)]}' { "log": [ { "commit": "4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90", "tree": "f1d70b1952fe86d8b72a765506b7a5663919bf04", "parents": [ "400544639d2a11a9c1e276a912a9dff8fe4107dc", "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - fix for creating tmpfiles\n\n - fix durable reconnect error path\n\n - validate SID in security descriptor when inheriting DACL\n\n* tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n ksmbd: validate SID in parent security descriptor during ACL inheritance\n ksmbd: fix durable reconnect error path file lifetime\n" }, { "commit": "400544639d2a11a9c1e276a912a9dff8fe4107dc", "tree": "587237ffcddde9bdde29ec58d8e182d12046fb7e", "parents": [ "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "f13342e15deafb7538a7a8577ed5f4c33c56f64e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A batch of fixes to simple quotas:\n\n - add conditional rescheduling point not dependent on the lock during\n inode iterations to avoid delays with PREEMPT_NONE enabled\n\n - fix subvolume deletion so it does not break the squota invariants\n\n - properly handle enabling squota, tracking extents in the initial\n transaction\n\n - catch and warn about underflows, clamp to zero to avoid further\n problems\n\n And one fix to inode size handling:\n\n - fix handling of preallocated extents beyond i_size when not using\n the no-holes feature\"\n\n* tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: swallow btrfs_record_squota_delta() ENOENT\n btrfs: clamp to avoid squota underflow\n btrfs: fix squota accounting during enable generation\n btrfs: check for subvolume before deleting squota qgroup\n btrfs: always drop root-\u003einodes lock before cond_resched()\n btrfs: mark file extent range dirty after converting prealloc extents\n" }, { "commit": "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "tree": "fa9f7b0ff70d88e7ccbed16200f44e8dd5a62e26", "parents": [ "eed108edc1170404bbef9e7d0189d18a3cc354f5", "8339dd0e5090f092c525c5e04b2a75ec5e5305a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fix from Carlos Maiolino:\n \"A single fix for a race in xfs buffer cache which may lead to\n filesystem shutdown due to inconsistent metadata if the buffer\n lookup happens to find an old dead buffer still in the cache\"\n\n* tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix a buffer lookup against removal race\n" }, { "commit": "eed108edc1170404bbef9e7d0189d18a3cc354f5", "tree": "b719bfa55f4f4394d3e017c5b9dc99f074a64311", "parents": [ "95e6d3ba0571330df866911da9dedd83e05417ca", "e90ef85ada857819313000cc50c6edfcddec6850" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "message": "Merge tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux\n\nPull nios2 fixes from Dinh Nguyen:\n\n - Implement _THIS_IP_ for inline asm\n\n - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported\n\n* tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:\n nios2: Implement _THIS_IP_ using inline asm\n MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n" }, { "commit": "95e6d3ba0571330df866911da9dedd83e05417ca", "tree": "10f93942d6fb2daa7fc91edc87a41376f06aa822", "parents": [ "c8561c73b4a8669bb13c57a5853318cd02655f9b", "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Rework KASLR to avoid initrd overlap, remove some unused code to avoid\n a build warning, fix some bugs in kprobes and KVM\"\n\n* tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Move some variable declarations to paravirt.h\n LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n LoongArch: Remove unused code to avoid build warning\n LoongArch: Avoid initrd overlap during kernel relocation\n LoongArch: Skip relocation-time KASLR if already applied\n efi/loongarch: Randomize kernel preferred address for KASLR\n" }, { "commit": "c8561c73b4a8669bb13c57a5853318cd02655f9b", "tree": "a9ac004283e3930c47a717576756b8d4a44857dd", "parents": [ "3f264650ca7d2a2d6de86234d919f305211632cd", "215c90ee656114f5e8c32408228d97082f8e0eef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Remove the software node on platform device release(); without this,\n the software node remains registered after the device is gone and a\n subsequent platform_device_register_full() reusing the same node\n fails with -EBUSY\n\n - In sysfs_update_group(), do not remove a pre-existing directory when\n create_files() fails; the previous code would silently destroy a\n sysfs group that the caller did not create\n\n - Set fwnode-\u003esecondary to NULL in fwnode_init() to avoid dereferencing\n uninitialized memory (e.g. in dev_to_swnode()) when the firmware node\n is allocated on the stack or via a non-zeroing allocator\n\n* tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n sysfs: don\u0027t remove existing directory on update failure\n driver core: platform: remove software node on release()\n" }, { "commit": "3f264650ca7d2a2d6de86234d919f305211632cd", "tree": "b440c7d62949730c6772d1698dafbba3152da9fe", "parents": [ "ab868c10971c5d2cd27b3709d11225941eabe78e", "023453cb7eb0f53c5dc36babed8e706c1b0b0187" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Core:\n - smbus: fix a potential uninitialization bug\n\n Tegra:\n - drop runtime PM reference when exiting on mutex_lock failure\n - preserve transfer errors when releasing the mutex\"\n\n* tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: smbus: fix a potential uninitialization bug\n i2c: tegra: make tegra_i2c_mutex_unlock() return void\n i2c: tegra: fix pm_runtime leak on mutex_lock failure\n" }, { "commit": "ab868c10971c5d2cd27b3709d11225941eabe78e", "tree": "78b438df7cde483d4aa05f28acc6004447e2df17", "parents": [ "f53a244224ec0304209917e3f4d68dc83b1967db", "5b74373390113fba798a76b483837029ab010fef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n\n - syzbot triggred crash in rxe due to concurrent plug/unplug\n\n - Possible non-zero\u0027d memory exposed to userspace in bnxt_re\n\n - Malicous \u0027magic packet\u0027 with SIW causes a buffer overflow\n\n - Tighten the new uAPI validation code to not crash in debugging prints\n and have the right module dependencies in drivers\n\n - mana was missing the max_msg_sz report to userspace\n\n - UAF in rtrs on an error path\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/rtrs: Fix use-after-free in path file creation cleanup\n RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port\n RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()\n RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs\n RDMA/siw: Reject MPA FPDU length underflow before signed receive math\n RDMA/bnxt_re: zero shared page before exposing to userspace\n selftests/rdma: explicitly skip tests when required modules are missing\n RDMA/nldev: Add mutual exclusion in nldev_dellink()\n" }, { "commit": "8339dd0e5090f092c525c5e04b2a75ec5e5305a6", "tree": "85f3a7a35a37edd40803494b5789707e6a87ce82", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "c69439a891ccb37ede5d68539636337c6bd92fab" ], "author": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux into test_merge\n\nxfs: fixes for v7.1-rc5\n\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n Lines starting with \u0027#\u0027 will be ignored.\n" }, { "commit": "f53a244224ec0304209917e3f4d68dc83b1967db", "tree": "fe19f266c5edbf2ce37ef1adef2188add9c8d32b", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "message": "Merge tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl\n\nPull fwctl fix from Jason Gunthorpe:\n\n - Buffer overflow due to missing input validation in pds\n\n* tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:\n fwctl: pds: Validate RPC input size before parsing\n" }, { "commit": "79bd2dded182b1d458b18e62684b7f82ffc682e5", "tree": "e11cab84e200dac97bef26a2c880d1fea8caf36d", "parents": [ "de37e502a315677138009d2965f87e2c0721e76f", "0c1a9dce208b4dc265925898e5da98934f7f9266" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Spurious WARN in ops_dequeue() racing with concurrent dispatch\n\n - Self-deadlock between scheduler disable and a concurrent sub-sched\n enable\n\n* tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()\n sched_ext: Fix deadlock between scx_root_disable() and concurrent forks\n" }, { "commit": "de37e502a315677138009d2965f87e2c0721e76f", "tree": "0012bea881280a202ccb1a3c6620ed1493a0e202", "parents": [ "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "22572dbcd3486e6c4dced877125bbf50e4e24edf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n \"Two rstat fixes:\n\n - Out-of-bounds access in the css_rstat_updated() BPF kfunc when\n called with an unchecked user-supplied cpu\n\n - Over-strict NMI guard after the recent switch to try_cmpxchg left\n sparc and ppc64 unable to queue rstat updates from NMI\"\n\n* tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: rstat: relax NMI guard after switch to try_cmpxchg\n cgroup/rstat: validate cpu before css_rstat_cpu() access\n" }, { "commit": "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "tree": "f06a88c6b9511d40464a6cd5ef9f7c2062bed8db", "parents": [ "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "84335a9985867c1a6cd28c693ffbedc4ef1caa39" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular fixes pull, amdgpu/xe being the usual, with bonus msm content\n to bulk things out, otherwise it has the usual scattered changes, with\n amdxdna dropping a badly thought out userspace api.\n\n gem:\n - clean up LRU locking\n\n msm:\n - Core:\n - Fixed bindings for SM8650, SM8750 and Eliza\n - Don\u0027t use UTS_RELEASE directly\n - Fix typo in clock-names property\n - DPU:\n - Fixed CWB description on Kaanapali\n - Fixed scanline strides for YUV UBWC formats\n - Stopped DSI register dumping to access past the end of region\n - DSI:\n - Fix dumping unaligned regions\n - GPU:\n - Fix GMEM_BASE for a6xx gen3\n - Fix userspace reachable crash on a2xx-a4xx\n - Fix sysprof_active for counter collection with IFPC enabled GPUs\n - Fix shrinker lockdep\n\n amdgpu:\n - Userq fixes\n - VPE fix\n - SMU 15 fix\n - Misc fixes\n - VCE fixes\n - DC bios parsing fixes\n - DC aux fix\n - Mode1 reset fix\n - RAS fixes\n\n amdkfd:\n - Misc fixes\n\n radeon:\n - CS parser fix\n\n xe:\n - SRIOV related fixes\n - Fix leak and double-free\n - Multi-cast register fixes\n - Multi-queue fix\n\n i915:\n - Fix joiner color pipeline selection [display]\n - Fix readback for target_rr in Adaptive Sync SDP [dp]\n - Apply Intel DPCD workaround when SDP on prior line used [psr]\n\n amdxdna:\n - remove mmap and export for ubuf\n\n bridge:\n - chipone-icn6211: managed bridge cleanup\n - lt66121: acquire reset GPIO\n - megachips: fix clean up on failed IRQ requests\n\n v3d:\n - fix UAF in error code paths\n - release GEM-object ref on free\u0027d jobs\n\n virtio:\n - use uninterruptible resv locking in plane updates\n\n mediatek:\n - fix sparse warnings\"\n\n* tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel: (78 commits)\n drm/xe/oa: Fix exec_queue leak on width check in stream open\n drm/virtio: use uninterruptible resv lock for plane updates\n drm/amdgpu: fix handling in amdgpu_userq_create\n drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check\n drm/amdgpu: userq_va_mapped should remain true once done\n drm/amdgpu: avoid integer overflow in VA range check\n drm/amd/ras: Fix UMC error address allocation leak\n drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset\n drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n drm/amd/display: Validate GPIO pin LUT table size before iterating\n drm/amd/display: Fix integer overflow in bios_get_image()\n drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id\n drm/amdgpu: use atomic operation to achieve lockless serialization\n drm/amdkfd: Check bounds on allocate_doorbell\n drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets\n drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets\n drm/amdgpu/vce1: Stop using amdgpu_vce_resume\n drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n drm/amdgpu/vce1: Don\u0027t repeat GTT MGR node allocation\n drm/amdgpu/vce1: Check if VRAM address is lower than GART.\n ...\n" }, { "commit": "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "tree": "2be0879a817e091f8e6c9cf24e1d0158de4490eb", "parents": [ "59825bc9ce06281224c15c51ec535bf339112d8c", "b71cb088b2e3427924a470fc43e7aedb8a40d2e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Small fixes, two in drivers and the remaining a sign conversion probem\n in sd with no user visible consequences (non-zero is error)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: tcm_loop: Fix NULL ptr dereference\n scsi: isci: Fix use-after-free in device removal path\n scsi: sd: Fix return code handling in sd_spinup_disk()\n" }, { "commit": "59825bc9ce06281224c15c51ec535bf339112d8c", "tree": "6098b6c20171c7bff75d2e8d1e543b389e25d681", "parents": [ "cca95436be15d00ddac02d73054b612649485495", "654ddf855bebd8d45a6e707f5dc2344921f5e0cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from\n\n - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to\n handle match overrides gracefully\n\n - asus-armoury:\n - Fix mini-LED mode get/set\n - Add support for FA401EA, FX607VU, G614FR, and GU605CP\n\n - bitland-mifs-wmi:\n - Add CONFIG_LEDS_CLASS dependency\n\n - hp-wmi:\n - Add thermal support for Omen 16-c0xxx (board 8902)\n\n - intel/vsec:\n - Fix enable_cnt imbalance due to PCIe error recovery\n\n - surface/aggregator_registry:\n - Remove battery \u0026 AC nodes on Surface Laptop 7 to avoid duplicated\n devices\n\n - uniwill-laptop:\n - Handle uninitialized and invalid charging threshold values\n - Accept charging threshold of 0 through power supply sysfs ABI and\n clamp it to 1\n - Make \u0027force\u0027 parameter to work also when device descriptor is\n found\n - Do not enable charging limit despite the \u0027force\u0027 parameter to\n avoid permanent damage to battery\n\n* tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)\n platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL\n platform/x86: system76: Check ACPI_COMPANION() against NULL\n platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL\n platform/x86: intel/rst: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu: Check ACPI_COMPANION() against NULL\n platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL\n platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL\n platform/x86: asus-armoury: add support for GU605CP\n platform/x86: asus-armoury: add support for FA401EA\n platform/x86: asus-armoury: add support for G614FR\n ...\n" }, { "commit": "84335a9985867c1a6cd28c693ffbedc4ef1caa39", "tree": "aef06d4fb220a4eca0c01cbb5087201e640ba8f2", "parents": [ "4378a4116567887066011b8e0cd443241609e467", "4d25342543c01310fc4e0cba7cb17c775e2421e2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:50:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:57:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- SRIOV related fixes (Wajdeczko, Mohanram)\n- Fix leak and double-free (Lin)\n- Multi-cast register fixes (Gustavo)\n- Multi-queue fix (Niranjana)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com\n" }, { "commit": "cca95436be15d00ddac02d73054b612649485495", "tree": "b99552f9fe51620b5a71e682057e808abc63c1d8", "parents": [ "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "ea17fc4d7dc2ba6459b1a318962960520201baf1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "message": "Merge tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy fixes from Vinod Koul:\n\n - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL\n lock failure fix\n\n - Apple typec switch/mux leak fix\n\n - Marvell incoorect register fix for mvebu utmi phy\n\n - Tegra per-pad calibration fix\n\n* tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:\n phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config\n phy: apple: atc: Fix typec switch/mux leak on unbind\n phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()\n phy: eswin: Fix incorrect error check in probe()\n phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix\n phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870\n phy: tegra: xusb: Fix per-pad high-speed termination calibration\n phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access\n phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff\n phy: qcom: edp: Fix AUX_CFG8 programming for DP mode\n phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables\n phy: qcom: edp: Add eDP/DP mode switch support\n phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables\n" }, { "commit": "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "tree": "b6fbef7d38212c0844bc2be04a2a09cf4d137d2e", "parents": [ "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"Another batch of driver fixes from Johan fixing error handling paths,\n plus another from Felix. We also have a new device ID added in the DT\n bindings for SpacemiT K3\"\n\n* tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: fsl-qspi: support SpacemiT K3\n spi: ti-qspi: fix use-after-free after DMA setup failure\n spi: sprd: fix error pointer deref after DMA setup failure\n spi: qup: fix error pointer deref after DMA setup failure\n spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()\n spi: ep93xx: fix error pointer deref after DMA setup failure\n" }, { "commit": "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "tree": "b35aec61f5ad38649275a6967f64fd29323bff2f", "parents": [ "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "f9b2d3b703d13df50c630997dfdc25648e96db0d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of fixes here, one very minor Kconfig fix and a fix for a\n nasty issue with error reporting in the tps65219 driver\"\n\n* tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: tps65219: fix irq_data.rdev not being assigned\n regulator: Kconfig: fix a typo in help\n" }, { "commit": "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "tree": "ef266fd1c05fe6752830fac5a3d0c67ea480972e", "parents": [ "99e08debac1a381d57bd50a26e377e27674d91b7", "3812a9e84265a5cdd90d29fe8d97a023e91fb945" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Implement the GPIO .get_direction() callback in the Mediatek driver\n to rid dmesg warnings\n\n - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin\n function, so there is no conflict with orthogonal muxing\n\n - Fix incorrect settings of the \"PUPD\" (pull-up-pull-down) register\n during suspend/resume in the Renesas RZG2L\n\n - Fix the SMT register cache to be per-bank in the Renesas RZG2L\n\n - Fix the QDSS track clock and control pin group names in the Qualcomm\n Eliza driver\n\n - Fix a deadlock in the Amlogic driver, caused by playing around in\n sysfs\n\n - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a\n similar fix for the Qualcomm SM8150\n\n - Allow parsing DTs without explicit function nodes in the Freescale\n i.MX1 driver\n\n - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk\n\n* tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\n pinctrl: imx1: Allow parsing DT without function nodes\n pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150\n pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615\n pinctrl: meson: amlogic-a4: fix deadlock issue\n pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names\n pinctrl: renesas: rzg2l: Fix SMT register cache handling\n pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume\n pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function\n pinctrl: mediatek: moore: implement gpio_chip::get_direction()\n" }, { "commit": "99e08debac1a381d57bd50a26e377e27674d91b7", "tree": "8c8e5bb8a6fdb4693d7bc7881ad1f6f3dd62351c", "parents": [ "c22407252a2421286998323831095e6b8a1d9532", "a4fa45c1d980bc2b9837f469119af24a9304a1fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - propagate the error code from regulator_enable() in resume path in\n gpio-pca953x\n\n - take the device lock when calling device_is_bound() in virtual GPIO\n drivers\n\n - fix software node leak in remove path in gpio-aggregator\n\n - fix a potential use-after-free in gpio-aggregator\n\n - harden the GPIO character device uAPI: check that line config\n attributes are correctly zeroed\n\n* tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: virtuser: lock device when calling device_is_bound()\n gpio: aggregator: lock device when calling device_is_bound()\n gpio: sim: lock device when calling device_is_bound()\n gpio: aggregator: remove the software node when deactivating the aggregator\n gpio: aggregator: fix a potential use-after-free\n gpio: cdev: check if uAPI v2 config attributes are correctly zeroed\n gpio: pca953x: propagate regulator_enable() error from resume\n" }, { "commit": "c22407252a2421286998323831095e6b8a1d9532", "tree": "1874b784b3391147fe004219ce3acee58924741a", "parents": [ "3997e3bb1d30a426c0599918ebaac51698fcc959", "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"As expected, we still continue receiving lots of small fixes.\n\n One major change is about HD-audio pending IRQ handling, but this\n would influence only on odd machines or slow VMs. There are a few\n other fixes for the core part, but most of them are not-too-serious\n UAF fixes, while the rest are mostly device-specific fixes and quirks.\n\n ALSA Core:\n - Fix for PCM silencing with bogus iov_iter\n - Fixes for past-the-end iterators in timer and seq\n - Serialization of UMP output teardown\n - Rate-limit ELD parsing errors\n\n HD-audio:\n - Fixes for IRQ work handling and SSID matching\n - Various Realtek quirks for HP and ASUS laptops, including LED fixes\n\n ASoC:\n - Intel: ACPI match table updates for PTL, NVL, and ARL platforms\n - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs\n - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm\n - DT-binding fix for MediaTek\n\n Others:\n - USB ua101: Reject too-short USB descriptors\n - Scarlett2: Fix for flash writes\n - ASIHPI: Fix for potential OOB access\n - AMD SPI: Fix for bus number in ACPI probe\n\n MAINTAINERS:\n - Updates for SOF and TI maintainers\"\n\n* tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits)\n ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional\n ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.\n ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform\n ASoC: cs-amp-lib: Fix typo in error message: write -\u003e read\n ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()\n ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data()\n ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()\n MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer\n ALSA: seq: Serialize UMP output teardown with event_input\n ALSA: scarlett2: Allow flash writes ending at segment boundary\n ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6\n ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream\n ALSA: hda: Move irq pending work into hda-intel stream\n ASoC: soc-utils: Add missing va_end in snd_soc_ret()\n ALSA: ua101: Reject too-short USB descriptors\n ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X\n ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()\n ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register()\n ...\n" }, { "commit": "3997e3bb1d30a426c0599918ebaac51698fcc959", "tree": "3fa748f59fd1af865c612a24367d5ba957887585", "parents": [ "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "f6982769910ecddabdb5b8b9afdab0bb8b6668ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n - Fix memory leak for peer-to-peer addresses\n - Fix dma map leaks on resource errors\n\n - Another bio integrity fix, fixing a recent regression\n\n - Fix for an issue with the request pre-allocation and caching when IO\n is queued, where if a bio split occurred and ended up blocking, the\n list could be corrupted\n\n* tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: avoid use-after-free in disk_free_zone_resources()\n blk-mq: pop cached request if it is usable\n nvme-pci: fix dma mapping leak on data setup error\n nvme-pci: fix dma_vecs leak on p2p memory\n bio-integrity-fs: pass data iter to bio_integrity_verify()\n" }, { "commit": "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "tree": "5280f6293c32b1f21d8d4cad148828f7b2a615ab", "parents": [ "558c3eca715ea0110fe6fce38b063a6f9936188c", "e97ff8b62d4690c69297f0f6de874f0564cc01a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix for an issue with IORING_OP_NOP and using injection results\n\n - Fix for an issue in IORING_OP_WAITID, where the info state was\n assumed cleared by the lower level syscall handler, but for some\n cases it is not. Just clear the data upfront, so that non-initialized\n data isn\u0027t copied back to userspace\n\n - Fix for a lockdep reported issue, where IORING_OP_BIND enters file\n create and hence hits mnt_want_write(), which creates a three part\n lockdep cycle between the super lock, io_uring\u0027s uring_lock, and the\n cred mutex\n\n - Fix a regression introduced in this cycle with how linked timeouts\n are deleted\n\n - Ensure that the -\u003eopcode nospec indexing on the opcode issue side\n covers all the cases\n\n* tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/nop: pass all errors to userspace\n io_uring/timeout: splice timed out link in timeout handler\n io_uring: propagate array_index_nospec opcode into req-\u003eopcode\n io_uring/waitid: clear waitid info before copying it to userspace\n io_uring/net: punt IORING_OP_BIND async if it needs file create\n" }, { "commit": "558c3eca715ea0110fe6fce38b063a6f9936188c", "tree": "c3ef3073c7b18bd51fe30cd95833d4fd3a63a66e", "parents": [ "632360e8f5fce2eee720e952fd84e8cefb5749b6", "dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - Fix missing lock\n - Fix dentry in use after unmounting\n - cifs.upcall security fix\n - require CAP_NET_ADMIN for swn netlink\n - change allocation in DUP_CTX_STR to GFP_KERNEL\n - minor smbdirect debug fix\n - handle_read_data() folio fix\n\n* tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: change allocation requirements in DUP_CTX_STR macro\n smb: client: require net admin for CIFS SWN netlink\n smb: smbdirect: divide, not multiply, milliseconds by 1000\n cifs: Fix busy dentry used after unmounting\n smb: client: use data_len for SMB2 READ encrypted folioq copy\n smb: client: reject userspace cifs.spnego descriptions\n smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n" }, { "commit": "632360e8f5fce2eee720e952fd84e8cefb5749b6", "tree": "e97c99601ce85d5e65e2bb2d8ce8733a87b10ba1", "parents": [ "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "3a8389d42bdf4213730f4067f8bfa78bae6564ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "message": "Merge tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs\n\nPull zonefs fix from Damien Le Moal:\n\n - Avoid potential overflow when converting a zonefs file number string\n to an inode number (from Johannes)\n\n* tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:\n zonefs: handle integer overflow in zonefs_fname_to_fno\n" }, { "commit": "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "tree": "7f1c03f6a6e9a4f477eda27186717fde6b7c8a1b", "parents": [ "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "a67f3113331d9fb3eb0664602d9b581cb2df7294" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix maximum frequency computation in the intel_pstate driver for\n two processor models, update its documentation and fix issues related\n to the dynamic EPP support (added during the current development\n cycle) in the amd-pstate driver:\n\n - Fix maximum frequency computation in the intel_pstate driver for\n Raptor Lake-E and Bartlett Lake that are SMP platforms derived from\n hybrid ones (Rafael Wysocki, Henry Tseng)\n\n - Fix the description of asymmetric packing with SMT in the\n intel_pstate driver documentation (Ricardo Neri)\n\n - Fix multiple amd-pstate driver issues related to dynamic EPP\n support added recently, including making it opt-in only (K Prateek\n Nayak, Mario Limonciello)\"\n\n* tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP\n cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake\n cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E\n Documentation: intel_pstate: Fix description of asymmetric packing with SMT\n cpufreq/amd-pstate-ut: Drop policy reference before driver switch\n cpufreq/amd-pstate: Use \"epp_default_dc\" as default when dynamic_epp is disabled\n cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset\n cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn\u0027t modified\n cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name\n cpufreq/amd-pstate: Grab \"amd_pstate_driver_lock\" when toggling dynamic_epp\n" }, { "commit": "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "tree": "901e80297d94498b21b988894d13e027aab0cfb4", "parents": [ "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "c35cb4fc7231702d1e9952aec1a442f3e27df6f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"Unbreak system wakeup on critical battery status in the ACPI battery\n driver inadvertently broken during the 7.0 development cycle\"\n\n* tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: battery: Fix system wakeup on critical battery status\n" }, { "commit": "f6982769910ecddabdb5b8b9afdab0bb8b6668ac", "tree": "da723edd043ab3d628732506f724b795a4931e75", "parents": [ "dc278e9bf2b9513a763353e6b9cc21e0f532954e" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri May 22 20:56:22 2026 +0900" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 22 08:01:52 2026 -0600" }, "message": "block: avoid use-after-free in disk_free_zone_resources()\n\nThe function disk_update_zone_resources() may call\ndisk_free_zone_resources() in case of error, and following this,\nblk_revalidate_disk_zones() will again calls disk_free_zone_resources() if\ndisk_update_zone_resources() failed. If a zone worker thread is being used\n(which is the default for a rotational media zoned device),\ndisk_free_zone_resources() will try to stop the zone worker thread twice\nbecause disk-\u003ezone_wplugs_worker is not reset to NULL when the worker\nthread is stopped the first time.\n\nIn disk_free_zone_resources(), fix this by correctly clearing\ndisk-\u003ezone_wplugs_worker to NULL when the worker thread is stopped.\n\nAnd while at it, since disk_free_zone_resources() is always called after a\nfailed call to disk_update_zone_resources(), remove the unnecessary call\nto disk_free_zone_resources() in disk_update_zone_resources().\n\nFixes: 1365b6904fd0 (\"block: allow submitting all zone writes from a single context\")\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/20260522115622.588535-1-dlemoal@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "tree": "7d2acd2bfc3a23d50420e60426a630d44f3daad1", "parents": [ "cbadb98b7cb017b6b7376940781cb108f7baac71", "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Handle probe on hinted conditional branch instructions.\n\n BC.cond instructions can be simulated in the same way as B.cond\n instructions, so extend the decode mask for B.cond to cover BC.cond\n\n - Flush the walk cache when unsharing PMD tables. Recent changes to\n huge_pmd_unshare() introduced mmu_gather::unshared_tables but the\n arm64 code was still treating the TLB flushing as only targeting leaf\n entries (TLBI VALE1IS).\n\n Fix it by using non-leaf-only instructions (TLBI VAE1IS) when\n tlb-\u003eunshared_tables is set\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: tlb: Flush walk cache when unsharing PMD tables\n arm64: probes: Handle probes on hinted conditional branch instructions\n" }, { "commit": "cbadb98b7cb017b6b7376940781cb108f7baac71", "tree": "f2e31ea57834aa968cca61f2b657aa92a0ea097c", "parents": [ "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "540f4a4f6ef806a28e794001bb4beac4840a6090" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - Fix PAI NNPA mismatch between counting and recording, where sampling\n reports twice the value\n\n - Fix loss of PAI counter increments during recording on systems with\n many CPUs under heavy load, while counting is not affected\n\n - On some supported machines, CHSC cannot access memory outside the DMA\n zone, causing CHSC command failures. Restore GFP_DMA flag when\n allocating memory for CHSC control blocks\n\n - Align the numbering scheme for higher-level topology structures like\n socket, book, drawer with other hardware identifiers e.g. in sysfs,\n procfs and tools like lscpu\n\n* tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/topology: Use zero-based numbering for containing entities\n s390/cio: Restore GFP_DMA for CHSC allocation\n s390/pai: Fix missing PAI counter increments under heavy load\n s390/pai: Disable duplicate read of kernel PAI counter value\n" }, { "commit": "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "tree": "39b3f3f45fb91213139aba5232909214792905aa", "parents": [ "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "67ea9d353d0ba12bdbc9183ff568dead9e949b80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - Stable fix for a missing cpus_read_lock in one of the cpu sheaves\n flushing paths (Qing Wang)\n\n* tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()\n" }, { "commit": "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "tree": "e18468dd6caf762b046a7d1310fa9b704ce85c9d", "parents": [ "23884007afe901352349e709e33eb19373a842d7", "af0c3f05866237f7592219bfe05387bc3bfc99b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two minor updates for the DMA-mapping code, mainly fixing some rare\n corner cases (Petr Tesarik, Jianpeng Chang)\"\n\n* tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma-mapping: move dma_map_resource() sanity check into debug code\n dma-direct: fix use of max_pfn\n" }, { "commit": "23884007afe901352349e709e33eb19373a842d7", "tree": "e698633fffae9e8d69b3f459bc0d07e1896e4d06", "parents": [ "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Avoid NULL return from hist_field_name()\n\n The function hist_field_name() is directly passed to a strcat() which\n does not handle \"NULL\" characters. Return a zero length string when\n size is greater than the limit.\n\n This is used only to output already created histograms and no field\n currently is greater than the limit. But it should still not return\n NULL.\n\n - Do not call map-\u003eops-\u003eelt_free() on allocation failure\n\n When elt_alloc() fails, it should not call the map-\u003eops-\u003eelt_free()\n function if it exists, as that function may not be able to handle the\n free on allocation failures. The -\u003eelt_free() should only be called\n when elt_alloc() succeeds.\n\n* tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails\n tracing: Avoid NULL return from hist_field_name() on truncation\n" }, { "commit": "654ddf855bebd8d45a6e707f5dc2344921f5e0cf", "tree": "f80a3430c0823873130732f8200e6cde7ca5a4b9", "parents": [ "53a8f95cbb407608ef77a864ad4a59f25ddd906c" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Tue May 19 22:28:01 2026 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Fri May 22 15:48:41 2026 +0300" }, "message": "platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n\nThe newly added driver requires the LED classdev support\nand causes a link failure when that is disabled:\n\nx86_64-linux-ld: vmlinux.o: in function `bitland_mifs_wmi_probe\u0027:\nbitland-mifs-wmi.c:(.text+0xede02a): undefined reference to `devm_led_classdev_register_ext\u0027\n\nFixes: dc1ec4fa86b2 (\"platform/x86: bitland-mifs-wmi: Add new Bitland MIFS WMI driver\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260519202804.1339581-1-arnd@kernel.org\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "215c90ee656114f5e8c32408228d97082f8e0eef", "tree": "ed95e062785ed5a085f9df266badf9b877dc6f7c", "parents": [ "237557b8a81ab948e8332f7c0058e758f081c0a3" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed May 06 13:57:00 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 22 12:24:08 2026 +0200" }, "message": "device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n\nIf a firmware node is allocated on the stack (for instance: temporary\nsoftware node whose life-time we control) or on the heap - but using a\nnon-zeroing allocation function - and initialized using fwnode_init(),\nits secondary pointer will contain uninitalized memory which likely will\nbe neither NULL nor IS_ERR() and so may end up being dereferenced (for\nexample: in dev_to_swnode()). Set fwnode-\u003esecondary to NULL on\ninitialization.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: 01bb86b380a3 (\"driver core: Add fwnode_init()\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Rafael J. Wysocki (Intel) \u003crafael@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260506115701.23035-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "tree": "3d3aa4f6a2ceb7f9fcfbdb54101ed579b6b7243f", "parents": [ "2ccd8ff980b50e842481bae71102fa3883fc4377" ], "author": { "name": "Zeng Heng", "email": "zengheng4@huawei.com", "time": "Thu May 21 15:30:11 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 22 11:13:51 2026 +0100" }, "message": "arm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables\u003dtrue\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL\u003d`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL\u003d`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL\u003d`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL\u003d`2` (L2) | Leaf entry at Level 2 only |\n\nSigned-off-by: Zeng Heng \u003czengheng4@huawei.com\u003e\nFixes: 8ce720d5bd91 (\"mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b", "tree": "d8af4f1f69384bae692b0dc56158140d27ceaf14", "parents": [ "1c856e158fd34ef2c4475a81c1dc386329989938" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "message": "LoongArch: KVM: Move some variable declarations to paravirt.h\n\nSome variables relative with paravirt feature are declared in the header\nfile asm/qspinlock.h, however this file can be included only when option\nCONFIG_SMP is on. There is compiling warnings if CONFIG_SMP is off since\nvariables are not declared.\n\nMove these variable declarations to header file asm/paravirt.h to avoid\ncompiling warnings.\n\nFixes: c43dce6f13fb (\"LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605061313.O8Hswm2b-lkp@intel.com/\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "1c856e158fd34ef2c4475a81c1dc386329989938", "tree": "13cde94f56edfcfed3b279d0d7b1e7d11486b0c0", "parents": [ "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n\nKPROBE_HIT_SS and KPROBE_REENTER are two types of fatal recursions that\ncan not be safely recovered in kprobes.\n\nKPROBE_HIT_SS means that a kprobe is hit during single-stepping. At\nthis point, the architecture-specific single-step context is already\nactive. Nested single-stepping would corrupt the state, as the kprobe\ncontrol block (kcb) and hardware registers cannot safely store multiple\nlevels of stepping state.\n\nKPROBE_REENTER means that a third-level recursion occurs when a probe\nis hit while the system is already handling a nested probe (second-\nlevel). The kcb only provides a single slot (prev_kprobe) to backup the\nstate. When a third probe is hit, there is no more space to save the\nstate without corrupting the first-level backup.\n\nKprobes work by replacing instructions with breakpoints. In order to\nexecute the original instruction and continue, it must be moved to a\ntemporary \"single-step\" slot. Since there is no backup space left to\nset up this slot safely, the CPU would be forced to return to the same\noriginal breakpoint address, triggering an endless loop.\n\nCurrently, the code only prints a warning and returns. This leads to\nan infinite re-entry loop as the CPU repeatedly hits the same trap and\na \"stuck\" CPU core because preemption was disabled at the start of the\nhandler and never re-enabled in this early return path.\n\nFix the logic by:\n1. Merging KPROBE_HIT_SS and KPROBE_REENTER cases, as both represent\n fatal recursions that cannot be safely recovered.\n2. Replacing WARN_ON_ONCE() with BUG() to terminate the system. This\n aligns LoongArch with other architectures (x86, arm64, riscv) and\n prevents stack overflow while providing diagnostic information.\n\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b", "tree": "07d56e7418b69f9a6ef254f23d267fa6f58feb16", "parents": [ "0ccc9d47cf020994097ff51827cebd04aa2b0bf4" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n\nOn SMP systems, kprobe handlers would occasionally fail to execute on\ncertain CPU cores. The issue is hard to reproduce and typically occurs\nrandomly under high system load.\n\nThe root cause is a software-side instruction hazard. According to the\nLoongArch Reference Manual, while the cache coherency is maintained by\nhardware, software must explicitly use the \"IBAR\" instruction to ensure\nthe instruction fetch unit (IFU) observes the effects of recent stores.\n\nThe current arch_arm_kprobe() and arch_disarm_kprobe() only execute the\n\"IBAR\" barrier (via flush_insn_slot -\u003e local_flush_icache_range) on the\nlocal CPU. This leaves a vulnerable window where remote CPU cores may\ncontinue executing stale instructions from their pipelines or prefetch\nbuffers, as they have not executed an \"IBAR\" since the code modification.\n\nSwitch to larch_insn_text_copy() to fix this:\n1. Synchronization: It uses stop_machine_cpuslocked() to synchronize all\n online CPUs, ensuring no CPU is executing the target code area during\n modification.\n2. Visibility: By passing cpu_online_mask to stop_machine_cpuslocked(),\n the callback text_copy_cb() is executed on all online cores. Each CPU\n core invokes local_flush_icache_range() to execute \"IBAR\", clearing\n instruction hazards system-wide and ensuring the \"break\" instruction\n is visible to the fetch units of all cores.\n3. Robustness: It properly manages memory write permissions (ROX/RW) for\n the kernel text segment during patching, ensuring compatibility with\n CONFIG_STRICT_KERNEL_RWX.\n\nCc: \u003cstable@vger.kernel.org\u003e # 6.18+\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816", "tree": "5c0bfe48f868799e25f70faddc3718e0ef531726", "parents": [ "60a1969fae6209644698fca91c185d153674f631", "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA bigger batch of fixes than usual due to -next not happeing last week,\nthis is mostly stuff for laptops - a lot of quirks and small fixes,\nmainly for x86 and SoundWire. Nothing too big or exciting individually,\njust two week\u0027s worth.\n" }, { "commit": "e90ef85ada857819313000cc50c6edfcddec6850", "tree": "dac30ecccddc3779d08024193672c8ab409ec4b0", "parents": [ "7734b168cad167a43e5bda19bc8ccc65669ec964" ], "author": { "name": "Marco Elver", "email": "elver@google.com", "time": "Thu May 21 14:23:55 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:50:46 2026 -0500" }, "message": "nios2: Implement _THIS_IP_ using inline asm\n\nBoth GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to\nbe broken:\n\n #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; })\n\nIn particular, the address of a label is only expected to be used with a\ncomputed goto.\n\nWhile the generic version more or less works today, it is known to be\nbrittle and may break with current and future optimizations. For\nexample, Clang -O2 always returns 1 when this function is inlined:\n\n static inline unsigned long get_ip(void)\n { return ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; }); }\n\nFix it by overriding _THIS_IP_ in \u003casm/linkage.h\u003e (which is included by\n\u003clinux/instruction_pointer.h\u003e) using an architecture-specific inline asm\nversion. Additionally, avoiding taking the address of a label prevents\ncompilers from emitting spurious indirect branch targets (e.g. ENDBR or\nBTI) under control-flow integrity schemes.\n\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id\u003d120071 [1]\nLink: https://github.com/llvm/llvm-project/issues/138272 [2]\nSigned-off-by: Marco Elver \u003celver@google.com\u003e\nReviewed-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "7734b168cad167a43e5bda19bc8ccc65669ec964", "tree": "7d628cd58e688e1be667549406cd7c6a678cbc68", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Simon Schuster", "email": "schuster.simon@siemens-energy.com", "time": "Thu May 21 14:46:28 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:48:24 2026 -0500" }, "message": "MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n\nAdd Simon Schuster as a co-maintainer for the nios2 architecture and\nmark it as supported.\n\nSigned-off-by: Simon Schuster \u003cschuster.simon@siemens-energy.com\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44", "tree": "ef3a3d8c16fc4d0473fb3bd5e642fc122d8254a7", "parents": [ "69f030cf95488ae1186c72ac8c66fd279664ea7f" ], "author": { "name": "ChenXiaoSong", "email": "chenxiaosong@kylinos.cn", "time": "Mon May 18 15:23:22 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:20:24 2026 -0500" }, "message": "smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n\nReproducer:\n\n 1. server: systemctl start ksmbd\n 2. client: mount -t cifs //${server_ip}/export /mnt\n 3. client: C program: openat(AT_FDCWD, \"/mnt\", O_RDWR | O_TMPFILE, 0600)\n\nDo not treat `FILE_DELETE_ON_CLOSE_LE` as delete pending while files\nremain open.\n\nThis patch fixes xfstests generic/004.\n\nCc: stable@vger.kernel.org\nLink: https://chenxiaosong.com/en/smb-xfstests-generic-004.html\nCo-developed-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nTested-by: Steve French \u003cstfrench@microsoft.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "69f030cf95488ae1186c72ac8c66fd279664ea7f", "tree": "d8536854cc7ad089f924001b7a8ddb03dcad6558", "parents": [ "3515503322f4819277091839eed46b695096aca5" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Tue May 19 16:12:04 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: validate SID in parent security descriptor during ACL inheritance\n\nIntroduce smb_validate_ntsd_sid() helper to safely validate Owner SID\nand Group SID inside the NT Security Descriptor (smb_ntsd) retrieved\nfrom the parent directory.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "3515503322f4819277091839eed46b695096aca5", "tree": "3ba1480aea9cefbdbd9b26aaa2389a28c437ba63", "parents": [ "1a2ab0feaa23147e347b4d4cb79cb3fc392118eb" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Mon May 18 23:27:19 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: fix durable reconnect error path file lifetime\n\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\n\nIn this case fp and dh_info.fp are the same object. The first put drops the\nreconnect lookup reference, but the final durable put can run\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\nit can free the file object without removing the volatile-id entry that was\njust published into the session table.\n\nUse the session-aware put for the final reconnect drop when the reconnect\nhad already succeeded and the error path is cleaning up the republished\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\nusing the durable-only put path.\n\nFixes: 1baff47b81f9 (\"ksmbd: fix use-after-free in smb2_open during durable reconnect\")\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "4378a4116567887066011b8e0cd443241609e467", "tree": "52fad68b4ca8d4bd0bf265c8a7217f76cb702598", "parents": [ "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "87ed4e845d5a90bba1a56c0a5c580a13982e8648" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:30:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:31:08 2026 +1000" }, "message": "Merge tag \u0027mediatek-drm-fixes-20260521\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes\n\nMediatek DRM Fixes - 20260521\n\n1. fix sparse warnings\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\nLink: https://patch.msgid.link/20260521135649.4681-1-chunkuang.hu@kernel.org\n" }, { "commit": "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "tree": "c50f50098c31bb77c5078ac553bb4d531425c1a8", "parents": [ "68993ced0f618e36cf33388f1e50223e5e6e78cc", "ed831e7ea1a860bdbab3eadeb95f7f73e9d212df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Remove obsolete PCIe maintainer addresses (Florian Eckert, Hans\n Zhang)\n\n - Restore a brcmstb link speed assignment that was inadvertently\n removed, reducing bcm2712 performance (Florian Fainelli)\n\n* tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: brcmstb: Assign pcie-\u003egen from of_pci_get_max_link_speed()\n MAINTAINERS: Remove Jianjun Wang as PCIe mediatek maintainer\n MAINTAINERS: Remove Chuanhua Lei as PCIe intel-gw maintainer\n" }, { "commit": "68993ced0f618e36cf33388f1e50223e5e6e78cc", "tree": "eeecfdda57b25b9e73bd3684ccabee83132edfea", "parents": [ "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, wireless and netfilter.\n\n Craziness continues with no end in sight. Even discounting the driver\n revert this is a pretty huge PR for standards of the previous era. I\u0027d\n speculate - we haven\u0027t seen the worst of it, yet. Good news, I guess,\n is that so far we haven\u0027t seen many (any?) cases of \"AI reported a\n bug, we fixed it and a real user regressed\".\n\n Current release - fix to a fix:\n\n - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events\n\n - vsock/virtio: relax the recently added memory limit a little\n\n Current release - regressions:\n\n - IB/IPoIB: make sure IB drivers always use async set_rx_mode since\n some (mlx5) are now required to use it due to locking changes\n\n Previous releases - regressions:\n\n - udp: fix UDP length on last GSO_PARTIAL segment\n\n - af_unix: fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\n - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\n - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP\n\n Previous releases - always broken:\n\n - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\n - ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\n - Bluetooth: a lot of locking and concurrency fixes (as always)\n\n - batman-adv (mesh wireless networking): a lot of random fixes for\n issues reported by security researchers and Sashiko\n\n - netfilter: same thing, a lot of small security-ish fixes all over\n the place, nothing really stands out\n\n Misc:\n\n - bring back the old 3c509 driver, Maciej wants to maintain it\"\n\n* tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits)\n net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n net: enetc: fix init and teardown order to prevent use of unsafe resources\n net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n net: enetc: fix race condition in VF MAC address configuration\n net: enetc: fix TOCTOU race and validate VF MAC address\n net: enetc: add ratelimiting to VF mailbox error messages\n net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n net: enetc: fix incorrect mailbox message status returned to VFs\n net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n l2tp: use list_del_rcu in l2tp_session_unhash\n net: bcmgenet: keep RBUF EEE/PM disabled\n ethernet: 3c509: Fix most coding style issues\n ethernet: 3c509: Update documentation to match MAINTAINERS\n ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n ethernet: 3c509: Fix AUI transceiver type selection\n Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n tools: ynl: support listening on all nsids\n net: gro: don\u0027t merge zcopy skbs\n pds_core: ensure null-termination for firmware version strings\n ...\n" }, { "commit": "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "tree": "f5bfe0752de92f43bc01f17f3b9581a90d5a7583", "parents": [ "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fix from Ilya Dryomov:\n \"A fix for an \u0027rbd unmap\u0027 race condition which popped up on a\n production setup where many RBD devices are frequently mapped and\n unmapped, marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client:\n rbd: eliminate a race in lock_dwork draining on unmap\n" }, { "commit": "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "tree": "e91cf187e8c5f748a06c0195b8f97fee74a5a362", "parents": [ "758c807bb943138f887d42d986b645e12446ba9c", "057caace5214da3b457bbd295e1a2ad34d3685ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "message": "Merge tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fixes from Steven Rostedt:\n\n - Fix reporting MISSED EVENTS in trace iterator\n\n When the \"trace\" file is read with tracing enabled, if the writer\n were to pass the iterator reader, it resets, sets a \"missed_events\"\n flag and continues. The tracing output checks for missed events and\n if there are some, it prints out \"[LOST EVENTS]\" to let the user know\n events were dropped.\n\n But the clearing of the missed_events happened when the tracing\n system queried the ring buffer iterator about missed events. This was\n premature as the ring buffer is per CPU, and the tracing code reads\n all the CPU buffers and checks for missed events when it is read. If\n the CPU iterator that had missed events isn\u0027t printed next, the\n output for the LOST EVENTS is lost.\n\n Clear the missed_events flag when the iterator moves to the next\n event and not when the missed_events flag is queried. Also clear it\n on reset.\n\n - Flush and stop the persistent ring buffer on panic\n\n On panic the persistent ring buffer is used to debug what caused the\n panic. But on some architectures, it requires flushing the memory\n from cache, otherwise, the ring buffer persistent memory may not have\n the last events and this could also cause the ring buffer to be\n corrupted on the next boot.\n\n - Fix nr_subbufs initialization in simple_ring_buffer_init_mm\n\n The remote simple ring buffer meta data nr_subbufs is initialized too\n early and gets cleared later on, making it zero and not reflect the\n actual number of sub-buffers.\n\n - Fix unload_page for simple_ring_buffer init rollback\n\n On error, the pages loaded need to be unloaded. To unload a page it\n is expected that: page \u003d load_page(va); -\u003e unload_page(page). But the\n code was doing: unload_page(va) and not unload_page(page).\n\n - Create output file from cmd_check_undefined\n\n The check for undefined symbols checks if the file *.o.checked exists\n and if so it skips doing the work. But the *.o.checked file never was\n created making every build do the work even when it was already done\n previously.\n\n* tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Create output file from cmd_check_undefined\n tracing: Fix unload_page for simple_ring_buffer init rollback\n tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm()\n ring-buffer: Flush and stop persistent ring buffer on panic\n ring-buffer: Fix reporting of missed events in iterator\n" }, { "commit": "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "tree": "9e06fe4d90a39b436cfca417fc6d0f525a839482", "parents": [ "aee43aaf26c7f162780ab77ce952bae6a1b354bd", "9af1b6e175c82daf4b423da339a722d8e67a735a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:00:45 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:01:04 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namdxdna:\n- remove mmap and export for ubuf\n\nbridge:\n- chipone-icn6211: managed bridge cleanup\n- lt66121: acquire reset GPIO\n- megachips: fix clean up on failed IRQ requests\n\ngem:\n- clean up LRU locking\n\nv3d:\n- fix UAF in error code paths\n- release GEM-object ref on free\u0027d jobs\n\nvirtio:\n- use uninterruptible resv locking in plane updates\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260521071456.GA14644@localhost.localdomain\n" }, { "commit": "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1", "tree": "411f9e78571a4a30261672c6264cbc6e27f85775", "parents": [ "ea6ec3343e05f7937a53eb6d7617b3abdb4abc19" ], "author": { "name": "Zhengyu He", "email": "hezhy472013@gmail.com", "time": "Thu May 21 22:44:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 21:56:07 2026 +0100" }, "message": "spi: dt-bindings: fsl-qspi: support SpacemiT K3\n\nAdd the SpacemiT K3 QSPI compatible to the fsl-qspi binding.\n\nK3 and K1 use the same QSPI controller, so document the K3 compatible\nwith \"spacemit,k1-qspi\" as fallback.\n\nSigned-off-by: Cody Kang \u003ccody.kang.hk@outlook.com\u003e\nSigned-off-by: Zhengyu He \u003chezhy472013@gmail.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260521-k3-pico-itx-qspi-v2-for-next-20260521-v2-1-52bce26e5fd8@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "dc278e9bf2b9513a763353e6b9cc21e0f532954e", "tree": "e43d8e1f3ddbca290546c7759432cb9a6eee3468", "parents": [ "94449463d2ab125067adccc2b0c2d7cd753edfb4" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 21 12:02:53 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 13:04:11 2026 -0600" }, "message": "blk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.\n\nFixes: b0077e269f6c1 (\"blk-mq: make sure active queue usage is held for bio_integrity_prep()\")\nFixes: 7b4f36cd22a65 (\"block: ensure we hold a queue reference when using queue limits\")\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\nLink: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660", "tree": "ed94992134f52d1f99c7b002ca34f1414f779e7c", "parents": [ "45cf24da0a10203890fae4bd10ca5dbfca430324" ], "author": { "name": "Jeongjun Park", "email": "aha310510@gmail.com", "time": "Thu May 21 20:37:12 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:28:24 2026 +0100" }, "message": "ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n\nIn the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as\na general mixer kcontrol instead of a DAPM kcontrol, so struct\nsnd_soc_dapm_context must not be accessed via\nsnd_soc_dapm_kcontrol_to_dapm().\n\nThis causes a NULL pointer dereference, so it must be modified to use\nsnd_soc_component_to_dapm().\n\nCc: stable@kernel.org\nCloses: https://github.com/raspberrypi/linux/issues/7242\nFixes: 02dbbb7e982a (\"ASoC: codecs: pcm512x: convert to snd_soc_dapm_xxx()\")\nSigned-off-by: Jeongjun Park \u003caha310510@gmail.com\u003e\nLink: https://patch.msgid.link/20260521113712.227438-1-aha310510@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "45cf24da0a10203890fae4bd10ca5dbfca430324", "tree": "2a7ed82c1010f7baea62acad07bddf667ebce0a1", "parents": [ "e0fb794d67f86726817756bcc25c628f4894df29" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.cirrus.com", "time": "Wed May 20 17:36:30 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:18:01 2026 +0100" }, "message": "ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n\nFor PTL onwards Cirrus are intending to rely on function topologies,\nrather than using a match table for each system type. Remove this\nunnecessary match table entry. Having the match entries can\nmean that systems match when they should use function topologies\ninstead, resulting in incorrect audio configurations. Although,\nadmittedly this is not too likely with this 6x amp configuration\nas those are quite rare, but best to follow best practice.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260520163631.3300102-3-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "e0fb794d67f86726817756bcc25c628f4894df29", "tree": "f4823ab8dba81af5d2fae5633fba98d13dd15b55", "parents": [ "2b8305f24a61b290f3258a3368be548f17451533" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.cirrus.com", "time": "Wed May 20 17:36:29 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:18:00 2026 +0100" }, "message": "ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional\n\nFor PTL onwards Cirrus are intending to rely on function\ntopologies, rather than using a match table for each system\ntype. Chrome systems tend to have custom magic in the topology\nand thus need to load a specific file. This causes problems as\nthese system can have the same layout as generic laptops causing\nthe match to apply to other laptops. Add a DMI quirk that forces\nthese matches to only apply to specific devices.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260520163631.3300102-2-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "2b8305f24a61b290f3258a3368be548f17451533", "tree": "bf0606ac3c70611d02f098f07bbad05b47a37da9", "parents": [ "fd9b9204f30e0463e1abec222aeec33b98571b71" ], "author": { "name": "Balamurugan C", "email": "balamurugan.c@intel.com", "time": "Wed May 20 14:11:43 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:13:25 2026 +0100" }, "message": "ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.\n\nAdding ES83x6 I2S codec support for NVL platforms and entry in match table.\n\nSigned-off-by: Balamurugan C \u003cbalamurugan.c@intel.com\u003e\nReviewed-by: Liam Girdwood \u003cliam.r.girdwood@intel.com\u003e\nSigned-off-by: Bard Liao \u003cyung-chuan.liao@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260520061143.2024963-1-yung-chuan.liao@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "fd9b9204f30e0463e1abec222aeec33b98571b71", "tree": "adb18df13fea118c0080b820e45799222270b8fd", "parents": [ "1129c0011b90f0d0453dadac4d1e81824aac07ff" ], "author": { "name": "Jairaj Arava", "email": "jairaj.arava@intel.com", "time": "Wed May 20 14:08:13 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:12:11 2026 +0100" }, "message": "ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform\n\nAdd an entry in the soundwire quirk table for novalake boards to support\nNVL RVP\n\nSigned-off-by: Jairaj Arava \u003cjairaj.arava@intel.com\u003e\nReviewed-by: Péter Ujfalusi \u003cpeter.ujfalusi@linux.intel.com\u003e\nReviewed-by: Ranjani Sridharan \u003cranjani.sridharan@linux.intel.com\u003e\nSigned-off-by: Bard Liao \u003cyung-chuan.liao@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260520060814.2024852-1-yung-chuan.liao@linux.intel.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1", "tree": "e4de5b98b10601922652fc18b89c083c6ecd6860", "parents": [ "c33f944a33d63c65f3506eee6f2ca3771b68454f", "dc14686f27df6454b13b16ad1c9203ab3e9b0375" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 11:03:58 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nQuite a few more updates:\n - cfg80211/mac80211:\n - various security(-ish) fixes\n - fix A-MSDU subframe handling\n - fix multi-link element parsing\n - ath10: avoid sending commands to dead device\n - ath11k:\n - fix WMI buffer leaks on error conditions\n - fix UAF in RX MSDU coalesce path\n - allow peer ID 0 on RX path (legal for mobile devices)\n - reinitialize shared SRNG pointers on restart\n - ath12k:\n - fix 20 MHz-only parsing of EHT-MCS map\n - iwlwifi:\n - fix TSO segmentation explosion\n - don\u0027t TX to dead device\n - fix warning in WoWLAN\n - fix TX rates on old devices\n - disconnect on beacon loss only if also no other traffic\n - fill NULL-ptr deref\n - fix STEP_URM hardware access\n\n* tag \u0027wireless-2026-05-21\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (24 commits)\n wifi: cfg80211: wext: validate chandef in monitor mode\n wifi: mac80211: consume only present negotiated TTLM maps\n wifi: wilc1000: fix dma_buffer leak on bus acquire failure\n wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n wifi: mac80211: fix multi-link element inheritance\n wifi: mac80211: fix MLE defragmentation\n wifi: mac80211: don\u0027t override max_amsdu_subframes\n wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs\n wifi: ath12k: fix EHT TX MCS limitation due to wrong 20 MHz-only parsing\n wifi: ath11k: clear shared SRNG pointer state on restart\n wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()\n wifi: ath11k: fix peer resolution on rx path when peer_id\u003d0\n wifi: iwlwifi: mld: disconnect only after 6 beacons without Rx\n wifi: iwlwifi: mld: don\u0027t WARN on WoWLAN suspend w/o BSS vif\n wifi: iwlwifi: use correct function to read STEP_URM register\n wifi: iwlwifi: mvm: fix driver-set TX rates on old devices\n wifi: iwlwifi: mld: don\u0027t dereference a pointer before NULL checking it\n wifi: iwlwifi: mld: stop TX during firmware restart\n wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n wifi: ath10k: skip WMI and beacon transmission when device is wedged\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260521152903.374070-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e97ff8b62d4690c69297f0f6de874f0564cc01a4", "tree": "fc46f173746f9d2127ffe63ef7e4f275af6ebf9d", "parents": [ "3d879647fb03dab6fe6e1dd9404a2dd324096218" ], "author": { "name": "Alexander A. Klimov", "email": "grandmaster@al2klimov.de", "time": "Wed May 20 20:00:44 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 11:10:56 2026 -0600" }, "message": "io_uring/nop: pass all errors to userspace\n\nThis fixes an inconsistency where io_nop() called req_set_fail()\nbased on ret, but passed just nop-\u003eresult to userspace.\nOriginally, ret is a even copy of nop-\u003eresult, but is set to an error\nwhen such happens subsequently. Now that\u0027s also passed to userspace.\n\nFixes: a85f31052bce (\"io_uring/nop: add support for testing registered files and buffers\")\nSigned-off-by: Alexander A. Klimov \u003cgrandmaster@al2klimov.de\u003e\nLink: https://patch.msgid.link/20260520180045.538533-1-grandmaster@al2klimov.de\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "0c1a9dce208b4dc265925898e5da98934f7f9266", "tree": "665a1e64dd268f46959c4225e78f374ef78d2e73", "parents": [ "515e3996a4c26e7f955c13b3b19522a2c8642af9" ], "author": { "name": "Samuele Mariotti", "email": "smariotti@disroot.org", "time": "Thu May 21 12:59:11 2026 +0200" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu May 21 06:27:44 2026 -1000" }, "message": "sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()\n\nops_dequeue() can race with finish_dispatch() and spuriously trigger the\n\"queued task must be in BPF scheduler\u0027s custody\" warning.\n\nops_dequeue() snapshots p-\u003escx.ops_state via atomic_long_read_acquire()\nand then, in the SCX_OPSS_QUEUED arm, asserts that SCX_TASK_IN_CUSTODY\nis set. The two reads are not atomic w.r.t. a concurrent\nfinish_dispatch() running on another CPU:\n\nCPU 1 CPU 2\n\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\n dequeue_task_scx()\n ops_dequeue()\n opss \u003d read_acquire(ops_state)\n \u003d SCX_OPSS_QUEUED\nfinish_dispatch()\n cmpxchg ops_state:\n SCX_OPSS_QUEUED -\u003e SCX_OPSS_DISPATCHING [succeeds]\n dispatch_enqueue(SCX_DSQ_GLOBAL,\n SCX_ENQ_CLEAR_OPSS)\n call_task_dequeue()\n p-\u003escx.flags \u0026\u003d ~SCX_TASK_IN_CUSTODY\n WARN_ON_ONCE(!(p-\u003escx.flags \u0026\n SCX_TASK_IN_CUSTODY))\n /* opss is stale: QUEUED,\n * but task already claimed */\n set_release(ops_state, SCX_OPSS_NONE)\n\nThe race has been observed via two distinct call chains: the most common\ngoes through sched_setaffinity(), a rarer variant through\nsched_change_begin().\n\nFor SCX_DSQ_GLOBAL / SCX_DSQ_BYPASS, dispatch_enqueue() clears\nSCX_TASK_IN_CUSTODY before clearing ops_state to SCX_OPSS_NONE\n(intentional, to avoid concurrent non-atomic RMW of p-\u003escx.flags against\nops_dequeue()). The window between those two writes is exactly what\nops_dequeue() observes as \"QUEUED without custody\".\n\nThe observed state is not actually inconsistent, it just means CPU 1 has\nalready claimed the task and the QUEUED value held by CPU 2 is stale.\nRe-read ops_state in that case; the next read is guaranteed to return\nSCX_OPSS_DISPATCHING or SCX_OPSS_NONE, both of which exit the switch\ncleanly. The retry is bounded: once IN_CUSTODY is cleared, ops_state has\nalready advanced past QUEUED for this dispatch cycle, and a fresh QUEUED\nwould require re-enqueue under p\u0027s rq lock, which CPU 2 holds.\n\nChanges in v2:\n- Use READ_ONCE() for p-\u003escx.flags to ensure fresh reads and prevent\n compiler reordering in the lockless path\n- Add cpu_relax() to reduce power consumption and improve performance\n during the spin-wait\n- Use unlikely() to optimize branch prediction for the common case\n- Expand the in-code comment to document the race condition and\n bounded retry guarantee\n\nFixes: ebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\")\nSuggested-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Samuele Mariotti \u003csmariotti@disroot.org\u003e\nSigned-off-by: Paolo Valente \u003cpaolo.valente@unimore.it\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e", "tree": "dcb93846e6f507044784ad347651a83a9e47883e", "parents": [ "d1ebfce2c1d161186a82e77590bf7da2ea1bce91" ], "author": { "name": "Fredric Cover", "email": "fredric.cover.lkernel@gmail.com", "time": "Wed May 13 13:19:15 2026 -0700" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 11:16:09 2026 -0500" }, "message": "smb: client: change allocation requirements in DUP_CTX_STR macro\n\nCurrently, the macro DUP_CTX_STR allocates new_ctx-\u003efield using\nGFP_ATOMIC. DUP_CTX_STR is only used in smb3_fs_context_dup(), which\nis never called in an atomic context. Using GFP_ATOMIC puts unnecessary\npressure on emergency memory pools.\n\nChange GFP_ATOMIC to GFP_KERNEL.\n\nSigned-off-by: Fredric Cover \u003cfredric.cover.lkernel@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "tree": "88ead13c19d29b03988f296b511884c23e176511", "parents": [ "fbc15231181669b51c0103fd74c9c2ac2756ab56" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Sun May 17 20:11:50 2026 -0400" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 11:15:17 2026 -0500" }, "message": "smb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations.\n\nFixes: fed979a7e082 (\"cifs: Set witness notification handler for messages from userspace daemon\")\nCc: stable@vger.kernel.org\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "758c807bb943138f887d42d986b645e12446ba9c", "tree": "8df52c99c7bd9ba3f388bb3c756481ce8bb7abab", "parents": [ "dd3802fc4f6b52201a93330d44981a66bd6ef883", "d8809f6931065cbbf3554647a50a65a471ab5983" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:59:52 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fixes from Ard Biesheuvel:\n\n - Permit ACPI PRM runtime firmware calls when acpi_init() runs\n\n - Add another Lenovo Ideapad framebuffer quirk\n\n - Cosmetic tweak\n\n* tag \u0027efi-fixes-for-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n efi: sysfb_efi: Extend quirk to cover IdeaPad Duet 3 10IGL5-LTE\n efi: efi.h: Remove extra semicolon\n efi: Allocate runtime workqueue before ACPI init\n" }, { "commit": "c33f944a33d63c65f3506eee6f2ca3771b68454f", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "bdd39576bf50a50bdafe3da968fd271bc674a48f", "9e68817f12d5935dbf73f2fe6e6299644f6de1b6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:02 2026 -0700" }, "message": "Merge branch \u0027net-enetc-sr-iov-robustness-and-security-fixes\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: SR-IOV robustness and security fixes\n\nThis patch series addresses a number of robustness, security, and\ncorrectness issues in the ENETC driver\u0027s SR-IOV subsystem, focusing\nprimarily on the VF-to-PF mailbox communication path.\n\nThe series can be grouped into the following categories:\n\n1. DoS and security fixes:\n - Prevent an unbounded loop DoS in the VF-to-PF message handler,\n which could be triggered by a malicious or misbehaving VF.\n - Fix a TOCTOU (Time-of-Check-Time-of-Use) race and add proper\n validation of VF MAC addresses to prevent spoofing or invalid\n configuration from being applied.\n\n2. Race condition fixes:\n - Fix a race condition in VF MAC address configuration that could\n lead to inconsistent state between the VF request and PF\n application.\n - Fix a race condition during SR-IOV teardown that could cause\n VF-\u003ePF mailbox operations to time out, resulting in unnecessary\n errors during shutdown.\n\n3. Memory safety fixes:\n - Fix a DMA write to freed memory in enetc_msg_free_mbx(), which\n could cause silent memory corruption or system instability.\n\n4. Error handling and initialization fixes:\n - Fix missing error code propagation when pf-\u003evf_state allocation\n fails, ensuring callers receive a proper errno instead of\n succeeding silently.\n - Fix incorrect mailbox message status values returned to VFs,\n which could cause VFs to misinterpret PF responses.\n - Fix initialization order to prevent the use of uninitialized\n resources during driver probe, which could cause undefined\n behavior on certain configurations.\n\n5. Diagnostics improvement:\n - Add rate limiting to VF mailbox error messages to prevent log\n flooding in the presence of a misbehaving VF.\n\nThese fixes improve the overall stability and security of the ENETC\nSR-IOV implementation, particularly in multi-tenant environments where\nVFs may be assigned to untrusted guests.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260520064421.91569-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e68817f12d5935dbf73f2fe6e6299644f6de1b6", "tree": "45f75637efc0d2f32ce4835636c7e9f0f1af236a", "parents": [ "54362b0176080b905dbd0651ee3dbb295da41541" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:21 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:49:00 2026 -0700" }, "message": "net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n\nDuring SR-IOV teardown, enetc_msg_psi_free() disables the MR interrupt\nbefore pci_disable_sriov() removes the VFs. If a VF sends a mailbox\nmessage during this window, the PF cannot receive it, causing the VF to\ntimeout waiting for a reply.\n\nSince the timeout occurs during SR-IOV teardown when the VF is about to\nbe removed anyway, it has no functional impact on operation. However,\nmore messages will be added in the future, some visible error logs may\nconfuse users. So fix it by calling pci_disable_sriov() first to remove\nall VFs, then safely clean up the mailbox resources. This eliminates the\nrace window where VFs could send messages to an unresponsive PF.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-10-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "54362b0176080b905dbd0651ee3dbb295da41541", "tree": "c289870991105875375e53fccc4bc2b294cbd8b8", "parents": [ "f8ae63de2a872fa3b68c287c35379f6d73d38a5d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix init and teardown order to prevent use of unsafe resources\n\nSashiko reported a potential issue in enetc_msg_psi_init() where the IRQ\nhandler is registered before DMA resources are fully initialized [1].\n\nThe current initialization sequence is:\n\n 1. request_irq(enetc_msg_psi_msix) \u003c- IRQ handler registered\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- work_struct initialized\n 3. enetc_msg_alloc_mbx() \u003c- mailbox DMA allocated\n\nThis ordering is unsafe because if a spurious interrupt or pending\ninterrupt from a previous device state fires immediately after\nrequest_irq() returns, the registered ISR enetc_msg_psi_msix() will\nexecute and unconditionally call:\n\n schedule_work(\u0026pf-\u003emsg_task)\n\nAt this point, pf-\u003emsg_task has not been initialized by INIT_WORK(), so\nthe work_struct contains garbage values in its internal linked list\npointers (work_struct-\u003eentry). Passing an uninitialized work_struct to\nschedule_work() could corrupt the kernel\u0027s workqueue linked lists,\npotentially leading to:\n\n - Kernel panic in __queue_work()\n - Memory corruption in workqueue data structures\n - System deadlock or undefined behavior\n\nAdditionally, even if the work_struct was initialized, the mailbox DMA\nbuffers (pf-\u003erxmsg[]) may not yet be allocated when the work handler\nenetc_msg_task() runs, resulting in NULL pointer dereference.\n\nFix by reordering the initialization sequence to ensure all resources are\nproperly initialized before the interrupt handler can execute:\n\n 1. enetc_msg_alloc_mbx() \u003c- Allocate all mailboxes\n 2. INIT_WORK(\u0026pf-\u003emsg_task, ...) \u003c- Initialize work first\n 3. request_irq(enetc_msg_psi_msix) \u003c- Register IRQ last\n 4. Configure hardware \u0026 enable MR interrupts\n\nThis guarantees that when enetc_msg_psi_msix() runs:\n - pf-\u003emsg_task is properly initialized (safe for schedule_work)\n - pf-\u003erxmsg[] buffers are allocated (safe for work handler access)\n - Hardware is configured appropriately\n\nAs the inverse of enetc_msg_psi_init(), enetc_msg_psi_free() also has\nsimilar problems. For example, if a pending interrupt fires between\nenetc_msg_free_mbx() and free_irq(), the ISR enetc_msg_psi_msix() may\nschedule the work handler again via schedule_work(), which could then\naccess already-freed DMA buffers (pf-\u003erxmsg[]), leading to use-after-free\nand potential memory corruption.\n\nTherefore, the order of enetc_msg_psi_free() is adjusted:\n 1. enetc_msg_disable_mr_int() \u003c- Stop new interrupts first\n 2. free_irq() \u003c- Ensure no IRQ handler can run\n 3. cancel_work_sync() \u003c- Wait for any pending work\n 4. enetc_msg_disable_mr_int() \u003c- Re-disable in case work\n\t\t\t\t\t re-enabled it\n 5. enetc_msg_free_mbx() \u003c- Safe to free DMA buffers now\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-9-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8ae63de2a872fa3b68c287c35379f6d73d38a5d", "tree": "3ebc1539b28452d3078eaff84d81e65453b02c76", "parents": [ "adb4599979cd00d5d426f26cf78b65264217e35b" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:19 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n\nThe enetc_msg_task() function has several issues that need to be addressed:\n\n1. Unbounded loop causing potential DoS:\n\nenetc_msg_task() processes VF-to-PF mailbox messages in an unbounded\nfor(;;) loop that keeps polling ENETC_PSIMSGRR until no MR bits are set.\nA malicious guest VM can exploit this by continuously sending messages at\na high rate - immediately sending a new message as soon as the PF\nacknowledges the previous one. Since the worker thread never yields or\nenforces a processing budget, the mr_mask check frequently evaluates to\nnon-zero, causing the PF to spin indefinitely and starving other tasks.\n\nFix this by replacing the unbounded loop with a single snapshot read at\ntask entry. The task processes only the VFs whose MR bits were set at\nthat point, then re-enables message interrupts before returning. This\nbounds work per invocation to at most num_vfs iterations. No messages are\nlost because the message interrupt is disabled in enetc_msg_psi_msix()\nbefore scheduling enetc_msg_task(), so any new messages arriving during\nprocessing will trigger a fresh interrupt once re-enabled, scheduling\nanother task invocation.\n\n2. Write order of ENETC_PSIIDR and ENETC_PSIMSGRR:\n\nBoth ENETC_PSIIDR and ENETC_PSIMSGRR contain MR bits indicating messages\nhave been received from VSIs, but only ENETC_PSIIDR trigger the CPU\ninterrupt. Previously, ENETC_PSIMSGRR was written before ENETC_PSIIDR.\nWriting ENETC_PSIMSGRR returns the message code to the VSI in its upper\n16 bits, signaling to the VF that message processing is complete and it\nmay send the next message. If the VF sends a new message before\nENETC_PSIIDR is written, the subsequent w1c write to ENETC_PSIIDR would\ninadvertently clear the MR bit set by the new message, causing the\ninterrupt to be lost and the new message to go unprocessed.\n\nTherefore, write ENETC_PSIIDR first to clear the interrupt source, then\nwrite ENETC_PSIMSGRR to acknowledge the message to the VSI.\n\n3. Check both ENETC_PSIMSGRR and ENETC_PSIIDR for mr_status:\n\nThe write order change above introduces a potential race: if a VF sends\na new message in the window between the ENETC_PSIIDR w1c and the\nENETC_PSIMSGRR w1c, the ENETC_PSIMSGRR MR bit for the new message may\nnot be set. If mr_status was derived solely from ENETC_PSIMSGRR, this\nmessage would never be detected despite ENETC_PSIIDR retaining its MR\nbit, leading to an unacknowledged interrupt storm.\n\nFix this by computing mr_status as the union of both ENETC_PSIMSGRR and\nENETC_PSIIDR MR bits, ensuring all pending messages are detected\nregardless of which register reflects the new message state.\n\nAdditionally, rename the per-register MR macros (ENETC_PSI*_MR_MASK,\nENETC_PSI*_MR) to register-agnostic names (ENETC_PSIMR_MASK,\nENETC_PSIMR_BIT) since the MR bit layout is shared across ENETC_PSIMSGRR,\nENETC_PSIIER, and ENETC_PSIIDR. Make the mask macro dynamic based on\nthe actual number of active VFs rather than hardcoded.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-8-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "adb4599979cd00d5d426f26cf78b65264217e35b", "tree": "b9abb7c1efafb17867c267b8acf8371c51d43f9c", "parents": [ "f262f5d893327a7131ed25ac8dd01ed7024bcc18" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:18 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n\nThe teardown sequence in enetc_msg_psi_free() frees the DMA buffer before\nclearing the device\u0027s DMA address registers. If a VF sends a message or a\npending DMA transfer completes within this window, the hardware will\nperform a DMA write into the kernel memory that has already been returned\nto the allocator.\n\nThe result is silent memory corruption that can affect arbitrary kernel\ndata structures. Therefore, clear the DMA address registers before the\nDMA buffer is freed.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-7-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f262f5d893327a7131ed25ac8dd01ed7024bcc18", "tree": "3670d5a0b5a914d5cc7913b6c052afe925a6aedf", "parents": [ "c666fa632fe628c34904bcd59aeb96bf08e40d31" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:17 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix race condition in VF MAC address configuration\n\nSashiko reported a potential race condition between the VF message\nhandler and administrative VF MAC configuration from the host [1].\n\nThe VF message handler (enetc_msg_pf_set_vf_primary_mac_addr) runs\nasynchronously in a workqueue context and accesses vf_state-\u003eflags\nwithout any locking. Concurrently, the host can administratively\nchange the VF MAC address via enetc_pf_set_vf_mac(), which executes\nunder RTNL lock and modifies both vf_state-\u003eflags and hardware\nregisters.\n\nThis creates two race windows:\n\n1) TOCTOU race on vf_state-\u003eflags: The check of ENETC_VF_FLAG_PF_SET_MAC\n and subsequent MAC programming are not atomic, allowing the flag state\n to change between check and use.\n\n2) Torn MAC address writes: Hardware MAC programming requires multiple\n non-atomic register writes (__raw_writel for lower 32 bits and\n __raw_writew for upper 16 bits). Concurrent updates from VF mailbox\n and PF admin paths can interleave these operations, resulting in a\n corrupted MAC address being programmed into the hardware.\n\nFix by introducing a per-VF mutex to serialize access to vf_state and\nhardware MAC register updates. Both enetc_pf_set_vf_mac() and\nenetc_msg_pf_set_vf_primary_mac_addr() now acquire this lock before\naccessing vf_state-\u003eflags or programming the MAC address, ensuring\natomic read-modify-write sequences and preventing register write\ninterleaving.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-6-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c666fa632fe628c34904bcd59aeb96bf08e40d31", "tree": "2e5e09b8f63d5b711fcf38d07ea13a6975f7b0b0", "parents": [ "4a995d37b537f437daa01752d39cf44c6ba9ee2c" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:16 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: fix TOCTOU race and validate VF MAC address\n\nSashiko reported that the PF driver accepts arbitrary MAC address from\nfrom VF mailbox messages without proper validation, creating a security\nvulnerability [1].\n\nIn enetc_msg_pf_set_vf_primary_mac_addr(), the MAC address is extracted\ndirectly from the message buffer (cmd-\u003emac.sa_data) and programmed into\nhardware via pf-\u003eops-\u003eset_si_primary_mac() without any validity checks.\nA malicious VF can configure a multicast, broadcast, or all-zero MAC\naddress. Therefore, a validation to check the MAC address provided by VF\nis required.\n\nHowever, simply checking the MAC address is not enough, because it also\nhas the potential TOCTOU race [2]: The code reads the MAC address from\nthe DMA buffer to validate it via is_valid_ether_addr(), if validation\npasses, reads the same DMA buffer a second time when calling\nenetc_pf_set_primary_mac_addr() to program the hardware. A malicious VF\ncan exploit this window by overwriting the MAC address in the DMA buffer\nbetween the validation check and the hardware programming, bypassing the\nvalidation entirely.\n\nTherefore, allocate a local buffer in enetc_msg_handle_rxmsg() and copy\nthe message content from the DMA buffer via memcpy() before processing.\nThis ensures the PF operates on a stable snapshot that the VF cannot\nmodify.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nLink: https://sashiko.dev/#/patchset/20260513103021.2190593-1-wei.fang%40nxp.com #2\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-5-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a995d37b537f437daa01752d39cf44c6ba9ee2c", "tree": "9fbd57e8c9e11512cb2626ce150fd4895e6b455d", "parents": [ "5027266dea471e140f93dd534845c9c4f43219a3" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:59 2026 -0700" }, "message": "net: enetc: add ratelimiting to VF mailbox error messages\n\nSashiko reported that a buggy or malicious guest VM can flood the host\nkernel log by repeatedly sending VF-to-PF messages at a high rate,\ndegrading host performance and hiding important system logs [1].\n\nFix by replacing dev_err()/dev_warn() with dev_err_ratelimited(),\nlimiting output to the default kernel ratelimit. This ensures errors are\nstill logged for debugging while preventing log flooding attacks.\n\nLink: https://sashiko.dev/#/patchset/20260511080805.2052495-1-wei.fang%40nxp.com #1\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-4-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5027266dea471e140f93dd534845c9c4f43219a3", "tree": "1b9263e38aea052ce3720af1795551f006ba487a", "parents": [ "8c84c5ec4aaff6ad7aac49935e050fed6b360a28" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:58 2026 -0700" }, "message": "net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n\nIn enetc_pf_probe(), when the memory allocation for pf-\u003evf_state fails,\nthe code jumps to the error handling label but the variable \u0027err\u0027 is not\nassigned an appropriate error code beforehand. This causes the function\nto return 0 (success) on an allocation failure path, misleading the\ncaller into thinking the probe succeeded. So set err to -ENOMEM before\njumping to the error handling label when the allocation for pf-\u003evf_state\nreturns NULL.\n\nFixes: e15c5506dd39 (\"net: enetc: allocate vf_state during PF probes\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-3-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8c84c5ec4aaff6ad7aac49935e050fed6b360a28", "tree": "32f98ff89d7176302a3f2a8c088e4276c011e430", "parents": [ "bdd39576bf50a50bdafe3da968fd271bc674a48f" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed May 20 14:44:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:48:58 2026 -0700" }, "message": "net: enetc: fix incorrect mailbox message status returned to VFs\n\nThere are two cases where VFs receive an incorrect success status from\nthe PF mailbox message handler, misleading them into believing their\nrequests have been fulfilled:\n\nIn enetc_msg_handle_rxmsg(), *status is pre-initialized to\nENETC_MSG_CMD_STATUS_OK. When an unsupported command type is received,\nthe default case only logs an error without updating *status, so it\nremains as ENETC_MSG_CMD_STATUS_OK.\n\nIn enetc_msg_pf_set_vf_primary_mac_addr(), when the PF has already\nassigned a MAC address for the VF (ENETC_VF_FLAG_PF_SET_MAC is set),\nthe function rejects the request but returns ENETC_MSG_CMD_STATUS_OK\ninstead of ENETC_MSG_CMD_STATUS_FAIL.\n\nTherefore, correct the status value for the two cases mentioned above.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260520064421.91569-2-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdd39576bf50a50bdafe3da968fd271bc674a48f", "tree": "954a8af35f5ba12cd463ea3e46f9e7942050930d", "parents": [ "979c017803c40829b03acd9e5236e354b7622360" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed May 20 11:42:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:47:36 2026 -0700" }, "message": "net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n\nAfter commit ff205bf8c554 (\"netlink: add one debug check in nla_nest_end()\")\nsyzbot found that br_fill_linkxstats() can send corrupted netlink packets.\n\nMake sure the nested attribute size is bounded.\n\nFixes: a60c090361ea (\"bridge: netlink: export per-vlan stats\")\nReported-by: syzbot+a35f9259d08f907c06e6@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6a0b0da3.050a0220.175f0c.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260520114207.1394241-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "979c017803c40829b03acd9e5236e354b7622360", "tree": "c7ee203983f82a11b494c012c2b06f22369e911e", "parents": [ "9a1730245e416d11ad5c0f2c100061d61cc43f60" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Mon May 18 14:34:47 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:47:20 2026 -0700" }, "message": "l2tp: use list_del_rcu in l2tp_session_unhash\n\nAn unprivileged local user can pin a host CPU indefinitely in\nl2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on\nL2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and\nL2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take\nGENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace\nsuffices; on any host that has l2tp_core loaded the trigger is\nreachable from a standard `unshare -Urn` sandbox.\n\nl2tp_session_unhash() removes a session from tunnel-\u003esession_list\nwith list_del_init(), but that list is walked by\nl2tp_session_get_by_ifname() with list_for_each_entry_rcu() under\nrcu_read_lock_bh(). list_del_init() leaves the deleted entry\u0027s\nnext/prev self-pointing; a reader that has loaded the entry and\nthen advances pos-\u003elist.next reads \u0026session-\u003elist, container_of()s\nback to the same session, and list_for_each_entry_rcu() never\nreaches the list head. The CPU stays in strcmp() inside the\nwalker, with BH and preemption disabled, so RCU grace periods on\nthe host stall behind it and the wedged thread cannot be killed\n(SIGKILL is delivered on syscall return).\n\nUse list_del_rcu() to match the existing list_add_rcu() in\nl2tp_session_register(); the deleted session remains visible to\nin-flight walkers with consistent next/prev pointers until\nkfree_rcu() in l2tp_session_free() releases it. tunnel-\u003esession_list\nhas exactly one list_del_init() call site; the list_del_init\n(\u0026session-\u003eclist) at l2tp_core.c:533 operates on the per-collision\nlist, which is not walked under RCU. list_empty(\u0026session-\u003elist) is\nnot used anywhere in net/l2tp/ after the unhash point, so dropping\nthe post-delete self-init is safe; the fix has no userspace-visible\nbehavior change.\n\nFixes: 89b768ec2dfef (\"l2tp: use rcu list add/del when updating lists\")\nCc: stable@vger.kernel.org # 6.11+\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nLink: https://patch.msgid.link/20260518183447.64078-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dd3802fc4f6b52201a93330d44981a66bd6ef883", "tree": "a254ca775ca8f6b82527a911817aeb8c04ebea24", "parents": [ "8bc67e4db64aa72732c474b44ea8622062c903f0", "1fcf4149418e7a8f8253dd74059d56340795503f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:43:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 08:43:26 2026 -0700" }, "message": "Merge tag \u0027soc-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n\n - The ff-a firmware driver gets 11 individual bugfixes for a number of\n issues with robustness to buggy firmware or client implementations.\n Another firmware fix address suspend to RAM via PSCI firmware.\n\n - The final code change is for the old Arm Integrator reference\n platform that recently started exposing an old NULL pointer\n dereference bug.\n\n - The MAINTAINERS file gets two updates, notably James Tai and Yu-Chun\n Lin are stepping up as co-maintainers for the Realtek platform.\n\n - The remaining patches are all for devicetree files. Two of these are\n for riscv boards, the rest are all for enesas Arm platforms,\n addressing build time checking issues as well as minor configuration\n problems.\n\n* tag \u0027soc-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits)\n firmware: psci: Set pm_set_resume/suspend_via_firmware() for SYSTEM_SUSPEND\n ARM: realtek: MAINTAINERS: Include pin controller drivers\n MAINTAINERS: Add maintainers for ARM/REALTEK ARCHITECTURE\n ARM: integrator: Fix early initialization\n firmware: arm_ffa: Fix sched-recv callback partition lookup\n firmware: arm_ffa: Snapshot notifier callbacks under lock\n firmware: arm_ffa: Align RxTx buffer size before mapping\n firmware: arm_ffa: Validate framework notification message layout\n firmware: arm_ffa: Keep framework RX release under lock\n firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies\n firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0\n firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue\n firmware: arm_ffa: Avoid collapsing NPI work from different CPUs\n firmware: arm_ffa: Skip free_pages on RX buffer alloc failure\n firmware: arm_ffa: Check for NULL FF-A ID table while driver registration\n riscv: dts: microchip: fix icicle i2c pinctrl configuration\n riscv: dts: starfive: jh7110: Drop CAMSS node\n arm64: dts: renesas: r9a09g056: Add #mux-state-cells to usb20phyrst\n arm64: dts: renesas: r9a09g057: Add #mux-state-cells to usb2{0,1}phyrst\n ARM: dts: renesas: rskrza1: Drop superfluous cells\n ...\n" }, { "commit": "9a1730245e416d11ad5c0f2c100061d61cc43f60", "tree": "8c14e30a02749c83d24d6bfec87c3d6b15716f34", "parents": [ "c5fcca7f662f0c0918eac60ea193bf65a36863e3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Wed May 20 20:43:20 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:37:56 2026 -0700" }, "message": "net: bcmgenet: keep RBUF EEE/PM disabled\n\nSetting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX\npath on GENET hardware once MAC EEE becomes active. RX traffic stops\nflowing while the link stays up and the usual descriptor/RX error\ncounters remain quiet. In that state the MAC still accepts frames\n(rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to\nDMA, so rx_packets is no longer incremented at the netdev level. On\nsome boards the corruption ends up as a paging fault in\nskb_release_data via bcmgenet_rx_poll on an LPI exit.\n\nReproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian\nFainelli on an internal Broadcom 4908-family board with the same crash\nsignature. RBUF_PM_EN is not publicly documented.\n\nThis shows up more often now that phy_support_eee() enables EEE by\ndefault, but it also affects older kernels as soon as TX LPI is\nturned on via ethtool, so it is not specific to recent changes.\n\nAlways clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so\nthe bits stay off across resets. UMAC and TBUF setup is left alone so\nTX-side EEE keeps working.\n\nLink: https://github.com/raspberrypi/linux/issues/7304\nFixes: 6ef398ea60d9 (\"net: bcmgenet: add EEE support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260520184320.652053-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03", "tree": "002281ed1fbbe60ce7e1e5cacc0ef2d0b3b1dc61", "parents": [ "576ec047d20b368b43c4d5db98c4f2e0f3c101ec" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu May 21 13:49:14 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu May 21 11:29:03 2026 -0400" }, "message": "tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails\n\nIn paths where tracing_map_elt_alloc() failed to allocate objects,\nthe map-\u003eops-\u003eelt_alloc() call was never successful. In this case,\nmap-\u003eops-\u003eelt_free() should not be called.\n\nLink: https://sashiko.dev/#/patchset/20260520223101.34710-1-rosenp%40gmail.com\n\nCc: stable@vger.kernel.org\nCc: Tom Zanussi \u003ctom.zanussi@linux.intel.com\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Rosen Penev \u003crosenp@gmail.com\u003e\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nFixes: 2734b629525a (\"tracing: Add per-element variable support to tracing_map\")\nLink: https://patch.msgid.link/177933895460.108746.5396070821443932634.stgit@devnote2\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c5fcca7f662f0c0918eac60ea193bf65a36863e3", "tree": "8ff09d71f5f859948adea9940ed72b8164bb27e5", "parents": [ "3287e81292f49dca2f253113c458e8f3d4ea091b", "014767c709a44b4e0a0bf70ee9101fb73f4e288b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:59 2026 -0700" }, "message": "Merge branch \u0027ethernet-3c509-bring-driver-back-and-make-some-fixes\u0027\n\nMaciej W. Rozycki says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nethernet: 3c509: Bring driver back and make some fixes\n\n As per the previous discussions[1][2] this patch series brings the 3c509\ndriver back. Picking up net rather than net-next as I consider it a fix\nto accidental removal and so that any downstream users do not suffer from\ndisruption when using released kernels.\n\n In the course of making the coding style changes requested I have come\nacross an actual bug in transceiver type selection code, where the old\nsetting is not masked out before ORing in the new one, causing no change\nto be actually made in a requested transition from BNC to AUI. I guess\nthis code must have been executed exceedingly rarely, as it\u0027s always been\nwrong ever since it was added in 2.5.42 back in 2002.\n\n Therefore I find it not worth backporting to stable branches, however for\nthe sake of appropriateness, in case someone downstream does want to have\nthe fix, I chose to apply it second in the series, right after the actual\nrevert and before code clean-ups.\n\n The remaining patches of the series should be obvious; see the respective\ncommit descriptions for details.\n\n[1] \"drivers: net: 3com: 3c509: Remove this driver\",\n \u003chttps://lore.kernel.org/r/alpine.DEB.2.21.2604240004280.28583@angie.orcam.me.uk/\u003e.\n\n[2] \"MAINTAINERS: Add self for the 3c509 network driver\",\n \u003chttps://lore.kernel.org/r/alpine.DEB.2.21.2604271056460.28583@angie.orcam.me.uk/\u003e.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201115010.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "014767c709a44b4e0a0bf70ee9101fb73f4e288b", "tree": "8ff09d71f5f859948adea9940ed72b8164bb27e5", "parents": [ "75756cb4b2aa148816b32d7d40c1f79f9a11eef6" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:19:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Fix most coding style issues\n\nUpdate the driver for our current coding style according to output from\n`checkpatch.pl\u0027 and manual code review, where no change to binary code\nresults, as indicated by `objdump -dr\u0027. Exceptions are as follows:\n\n- incomplete reverse xmas tree in set_multicast_list(), as that would\n change binary output,\n\n- referring el3_start_xmit() verbatim rather than via `__func__\u0027 with\n pr_debug(), likewise,\n\n- a bunch of pr_cont() calls, likewise,\n\n- a long udelay() call in el3_netdev_set_ecmd() made under a spinlock,\n likewise plus it\u0027s not eligible for conversion to a sleep in the first\n place,\n\n- a blank line at the start of a block in el3_interrupt(), to improve\n readability where the first statement would otherwise visually merge\n with the controlling expression of the enclosing `while\u0027 statement.\n\nThese issues are benign and depending on circumstances may be adressed\nwith suitable code refactoring later on.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201208280.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75756cb4b2aa148816b32d7d40c1f79f9a11eef6", "tree": "9295d805d0468dfdc8a591e0a79b026b1a668d3e", "parents": [ "240117bb51b95ce93ec28c7c9439c9a87d7b120c" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:19:02 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Update documentation to match MAINTAINERS\n\nThere has been apparently a single message only ever publicly posted by\nDavid Ruggiero, back in 2002, which added this documentation piece among\nothers, and MAINTAINERS was never updated accordingly. It is therefore\ndoubtful that his maintainer status has actually come into effect. Just\nreplace the reference then so as not to confuse people.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201207380.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "240117bb51b95ce93ec28c7c9439c9a87d7b120c", "tree": "3dd91be335236c0904405e5de545940e5114a84f", "parents": [ "029a6b3a14bf02e6f59ce6ecd10f9d003334c612" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:57 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n\nThis driver has landed with Linux 0.99.13k, which was covered by the GNU\nGeneral Public License version 2, and no further conditions as to\nlicensing terms have been specified within the copyright notice included\nwith the driver itself.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201206370.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "029a6b3a14bf02e6f59ce6ecd10f9d003334c612", "tree": "7961a9b5526e4dfa5938dcc88accdf4c4d376cb6", "parents": [ "28db0338db61ec75d146192463907351907a0dbc" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:53 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "ethernet: 3c509: Fix AUI transceiver type selection\n\nThe transceiver type is held in bits 15:14 of the Address Configuration\nRegister, with the values of 0b00, 0b01, and 0b11 denoting TP, AUI, and\nBNC types respectively. Therefore switching from BNC to AUI requires\nbits to be cleared before setting bit 14 or the setting won\u0027t change.\n\nNB this has always been wrong ever since this code was added in 2.5.42.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201205160.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "28db0338db61ec75d146192463907351907a0dbc", "tree": "b93cf19fc339b2f397e4a637a4e86fef7e0a77e0", "parents": [ "3287e81292f49dca2f253113c458e8f3d4ea091b" ], "author": { "name": "Maciej W. Rozycki", "email": "macro@orcam.me.uk", "time": "Wed May 20 12:18:49 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:28:56 2026 -0700" }, "message": "Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n\nThis reverts commit 91f3a27ae9f66d81a5906461762c37c8a2bcab06.\n\nContrary to the assumption stated with the original commit description\nthis driver is in use and I\u0027m going to maintain it for the foreseeable\nfuture.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nLink: https://patch.msgid.link/alpine.DEB.2.21.2605201204260.1450@angie.orcam.me.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3287e81292f49dca2f253113c458e8f3d4ea091b", "tree": "9e10d6e881364d9b1f2b714207e7d243196efec8", "parents": [ "4db79a322db8c97f7b73b8a347395ef4d685eb40" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Wed May 20 19:22:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:23:50 2026 -0700" }, "message": "tools: ynl: support listening on all nsids\n\nA new method ntf_listen_all_nsid() to enable listening on events from\nall namespaces. Useful for testing cross-namespace functionality.\n\nrecv() replaced with recvmsg() to be able to receive NSID through the\nancillary data.\n\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20260520172317.175168-4-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4db79a322db8c97f7b73b8a347395ef4d685eb40", "tree": "d50b56ff50c4989fbbf316afcd32ab7d11edec2b", "parents": [ "3d4432d34c1992701289cbe12df9fd024f315998" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Wed May 20 22:44:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:21:33 2026 -0700" }, "message": "net: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs.\n\nFixes: 753f1ca4e1e5 (\"net: introduce managed frags infrastructure\")\nReported-by: Huzaifa Sidhpurwala \u003chuzaifas@redhat.com\u003e\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3d4432d34c1992701289cbe12df9fd024f315998", "tree": "b521687feed6837a7218394c32f1863141ca1c9f", "parents": [ "985d4a55e64e43bd86eeb896b81ceba453301989" ], "author": { "name": "Nikhil P. Rao", "email": "nikhil.rao@amd.com", "time": "Wed May 20 20:58:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:21:11 2026 -0700" }, "message": "pds_core: ensure null-termination for firmware version strings\n\nThe driver passes fw_version directly to devlink_info_version_stored_put()\nwithout ensuring null-termination. While current firmware null-terminates\nthese strings, the driver should not rely on this behavior. Add explicit\nnull-termination to prevent potential issues if firmware behavior changes.\n\nFixes: 45d76f492938 (\"pds_core: set up device and adminq\")\nSigned-off-by: Nikhil P. Rao \u003cnikhil.rao@amd.com\u003e\nLink: https://patch.msgid.link/20260520205842.1486718-1-nikhil.rao@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "985d4a55e64e43bd86eeb896b81ceba453301989", "tree": "3e0110854d6810c9a473e7cecee9f4ec5e8a0dee", "parents": [ "e46e6bc97fb1f339730ff1ba74267fbf48e7a422" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Wed May 20 15:12:02 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:19:54 2026 -0700" }, "message": "net: airoha: Disable GDM2 forwarding before configuring GDM2 loopback\n\nHw design requires to disable GDM2 forwarding before configuring GDM2\nloopback in airoha_set_gdm2_loopback routine.\n\nFixes: 9cd451d414f6e (\"net: airoha: Add loopback support for GDM2\")\nTested-by: Madhur Agrawal \u003cmadhur.agrawal@airoha.com\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260520-airoha-disable-gdm2-fwd-v1-1-1eeea5dffc2f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e46e6bc97fb1f339730ff1ba74267fbf48e7a422", "tree": "035de3c2808c6acae9c2bdc39e9e87464b0713ec", "parents": [ "bddc09212c24934643bd44fc794748d2bbb3b6cd" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@gmail.com", "time": "Wed May 20 14:42:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:19:25 2026 -0700" }, "message": "ipv6: ioam: refresh hdr pointer before ioam6_event()\n\nReported by Sashiko:\n\nIn ipv6_hop_ioam(), the hdr pointer is initialized to point into the\nskb\u0027s linear data buffer. Later, the code calls skb_ensure_writable(),\nwhich might reallocate the buffer:\n\n\tif (skb_ensure_writable(skb, optoff + 2 + hdr-\u003eopt_len))\n\t\tgoto drop;\n\n\t/* Trace pointer may have changed */\n\ttrace \u003d (struct ioam6_trace_hdr *)(skb_network_header(skb)\n\t\t\t\t\t + optoff + sizeof(*hdr));\n\n\tioam6_fill_trace_data(skb, ns, trace, true);\n\n\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb-\u003edev),\n\t\t GFP_ATOMIC, (void *)trace, hdr-\u003eopt_len - 2);\n\nIf the skb is cloned or lacks sufficient linear headroom,\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates\nthe skb\u0027s data buffer and frees the old one, invalidating pointers to\nit. While the code recalculates the trace pointer immediately after the\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.\n\nThis patch fixes the above by recalculating the hdr pointer before\npassing hdr-\u003eopt_len to ioam6_event(), so that we avoid any UaF.\n\nFixes: f655c78d6225 (\"net: exthdrs: ioam6: send trace event\")\nCc: stable@vger.kernel.org\nSigned-off-by: Justin Iurman \u003cjustin.iurman@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260520124242.32320-1-justin.iurman@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bddc09212c24934643bd44fc794748d2bbb3b6cd", "tree": "ebb2d3b6fd806f9ecfef464eabf539ade7a3a3f0", "parents": [ "2bccfb8476ca5f3548afbd623dc7a6980d4e77de" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed May 20 00:57:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:16:12 2026 -0700" }, "message": "tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\nIn the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an\nuninitialised on-stack struct sockaddr_storage to userspace via\nifr_hwaddr, but netif_get_mac_address() only writes sa_family and\ndev-\u003eaddr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.\n\nThose 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a\nmacvtap chardev returns kernel .text and direct-map pointers, defeating\nKASLR.\n\nInitialise ss at declaration.\n\nFixes: 3b23a32a6321 (\"net: fix dev_ifsioc_locked() race condition\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260520075736.3415676-3-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2bccfb8476ca5f3548afbd623dc7a6980d4e77de", "tree": "c64e54801d1a5233336de02a480795147c35ae06", "parents": [ "b809d0409991b75a6cff846a5ac27c3062953f84" ], "author": { "name": "Dawei Feng", "email": "dawei.feng@seu.edu.cn", "time": "Wed May 20 15:03:23 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:15:00 2026 -0700" }, "message": "qed: fix double free in qed_cxt_tables_alloc()\n\nIf one of the later PF or VF CID bitmap allocations fails,\nqed_cid_map_alloc() jumps to cid_map_fail and frees the previously\nallocated CID bitmaps before returning an error. qed_cxt_tables_alloc()\nthen calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()\nagain.\n\nFix this by setting each CID bitmap pointer to NULL after bitmap_free()\nto avoid double free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc3.\n\nRuntime reproduction was not attempted because exercising the failing\nallocation path requires device-specific setup.\n\nFixes: fe56b9e6a8d9 (\"qed: Add module with basic common support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zilin Guan \u003czilin@seu.edu.cn\u003e\nSigned-off-by: Dawei Feng \u003cdawei.feng@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260520070323.2762379-1-dawei.feng@seu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b809d0409991b75a6cff846a5ac27c3062953f84", "tree": "c2805438cf187f213804b4ca3b415d6c4c1a72a1", "parents": [ "9eddc819f00b5b74bb4ac91396f80bd35f5f3561" ], "author": { "name": "Aditya Garg", "email": "gargaditya@linux.microsoft.com", "time": "Tue May 19 22:15:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:14:11 2026 -0700" }, "message": "net: mana: validate rx_req_idx to prevent out-of-bounds array access\n\nIn mana_hwc_rx_event_handler(), rx_req_idx is derived from\nsge-\u003eaddress in DMA-coherent memory. In Confidential VMs\n(SEV-SNP/TDX), this memory is shared unencrypted and HW can modify\nWQE contents at any time. No bounds check exists on rx_req_idx,\nwhich can lead to an out-of-bounds access into reqs[].\n\nAdd bounds check on rx_req_idx in mana_hwc_rx_event_handler() before\nusing it to index the reqs[] array.\n\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nSigned-off-by: Aditya Garg \u003cgargaditya@linux.microsoft.com\u003e\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nLink: https://patch.msgid.link/20260520051553.857120-1-gargaditya@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9eddc819f00b5b74bb4ac91396f80bd35f5f3561", "tree": "08265b402f8fff19f2cb0a960eea34a40f7a0cad", "parents": [ "c367b9082194d01cb38bdefac6e887ebf1ab017d" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed May 20 10:00:36 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:12:59 2026 -0700" }, "message": "octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs\n\nWhen installing the allmulticast NPC rule, rvu_npc_install_allmulti_entry()\nshould skip LBK and SDP VFs (only CGX PF/VF may add the entry). The\ncode combined is_lbk_vf() and is_sdp_vf() with logical AND, which is\nnever true for a single pcifunc, so the intended early return never ran.\n\nUse logical OR instead.\n\nCc: Geetha sowjanya \u003cgakula@marvell.com\u003e\nFixes: ae703539f49d2 (\"octeontx2-af: Cleanup loopback device checks\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260520043036.1523798-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "94449463d2ab125067adccc2b0c2d7cd753edfb4", "tree": "0178f07e2dd83e8654c8f6c19cb23fb1996e9b45", "parents": [ "431e40042d3599559e588b8946bb28bd440b4f65", "1bf86336e4b6cf40873fda47a7fe191446864937" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 09:12:40 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 09:12:40 2026 -0600" }, "message": "Merge tag \u0027nvme-7.1-2026-05-21\u0027 of git://git.infradead.org/nvme into block-7.1\n\nPull NVMe fixes from Keith:\n\n\"- Fix memory leak for peer-to-peer addresses\n - Fix dma map leaks on resource errors\"\n\n* tag \u0027nvme-7.1-2026-05-21\u0027 of git://git.infradead.org/nvme:\n nvme-pci: fix dma mapping leak on data setup error\n nvme-pci: fix dma_vecs leak on p2p memory\n" }, { "commit": "c367b9082194d01cb38bdefac6e887ebf1ab017d", "tree": "8fb12e2fb5ea0a38a26d31dba7f97d4b890cfca6", "parents": [ "c5d93b2c40355e999715262a824965aac025a427" ], "author": { "name": "Zhang Cen", "email": "rollkingzzc@gmail.com", "time": "Tue May 19 18:46:47 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:10:18 2026 -0700" }, "message": "netpoll: normalize skb-\u003edev to the netpoll device\n\n__netpoll_send_skb() always transmits through np-\u003edev and queues busy\npackets on np-\u003edev-\u003enpinfo-\u003etxq, but it leaves skb-\u003edev unchanged.\nStacked callers such as DSA and macvlan can reach netpoll with skb-\u003edev\nstill naming the upper device while np-\u003edev is the lower device that\nowns the netpoll state.\n\nIf the skb has to be deferred, queue_process() later dequeues it from\nthe lower device\u0027s txq but retries it through skb-\u003edev. That can\nre-enter the upper ndo_start_xmit path on an already transformed skb,\nand if the upper device disappears before the lower txq drains the\nworkqueue can dereference a stale skb-\u003edev pointer.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\npath A label: netpoll enqueue path path B label: upper-device teardown\n1. Stacked xmit calls netpoll 1. Teardown unregisters the upper\n with lower np-\u003edev and upper net_device while lower npinfo\n skb-\u003edev. stays alive.\n2. __netpoll_send_skb() uses 2. netdev_release() runs for the\n np-\u003edev-\u003enpinfo as the txq upper net_device.\n owner.\n3. Busy transmit queues the skb 3. The lower txq still owns the\n on that lower txq with upper deferred skb.\n skb-\u003edev.\n4. queue_process() drains the 4. queue_process() dereferences\n lower txq and reads skb-\u003edev. that stale upper skb-\u003edev.\n\nNormalize skb-\u003edev to np-\u003edev after loading np-\u003edev from the netpoll\ninstance, before either the direct transmit path or the fallback enqueue.\nThis keeps the queued skb in the same device and txq domain as the\nnetpoll state that owns it.\n\nKASAN report as below:\n\nKASAN slab-use-after-free in queue_process+0x7c/0x480\nWorkqueue: events queue_process\nThe buggy address belongs to the object at ffff88810906c000 which belongs\nto the cache kmalloc-4k of size 4096\nThe buggy address is located 168 bytes inside of freed 4096-byte region\n[ffff88810906c000, ffff88810906d000)\nRead of size 8\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x620 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x215/0x420 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n queue_process+0x7c/0x480 (net/core/netpoll.c:88)\n kasan_check_range+0x10c/0x1c0 (?:?)\n __kasan_check_read+0x15/0x20 (?:?)\n process_one_work+0x8b7/0x1af0 (kernel/workqueue.c:3200)\n assign_work+0x170/0x3f0 (?:?)\n worker_thread+0x574/0xf10 (?:?)\n _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)\n trace_hardirqs_on+0x2a/0x180 (?:?)\n kthread+0x2fc/0x3f0 (?:?)\n ret_from_fork+0x58b/0x830 (?:?)\n __switch_to+0x58e/0xe90 (?:?)\n __switch_to_asm+0x39/0x70 (?:?)\n ret_from_fork_asm+0x1a/0x30 (?:?)\nFreed by task stack:\n kasan_save_stack+0x3d/0x60 (?:?)\n kasan_save_track+0x18/0x40 (?:?)\n kasan_save_free_info+0x3f/0x60 (?:?)\n __kasan_slab_free+0x48/0x70 (?:?)\n kfree+0x20e/0x4e0 (?:?)\n kvfree+0x31/0x40 (?:?)\n netdev_release+0x71/0x90 (net/core/net-sysfs.c:2227)\n device_release+0xd2/0x250 (?:?)\n kobject_put+0x181/0x4c0 (lib/kobject.c:730)\n netdev_run_todo+0x700/0x1000 (net/core/dev.c:11666)\n rtnl_dellink+0x396/0xc00 (net/core/rtnetlink.c:3558)\n rtnetlink_rcv_msg+0x740/0xc20 (net/core/rtnetlink.c:6897)\n netlink_rcv_skb+0x147/0x3a0 (?:?)\n rtnetlink_rcv+0x19/0x20 (net/core/rtnetlink.c:7021)\n netlink_unicast+0x4d1/0x830 (net/netlink/af_netlink.c:1327)\n netlink_sendmsg+0x840/0xe10 (net/netlink/af_netlink.c:1812)\n ____sys_sendmsg+0x8a7/0xb50 (?:?)\n ___sys_sendmsg+0x104/0x190 (?:?)\n __sys_sendmsg+0x135/0x1d0 (?:?)\n __x64_sys_sendmsg+0x7b/0xc0 (?:?)\n x64_sys_call+0x205c/0x2130 (?:?)\n do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)\n\nFixes: 5de4a473bda4 (\"netpoll queue cleanup\")\nSigned-off-by: Zhang Cen \u003crollkingzzc@gmail.com\u003e\nLink: https://patch.msgid.link/20260519104647.3517990-1-rollkingzzc@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5d93b2c40355e999715262a824965aac025a427", "tree": "b7dd32039fd2c9d11285e22e7b7565b4ca696851", "parents": [ "85fac50b58ca0e96dc8bfa649705cb901400877f" ], "author": { "name": "Abdun Nihaal", "email": "nihaal@cse.iitm.ac.in", "time": "Tue May 19 11:57:39 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 21 08:06:02 2026 -0700" }, "message": "net: wwan: iosm: fix potential memory leaks in ipc_imem_init()\n\nThe memory allocated in ipc_protocol_init() is not freed on the error\npaths that follow in ipc_imem_init(). Fix that by calling the\ncorresponding release function ipc_protocol_deinit() in the error path.\n\nFixes: 3670970dd8c6 (\"net: iosm: shared memory IPC interface\")\nCc: stable@vger.kernel.org\nSigned-off-by: Abdun Nihaal \u003cnihaal@cse.iitm.ac.in\u003e\nLink: https://patch.msgid.link/20260519062815.55545-1-nihaal@cse.iitm.ac.in\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1bf86336e4b6cf40873fda47a7fe191446864937", "tree": "0178f07e2dd83e8654c8f6c19cb23fb1996e9b45", "parents": [ "85686c72966c5ee637893f124ddb31a1cace7bee" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Tue May 19 13:01:57 2026 -0700" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 21 07:49:05 2026 -0700" }, "message": "nvme-pci: fix dma mapping leak on data setup error\n\nWe\u0027re leaking the initial DMA mapping during iteration if we fail to\nallocate the tracking descriptor for both PRP and SGL. Unmap the\niterator directly; we can\u0027t use the existing unmap helper because it\ndepends on the tracking descriptor being successfully allocated, so a\nnew one for an in-use iterator is provided.\n\nThe mappings were also leaking when the driver detects an invalid\nbio_vec when mapping PRPs, so fix that too.\n\nFixes: b8b7570a7ec87 (\"nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping\")\nFixes: 7ce3c1dd78fca (\"nvme-pci: convert the data mapping to blk_rq_dma_map\")\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "85686c72966c5ee637893f124ddb31a1cace7bee", "tree": "6e6dbbd8e615258ba0e3ef53f517a399ec99e873", "parents": [ "431e40042d3599559e588b8946bb28bd440b4f65" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Tue May 19 18:03:44 2026 -0700" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 21 07:48:58 2026 -0700" }, "message": "nvme-pci: fix dma_vecs leak on p2p memory\n\nWe don\u0027t unmap P2P memory, so we don\u0027t need to track it. The dma_vec\nallocation was getting leaked on the completion.\n\nFixes: b8b7570a7ec87 (\"nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping\")\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" } ], "next": "85fac50b58ca0e96dc8bfa649705cb901400877f" }