u003cg@b4.vu\u003e\nLink: https://patch.msgid.link/acEkEbftzyNe8W7C@m.b4.vu\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" } ], "next": "2f388b4e8fdd6b0f27cafd281658daacfd85807e" }