)]}' { "log": [ { "commit": "ee1bcf8271eb2e1d191bf97348ddf823c6071fa9", "tree": "94959aa7b086fac9fbb5ca47b503e1c512763e2e", "parents": [ "e909296d8750c9939ce311925ca1f59acb8944c1" ], "author": { "name": "Yonghong Song", "email": "yonghong.song@linux.dev", "time": "Tue Jul 07 15:01:36 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Wed Jul 08 05:15:34 2026 +0200" }, "message": "selftests/bpf: Rename libarena struct bitmap to struct arena_bitmap\n\nWhen building bpf selftest with latest bpf-next, I got the following failure:\n\n In file included from /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/selftests/test_parallel_bitmap.bpf.c:8:\n /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/include/libarena/bitmap.h:11:8: error: redefinition of\n \u0027bitmap\u0027\n 11 | struct bitmap {\n | ^\n /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/vmlinux.h:51320:8: note: previous definition is here\n 51320 | struct bitmap {\n | ^\n\nThe vmlinux.h struct bitmap comes from drivers/md/md-bitmap.c:\n struct bitmap {\n\tstruct bitmap_counts { ... }\n\t...\n }\n\nTo fix the issue, I renamed libarena struct bitmap to arena_bitmap to avoid the conflict.\n\nSigned-off-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260707220136.910374-1-yonghong.song@linux.dev\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "e909296d8750c9939ce311925ca1f59acb8944c1", "tree": "d54ea5c59ac6064ee26c52019846a04a4efd2c8f", "parents": [ "602701718649936eb287bf6c7ecf870ec54c6f71", "b6d29b9ba9d6c72558d0e30f3cc3f48990d08a54" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Wed Jul 08 03:34:17 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Wed Jul 08 03:38:29 2026 +0200" }, "message": "Merge branch \u0027bpf-remove-artificial-limitations-on-pointer-types-eligable-for-spilling\u0027\n\nEduard Zingerman says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: remove artificial limitations on pointer types eligible for spilling\n\nTrack spills for the following register types precisely:\n- PTR_TO_TP_BUFFER\n- PTR_TO_INSN\n- CONST_PTR_TO_DYNPTR\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260707-missing-spillable-types-v1-0-44a92121dc41@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "b6d29b9ba9d6c72558d0e30f3cc3f48990d08a54", "tree": "d54ea5c59ac6064ee26c52019846a04a4efd2c8f", "parents": [ "1f737e46ca6a845e6e96982ad57a31026f3521fa" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Tue Jul 07 17:44:29 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Wed Jul 08 03:35:24 2026 +0200" }, "message": "selftests/bpf: Test cases for missing spill types\n\nA few selftests checking that the verifier represents spills for the\nfollowing pointer types w/o losing precision:\n- PTR_TO_INSN\n- PTR_TO_TP_BUFFER\n- CONST_PTR_TO_DYNPTR\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260707-missing-spillable-types-v1-2-44a92121dc41@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "1f737e46ca6a845e6e96982ad57a31026f3521fa", "tree": "401cdf43a96bac27333ac492a66d02f6c98c156b", "parents": [ "602701718649936eb287bf6c7ecf870ec54c6f71" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Tue Jul 07 17:44:28 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Wed Jul 08 03:34:30 2026 +0200" }, "message": "bpf: Remove artificial limitations on pointer types eligible for spilling\n\nThe verifier loses precision when simulating stack spills for the\nfollowing register types:\n- PTR_TO_TP_BUFFER\n- PTR_TO_INSN\n- CONST_PTR_TO_DYNPTR\n\nThese types are not allow-listed in the is_spillable_regtype(),\nbecause of that check_stack_write_fixed_off() takes the branch\nthat marks the slots STACK_MISC.\n\nThere are no technical reasons for this limitation.\nThis commit replaces an explicit list of pointer types in\nis_spillable_regtype() with explicit list of non-pointer types.\nThe function is renamed to is_pointer_regtype() for clarity.\n\nReported-by: Andrii Nakryiko \u003candrii.nakryiko@gmail.com\u003e\nSuggested-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260707-missing-spillable-types-v1-1-44a92121dc41@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "602701718649936eb287bf6c7ecf870ec54c6f71", "tree": "f407b2b3a7ac09956d51a4bf254a281fe830070e", "parents": [ "5de7a6eaed89b45b91ca1830a7ddda7d8f50673b" ], "author": { "name": "Feng Yang", "email": "yangfeng@kylinos.cn", "time": "Tue Jul 07 16:14:34 2026 +0800" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 21:09:48 2026 +0200" }, "message": "selftests/bpf: Fix memory leak in msg_alloc_iov\n\nIn the msg_alloc_iov function, the iov pointer is only assigned to\nmsg-\u003emsg_iov after all memory allocations complete successfully.\nTherefore, when a calloc failure triggers the unwind_iov cleanup branch,\nwe should use the local variable iov instead of msg-\u003emsg_iov.\n\nFixes: 753fb2ee0934 (\"bpf: sockmap, add msg_peek tests to test_sockmap\")\nSigned-off-by: Feng Yang \u003cyangfeng@kylinos.cn\u003e\nReviewed-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260707081434.539327-1-yangfeng59949@163.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "5de7a6eaed89b45b91ca1830a7ddda7d8f50673b", "tree": "1e2f9740a4ee327671cc65ad504898d5fcd7eef0", "parents": [ "be39165224d03d92a05f62b9ea10eec089365480" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Tue Jun 30 14:54:06 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 21:09:47 2026 +0200" }, "message": "selftests/bpf: Drop tc/xdp/flow_dissector/socket_filter sockmap mutation tests\n\ntc, xdp, socket_filter and flow_dissector programs can no longer update\nor delete a sockmap. Adjust the tests:\n\n - verifier_sockmap_mutate: the tc, xdp, socket_filter and\n flow_dissector cases now expect __failure with \"cannot update sockmap\n in this context\".\n - sockmap_basic: drop \"sockmap update\" / \"sockhash update\", which load\n a SEC(\"tc\") program that copies a sock between maps.\n - fexit_bpf2bpf: drop \"func_sockmap_update\", whose freplace program\n updates a sockmap in the tc cls_redirect context.\n\nRemove the now-unused test_sockmap_update.c and freplace_cls_redirect.c.\n\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260630145410.3648099-3-rhkrqnwk98@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "be39165224d03d92a05f62b9ea10eec089365480", "tree": "cb0507bbbe84c756a24dd4c75a56c67ff764766e", "parents": [ "e7333034387d7cbc80de91d52b3427384902ada7" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Tue Jun 30 14:54:05 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 21:09:47 2026 +0200" }, "message": "bpf, sockmap: Disallow update and delete from tc, xdp, socket_filter and flow_dissector\n\nsock_map_update_common() and __sock_map_delete() hold stab-\u003elock and call\nsock_map_unref() -\u003e sock_map_del_link(), which takes sk_callback_lock for\nwrite. That gives the order stab-\u003elock -\u003e sk_callback_lock.\n\nThe reverse order comes from the SK_SKB stream parser.\nsk_psock_strp_data_ready() holds sk_callback_lock for read, and after the\nverdict tcp_bpf_strp_read_sock() acks the consumed data inline via\n__tcp_cleanup_rbuf(). The ACK goes out egress, where a sched_cls program\ndeletes from the sockmap and takes stab-\u003elock:\n\n WARNING: possible circular locking dependency detected\n ------------------------------------------------------\n syz.9.8824 is trying to acquire lock:\n (\u0026stab-\u003elock){+.-.}-{3:3}, at: __sock_map_delete net/core/sock_map.c:421\n but task is already holding lock:\n (clock-AF_INET){++.-}-{3:3}, at: sk_psock_strp_data_ready net/core/skmsg.c:1173\n\n -\u003e #1 (clock-AF_INET){++.-}-{3:3}:\n _raw_write_lock_bh\n sock_map_del_link net/core/sock_map.c:167\n sock_map_unref net/core/sock_map.c:184\n sock_map_update_common net/core/sock_map.c:509\n sock_map_update_elem_sys net/core/sock_map.c:588\n map_update_elem kernel/bpf/syscall.c:1805\n\n -\u003e #0 (\u0026stab-\u003elock){+.-.}-{3:3}:\n _raw_spin_lock_bh\n __sock_map_delete net/core/sock_map.c:421\n sock_map_delete_elem net/core/sock_map.c:452\n bpf_prog_06044d24140080b6\n tcx_run net/core/dev.c:4451\n sch_handle_egress net/core/dev.c:4541\n __dev_queue_xmit net/core/dev.c:4808\n ...\n tcp_bpf_strp_read_sock net/ipv4/tcp_bpf.c:701\n strp_data_ready net/strparser/strparser.c:402\n sk_psock_strp_data_ready net/core/skmsg.c:1174\n tcp_data_queue net/ipv4/tcp_input.c:5661\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n rlock(clock-AF_INET);\n lock(\u0026stab-\u003elock);\n lock(clock-AF_INET);\n lock(\u0026stab-\u003elock);\n\n *** DEADLOCK ***\n\nA tc, xdp, socket_filter or flow_dissector program has no reason to\nupdate or delete a sockmap, and redirect does not go through here. Drop\nthem from may_update_sockmap() so the verifier rejects it. It also\ncloses the matching sockhash inversion.\n\nSuggested-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260630145410.3648099-2-rhkrqnwk98@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "e7333034387d7cbc80de91d52b3427384902ada7", "tree": "323dc19aa00695dbc449f25d1f1226e1fe4bdf0d", "parents": [ "5f6cc299938b561cb01e343bab7042611fcee12a" ], "author": { "name": "Maxim Khmelevskii", "email": "max@linux.ibm.com", "time": "Fri Jul 03 14:51:36 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:49 2026 +0200" }, "message": "selftests/bpf: Add test for bpf_get_smp_processor_id\n\nAdd a test which checks on each CPU that the bpf_get_smp_processor_id\nBPF helper is returning the correct CPU number.\n\nSigned-off-by: Maxim Khmelevskii \u003cmax@linux.ibm.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Ilya Leoshkevich \u003ciii@linux.ibm.com\u003e\nLink: https://lore.kernel.org/bpf/20260703125648.919196-6-max@linux.ibm.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "5f6cc299938b561cb01e343bab7042611fcee12a", "tree": "9a4cb9eac88fb92b8cad041cd6ef09a0b3db5de4", "parents": [ "f66d25468b59f1694eb9b531e765dcd548350b8f" ], "author": { "name": "Maxim Khmelevskii", "email": "max@linux.ibm.com", "time": "Fri Jul 03 14:51:35 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:42 2026 +0200" }, "message": "s390/bpf: Replace ly instruction with llgf\n\ncpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register, when ly loads\nthe cpu_nr into BPF_REG_0 it does not zero the upper bits, but llgf does.\n\nFixes: 9012cf2491e3 (\"s390/bpf: Inline smp_processor_id and current_task\")\nSigned-off-by: Maxim Khmelevskii \u003cmax@linux.ibm.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Ilya Leoshkevich \u003ciii@linux.ibm.com\u003e\nLink: https://sashiko.dev/#/patchset/20260414142930.528751-1-max%40linux.ibm.com\nLink: https://lore.kernel.org/bpf/20260703125648.919196-5-max@linux.ibm.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "f66d25468b59f1694eb9b531e765dcd548350b8f", "tree": "ab1526026cf8bf259e3536c2f111b27f27f77765", "parents": [ "dfe39ce7b0b7563fe14a81f13f2d39e59f790816" ], "author": { "name": "Ricardo B. Marlière", "email": "rbm@suse.com", "time": "Mon Jul 06 12:28:43 2026 -0300" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:39 2026 +0200" }, "message": "docs/bpf: Document BPF_STRICT_BUILD\u003d0 to tolerate test build failures\n\nWhen the kernel config does not fully match the BPF selftest config\nfragment, some tests may fail to compile. BPF_STRICT_BUILD (defaulting to\n1) makes any such failure fatal. Mention the option so that developers are\naware they can set it to 0 to skip broken tests and keep the build going,\nwhich is particularly useful during bringup or when testing on constrained\n(e.g. distribution) configurations.\n\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260706-b4-bpf_strict_build_docs-v1-1-5324d605c7b0@suse.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "dfe39ce7b0b7563fe14a81f13f2d39e59f790816", "tree": "c455087c7c8a59f0d3e6dc44af4129d0c90aabe5", "parents": [ "0bebfaa39deadec21638f6fba553eae12627a26d", "4137bbd9af1f80f86419097d728e6af136e4fea8" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 00:19:32 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:35 2026 +0200" }, "message": "Merge branch \u0027bpf-reject-mem_alloc-btf-accesses-past-bounds\u0027\n\nYiyang Chen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Reject MEM_ALLOC BTF accesses past bounds\n\nBTF struct walks can relax the top-level struct-size check for trailing\nflexible arrays. That relaxation must not let a PTR_TO_BTF_ID | MEM_ALLOC\naccess escape the bytes allocated by bpf_obj_new() or bpf_percpu_obj_new().\n\nPatch 1 rejects MEM_ALLOC BTF walks whose access range reaches past the\ncurrent struct size before applying the flexible-array relaxation. This now\nalso applies to struct ID matching used by kfunc and kptr type checks.\nPatch 2 adds a linked_list negative loader case for this path.\n\nChanges in v3:\n- Pass the flexible-array walk policy through btf_struct_ids_match() callers,\n so MEM_ALLOC kfunc/kptr type checks use the same bounds rule.\n- Rename the btf_struct_walk() parameter to walk_flex_arrays.\n- Rebase onto current bpf-next.\n\nv2:\nhttps://lore.kernel.org/bpf/cover.1782197377.git.chenyy23@mails.tsinghua.edu.cn/\n\nv1:\nhttps://lore.kernel.org/bpf/cover.1782100805.git.chenyy23@mails.tsinghua.edu.cn/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1782807039.git.chenyy23@mails.tsinghua.edu.cn\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "4137bbd9af1f80f86419097d728e6af136e4fea8", "tree": "c455087c7c8a59f0d3e6dc44af4129d0c90aabe5", "parents": [ "9c9ee0324c774490ae953162aaaf4561d222bd93" ], "author": { "name": "Yiyang Chen", "email": "chenyy23@mails.tsinghua.edu.cn", "time": "Tue Jun 30 08:41:27 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:27 2026 +0200" }, "message": "selftests/bpf: Cover MEM_ALLOC access past object bounds\n\nAdd a linked_list negative loader case for a program-BTF type whose last\nmember is a zero-length flexible array. The program writes through the\nfirst flexible-array element of an object allocated by bpf_obj_new().\n\nThe verifier should reject the access when the BTF walk reaches beyond the\nstatic size of the allocated object.\n\nSigned-off-by: Yiyang Chen \u003cchenyy23@mails.tsinghua.edu.cn\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/e36fd5d2f4047809f0e5da46a7077083297e64db.1782807039.git.chenyy23@mails.tsinghua.edu.cn\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "9c9ee0324c774490ae953162aaaf4561d222bd93", "tree": "81f079320621795a396bc7e93a1755d923746e8c", "parents": [ "0bebfaa39deadec21638f6fba553eae12627a26d" ], "author": { "name": "Yiyang Chen", "email": "chenyy23@mails.tsinghua.edu.cn", "time": "Tue Jun 30 08:41:26 2026 +0000" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:23 2026 +0200" }, "message": "bpf: Reject MEM_ALLOC BTF accesses past object bounds\n\nBTF struct walks relax the struct-size check for accesses through a\ntrailing flexible array. That is valid for ordinary BTF type walking, but\nPTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static\nBTF type size.\n\nWhen walking a MEM_ALLOC object, reject the access before applying the\nflexible-array relaxation if the access range extends past the struct size.\nApply the same policy to struct ID matching so kfunc and kptr type checks\ndo not walk past the allocated object bounds either.\n\nFixes: 958cf2e273f0 (\"bpf: Introduce bpf_obj_new\")\nFixes: 36d8bdf75a93 (\"bpf: Add alloc/xchg/direct_access support for local percpu kptr\")\nSigned-off-by: Yiyang Chen \u003cchenyy23@mails.tsinghua.edu.cn\u003e\nReviewed-by: Amery Hung \u003cameryhung@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/4b8c8a81102ba4b595011434c881194f264ddc59.1782807039.git.chenyy23@mails.tsinghua.edu.cn\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "0bebfaa39deadec21638f6fba553eae12627a26d", "tree": "ae5254d0990fdc5ae442aa1ea1dd83695fe164cb", "parents": [ "a58999f9a9ba620593d015981057330de8c56971" ], "author": { "name": "Malaya Kumar Rout", "email": "malayarout91@gmail.com", "time": "Sat Jul 04 17:59:35 2026 +0530" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:20 2026 +0200" }, "message": "selftests/bpf: Fix memory leak in msg_alloc_iov error path\n\nIn msg_alloc_iov(), when calloc() fails for an individual iov_base\nallocation, the error path frees all previously allocated iov_base\nentries but fails to free the iov array itself that was allocated\nwith calloc() at the beginning of the function. This results in a\nmemory leak of the iov array.\n\nAdd free(iov) in the unwind_iov error path to ensure proper cleanup\nof all allocated memory.\n\nFixes: 753fb2ee0934 (\"bpf: sockmap, add msg_peek tests to test_sockmap\")\nSigned-off-by: Malaya Kumar Rout \u003cmalayarout91@gmail.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260704122936.102394-1-malayarout91@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "a58999f9a9ba620593d015981057330de8c56971", "tree": "a085e6d9a6a8688590b2a2894c66b9768b005342", "parents": [ "87bfe634b1193db90e5170e1ddbad04a63ef4501", "df64aadc78c13419a3ca412ad0122b37e72f83fd" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Mon Jul 06 21:00:33 2026 +0200" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:15 2026 +0200" }, "message": "Merge branch \u0027selftests-bpf-libarena-cleanup-and-bitmap-struct\u0027\n\nEmil Tsalapatis says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests/bpf: libarena cleanup and bitmap struct\n\nCleanup patches for libarena, along with a new bitmap data type that is\nin use by sched-ext. Patch 1 is an NFC that properly renames the buddy\nselftests for consistency. Patch 2 fixes the zero variable used in\nlibarena for can_loop based looping, and afterwrds removes all bpf_for()\ninstances from the code. Patch 3 fixes an (untriggered) edge case that\ncould cause spurious selftest failures. Finally, patches 4 to 6\nintroduce the bitmap data structure along with selftests.\n\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\n\nCHANGELOG\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nv3 was resent as the first submission was missing the first patch.\n\nv2 -\u003e v3: (https://lore.kernel.org/bpf/20260701185235.4516-1-emil@etsalapatis.com)\n- Remove unused macros and fix typo in commit message (AI)\n\nv1 -\u003e v2: (https://lore.kernel.org/bpf/20260618085626.19633-1-emil@etsalapatis.com)\n\n- Added acks by Ihor and Eduard\n- Fix missing commit message (Ihor)\n- Enforce 64 bits per cell with BITS_TO_LONG_LONG (Sashiko)\n- Add test for bmp_copy (Ihor)\n- Add atomic versions of _set() and _clear() (Ihor) and add a parallel\n selftest for them.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260706181730.21731-1-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "df64aadc78c13419a3ca412ad0122b37e72f83fd", "tree": "a085e6d9a6a8688590b2a2894c66b9768b005342", "parents": [ "5a903a4f73eec60804a702d624fe0a72d823266d" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:30 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:12 2026 +0200" }, "message": "selftests/bpf: libarena: Add parallel bitmap selftest\n\nAdd a selftest for testing the atomic bitmap set/clear/\ntest_and_set/test_and_clear operations. The selftest\nchecks atomicity by spawning two threads, each of which\neither only works on even bits or with odd bits. The\ntest checks that threads do not affect each other\u0027s\nbits.\n\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-7-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "5a903a4f73eec60804a702d624fe0a72d823266d", "tree": "0626b25efbaf7c8f0dbac0372b8f03c2cd61eef6", "parents": [ "5a93b10f6c47a55d6b578983ca76d98b8ae3d268" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:29 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:09 2026 +0200" }, "message": "selftests/bpf: libarena: Add bitmap selftests\n\nAdd testing for the new arena bitmap data structure.\n\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nAcked-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-6-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "5a93b10f6c47a55d6b578983ca76d98b8ae3d268", "tree": "115696a3c2f5f06b2492368b8c3c27f4ca55ea8c", "parents": [ "14c2b770d15d5b0d814cdef114de55e01a281e00" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:28 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:06 2026 +0200" }, "message": "selftests/bpf: Add arena-based bitmap data structure\n\nAdd an arena-based word-aligned bitmap data struture. The\nstructure is useful as a building block, e.g., sched-ext\nuses it to represent cpumask structures.\n\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-5-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "14c2b770d15d5b0d814cdef114de55e01a281e00", "tree": "edea959163105e418626d967cb10882088b1e9fa", "parents": [ "857071efc362d4641673c1fbf7e8a2d7a2408e75" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:27 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:09:01 2026 +0200" }, "message": "selftests/bpf: libarena: Clean up allocation state before buddy tests\n\nSummary: The buddy allocator requires the global BPF buddy allocator\nto not be already initialized. However, the test currently merely resets\nthe allocator before the buddy tests instead of destroying it, and the\ntest worked because the buddy test happened to run first. Properly\ndestroy the allocator instead of resetting it.\n\nFixes: b1487dc1b181 (\"selftests/bpf: Add selftests for libarena buddy allocator\")\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nAcked-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-4-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "857071efc362d4641673c1fbf7e8a2d7a2408e75", "tree": "2b2559bbfdbe627e576d9f960fca073071a9dbc7", "parents": [ "d7123afeecc86026fdab830af977a79f65a77ab8" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:26 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:08:47 2026 +0200" }, "message": "selftests/bpf: libarena: Fix can-loop zero variable definition\n\nBPF can_loop based loops require the index variable to stay imprecise.\nThis means we must initialize them from a currently imprecise variable\ninstead of directly assigning 0 to them, like so:\n\nstatic volatile u32 zero \u003d 0;\n\nfor (i \u003d zero; i \u003c NUM_LOOPS; i++) {\n\t/* loop body */\n}\n\nThe libarena implementation of this technique is currently faulty. For\nthe technique to work, the variable must not be in a map. This includes\nthe .rodata DATASEC map used for const variables. However, libarena\nstill defines the zero variable as constant.\n\nModify the zero variable definition into a volatile variable. This\nchange adds a complication caused by the compiler optimizing array\nderefences from\n\nfor (i \u003d zero; i \u003c NUM_LOOPS; i++) {\n\tval \u003d *(ptr + i);\n}\n\ninto\n\nfor (i \u003d zero; i \u003c NUM_LOOPS; i++) {\n\tval \u003d *ptr++;\n}\n\nand causing verification failures. Use the barrier_var() clobber macro\nto prevent this optimization from taking place. Using barrier_var() is\nthe only way to break the optimization, as annotating the index as\nvolatile does not suffice.\n\nAfter that, remove the bpf_for() invocations introduced in libarena for\nparallel spmc testing.\n\nReported-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-3-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "d7123afeecc86026fdab830af977a79f65a77ab8", "tree": "dfb96686c23148dfafdec49f9f45d27905e12917", "parents": [ "87bfe634b1193db90e5170e1ddbad04a63ef4501" ], "author": { "name": "Emil Tsalapatis", "email": "emil@etsalapatis.com", "time": "Mon Jul 06 14:17:25 2026 -0400" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Tue Jul 07 18:08:43 2026 +0200" }, "message": "selftests/bpf: libarena: Replace leftover st_ prefix with test_\n\nThe st_ (selftests_) prefix is confusing and has been replaced\nwith the more descriptive test_. However, last patch did not\nproperly move all files to the new prefix. Rename the existing\nfiles to complete the move.\n\nAcked-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nSigned-off-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/20260706181730.21731-2-emil@etsalapatis.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "87bfe634b1193db90e5170e1ddbad04a63ef4501", "tree": "ecbbd16fbf6e1ff7a7f15eebd27b4b466b4e5dfd", "parents": [ "bb4e90e91ba19b598cbdd9a2161b893b86a3f637", "d2c9a99135da931377240942d44f3dea104cedb8" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Jul 03 19:15:35 2026 +0200" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Jul 03 19:15:35 2026 +0200" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc2\n\nCross-merge BPF and other fixes after downstream PR.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "d2c9a99135da931377240942d44f3dea104cedb8", "tree": "2030fc72fd9abbf784155bb8b50efa0d906aa957", "parents": [ "c85167c926e0b1a9213ecc9040eb355f90426832", "995832b2cebe6969d1b42635db698803ee31294d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 20:54:26 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 20:54:26 2026 -1000" }, "message": "Merge tag \u0027device-id-rework\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux\n\nPull mod_devicetable.h header split from Uwe Kleine-König:\n \"Split \u003clinux/mod_devicetable.h\u003e in per subsystem headers\n\n \u003clinux/mod_devicetable.h\u003e is included transitively in nearly every\n driver in an x86_64 allmodconfig build of v7.1:\n\n $ find drivers -name \\*.o -not -name \\*.mod.o | wc -l\n 21330\n $ find drivers -name \\*.o.cmd -not -name \\*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l\n 17038\n\n The result of this mixture of different and unrelated subsystem\n details is that even when touching an obscure device id struct most of\n the kernel needs to be recompiled. Given that each driver typically\n only needs one or two of these structures, splitting into per\n subsystem headers and only including what is really needed reduces the\n amount of needed recompilation.\n\n This split is implemented in the first commit and then after some\n preparatory work in the following commits, the last two replace\n includes of \u003clinux/mod_devicetable.h\u003e by the actually needed more\n specific headers.\n\n There are still a few instances left, but the ones with high impact\n (that is in headers that are used a lot) and the easy ones (.c files)\n are handled. These remaining includes will be addressed during the\n next merge window\"\n\n* tag \u0027device-id-rework\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:\n Replace \u003clinux/mod_devicetable.h\u003e by more specific \u003clinux/device-id/*.h\u003e (c files)\n Replace \u003clinux/mod_devicetable.h\u003e by more specific \u003clinux/device-id/*.h\u003e (headers)\n parisc: #include \u003clinux/compiler.h\u003e for unlikely() in \u003casm/ptrace.h\u003e\n media: em28xx: Add include for struct usb_device_id\n LoongArch: KVM: Add include defining struct cpu_feature\n ALSA: hda/core: Add include defining struct hda_device_id\n usb: dwc2: Add include defining struct pci_device_id\n platform/x86: int3472: Add include defining struct dmi_system_id\n platform/x86: x86-android-tablets: Add include defining struct dmi_system_id\n i2c: Let i2c-core.h include \u003clinux/i2c.h\u003e\n of: Explicitly include \u003clinux/types.h\u003e and \u003clinux/err.h\u003e\n platform/x86: msi-ec: Ensure dmi_system_id is defined\n usb: serial: Include \u003clinux/usb.h\u003e in \u003clinux/usb/serial.h\u003e\n driver core: platform: Include header for struct platform_device_id\n driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver\n media: ti: vpe: #include \u003clinux/platform_device.h\u003e explicitly\n mod_devicetable.h: Split into per subsystem headers\n" }, { "commit": "c85167c926e0b1a9213ecc9040eb355f90426832", "tree": "6782d8e4aafad82e17f06555adb6e1cb935d3fe6", "parents": [ "51512e22efe813d8223de27f6fd02a8a48ea2323", "cd64be0ecd399fa2b1ab60b3aaf2b2b744243467" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 20:05:43 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 20:05:43 2026 -1000" }, "message": "Merge tag \u0027ata-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Damien Le Moal:\n\n - Quirk the Phison PS3111-S11 SSD with NOLPM due to its defective\n link power management (Bryam)\n\n - Strengthen checks on a device concurrent positioning range\n information to make sure to reject any invalid report (Bryam)\n\n - Fix probe error handling in the pata_pxa and sata_gemini\n drivers (Myeonghun, Wentao)\n\n - Limit buffer size of replies from translated commands to what\n libata actually generated (Karuna)\n\n* tag \u0027ata-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: limit simulated SCSI command copy to response length\n ata: pata_pxa: Fix DMA channel leak on probe error\n ata: sata_gemini: unwind clocks on IDE pinctrl errors\n ata: libata-core: Reject an invalid concurrent positioning ranges count\n ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD\n" }, { "commit": "995832b2cebe6969d1b42635db698803ee31294d", "tree": "a94fcfdcd2e78f1210d5c7a520e2c5e82ee4b066", "parents": [ "ecca1d63c1eadbbb38ceab82de0f7adfbc2b465d" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:36 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:17 2026 +0200" }, "message": "Replace \u003clinux/mod_devicetable.h\u003e by more specific \u003clinux/device-id/*.h\u003e (c files)\n\nReplace the #include of \u003clinux/mod_devicetable.h\u003e by the more specific\n\u003clinux/device-id/*.h\u003e where applicable. For most cases the include\ncan be dropped completely, only a few drivers need one or two headers\nadded.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nAcked-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "ecca1d63c1eadbbb38ceab82de0f7adfbc2b465d", "tree": "d0201da24e0ceaafac066fb3c079f3438b1b1b2d", "parents": [ "a7e8cae4c60e693fffa493c7e3088cd03ee66232" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:35 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:16 2026 +0200" }, "message": "Replace \u003clinux/mod_devicetable.h\u003e by more specific \u003clinux/device-id/*.h\u003e (headers)\n\n\u003clinux/mod_devicetable.h\u003e is included in a many files:\n\n\t$ git grep \u0027\u003clinux/mod_devicetable.h\u003e\u0027 ef0c9f75a195 | wc -l\n\t1598\n\n; some of them are widely used headers. To stop mixing up different and\nunrelated driver( type)s let the subsystem headers only use the subset\nof the recently split \u003clinux/mod_devicetable.h\u003e that are relevant for\nthem.\n\nThe fallout (I hope) is addressed in the previous commits that handle\nsources relying on e.g. \u003clinux/i2c.h\u003e pulling in the full legacy header\nand thus providing pci_device_id.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/199fe46b624ba07fb9bd3e0cd6ff13757932cb5f.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "a7e8cae4c60e693fffa493c7e3088cd03ee66232", "tree": "06b25e128e3a36160f3b0176149504549314c8d1", "parents": [ "c19f08f796cbc169307a275d24a6a0e41d9bbd64" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:34 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:16 2026 +0200" }, "message": "parisc: #include \u003clinux/compiler.h\u003e for unlikely() in \u003casm/ptrace.h\u003e\n\nCurrently \u003clinux/compiler.h\u003e isn\u0027t included at all (not even\ntransitively) in \u003casm/ptrace.h\u003e.\narch/parisc/kernel/asm-offsets.c just happens to include the following\nchain of includes before \u003casm/ptrace.h\u003e:\n\n\t\u003clinux/sched.h\u003e\n\t-\u003e \u003casm/processor.h\u003e\n\t-\u003e \u003casm/hardware.h\u003e\n\t-\u003e \u003clinux/mod_devicetable.h\u003e\n\t-\u003e \u003clinux/uuid.h\u003e\n\t-\u003e \u003clinux/string.h\u003e\n\t-\u003e \u003clinux/compiler.h\u003e\n\n. That chain will be broken, because in one of the next commits\n\u003casm/hardware.h\u003e is changed to only include \u003clinux/device-id/parisc.h\u003e\ninstead of \u003clinux/mod_devicetable.h\u003e. So to ensure\narch/parisc/kernel/asm-offsets.c knows about unlikely() even after that\nchange, #include \u003clinux/compiler.h\u003e explicitly.\n\nLink: https://patch.msgid.link/0574a2b73363c3cbf21c55c27455c3cecfb33583.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "c19f08f796cbc169307a275d24a6a0e41d9bbd64", "tree": "4692318c451b8e4fa4e9e292925e227fafc6cc04", "parents": [ "a59fbb8ceff625a4841c1d010bd9b6a53dcfd190" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:33 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:16 2026 +0200" }, "message": "media: em28xx: Add include for struct usb_device_id\n\nTraditionally \u003clinux/mod_devicetable.h\u003e was a header defining a plethora\nof structs, among them struct usb_device_id. This was split now with the\nobjective that only the relevant bits are included.\n\nCurrently \u003clinux/mod_devicetable.h\u003e is transitively included in\ndrivers/media/usb/em28xx/em28xx.h via:\n\n\tdrivers/media/usb/em28xx/em28xx.h -\u003e\n\t\u003clinux/i2c.h\u003e -\u003e\n\t\u003clinux/acpi.h\u003e -\u003e\n\t\u003clinux/device.h\u003e -\u003e\n\t\u003clinux/device/driver.h\u003e -\u003e\n\t\u003clinux/mod_devicetable.h\n\nTo keep struct usb_device_id available once \u003clinux/device/driver.h\u003e\nstops including \u003clinux/mod_devicetable.h\u003e, include it the header\nproviding that struct explictly.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/e72de5b4b9f1aa77a3c19a5e698a195dfd81ae0b.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "a59fbb8ceff625a4841c1d010bd9b6a53dcfd190", "tree": "d3a4ef6887f35bcc2ed3600fc38c436bfc64cc32", "parents": [ "4e38ddd96b528a35477a9dfd5e6748d3961c85ab" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:32 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:16 2026 +0200" }, "message": "LoongArch: KVM: Add include defining struct cpu_feature\n\nTraditionally \u003clinux/mod_devicetable.h\u003e was a header defining a plethora\nof structs, among them struct cpu_features. This was split now with the\nobjective that only the relevant bits are included.\n\nCurrently \u003clinux/mod_devicetable.h\u003e is transitively included in\narch/loongarch/kvm/main.c via:\n\n\tarch/loongarch/kvm/main.c -\u003e\n\t\u003clinux/kvm_host.h\u003e -\u003e\n\t\u003clinux/entry-virt.h\u003e -\u003e\n\t\u003clinux/resume_user_mode.h\u003e -\u003e\n\t\u003clinux/memcontrol.h\u003e -\u003e\n\t\u003clinux/cgroup.h\u003e -\u003e\n\t\u003clinux/kernel_stat.h\u003e -\u003e\n\t\u003clinux/interrupt.h\u003e -\u003e\n\t\u003clinux/hardirq\u003e -\u003e\n\t\u003casm/hardirq.h\u003e -\u003e\n\t\u003clinux/irq.h\u003e -\u003e\n\t\u003casm/irq.h\u003e -\u003e\n\t\u003clinux/irqdomain.h\u003e -\u003e\n\t\u003clinux/of.h\u003e -\u003e\n\t\u003clinux/mod_devicetable.h\u003e\n\nTo keep struct cpu_features available once \u003clinux/of.h\u003e stops including\n\u003clinux/mod_devicetable.h\u003e, include it here explicitly.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/052feec0e04ea8f5b2706a19a5b236679eed0aba.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "4e38ddd96b528a35477a9dfd5e6748d3961c85ab", "tree": "4b9a63015df05a0bd8b005368f7999b651dc519c", "parents": [ "e3cda6938ab3027266bcbf92063075c9c495ddc2" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:31 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "ALSA: hda/core: Add include defining struct hda_device_id\n\nTraditionally all *_device_id were defined in a single header\n\u003clinux/mod_devicetable.h\u003e. This was split now with the objective that\nonly the relevant bits are included. So including \u003clinux/pci.h\u003e won\u0027t be\nenough to get a definition of (the unrelated to pci) struct\nhda_device_id.\n\nAdd an explicit include for the header defining struct hda_device_id to\nkeep working when \u003clinux/pci.h\u003e stops providing this defintion.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nReviewed-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/376883bc5889d5cca01efb6f8d4e07a20158f2b8.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "e3cda6938ab3027266bcbf92063075c9c495ddc2", "tree": "1bdc17844cc6706d2d45502a450414ab99ad6c5b", "parents": [ "a66f9107a8ff8881f98bcbf4a271eac591f11e26" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:30 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "usb: dwc2: Add include defining struct pci_device_id\n\nUp to now \u003clinux/acpi.h\u003e includes \u003clinux/mod_devicetable.h\u003e that\nprovides struct pci_device_id. However \u003clinux/mod_devicetable.h\u003e was\nsplit into per bus headers and \u003clinux/acpi.h\u003e will only include the acpi\nrelated one (and similar for other bus headers).\n\nAs struct pci_device_id is used in drivers/usb/dwc2/core.h, add an\ninclude to ensure it\u0027s defined also after the includes in \u003clinux/acpi.h\u003e\nare tightened.\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/bddfcdfaf36d735c244e03efada6083ef98ebd51.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "a66f9107a8ff8881f98bcbf4a271eac591f11e26", "tree": "f68fee9afa9592e4c86882d289e235f57fe56b70", "parents": [ "5e4cc258b35cf1cca2248d370bfe75a67f51527b" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:29 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "platform/x86: int3472: Add include defining struct dmi_system_id\n\nCurrently \u003clinux/mod_devicetable.h\u003e is included transitively in\nint3472.h via\n\n\t\u003clinux/clk-provider.h\u003e -\u003e\n\t\u003clinux/of.h\u003e -\u003e\n\t\u003clinux/mod_devicetable.h\u003e\n\nHowever these includes will be tightend such that only the bits relevant\nfor of will be provided by \u003clinux/of.h\u003e. To ensure that dmi_system_id\nstays around, include the respective header explicitly.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nAcked-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nLink: https://patch.msgid.link/0ba52730f67dc995d9d896b81fa6a7320bf8cb4b.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "5e4cc258b35cf1cca2248d370bfe75a67f51527b", "tree": "0fc16cd55e43381e96937d75276fedecf719a904", "parents": [ "6d924c42e0ada2a9938b2a9c0b9bbc406c6282ce" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:28 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "platform/x86: x86-android-tablets: Add include defining struct dmi_system_id\n\nCurrently \u003clinux/i2c.h\u003e includes \u003clinux/mod_devicetable.h\u003e transitively\nwhich ensures that struct dmi_system_id is defined in\ndrivers/platform/x86/x86-android-tablets/x86-android-tablets.h. However\nthis include in \u003clinux/i2c.h\u003e will be replaced by one for i2c_device_id\nonly. To ensure that dmi_system_id is available add the include for that\nexplicitly.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/32928d9ee47cefc7dfc4c385c06bd5e598b0fca1.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "6d924c42e0ada2a9938b2a9c0b9bbc406c6282ce", "tree": "30635c46249938690a3d9de6d130318542d854b8", "parents": [ "2fb03de5256989d603f68dc07f06b6dbd72a9d92" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:27 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "i2c: Let i2c-core.h include \u003clinux/i2c.h\u003e\n\nThe subsystem private header i2c-core.h uses several symbols defined in\n\u003clinux/i2c.h\u003e, e.g. struct i2c_board_info and i2c_lock_bus()). This\ndoesn\u0027t pose a problem in practise because all files including\n\"i2c-core.h\" also include \u003clinux/i2c.h\u003e.\n\nTo make this more robust add an include statement for \u003clinux/i2c.h\u003e\nmaking the header self-contained.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nReviewed-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/46aa85ab3dc4e63bfb5bd8ff1fd212a3d0e31f58.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "2fb03de5256989d603f68dc07f06b6dbd72a9d92", "tree": "aeb1e4fc3f958cc7ca5e0414bad3d8ac2b3dd70b", "parents": [ "4c8f323b9e1517ea97bfdb2bc6f3c246f7d43eac" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:26 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "of: Explicitly include \u003clinux/types.h\u003e and \u003clinux/err.h\u003e\n\n\u003clinux/of_platform.h\u003e uses resource_size_t and relies on the transitive\ninclude \u003clinux/mod_devicetable.h\u003e -\u003e \u003clinux/types.h\u003e. It also uses error\nconstants and thus relying on the include chain\n\u003clinux/mod_devicetable.h\u003e -\u003e \u003clinux/uuid.h\u003e -\u003e \u003clinux/string.h\u003e -\u003e\n\u003clinux/err.h\u003e.\n\nWith the plan to split \u003clinux/mod_devicetable.h\u003e per subsystem and then\nonly letting of_platform.h include the of-specific bits (which don\u0027t\nrequire these two headers), add the needed includes explicitly to keep\nthe header self-contained.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/a730991bc8813cf70c2445064ea425291538f709.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "4c8f323b9e1517ea97bfdb2bc6f3c246f7d43eac", "tree": "0cf9dc1e1e8eb980df9f59a48d88a2bade651249", "parents": [ "b14f81978d7ab6f28381f7cc0be7e65f244a083b" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:25 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:15 2026 +0200" }, "message": "platform/x86: msi-ec: Ensure dmi_system_id is defined\n\nCurrently \u003clinux/acpi.h\u003e includes \u003clinux/mod_devicetable.h\u003e and thus\ndmi_system_id is available for the driver. To disentangle includes\n\u003clinux/acpi.h\u003e will be changed to only include the header for\nacpi_device_id instead of the full \u003clinux/mod_devicetable.h\u003e. To prepare\nfor that include the dedicated header for struct dmi_device_id.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/600c7ab3263dcb8cee39b43dbd313eba8abef376.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "b14f81978d7ab6f28381f7cc0be7e65f244a083b", "tree": "9253c0fd60f2571d9a6869c88297e6d1b8049bd2", "parents": [ "00cd8fc630e06e15a46200ce941d7fe98fea1e9d" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:24 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:14 2026 +0200" }, "message": "usb: serial: Include \u003clinux/usb.h\u003e in \u003clinux/usb/serial.h\u003e\n\nAll consumers of the latter also include the former, but without that\nstruct usb_driver and struct usb_device_id (and maybe more) are not\ndefined. Add an include for \u003clinux/usb.h\u003e to make the header\nself-contained.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/82219ab65d16ee5bfe5a35d11bc938baac3fd3bc.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "00cd8fc630e06e15a46200ce941d7fe98fea1e9d", "tree": "57fed814aa6c1b8bee55f5098ec7954e656397c9", "parents": [ "e1da37efb51b46870f7e50ae5e8a03293335bce5" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:23 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:14 2026 +0200" }, "message": "driver core: platform: Include header for struct platform_device_id\n\nPlatform drivers can define an array containing the supported device\nvariants to be assigned to the struct platform_driver\u0027s .id_table.\n\nWhile a forward declaration of struct platform_device_id is technically\nenough to make the driver self-contained, it\u0027s reasonable to provide the\n(very lightweight) data type definition for that array in\n\u003clinux/platform_device.h\u003e to not add that burden to all platform drivers\nwith an id-table.\n\nNote that currently \u003clinux/device.h\u003e transitively includes\n\u003clinux/mod_devicetable.h\u003e that provides struct platform_device_id. But\nthat include is planned to be replaced by a tighter set of includes that\nonly define the structures relevant for the stuff in \u003clinux/device.h\u003e.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/4ca29592c9d1c6d528a65e05b80af7355f3c79c5.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "e1da37efb51b46870f7e50ae5e8a03293335bce5", "tree": "5b48eb40533ac1038cf703565c9443fb9f9e4e68", "parents": [ "1b44cfa834e12aac55d2f071cabedc3aaa6fd19c" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:22 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:14 2026 +0200" }, "message": "driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver\n\nstruct device_driver contains pointers of type struct of_device_id* and\nstruct acpi_device_id* but doesn\u0027t ensure these are defined. To make the\nheader self-contained add the (very lightweight) includes that contain\nthe respective definitions.\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Rafael J. Wysocki (Intel) \u003crafael@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/199ba71b4ac73f4b4d9f5d2be635c96eec73c70e.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "1b44cfa834e12aac55d2f071cabedc3aaa6fd19c", "tree": "642a5b9e41efaf21343b1e4ab1c9a9d2a5cc32e1", "parents": [ "ad428f5811bd7fb3d91fa002174de533f9da94d7" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:21 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:38:14 2026 +0200" }, "message": "media: ti: vpe: #include \u003clinux/platform_device.h\u003e explicitly\n\nThe driver uses several symbols and structs defined in that header. The\nheader is currently included transitively via\n\n\t\"vip.h\" -\u003e\n\t\u003cmedia/v4l2-ctrls.h\u003e -\u003e\n\t\u003cmedia/media-request.h\u003e -\u003e\n\t\u003cmedia/media-device.h\u003e -\u003e\n\t\u003clinux/platform_device.h\u003e\n\nwhich seems to be on the lower end of the scale between random and\nreliable.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nReviewed-by: Yemike Abhilash Chandra \u003cy-abhilashchandra@ti.com\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nLink: https://patch.msgid.link/9f2e0e001eec087f00ac2c5af2de2e8f6d0978c1.1782808461.git.u.kleine-koenig@baylibre.com\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "ad428f5811bd7fb3d91fa002174de533f9da94d7", "tree": "aee60b8200d3570af5afa3a007a27cbd0e92e5d8", "parents": [ "dc59e4fea9d83f03bad6bddf3fa2e52491777482" ], "author": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Tue Jun 30 11:24:20 2026 +0200" }, "committer": { "name": "Uwe Kleine-König (The Capable Hub)", "email": "u.kleine-koenig@baylibre.com", "time": "Fri Jul 03 07:37:43 2026 +0200" }, "message": "mod_devicetable.h: Split into per subsystem headers\n\n\u003clinux/mod_devicetable.h\u003e is included transitively in nearly every\ndriver in an x86_64 allmodconfig build of v7.1:\n\n\t$ find drivers -name \\*.o -not -name \\*.mod.o | wc -l\n\t21330\n\t$ find drivers -name \\*.o.cmd -not -name \\*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l\n\t17038\n\nThe result is that even when touching an obscure device id struct most\nof the kernel needs to be recompiled. Given that each driver typically\nonly needs one or two of these structures, splitting into per subsystem\nheaders and only including what is really needed reduces the amount of\nneeded recompilation.\n\nImplement the first step and define each device id struct in a separate\nheader (together with its associated #defines).\n\n\u003clinux/mod_devicetable.h\u003e is modified to include all the new headers to\ncontinue to provide the same symbols.\n\nSeveral headers currently include \u003clinux/mod_devicetable.h\u003e, those that\nare most lukrative to include only their subsystem headers only are:\n\n\t$ git -C source grep -l mod_devicetable.h include/linux | while read h; do echo -n \"$h:\"; find drivers -name \\*.o.cmd -not -name \\*.mod.o.cmd | xargs grep -l $h | wc -l; done | sort -t: -k2 -n -r | head\n\tinclude/linux/of.h:10897\n\tinclude/linux/pci.h:7920\n\tinclude/linux/acpi.h:7097\n\tinclude/linux/i2c.h:5402\n\tinclude/linux/spi/spi.h:1897\n\tinclude/linux/dmi.h:1643\n\tinclude/linux/usb.h:1222\n\tinclude/linux/input.h:1205\n\tinclude/linux/mdio.h:835\n\tinclude/linux/phy.h:733\n\nstruct cpu_feature isn\u0027t really a device_id struct. That is kept in\n\u003clinux/mod_devicetable.h\u003e for now.\n\nAcked-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nAcked-by: Takashi Sakamoto \u003co-takashi@sakamocchi.jp\u003e\nAcked-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e # zorro\nLink: https://patch.msgid.link/41400e323be8640702b906d04327e833c5bdaf4a.1782808461.git.u.kleine-koenig@baylibre.com\n[Drop \"MOD\" from the header guards]\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "cd64be0ecd399fa2b1ab60b3aaf2b2b744243467", "tree": "6782d8e4aafad82e17f06555adb6e1cb935d3fe6", "parents": [ "fcaf242e7fc406e78f444a35441e3b58f5e28781" ], "author": { "name": "Karuna Ramkumar", "email": "rkaruna@google.com", "time": "Thu Jul 02 02:01:42 2026 +0000" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Jul 03 13:44:18 2026 +0900" }, "message": "ata: libata-scsi: limit simulated SCSI command copy to response length\n\nThe function ata_scsi_rbuf_fill() is used to copy the response of\nemulated SCSI commands from ata_scsi_rbuf to the SCSI command\u0027s\nscatterlist.\n\nCurrently, sg_copy_from_buffer() is called with the size argument\nset to ATA_SCSI_RBUF_SIZE (2048 bytes). Since ata_scsi_rbuf is\nzeroed out before the simulation actor is invoked, copying the\nfull buffer size causes the remainder of the SCSI command\u0027s\ntransfer buffer (beyond the actual response length \u0027len\u0027) to be\noverwritten with zeroes. This clobbers any pre-existing sentinel\nvalues or data in the caller\u0027s buffer tail, even though the\ncorrect residual count is reported via scsi_set_resid().\n\nFix this by passing the actual response length \u0027len\u0027 as the copy\nsize to sg_copy_from_buffer(), ensuring that the tail of the\ncaller\u0027s buffer remains untouched. Also, add a defensive check\nto ensure that the actor does not return a length exceeding the\nstatic buffer capacity. If this occurs, trigger a WARN_ON(),\nfail the command with an aborted command error, and return\nimmediately without copying any data.\n\nThe fix was tested by invoking an SCSI SG_IO INQUIRY on\nan ATA disk on vanilla build, and build with the fix. Confirmed\nthat the input buffer\u0027s tail end remains unmodified with the fix.\n\nFixes: 5251ae224d8d (\"ata: libata-scsi: Return residual for emulated SCSI commands\")\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Karuna Ramkumar \u003crkaruna@google.com\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "fcaf242e7fc406e78f444a35441e3b58f5e28781", "tree": "19b068e81cecb92eac0b1f3cbb83e0bf4da41a65", "parents": [ "c0ace4130e813acbabdfaa28d4e94a849c2ffdd7" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Thu Jun 25 22:18:37 2026 +0800" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Jul 03 13:44:18 2026 +0900" }, "message": "ata: pata_pxa: Fix DMA channel leak on probe error\n\nWhen dmaengine_slave_config() fails, the DMA channel acquired by\ndma_request_chan() is not released before returning the error,\nleaking the channel reference.\n\nFix by adding dma_release_channel() in the error path.\n\nThe ata_host_activate() error path already correctly releases the\nDMA channel.\n\nCc: stable@vger.kernel.org\nFixes: 88622d80af82 (\"ata: pata_pxa: dmaengine conversion\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "c0ace4130e813acbabdfaa28d4e94a849c2ffdd7", "tree": "4a43080d4ebd575d7e22a7f4eddaa41c0f1fa2c4", "parents": [ "533a0b940f901c15e5cbbd4b5d66e871c209e8ce" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Fri Jun 26 17:58:37 2026 +0900" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Jul 03 13:44:18 2026 +0900" }, "message": "ata: sata_gemini: unwind clocks on IDE pinctrl errors\n\ngemini_sata_bridge_init() prepares and enables both SATA PCLKs, then\ndisables them again while keeping the clocks prepared for later bridge\nstart and stop operations. If gemini_setup_ide_pins() fails after that,\ngemini_sata_probe() returns directly and skips the existing\nout_unprep_clk unwind path.\n\nRoute the IDE pinctrl failure through out_unprep_clk so the clocks\nprepared by gemini_sata_bridge_init() are unprepared before probe\nfails.\n\nFixes: d872ced29d5f (\"ata: sata_gemini: Introduce explicit IDE pin control\")\nCo-developed-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nReviewed-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "533a0b940f901c15e5cbbd4b5d66e871c209e8ce", "tree": "ed19ca4c626d9496522c7ac3a6aac68e0fa08a31", "parents": [ "462775c620197adaabc983ce847e5b9878ff4cb0" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Mon Jun 22 22:23:45 2026 -0500" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Jul 03 13:44:18 2026 +0900" }, "message": "ata: libata-core: Reject an invalid concurrent positioning ranges count\n\nata_dev_config_cpr() takes the number of range descriptors from buf[0]\nof the concurrent positioning ranges log (up to 255), which the device\nreports independently of the log size in the GPL directory. The count is\nthen walked at a fixed 32-byte stride in two places with no bound: the\nlog read here, and the INQUIRY VPD page B9h emitter, which writes one\ndescriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device\nreporting a count larger than its own log overflows the read buffer (up\nto 7704 bytes past a 512-byte slab), and a count above 62 overflows the\nresponse buffer on the emit side.\n\nBound the count once, on probe, against both the log the device returned\nand the number of descriptors the VPD B9h response buffer can hold\n(ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range\ncount with a warning; this keeps the emitter in bounds with no separate\nchange there.\n\nSuggested-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nFixes: fe22e1c2f705 (\"libata: support concurrent positioning ranges log\")\nFixes: c745dfc541e7 (\"libata: fix reading concurrent positioning ranges log\")\nCc: stable@vger.kernel.org\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "462775c620197adaabc983ce847e5b9878ff4cb0", "tree": "cffac51490a122edbed561737571a05c268f4811", "parents": [ "51512e22efe813d8223de27f6fd02a8a48ea2323" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Fri Jun 19 21:54:02 2026 -0500" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri Jul 03 13:44:18 2026 +0900" }, "message": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD\n\nThe PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus\nafter entering Device-Initiated Slumber during idle. With the default\nmed_power_with_dipm policy the link goes down (SStatus 1 SControl 300)\nand does not recover, forcing the filesystem read-only. Forcing\nmax_performance keeps the link stable across prolonged idle.\n\nAdd a NOLPM quirk so link power management is disabled for this drive\nspecifically, leaving it intact for other devices on the host.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "51512e22efe813d8223de27f6fd02a8a48ea2323", "tree": "71652a4126cce9f0529d265519df11fb118af40b", "parents": [ "826eec5b5efd785dc87638a54d5ecc9f88e5afce", "b72e29e0f7ee329d89f86db8700c8ea99b4a370a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 16:39:28 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 16:39:28 2026 -1000" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull BPF fixes from Daniel Borkmann:\n\n - Initialize task local storage before fork bails out to free the task\n (Jann Horn)\n\n - Fix insn_aux_data leak on verifier error path (KaFai Wan)\n\n - Reject BPF inode storage map creation when BPF LSM is uninitialized\n (Matt Bobrowski)\n\n - Mask pseudo pointer values in verifier logs when pointer leaks are\n not allowed (Nuoqi Gui)\n\n - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)\n\n - Reject a skb-modifying SK_SKB stream parser since the latter is only\n meant to measure the next message (Sechang Lim)\n\n - Fix bpf_refcount_acquire to reject refcounted allocation arguments\n with a non-zero fixed offset (Yiyang Chen)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf: Prefer dirty packs for eBPF allocations\n bpf: Prefer packs that won\u0027t trigger an IBPB flush on allocation\n bpf: Skip redundant IBPB in pack allocator\n bpf: Restrict JIT predictor flush to cBPF\n x86/bugs: Enable IBPB flush on BPF JIT allocation\n bpf: Support for hardening against JIT spraying\n bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\n bpf,fork: wipe -\u003ebpf_storage before bailouts that access it\n bpf: Fix insn_aux_data leak on verifier err_free_env path\n selftests/bpf: Cover pseudo-BTF ksym log masking\n bpf: Mask pseudo pointer values in verifier logs\n selftests/bpf: Cover refcount acquire node offsets\n bpf: Reject offset refcount acquire arguments\n selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser\n bpf, sockmap: reject a packet-modifying SK_SKB stream parser\n selftests/bpf: don\u0027t modify the skb in the strparser parser prog\n" }, { "commit": "826eec5b5efd785dc87638a54d5ecc9f88e5afce", "tree": "506372685f6c9b913607a7545e7e9d7ff9b650e8", "parents": [ "87320be9f0d24fce67631b7eef919f0b79c3e45c", "e242e974e812e7a47e3088860c80d9492fac314f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 15:25:54 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 15:25:54 2026 -1000" }, "message": "Merge tag \u0027vfio-v7.2-rc2\u0027 of https://github.com/awilliam/linux-vfio\n\nPull VFIO fixes from Alex Williamson:\n \"Mostly straightforward fixes here, inconsistent runtime PM handling\n due to global device policies, bitfield races, unwind path gaps,\n teardown ordering, and a misplaced library flag.\n\n - Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci\n variant driver with a binary split between setup/release and\n runtime modified flags. These were noted across several Sashiko\n reviews as pre-existing issues (Alex Williamson)\n\n - Fix runtime PM inconsistency where the vfio-pci driver module_init\n could modify the idle PM policy of existing devices through globals\n managed in vfio-pci-core, leading to unbalanced runtime PM\n operations (Alex Williamson)\n\n - Restore mutability of writable vfio-pci module options by further\n pulling policy globals out of vfio-pci-core, to instead be latched\n per device at device init. Provide visibility of the per device\n latched values through debugfs (Alex Williamson)\n\n - Fix missing VGA arbiter uninit callback in unwind path (Alex\n Williamson)\n\n - Reorder device debugfs removal before device_del() to avoid gap\n where debugfs is available with stale devres pointers (Alex\n Williamson)\n\n - Move UUID library linking flag from vfio selftest Makefile into\n libvfio.mk to avoid exposing such dependencies when linking with\n KVM selftests (Sean Christopherson)\"\n\n* tag \u0027vfio-v7.2-rc2\u0027 of https://github.com/awilliam/linux-vfio:\n vfio: selftests: Add luuid to libvfio.mk\u0027s list of libraries, not to the Makefile\n vfio/pci: Expose latched module parameter policy in debugfs\n vfio: Remove device debugfs before releasing devres\n vfio/pci: Latch all module parameters per device\n vfio/mlx5: Fix racy bitfields and tighten struct layout\n vfio/pci: Fix racy bitfields and tighten struct layout\n vfio/pci: Release the VGA arbiter client on register_device() failure\n vfio/pci: Latch disable_idle_d3 per device\n" }, { "commit": "bb4e90e91ba19b598cbdd9a2161b893b86a3f637", "tree": "bb8dd260d7d0a742bc6d36b2b3efaeadba444c69", "parents": [ "0b58988cacfc91604c4b5be2c3295f8aac0ee3d0" ], "author": { "name": "luoliang", "email": "luoliang@kylinos.cn", "time": "Thu Jul 02 09:23:11 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Thu Jul 02 09:25:45 2026 -0700" }, "message": "bpftool: Use btf_vlen()/btf_kind()/btf_kflag() helpers consistently\n\nThe btf_vlen(), btf_kind() and btf_kflag() inline helpers defined in\ntools/lib/bpf/btf.h are thin wrappers around the BTF_INFO_VLEN(),\nBTF_INFO_KIND() and BTF_INFO_KFLAG() UAPI macros - each one simply\nreturns the corresponding macro applied to t-\u003einfo.\n\nbpftool already uses these helpers in most places, but 13 call sites\nin btf.c and btf_dumper.c still open-code the raw macros. Use the\nhelpers consistently, matching the rest of bpftool as well as libbpf.\n\nNo functional change.\n\nSigned-off-by: Liang Luo \u003cluoliang@kylinos.cn\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nReviewed-by: Quentin Monnet \u003cqmo@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260702012311.2265001-1-luoliang@kylinos.cn\n" }, { "commit": "87320be9f0d24fce67631b7eef919f0b79c3e45c", "tree": "acea3ad5a6bc1c5fd1a5fc8fd2a29184802c88d5", "parents": [ "a9d4dd742466cab468a950441447c614a3920aad", "d8e8b85a85fe21954d303db68034aac4639df88d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 06:01:12 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 06:01:12 2026 -1000" }, "message": "Merge tag \u0027net-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter and batman-adv.\n\n Current release - new code bugs:\n\n - netfilter: cthelper: cap to maximum number of expectation per master\n\n Previous releases - regressions:\n\n - netpoll: fix a use-after-free on shutdown path\n\n - tcp: restore RCU grace period in tcp_ao_destroy_sock\n\n - ipv6: fix NULL deref in fib6_walk_continiue() on multi-batch dump\n\n - batman-adv: dat: ensure accessible eth_hdr proto field\n\n - eth:\n - virtio_net: disable cb when NAPI is busy-polled\n - lan743x: Initialize eth_syslock spinlock before use\n\n Previous releases - always broken:\n\n - netfilter:\n - nft_set_pipapo: don\u0027t leak bad clone into future transaction\n\n - sched:\n - sch_teql: Introduce slaves_lock to avoid race condition and UAF\n - replace direct dequeue call with peek and qdisc_dequeue_peeked\n\n - sctp: add INIT verification after cookie unpacking\n\n - tipc: fix out-of-bounds read in broadcast Gap ACK blocks\n\n - seg6: validate SRH length before reading fixed fields\n\n - eth:\n - mlx5e: fix use-after-free of metadata_dst on RX SC delete\n - enetc: check the number of BDs needed for xdp_frame\n - fbnic: don\u0027t cache shinfo across skb realloc\"\n\n* tag \u0027net-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits)\n net/mlx5: HWS, fix matcher leak on resize target setup failure\n net/sched: hhf: clear heavy-hitter state on reset\n net/sched: dualpi2: clear stale classification on filter miss\n net/sched: act_bpf: use rcu_dereference_bh() to read the filter\n selftests: drv-net: tso: don\u0027t touch dangerous feature bits\n cxgb4: Fix decode strings dump for T6 adapters\n virtio_net: disable cb when NAPI is busy-polled\n sctp: fix addr_wq_timer race in sctp_free_addr_wq()\n selftests: net: bump default cmd() timeout to 20 seconds\n bridge: stp: Fix a potential use-after-free when deleting a bridge\n net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF\n net: gianfar: dispose irq mappings on probe failure and device removal\n net: lan743x: Initialize eth_syslock spinlock before use\n net: libwx: fix VMDQ mask for 1-queue mode\n net: airoha: fix max receive size configuration\n fsl/fman: Free init resources on KeyGen failure in fman_init()\n netfilter: nftables: restrict checkum update offset\n netfilter: nftables: restrict linklayer and network header writes\n netfilter: nfnetlink_queue: restrict writes to network header\n netfilter: nft_fib: reject fib expression on the netdev egress hook\n ...\n" }, { "commit": "a9d4dd742466cab468a950441447c614a3920aad", "tree": "7636eb983dfd189e951ec8972be483b3d9b55f35", "parents": [ "db78c0db411b111b438f00a1ba418e995b5bd246", "fe87b8dc67f1b2c64e76a66e78468c533d3c44ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 05:58:35 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 05:58:35 2026 -1000" }, "message": "Merge tag \u0027hwmon-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - adm1275: Detect coefficient overflow, and prevent reading\n uninitialized stack\n\n - aspeed-g6-pwm-tach: Guard fan RPM calculation against divide-by-zero\n\n - asus_atk0110: Check package count before accessing element\n\n - ltc4283: fix malformed table docs build error\n\n - occ: Unregister sysfs devices outside occ lock to avoid lockdep\n warning\n\n - pmbus core: Fix passing events to regulator core, and honor\n vrm_version in pmbus_data2reg_vid()\n\n - w83627hf: Remove VID sysfs files on error and remove\n\n - w83793: remove vrm sysfs file on probe failure\n\n - Various: Add missing \u0027select REGMAP_I2C\u0027 to Kconfig\n\n* tag \u0027hwmon-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero\n hwmon: (pmbus) Fix passing events to regulator core\n hwmon: adm1275: Detect coefficient overflow\n hwmon: adm1275: Prevent reading uninitialized stack\n hwmon: (max6697) add missing \u0027select REGMAP_I2C\u0027 to Kconfig\n hwmon: (ltc2992) add missing \u0027select REGMAP_I2C\u0027 to Kconfig\n hwmon: (max1619) add missing \u0027select REGMAP\u0027 to Kconfig\n hwmon: (w83627hf) remove VID sysfs files on error and remove\n hwmon: (w83793) remove vrm sysfs file on probe failure\n hwmon: (asus_atk0110) Check package count before accessing element\n docs: hwmon: ltc4283: fix malformed table docs build error\n hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()\n hwmon: (occ) unregister sysfs devices outside occ lock\n" }, { "commit": "db78c0db411b111b438f00a1ba418e995b5bd246", "tree": "0595366a5ac26c2d8c8062f38adba58dc67435c2", "parents": [ "4a50a141f05a8d1737661b19ee22ff8455b94409", "d5d2d7a8d8be18681a0864f58e3875f1c639e11c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 05:56:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 02 05:56:44 2026 -1000" }, "message": "Merge tag \u0027mfd-fixes-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd\n\nPull MFD fix from Lee Jones:\n\n - Add MFD mailing list to MAINTAINERS\n\n* tag \u0027mfd-fixes-7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:\n MAINTAINERS: Add a mailing list entry to MFD\n" }, { "commit": "d8e8b85a85fe21954d303db68034aac4639df88d", "tree": "d4d398dbf1006a4f7001656feebe82a5cb04faab", "parents": [ "bb09d0e64ecaa0aa0f7d1133a1696ed74dead295", "26560c4a03dc4d607331600c187f59ab2df5f341" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 02 10:34:05 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 02 10:34:06 2026 +0200" }, "message": "Merge tag \u0027batadv-net-pullrequest-20260630\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are some batman-adv bugfix, all by Sven Eckelmann:\n\n - fix pointers after potential skb reallocs (5 patches)\n\n - dat: ensure accessible eth_hdr proto field\n\n* tag \u0027batadv-net-pullrequest-20260630\u0027 of https://git.open-mesh.org/batadv:\n batman-adv: dat: ensure accessible eth_hdr proto field\n batman-adv: bla: reacquire gw address after skb realloc\n batman-adv: dat: acquire ARP hw source only after skb realloc\n batman-adv: gw: acquire ethernet header only after skb realloc\n batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc\n batman-adv: retrieve ethhdr after potential skb realloc on RX\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260630134430.85786-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d5d2d7a8d8be18681a0864f58e3875f1c639e11c", "tree": "00a8c1a1e2117f6718c306e2d0e91837ced89d37", "parents": [ "dc59e4fea9d83f03bad6bddf3fa2e52491777482" ], "author": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Fri Jun 19 09:07:14 2026 +0100" }, "committer": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Thu Jul 02 09:07:03 2026 +0100" }, "message": "MAINTAINERS: Add a mailing list entry to MFD\n\nThis is to be included by all contributors and will be leaned on for\nSashiko\u0027s \"reply to author\" support.\n\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\n" }, { "commit": "bb09d0e64ecaa0aa0f7d1133a1696ed74dead295", "tree": "6e328b19cc29c5d3518103dea429ec6624cc27dd", "parents": [ "0469d460a598d03fc85ebd97f99640e6c579e2a2" ], "author": { "name": "Dawei Feng", "email": "dawei.feng@seu.edu.cn", "time": "Mon Jun 29 14:40:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 02 09:27:26 2026 +0200" }, "message": "net/mlx5: HWS, fix matcher leak on resize target setup failure\n\nhws_bwc_matcher_move() allocates a replacement matcher before setting it\nas the resize target. If mlx5hws_matcher_resize_set_target() fails, the\nreplacement matcher is not attached anywhere and is leaked.\n\nFix the leak by destroying the replacement matcher before returning from\nthe resize-target failure path.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1.1.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nmlx5 HWS-capable device to test with, no runtime testing was able to be\nperformed.\n\nFixes: 2111bb970c78 (\"net/mlx5: HWS, added backward-compatible API handling\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dawei Feng \u003cdawei.feng@seu.edu.cn\u003e\nReviewed-by: Yevgeny Kliteynik \u003ckliteyn@nvidia.com\u003e\nAcked-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260629064049.3852759-1-dawei.feng@seu.edu.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4a50a141f05a8d1737661b19ee22ff8455b94409", "tree": "e9e87e24e0f18c0084916092e4246fe70b1d66bc", "parents": [ "665159e246749578d4e4bfe106ee3b74edcdab18", "dec4d8118c179b3d12bca7e609054c6011c4f2ce" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 01 14:21:03 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 01 14:21:03 2026 -1000" }, "message": "Merge tag \u0027bootconfig-fixes-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull bootconfig fix from Masami Hiramatsu:\n\n - bootconfig: Fix NULL-pointer arithmetic\n\n Fix undefined pointer arithmetic in xbc_snprint_cmdline() when\n probing the buffer length with NULL and size 0. Track the written\n length as a size_t instead to prevent build-time UBSan/FORTIFY_SOURCE\n failures.\n\n* tag \u0027bootconfig-fixes-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()\n" }, { "commit": "0b58988cacfc91604c4b5be2c3295f8aac0ee3d0", "tree": "ac0a9562f3ee2aa3ada838e1456711c7e56c0c2a", "parents": [ "d262a25d8b58b697b2a1a2fe4b0078446cc00e11" ], "author": { "name": "JP Kobryn", "email": "jp.kobryn@linux.dev", "time": "Fri Jun 26 10:20:26 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Jul 01 16:53:17 2026 -0700" }, "message": "Documentation/bpf: make it clear that kfuncs should be non-static\n\nThe kfunc documentation mentions how the macro __bpf_kfunc prevents\ninlining for static functions. This makes it sound like static kfuncs are\nacceptable. Although static kfuncs may happen to work, it is by chance that\nthe compiler chose not to rename these functions and BTF resolution still\nsucceeds.\n\nMake it clear in the documentation why kfuncs should not be declared\nstatic. First, remove wording that makes it sound like static is ok. Then\npoint out the external naming needed for BTF resolution. Finally point out\nthat sparse may warn on unreferenced kfuncs and that this warning can be\nignored.\n\nSigned-off-by: JP Kobryn \u003cjp.kobryn@linux.dev\u003e\nAcked-by: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nAcked-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nLink: https://lore.kernel.org/r/20260626172026.7327-1-jp.kobryn@linux.dev\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "d262a25d8b58b697b2a1a2fe4b0078446cc00e11", "tree": "96c43ceed711a759157533ad87886d7c43d6b8c8", "parents": [ "2ce3f548cfc6a1fe4c53479cf8a21931cdfd51d8" ], "author": { "name": "Yuan Chen", "email": "chenyuan@kylinos.cn", "time": "Wed Jun 10 22:50:53 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 13:43:47 2026 -0700" }, "message": "libbpf: Skip bpf_object__probe_loading() when BPF token is in use\n\nbpf_object__probe_loading() tries to load trivial SOCKET_FILTER and\nTRACEPOINT programs to verify the BPF environment works. When a\nBPF token is in use with restricted program type permissions, these\nprobe loads may fail because the token does not allow the specific\nprogram types, even though BPF loading is perfectly functional.\n\nFix by skipping the probe when a token FD is present: BPF token\ncreation itself proves the kernel has a working BPF subsystem.\nReal BPF issues will be caught during actual program and map loading.\n\nSigned-off-by: Yuan Chen \u003cchenyuan@kylinos.cn\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260610145059.113412-2-chenyuan_fl@163.com\n" }, { "commit": "2ce3f548cfc6a1fe4c53479cf8a21931cdfd51d8", "tree": "48169be3ebfa0bf538536c469c84f8677f9f0961", "parents": [ "27a0f3635d862919dd7e5e93e19f3f5d1b240e57" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Wed Jul 01 08:07:51 2026 +0000" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 13:10:20 2026 -0700" }, "message": "bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks\n\n__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.\nsecurity_bpf_prog_free() called from there fires bpf_prog_free in softirq;\nif a sleepable LSM prog is attached to that hook, might_fault() BUGs:\n\n BUG: sleeping function called from invalid context\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038\n preempt_count: 101, expected: 0\n Call Trace:\n \u003cIRQ\u003e\n __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255\n bpf_trampoline_6442549705+0x53/0xd7\n security_bpf_prog_free+0xde/0x130 security/security.c:5465\n __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365\n rcu_do_batch kernel/rcu/tree.c:2617 [inline]\n handle_softirqs+0x236/0x800 kernel/softirq.c:622\n \u003c/IRQ\u003e\n\nThe call_rcu/call_rcu_tasks_trace split reflects the freed program\u0027s\nsleepability, not that of any attached observer.\n\nsecurity_bpf_prog_free() also frees prog-\u003eaux-\u003esecurity, which has to stay\nafter the grace period, so drop bpf_prog_free from sleepable_lsm_hooks\nrather than move the call. Non-sleepable observers still run there.\n\nFixes: 1b67772e4e3f (\"bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks\")\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260701080757.1394144-1-rhkrqnwk98@gmail.com\n" }, { "commit": "27a0f3635d862919dd7e5e93e19f3f5d1b240e57", "tree": "7714216d43a05dce5757ccc60872bc95356db9bb", "parents": [ "475b59db3bd5c7717b5441481ac06f226815cb0a" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Wed Jul 01 15:14:22 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 13:06:04 2026 -0700" }, "message": "selftests/bpf: Fix test_maps sockmap failure\n\ntest_maps fails in the sockmap test because sockmap_verdict_prog.c\ndrops the packet when the first 8 bytes are not directly accessible:\n\t if (data + 8 \u003e data_end)\n\t\t\t return SK_DROP;\n\nThe blamed commit removed bpf_skb_pull_data() from the stream parser\nprogram so that the parser no longer modifies the skb. That was needed,\nbut it also removed an implicit side effect: bpf_skb_pull_data()\nlinearized enough of the skb for later direct packet access.\n\nIn this test, the send side goes through the sockmap SK_MSG path. The\nskb can have skb-\u003elen \u003d\u003d 20 while its linear area is empty, so the\nverdict program sees data \u003d\u003d data_end and drops the packet even though\nthe payload length is sufficient.\n\nKeep the parser read-only, and pull the first 8 bytes in the verdict\nprogram before reading or writing them. Reload data/data_end after\nbpf_skb_pull_data() as required.\n\nFixes: 22a0cc10dacb (\"selftests/bpf: don\u0027t modify the skb in the strparser parser prog\")\nReported-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260701071501.39628-1-jiayuan.chen@linux.dev\n\nCloses: https://lore.kernel.org/bpf/e3a91acd-2b4d-4e93-a3bb-a0e9ee5ede0f@linux.dev/\n" }, { "commit": "475b59db3bd5c7717b5441481ac06f226815cb0a", "tree": "a571e9128df41b5053bc411eea9484a748bc8e8c", "parents": [ "b4b8b334f6b535a86ab83f18d3d241fe01270bc3" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Wed Jul 01 11:51:07 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:59:49 2026 -0700" }, "message": "bpf: Use BPF_CALL_IMM macro consistently in bpf_do_misc_fixups\n\nIn bpf_do_misc_fixups(), the conversion from a function address to a\nBPF immediate value is handled using the BPF_CALL_IMM macro inside the\n\u0027patch_map_ops_generic\u0027 label block. However, immediately following it\nin the \u0027patch_call_imm\u0027 label block, the immediate value is calculated\nmanually by subtracting __bpf_call_base from fn-\u003efunc.\n\nInspired by KaFai Wan\u0027s review comments on fixing helper call offsets,\nuse the BPF_CALL_IMM macro in \u0027patch_call_imm\u0027 as well to clean this up.\nThis removes the redundant manual pointer arithmetic and ensures coding\nstyle consistency across adjacent label blocks within the same function.\n\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260701035107.8069-1-yangtiezhu@loongson.cn\n" }, { "commit": "b4b8b334f6b535a86ab83f18d3d241fe01270bc3", "tree": "5c8ecd9922107ab94256c38c62a72e08cdb394ca", "parents": [ "c4082e93d9be23833a2310473badf2fff9bd5989" ], "author": { "name": "Guillaume Maudoux", "email": "layus.on@gmail.com", "time": "Tue Jun 30 11:57:23 2026 +0200" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:50:30 2026 -0700" }, "message": "selftests/bpf: Mask socket type flags in mptcpify prog\n\nThe mptcpify BPF prog upgrades eligible TCP sockets to MPTCP, but only\nwhen the socket type is exactly SOCK_STREAM. Its update_socket_protocol()\nhook runs on the raw type from userspace, before the socket core masks\nit with SOCK_TYPE_MASK, so the type may still carry SOCK_CLOEXEC or\nSOCK_NONBLOCK in its upper bits and the equality check fails.\n\nAs a result, a socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0) -- what\ncommon libraries do by default -- is silently left as plain TCP. This\nwas hit in practice with curl. Since mptcpify.c is referenced as example\ncode for enabling MPTCP transparently, the same mistake is likely to be\ncopied into real deployments where it fails the same way and is hard to\ndiagnose.\n\nMask the type before comparing, mirroring the socket core. Extend the\ntest to also create the server with SOCK_CLOEXEC set; the same masking\nis applied to start_server_addr() so a flagged type still listens.\n\nFixes: ddba122428a7 (\"selftests/bpf: Add mptcpify test\")\nSigned-off-by: Guillaume Maudoux \u003clayus.on@gmail.com\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260630095723.564392-1-layus.on@gmail.com\n" }, { "commit": "c4082e93d9be23833a2310473badf2fff9bd5989", "tree": "092c6dc26e6cc86c7a1e7b3346dc1698fe20b9b3", "parents": [ "09e7d46e33dd95803c3105eaba0e6de02dd1713e", "37c1e353c9fd68eb27fa2103bfed22835936ec3e" ], "author": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:44:13 2026 -0700" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:44:13 2026 -0700" }, "message": "Merge branch \u0027bpf-tracing_multi-link-info-support\u0027\n\nJiri Olsa says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: tracing_multi link info support\n\nhi,\nadding link info support for tracing_multi link.\n\nAdding the kernel support with related selftests and bpftool support\nto display the tracing_multi link info, the output looks like:\n\n # bpftool link\n ...\n 61: tracing_multi prog 167\n attach_type trace_fentry_multi btf_obj_id 1 count 3\n btf_id addr cookie func [module]\n 92598 ffffffff825017c4 10 bpf_fentry_test1\n 92600 ffffffff82503814 30 bpf_fentry_test2\n 92601 ffffffff82503824 20 bpf_fentry_test3\n pids test_progs(1540)\n\nthanks,\njirka\n\nv1: https://lore.kernel.org/bpf/20260621204524.61067-1-jolsa@kernel.org/\nv2: https://lore.kernel.org/bpf/20260623142417.275892-1-jolsa@kernel.org/\nv3: https://lore.kernel.org/bpf/20260629143844.862369-1-jolsa@kernel.org/\n\nv4 changes:\n- fix wrong allocation check [Alexei]\n\nv3 changes:\n- added acks [Andrii, Leon]\n- display cookies as decimal numbers [Andrii]\n- renamed obj_id to btf_obj_id [Andrii]\n- several fixes in bpftool change [Andrii]\n\nv2 changes:\n- fix kernel symbol search logic [sashiko]\n- typo fixes [bots]\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260629212208.895962-1-jolsa@kernel.org\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\n" }, { "commit": "37c1e353c9fd68eb27fa2103bfed22835936ec3e", "tree": "092c6dc26e6cc86c7a1e7b3346dc1698fe20b9b3", "parents": [ "d36e4dd547bb061eb78c7aca54f4575395598540" ], "author": { "name": "Jiri Olsa", "email": "jolsa@kernel.org", "time": "Mon Jun 29 23:22:08 2026 +0200" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:44:12 2026 -0700" }, "message": "bpftool: Add tracing_multi link info output\n\nAdding bpftool support to show tracing_multi link details,\nthe new output looks like:\n\n # bpftool link\n ...\n 61: tracing_multi prog 167\n attach_type trace_fentry_multi btf_obj_id 1 count 3\n btf_id addr cookie func [module]\n 92598 ffffffff825017c4 10 bpf_fentry_test1\n 92600 ffffffff82503814 30 bpf_fentry_test2\n 92601 ffffffff82503824 20 bpf_fentry_test3\n pids test_progs(1540)\n\nAssisted-by: Codex:GPT-5\n\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260629212208.895962-4-jolsa@kernel.org\n" }, { "commit": "d36e4dd547bb061eb78c7aca54f4575395598540", "tree": "b4633c8785b4fff79d9fa8df1a11a0ee2d085cea", "parents": [ "859055e07697c46f6964109981aa1cd23d6bde47" ], "author": { "name": "Jiri Olsa", "email": "jolsa@kernel.org", "time": "Mon Jun 29 23:22:07 2026 +0200" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:44:12 2026 -0700" }, "message": "selftests/bpf: Add tracing_multi link info tests\n\nAdding tracing_multi link info tests that follow the kprobe_multi\nand uprobe_multi tests logic.\n\nAssisted-by: Codex:GPT-5\n\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260629212208.895962-3-jolsa@kernel.org\n" }, { "commit": "859055e07697c46f6964109981aa1cd23d6bde47", "tree": "c828f2bebb60321921803801b9f350ba89f4e8db", "parents": [ "09e7d46e33dd95803c3105eaba0e6de02dd1713e" ], "author": { "name": "Jiri Olsa", "email": "jolsa@kernel.org", "time": "Mon Jun 29 23:22:06 2026 +0200" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 12:44:12 2026 -0700" }, "message": "bpf: Add tracing_multi link info support\n\nAdding BPF_OBJ_GET_INFO_BY_FD support for tracing_multi links.\n\nWe expose following tracing_multi link data:\n- attach_type of the program\n- number of ids\n- array of BTF ids\n- array of its related kernel addresses\n- array of cookies\n\nThe change follows the kprobe_multi and uprobe_multi link-info convention\nof optional output arrays with an in/out count,\n\nOn top of standard tracing link data we also expose addresses, because they\nare useful info for user (especially when the attachment was done via pattern).\nThis data is hidden when kallsyms does not allow exposing kernel pointer values.\n\nAssisted-by: Codex:GPT-5\n\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nAcked-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nAcked-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260629212208.895962-2-jolsa@kernel.org\n" }, { "commit": "09e7d46e33dd95803c3105eaba0e6de02dd1713e", "tree": "be1005a67a053b20f512863c47f661e4dafa408f", "parents": [ "f29997a6d920cdfa2c43995e17c596c599ff261b", "163944262f8646bf3a1eec557b6aff1f38582a9f" ], "author": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:27:37 2026 -0700" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:27:38 2026 -0700" }, "message": "Merge branch \u0027bpf-copy-per-cpu-map-value-padding-in-copy_map_value_long\u0027\n\nLeon Hwang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Copy per-CPU map value padding in copy_map_value_long()\n\nSashiko reported [1]:\n\nThis is a pre-existing issue, but does iterating over per-CPU maps expose\nuninitialized kernel heap memory?\n\nWhen working with per-CPU maps, temporary buffers are allocated using kmalloc\nwithout the __GFP_ZERO flag in functions like bpf_iter_init_array_map in\nkernel/bpf/arraymap.c:\n\nkernel/bpf/arraymap.c:bpf_iter_init_array_map() {\n ...\n value_buf \u003d kmalloc(buf_size, GFP_USER | __GFP_NOWARN);\n ...\n}\n\nThis is also done in kernel/bpf/hashtab.c:bpf_iter_init_hash_map().\n\nIf the map contains a BTF record, bpf_obj_memcpy in include/linux/bpf.h\nexplicitly stops at map-\u003evalue_size instead of filling the entire rounded-up\nsize:\n\ninclude/linux/bpf.h:bpf_obj_memcpy() {\n ...\n memcpy(dst + curr_off, src + curr_off, size - curr_off);\n ...\n}\n\nThis fails to overwrite the padding bytes up to round_up(map-\u003evalue_size, 8).\n\n[1] https://lore.kernel.org/bpf/20260622150844.28C551F000E9@smtp.kernel.org/\n\n\u003d\u003d\u003d\nFor example,\n\nstruct map_uninit_value {\n\tstruct prog_test_ref_kfunc __kptr_untrusted *unref_ptr;\n\t__u32 data;\n} __attribute__((packed));\n\nstruct {\n\t__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);\n\t__type(key, int);\n\t__type(value, struct map_uninit_value);\n\t__uint(max_entries, 1);\n} pcpu_array SEC(\".maps\");\n\nThere are 4 padding bytes in the kernel percpu_array map elements.\n\nWhen lookup element from \u0027pcpu_array\u0027 map, for each CPU, the 4 padding\nbytes memory allocated by syscall.c::map_lookup_elem():kvmalloc() could\nbe exposed to user space.\n\nWithout the fix, the selftest could fail with:\n\ntest_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memory\nmismatch\nactual:\n\t2B 2B 2B 2B\nexpected:\n\t00 00 00 00\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260624155115.85196-1-leon.hwang@linux.dev\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\n" }, { "commit": "163944262f8646bf3a1eec557b6aff1f38582a9f", "tree": "be1005a67a053b20f512863c47f661e4dafa408f", "parents": [ "7cf9cd98cf6f0df3befc167ca6b54c07014d71de" ], "author": { "name": "Leon Hwang", "email": "leon.hwang@linux.dev", "time": "Wed Jun 24 23:51:15 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:27:37 2026 -0700" }, "message": "selftests/bpf: Verify no non-zeroed kernel heap memory exposure\n\nWhen lookup element from those per-CPU maps, which have special field\nin their values and their value size is not equal to roundup(value_sz, 8),\nthe padding size of temporary non-zeroed kernel heap memory allocated by\nkvmalloc should not be exposed to user space.\n\nWithout the fix:\n\ntest_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memory mismatch\nactual:\n\t2B 2B 2B 2B\nexpected:\n\t00 00 00 00\n\nAssisted-by: Codex:gpt-5.5\n\nSigned-off-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260624155115.85196-3-leon.hwang@linux.dev\n" }, { "commit": "7cf9cd98cf6f0df3befc167ca6b54c07014d71de", "tree": "ba9f785e6eebb69e564a0c77bab006114e693fe0", "parents": [ "f29997a6d920cdfa2c43995e17c596c599ff261b" ], "author": { "name": "Leon Hwang", "email": "leon.hwang@linux.dev", "time": "Wed Jun 24 23:51:14 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:27:37 2026 -0700" }, "message": "bpf: Copy per-CPU map value padding in copy_map_value_long()\n\nIn kernel, per-CPU map elements are stored with\nround_up(map-\u003evalue_size, 8) bytes. On UAPI lookup paths, it copies the\nrounded size for each CPU into a temporary buffer.\n\nHowever, copy_map_value_long() passes \u0027map-\u003evalue_size\u0027 to\nbpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies\naround those fields with memcpy(), and does not copy the tail padding\nbetween \u0027map-\u003evalue_size\u0027 and round_up(map-\u003evalue_size, 8).\n\nThe temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a\nresult, when the per-CPU map\u0027s value size is not equal to\nround_up(map-\u003evalue_size, 8), UAPI LOOKUP_ELEM and its variants can return\nstale heap contents from that padding to user space. The same issue\napplies to bpf_iter for per-CPU maps.\n\nPass round_up(map-\u003evalue_size, 8) to bpf_obj_memcpy() from\ncopy_map_value_long(), so per-CPU maps both with and without special\nfields copy the entire per-CPU slot. Remove the now redundant round_up()\nfrom bpf_obj_memcpy()\u0027s long_memcpy path.\n\nFixes: 448325199f57 (\"bpf: Add copy_map_value_long to copy to remote percpu memory\")\nSigned-off-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260624155115.85196-2-leon.hwang@linux.dev\n" }, { "commit": "f29997a6d920cdfa2c43995e17c596c599ff261b", "tree": "bfa65907811f4a6c2276a73f1b1eb4be525d7770", "parents": [ "a954c9e3168cdf0c3cad07b43dfc8ca2945d773a", "f7f540e19751face50c68bb9ce58460fcb46c293" ], "author": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:17:43 2026 -0700" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:17:43 2026 -0700" }, "message": "Merge branch \u0027tools-bpf-bpftool-fix-vmlinux-btf-state-cleanup\u0027\n\nYichong Chen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ntools/bpf/bpftool: Fix vmlinux BTF state cleanup\n\nThis series fixes stale vmlinux BTF state in bpftool batch mode.\n\nPatch 1 resets the map command cached vmlinux BTF pointer when the\ncommand releases it, and avoids freeing the cached object from the\nmap lookup path.\n\nPatch 2 resets the struct_ops command cached vmlinux BTF pointer and\ndependent cached map info state after each struct_ops command.\n\nChanges in v4:\n- Add Emil\u0027s Reviewed-by tag to patch 1.\n- Inline the struct_ops cleanup instead of adding a helper.\n\nChanges in v3:\n- Add Fixes tags to both patches.\n\nChanges in v2:\n- Fold the map lookup path fix into patch 1.\n- Update patch 1 subject and commit message to cover map commands\n rather than only map dump.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/12A35C14DA710D2E+20260624025055.1574875-1-chenyichong@uniontech.com\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\n" }, { "commit": "f7f540e19751face50c68bb9ce58460fcb46c293", "tree": "bfa65907811f4a6c2276a73f1b1eb4be525d7770", "parents": [ "66d7e39e49b0dd57610c9b63afc65b4d5690983b" ], "author": { "name": "Yichong Chen", "email": "chenyichong@uniontech.com", "time": "Wed Jun 24 10:50:55 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:17:43 2026 -0700" }, "message": "tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands\n\nstruct_ops frees the global btf_vmlinux object.\n\nIn batch mode, a later struct_ops command can reuse stale state.\n\nReset the BTF pointer and cached map info state.\n\nFixes: 65c93628599d (\"bpftool: Add struct_ops support\")\nSigned-off-by: Yichong Chen \u003cchenyichong@uniontech.com\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/9F9017160ABE125F+20260624025055.1574875-3-chenyichong@uniontech.com\n" }, { "commit": "66d7e39e49b0dd57610c9b63afc65b4d5690983b", "tree": "9d2853665f3ed96feda0e52cac4190d116607ee1", "parents": [ "a954c9e3168cdf0c3cad07b43dfc8ca2945d773a" ], "author": { "name": "Yichong Chen", "email": "chenyichong@uniontech.com", "time": "Wed Jun 24 10:50:54 2026 +0800" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:17:43 2026 -0700" }, "message": "tools/bpf/bpftool: Reset vmlinux BTF after map commands\n\nget_map_kv_btf() caches the vmlinux BTF object when a map uses\nbtf_vmlinux_value_type_id. map dump released that object when the\ncommand completed, but left the global pointer stale.\n\nThe same cached object can also be returned to print_key_value(), which\nfreed it directly. That leaves btf_vmlinux dangling before the command\ncleanup path runs.\n\nUse free_map_kv_btf() for per-entry cleanup, and reset the cached\nbtf_vmlinux pointer when the map command releases the object. This keeps\nbatch mode from reusing a freed BTF object.\n\nFixes: 4e1ea33292ff (\"bpftool: Support dumping a map with btf_vmlinux_value_type_id\")\nSigned-off-by: Yichong Chen \u003cchenyichong@uniontech.com\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/bpf/9072F43B3F74DF91+20260624025055.1574875-2-chenyichong@uniontech.com\n" }, { "commit": "a954c9e3168cdf0c3cad07b43dfc8ca2945d773a", "tree": "661b7075406ed0ebb3e750b1743439f056012d0c", "parents": [ "53435562a725962e4de0c29653223129ba11643a" ], "author": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Tue Jun 30 13:54:18 2026 -0700" }, "committer": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Wed Jul 01 11:14:34 2026 -0700" }, "message": "bpftool: Strip all -Wformat* flags from bootstrap libbpf build\n\nCommit 9080b97689db (\"bpftool: Pass host flags to bootstrap libbpf\")\nstarted building the bootstrap libbpf with HOST_CFLAGS, stripping the\nwarning options that are unsuitable for that build by filtering out\n-W -Wall -Wextra -Wformat -Wformat-signedness.\n\nHOST_CFLAGS inherits EXTRA_WARNINGS, which includes -Wformat-security\nand -Wformat-y2k. The filter drops -Wall and -Wformat (the latter being\nwhat actually enables -Wformat), but leaves those two -Wformat-* children\nin LIBBPF_BOOTSTRAP_CFLAGS. Building the bootstrap libbpf with it then\nwarns:\n\n cc1: warning: \u0027-Wformat-y2k\u0027 ignored without \u0027-Wformat\u0027\n cc1: warning: \u0027-Wformat-security\u0027 ignored without \u0027-Wformat\u0027\n\nThe warning is easy to miss in an in-tree build: tools/lib/bpf/Makefile\nre-adds -Wall via \"override CFLAGS +\u003d -Wall\", which re-enables -Wformat\nfor the libbpf objects, so only libbpf\u0027s feature-detection probe (which\nuses the passed CFLAGS verbatim) leaks the two warnings. The standalone\nlibbpf Makefile (github.com/libbpf/libbpf, used by the bpftool mirror)\ninstead uses \"CFLAGS ?\u003d ... -Wall\", which the passed-in CFLAGS overrides,\nso -Wall is never re-added and every bootstrap object warns.\n\nUse a -Wformat% wildcard in the filter-out so the orphaned children are\nremoved together with the parent.\n\nFixes: 9080b97689db (\"bpftool: Pass host flags to bootstrap libbpf\")\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nAcked-by: Quentin Monnet \u003cqmo@kernel.org\u003e\nLink: https://lore.kernel.org/bpf/20260630205418.3483969-1-andrii@kernel.org\n" }, { "commit": "0469d460a598d03fc85ebd97f99640e6c579e2a2", "tree": "60db252156e4f70615071fab658b959095a5f9dc", "parents": [ "a225f8c20712713406ae47024b8df42deacddd4a", "c3716a3c43465641ded6e01c0b187de42e87a80d" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 01 18:56:27 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 01 18:56:27 2026 +0200" }, "message": "Merge tag \u0027nf-26-06-30\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*.\nDue to bug volume the plan is to make a second *net* pull request\nthis Friday.\n\n1) Zero nf_conntrack_expect at allocation to prevent uninitialized data\nleaks to userspace. Add missing exp-\u003edir initialization.\n\n2) Prevent out-of-bounds writes in nft_set_pipapo caused by inconsistent\nclones during allocation failures. Fail operations if the clone enters an\nerror state. This was a day-0 bug.\n\n3) Fix use-after-free race between ipset dump and array resizing. Protect\narray pointer access with rcu_read_lock(). From Xiang Mei. Bug existed\nsince v4.20.\n\n4) Validate skb_dst() exists before access in nf_conntrack_sip.\nThis Prevent crash when called from tc ingress or openvswitch.\nFrom Pablo Neira Ayuso. Bug added in 4.3 when ovs gained support\nfor conntrack helpers.\n\n5) Cap the maximum number of expectations to NF_CT_EXPECT_MAX_CNT during\nuserspace helper policy updates. Also from Pablo.\n\n6) Prevent NULL pointer dereference in nft_fib on netdev egress hooks. Add\nnft_fib_netdev_validate() to restrict fib expressions to appropriate\nnetdev hooks. Restrict nft_fib_validate() to IPv4, IPv6, and INET\nprotocols. From Theodor Arsenij Larionov-Trichkine.\nBug was exposed in v5.16 when egress hooks got added.\n\n7) Restrict nfnetlink_queue writes to network headers. Validate IP/IPv6\nheader length and disable extension headers or IP option modifications.\nDisable bridge modification for now, its unlikely anyone is using this.\n\n8) Restrict arbitrary writes to link-layer and network headers in nftables.\nPrevent link-layer modifications from spilling into network headers.\nPrevent writes to IP version and length fields.\n\n9) Restrict L3 checksum update offset to IPv4. Else csum offset can be\nused to munge arbitrary header offsets, rendering the previous change moot.\n\nThese three patches are follow-ups to a 7.1 change that disabled\nheader rewrite ability in unprivileged network namespaces.\nunprivileged netns support is not yet enabled again here.\n\nnetfilter pull request nf-26-06-30\n\n* tag \u0027nf-26-06-30\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nftables: restrict checkum update offset\n netfilter: nftables: restrict linklayer and network header writes\n netfilter: nfnetlink_queue: restrict writes to network header\n netfilter: nft_fib: reject fib expression on the netdev egress hook\n netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master\n netfilter: nf_conntrack_sip: validate skb_dst() before accessing it\n netfilter: ipset: fix race between dump and ip_set_list resize\n netfilter: nft_set_pipapo: don\u0027t leak bad clone into future transaction\n netfilter: nf_conntrack_expect: zero at allocation time\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260630045243.2657-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b72e29e0f7ee329d89f86db8700c8ea99b4a370a", "tree": "ac4ca7ece438c3831892ac9c4d3a9023b615d558", "parents": [ "a9b1f19a6a673ba06820898d0f1ad02883ea1639" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:39:29 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:34:41 2026 +0200" }, "message": "bpf: Prefer dirty packs for eBPF allocations\n\nThe pack allocator only flushes predictors when reusing a dirty pack for\ncBPF, eBPF allocations never trigger a flush. Currently, eBPF picks the\nfirst free pack, which could be a clean pack. As an optimization, leaving\na clean pack for cBPF can avoid flushes.\n\nPrefer dirty packs for eBPF and keep clean packs free for cBPF. This\nmirrors the existing cBPF preference for clean packs: each program kind\nprefers the pack that avoids an extra flush, and falls back to the other\nkind only when no preferred pack has room. eBPF reuse of a dirty pack is\nharmless since eBPF being privileged does not flush.\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "a9b1f19a6a673ba06820898d0f1ad02883ea1639", "tree": "0a8b7398bc9aa2b10005593656ab166ea861d03a", "parents": [ "a23c1c5396a91680703360d1ee28a44657c503c4" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:38:54 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:33:45 2026 +0200" }, "message": "bpf: Prefer packs that won\u0027t trigger an IBPB flush on allocation\n\nCurrently BPF pack allocator picks the chunks from the first available\npack. While this is okay, it naturally leads to more frequent flushes\nwhen there are multiple packs in the system that weren\u0027t used since the\nlast flush.\n\nAs an optimization prefer allocating the new programs from packs that\nare unused since last flush. When all packs are dirty, allocation forces\na flush and marks all packs clean.\n\nBelow are some future optimizations ideas:\n\n 1. Currently, the \"dirty\" tracking is only done at the pack-level.\n Flush frequency can further be reduced with chunk-level tracking.\n This requires a new bitmap per-pack to track the dirty state.\n 2. IBPB flush is done on all CPUs, even if only a single CPU ran the\n BPF program. On a system with hundreds of CPUs this could be a\n major bottleneck forcing hundreds of IPIs to deliver the flush.\n The solution is to track the CPUs where a BPF program ran, and\n issue IBPB only on those CPUs.\n 3. Avoid IBPB when flush is already done at other sources (e.g.\n context switch).\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "a23c1c5396a91680703360d1ee28a44657c503c4", "tree": "ac518258cf27d1e25116130757c8562b963e3932", "parents": [ "0bb99f2cfaae6822d734d69722de30af823efdf3" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:38:38 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:33:40 2026 +0200" }, "message": "bpf: Skip redundant IBPB in pack allocator\n\nbpf_prog_pack_alloc() issues IBPB on all CPUs on every cBPF allocation,\neven when reusing chunks from an existing pack where no new memory was\ntouched since the last IBPB.\n\nSince IBPB on all CPUs is heavy, Dave Hansen suggested to track allocation\nsince last IBPB, and only issue IBPB at reuse for the chunks that have not\nseen an IBPB since they were last freed.\n\nTrack per-pack whether an IBPB is needed via arch_flush_needed. Set it when\nallocating a chunk, reset on IBPB flush. On reuse, conditionally issue the\nflush. Since IBPB invalidates all BTB entries, clear the flag on all packs\nafter flushing.\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "0bb99f2cfaae6822d734d69722de30af823efdf3", "tree": "0e362f71c32615a1d66f83ce70655c69d01cdabe", "parents": [ "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:38:23 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:33:38 2026 +0200" }, "message": "bpf: Restrict JIT predictor flush to cBPF\n\nCurrently predictor flush on memory reuse is done for all BPF JIT\nallocations, but only cBPF programs can be loaded by an unprivileged user.\neBPF is privileged by default, and flushing predictors for all CPUs on\nevery eBPF reuse penalizes the common case for no security benefit.\n\neBPF allocations can be frequent on busy systems, only flush predictors\nfor cBPF programs. Trampoline and dispatcher allocations also skip the\nflush as they are eBPF-only.\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d", "tree": "4d6a2c70d98f256dc4999298e27a89783ab33a96", "parents": [ "96cce16e26dd02a8678f1e87f88a4b5cdb63b995" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:38:07 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:33:38 2026 +0200" }, "message": "x86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT\u003dn.\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "96cce16e26dd02a8678f1e87f88a4b5cdb63b995", "tree": "9cf15a2717185fbce3df83b7be82b1658ef043c7", "parents": [ "a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4" ], "author": { "name": "Pawan Gupta", "email": "pawan.kumar.gupta@linux.intel.com", "time": "Mon Jun 29 22:37:52 2026 -0700" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Jul 01 10:33:35 2026 +0200" }, "message": "bpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don\u0027t reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active.\n\nSigned-off-by: Pawan Gupta \u003cpawan.kumar.gupta@linux.intel.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "a225f8c20712713406ae47024b8df42deacddd4a", "tree": "d7e986f6a63eeaae6772b3fd1b656c77b746a72c", "parents": [ "bf83ee45874e9f071478bed39f9cf40cc741629f" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Mon Jun 29 16:44:59 2026 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 01 09:09:38 2026 +0100" }, "message": "net/sched: hhf: clear heavy-hitter state on reset\n\nHHF reset does not clear the classifier state used to identify heavy\nhitters. Packets after reset can therefore be scheduled using flow\nhistory from before the reset.\n\nThe reset operation should return the qdisc to an empty state.\n\nClear the heavy-hitter classifier tables when HHF is reset.\n\nFixes: 10239edf86f1 (\"net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc\")\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "bf83ee45874e9f071478bed39f9cf40cc741629f", "tree": "dd435c45de3df1750bc611e9bee48e6ffea415a2", "parents": [ "adc49c7ba690c9b33b8392ec27397456b65d0893" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Sun Jun 28 13:48:47 2026 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jul 01 09:00:25 2026 +0100" }, "message": "net/sched: dualpi2: clear stale classification on filter miss\n\nDualPI2 leaves previous classification state attached to an skb when\nfilter classification returns no match. The enqueue path can then act\non stale state from an earlier classification attempt.\n\nA filter miss should fall back to the default class without reusing old\nper-packet classification data.\n\nInitialize the classification result to CLASSIC before running the\nclassifier. Explicit L4S, priority, and successful filter\nclassification can still override that default.\n\nFixes: 8f9516daedd6 (\"sched: Add enqueue/dequeue of dualpi2 qdisc\")\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "665159e246749578d4e4bfe106ee3b74edcdab18", "tree": "42f7d7c0f347b318766f665a22327a671f94a4a0", "parents": [ "dc59e4fea9d83f03bad6bddf3fa2e52491777482", "a369299c3f785cf556bbef2de2db0aa2d294c4c9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 30 17:50:44 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jun 30 17:50:44 2026 -1000" }, "message": "Merge tag \u0027probes-fixes-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probes fixes from Masami Hiramatsu:\n \"fprobe fixes and spelling typos:\n\n - Fix NULL pointer dereference in fprobe_fgraph_entry(). Prevent\n general protection faults by checking shadow-stack reservation\n bounds. Skip mid-flight registered fprobes that were not counted\n during sizing.\n\n eprobe: fix string pointer extraction\n\n - Correct the casting of string pointers read from the ringbuffer to\n prevent truncation of base event pointer variables when\n dereferencing FILTER_PTR_STRING fields.\n\n tracing/probes: clean up argument parsing and BTF helper logic\n\n - Make the $ prefix mandatory for comm access: Require the $ prefix\n for special fetcharg variables like $comm and $COMM, preventing\n naming conflicts with regular BTF-based event fields.\n\n - Fix double addition of offset for @+FOFFSET: Clear the temporary\n offset variable after setting the FETCH_OP_FOFFS instruction to\n avoid applying the offset multiple times.\n\n - Remove WARN_ON_ONCE from parse_btf_arg: Prevent triggering a kernel\n warning via user-space input when creating a kprobe event on a raw\n address.\n\n - Fix typo in a log message: Correct a spelling error (\"$-valiable\")\n in trace probe log messages.\n\n samples/trace_events: improve error checking\n\n - Validate the thread pointer returned from kthread_run() in the\n trace events sample code to properly handle thread creation\n failures\"\n\n* tag \u0027probes-fixes-v7.2-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probes: Make the $ prefix mandatory for comm access\n tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()\n tracing/probes: Fix double addition of offset for @+FOFFSET\n tracing: eprobe: read the complete FILTER_PTR_STRING pointer\n tracing/events: Fix to check the simple_tsk_fn creation\n tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg\n tracing: probes: fix typo in a log message\n" }, { "commit": "adc49c7ba690c9b33b8392ec27397456b65d0893", "tree": "16885d4208c59f75451367b50355a97e37be247e", "parents": [ "2f7f2e311106cb838d3f3fb6ef25effdb3f8e366" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Mon Jun 29 15:41:06 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 18:27:26 2026 -0700" }, "message": "net/sched: act_bpf: use rcu_dereference_bh() to read the filter\n\ntcf_bpf_act() can run from the tc egress path, which holds only\nrcu_read_lock_bh(), but reads prog-\u003efilter with rcu_dereference() and\ntrips lockdep:\n\n WARNING: suspicious RCU usage\n net/sched/act_bpf.c:47 suspicious rcu_dereference_check() usage!\n 1 lock held by syz.2.1588/12756:\n #0: (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit net/core/dev.c:4792\n tcf_bpf_act+0x6ae/0x940 net/sched/act_bpf.c:47\n tcf_classify+0x6e4/0x1080 net/sched/cls_api.c:1860\n sch_handle_egress net/core/dev.c:4545 [inline]\n __dev_queue_xmit+0x2185/0x2c00 net/core/dev.c:4808\n packet_sendmsg+0x3dfa/0x5120 net/packet/af_packet.c:3114\n\nThe other tc actions and cls_bpf already use rcu_dereference_bh() here.\nDo the same.\n\nFixes: 1f211a1b929c (\"net, sched: add clsact qdisc\")\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nReviewed-by: Amery Hung \u003cameryhung@gmail.com\u003e\nLink: https://patch.msgid.link/20260629154112.1164986-1-rhkrqnwk98@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2f7f2e311106cb838d3f3fb6ef25effdb3f8e366", "tree": "8f0a03625a89a66fc24c56eb992157984ddf4ace", "parents": [ "5d6dc22d62682d93f5f55f145ad792f2891de911" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jun 29 16:39:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 17:23:25 2026 -0700" }, "message": "selftests: drv-net: tso: don\u0027t touch dangerous feature bits\n\nquery_nic_features() detects which offloads depend on tx-gso-partial\nby enabling everything, turning tx-gso-partial off, and seeing which\nactive features drop out. Enabling all hw features is dangerous:\nwe may end up enabling rx-fcs and loopback for example. For the\nice driver we end up getting into problems with feature dependencies\nso the cleanup isn\u0027t successful either, and the test exits with\nrx-fcs and loopback enabled.\n\nScope the feature probing just to segmentation bits.\n\nFixes: 266b835e5e84 (\"selftests: drv-net: tso: enable test cases based on hw_features\")\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20260629233923.2151144-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d6dc22d62682d93f5f55f145ad792f2891de911", "tree": "f0217e777e8f1927bf04fd6be1430d07ab0e97a0", "parents": [ "1eb8fc67ca41db71c90866ff76c990d85247daef" ], "author": { "name": "Gleb Markov", "email": "markov.gi@npc-ksb.ru", "time": "Mon Jun 29 16:08:54 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 17:18:28 2026 -0700" }, "message": "cxgb4: Fix decode strings dump for T6 adapters\n\nDepending on the value of chip_version, the correct decode set is selected.\nHowever, the subsequent matching with the t4 encoding type in the if-else\nblock results in a reassignment, which leads to the loss of support for\nt6_decode as well as reinitializing of values t4_decode and t5_decode.\n\nThe component history shows that the if-else block previously used for\nthis purpose, as well as the execution order, was not affected by the\nchange.\nFurthermore, it is suggested by the execution order that the scenario with\noverwriting and loss of support will be implemented.\n\nDelete the if-else block.\n\nFixes: 6df397539cb0 (\"cxgb4: Update correct encoding of SGE Ingress DMA States for T6 adapter\")\nSigned-off-by: Gleb Markov \u003cmarkov.gi@npc-ksb.ru\u003e\nReviewed-by: Potnuri Bharat Teja \u003cbharat@chelsio.com\u003e\nLink: https://patch.msgid.link/20260629130856.1168-1-markov.gi@npc-ksb.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1eb8fc67ca41db71c90866ff76c990d85247daef", "tree": "1a6e1881743f8d9766d4d2e301f163c1706f8a00", "parents": [ "976c19de0f22a857ba0112f39635f8fd7a257568" ], "author": { "name": "Longjun Tang", "email": "tanglongjun@kylinos.cn", "time": "Mon Jun 29 10:42:30 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 17:03:37 2026 -0700" }, "message": "virtio_net: disable cb when NAPI is busy-polled\n\nWhen busy-poll is active, napi_schedule_prep() returns false in\nvirtqueue_napi_schedule(), so virtqueue_disable_cb() is skipped.\nThe device may keep firing irqs until reaches virtqueue_napi_complete().\nUnder load (received \u003d\u003d budget), it will lead to a large number\nof spurious interrupts.\n\nFix it by disabling the callback at the virtnet_poll() entry.\nThis keeps the callback off while we poll and it is re-enabled by\nvirtqueue_napi_complete() when going idle.\n\nFixes: ceef438d613f (\"virtio_net: remove custom busy_poll\")\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Longjun Tang \u003ctanglongjun@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260629024230.37325-1-lange_tang@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "976c19de0f22a857ba0112f39635f8fd7a257568", "tree": "8af0b6f53c220706f43c88a195f71c7f6f42bba3", "parents": [ "57bb59ab6fa39128b733c71eaa0ab511109a0ea1" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Mon Jun 29 14:31:14 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 16:58:59 2026 -0700" }, "message": "sctp: fix addr_wq_timer race in sctp_free_addr_wq()\n\nsctp_free_addr_wq() previously removed addr_wq_timer using timer_delete()\nwhile holding addr_wq_lock. However, timer_delete() does not guarantee that\na currently running timer handler has completed.\n\nThis allows a race with sctp_addr_wq_timeout_handler(), where the handler\nmay still run after addr_waitq has been freed, acquire addr_wq_lock, and\naccess freed memory, leading to a use-after-free.\n\nFix this by calling timer_shutdown_sync() before taking addr_wq_lock. This\nguarantees that any in-flight timer handler has finished and prevents the\ntimer from being re-armed during teardown, making subsequent cleanup safe.\n\nFixes: 4db67e808640 (\"sctp: Make the address lists per network namespace\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/5dc95f295bdb5c3f60e880dd9aa5112dc5c071cc.1782757874.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57bb59ab6fa39128b733c71eaa0ab511109a0ea1", "tree": "44e52ab7d8da697652e9e361aa44627c108d81fc", "parents": [ "2a00517db8de4be7df3d483b215c5544fb30a191" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jun 29 16:33:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jun 30 16:54:37 2026 -0700" }, "message": "selftests: net: bump default cmd() timeout to 20 seconds\n\nWe always used 5 sec as the default command timeout. But soon after\nit was introduced, David effectively made us ignore the timeout\n(it was passed to process.communicate() as the wrong argument).\nGal recently fixed that, but turns out the 5 sec is not enough\nfor a lot of tests and setups. The fix caused regressions.\n\nIn particular running reconfig commands (e.g. XDP attach) on mlx5\nwith 32 rings and 9k MTU, on a heavily-debug-enabled kernel takes\nmore than 5 sec. The XDP installation command will time out after\n5 sec but since the sleeps in the kernel are non interruptible\nthe command finishes anyway, leaving the XDP program attached,\nbut with non-zero exit code. defer()ed cleanups are not installed,\nbreaking the environment for subsequent tests.\n\nSince \"install XDP\" is a pretty normal command a \"point fix\"\ndoes not seem appropriate. 32 rings is a fairly reasonable\nconfig, too, so we should just increase the timeout to 20 sec.\n\nThere\u0027s no real reason behind the value of 20.\n\nFixes: 1cf270424218 (\"net: selftest: add test for netdev netlink queue-get API\")\nFixes: f0bd19316663 (\"selftests: net: fix timeout passed as positional argument to communicate()\")\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nAcked-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nLink: https://patch.msgid.link/20260629233348.2145841-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dec4d8118c179b3d12bca7e609054c6011c4f2ce", "tree": "16b2b8afa515f8e35079009a8dd60722ac83592a", "parents": [ "dc59e4fea9d83f03bad6bddf3fa2e52491777482" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Fri Jun 26 05:50:10 2026 -0700" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Wed Jul 01 08:08:27 2026 +0900" }, "message": "bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()\n\nxbc_snprint_cmdline() is meant to be called twice: first with\nbuf\u003dNULL, size\u003d0 to probe the rendered length, then with a real\nbuffer to fill it (the standard snprintf() two-pass pattern). The\nprobe call makes the function compute \"buf + size\" (NULL + 0) and,\non every iteration, advance \"buf +\u003d ret\" from that NULL base and\npass the result back into snprintf().\n\nPointer arithmetic on a NULL pointer is undefined behavior. It is\nharmless in the in-kernel callers today, but the follow-up patches\nrun this same code in the userspace tools/bootconfig parser at kernel\nbuild time, where host UBSan / FORTIFY_SOURCE abort the build.\n\nTrack a running written length (size_t) instead of mutating @buf, and\nonly form \"buf + len\" when @buf is non-NULL. snprintf(NULL, 0, ...)\nis itself well defined and returns the would-be length, so the\ntwo-pass \"probe then fill\" usage returns identical byte counts.\n\nLink: https://lore.kernel.org/all/20260626-bootconfig_using_tools-v7-1-24ab72139c29@debian.org/\n\nFixes: 51887d03aca1 (\"bootconfig: init: Allow admin to use bootconfig for kernel command line\")\nCc: stable@vger.kernel.org\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "e242e974e812e7a47e3088860c80d9492fac314f", "tree": "3572b2a8e481709fbc36c364c9d81d73e79d8b86", "parents": [ "586a989d8b0db75d6f97c80a4f588d46e1df6881" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Tue Jun 30 14:28:05 2026 -0700" }, "committer": { "name": "Alex Williamson", "email": "alex@shazbot.org", "time": "Tue Jun 30 15:50:55 2026 -0600" }, "message": "vfio: selftests: Add luuid to libvfio.mk\u0027s list of libraries, not to the Makefile\n\nLink to the uuid library as part of libvfio.mk instead of as only linking\nit via VFIO selftests\u0027 Makefile, as the whole point of providing libvfio.mk\nis to allow linking the VFIO library functionality into KVM selftests,\nwithout KVM selftests having to know the gory details or duplicate code.\n\nCc: Raghavendra Rao Ananta \u003crananta@google.com\u003e\nCc: David Matlack \u003cdmatlack@google.com\u003e\nCc: Vipin Sharma \u003cvipinsh@google.com\u003e\nCc: Alex Williamson \u003calex@shazbot.org\u003e\nFixes: e65f1bf8a2db (\"vfio: selftests: Extend container/iommufd setup for passing vf_token\")\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nReviewed-by: David Matlack \u003cdmatlack@google.com\u003e\nLink: https://lore.kernel.org/r/20260630212805.474418-1-seanjc@google.com\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n" }, { "commit": "a369299c3f785cf556bbef2de2db0aa2d294c4c9", "tree": "9477c093e08622e75dd53ffabe948ae8db607aee", "parents": [ "367c49d6e283c17b56a31e7a8d964a079244264c" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Jun 25 08:34:48 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:20 2026 +0900" }, "message": "tracing/probes: Make the $ prefix mandatory for comm access\n\nSince $comm or $COMM are not event field but special fetcharg\nvariables to access current-\u003ecomm, It should not be accessed\nwithout \u0027$\u0027 prefix even with typecast.\n\nLink: https://lore.kernel.org/all/178231209724.732967.12049805699091810641.stgit@devnote2/\n\nFixes: 69efd863a785 (\"tracing/eprobes: Allow use of BTF names to dereference pointers\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "367c49d6e283c17b56a31e7a8d964a079244264c", "tree": "9a7a03105d01c359d2aedfbbea7414684e0356af", "parents": [ "9a667b7750dda88cbf1cca96a53a2163b2ee71f7" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Thu Jun 25 08:34:48 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:19 2026 +0900" }, "message": "tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()\n\nfprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of\nthe per-ip fprobe list and fills it in a second walk, both under\nrcu_read_lock() only. A fprobe registered on an already-live ip can\nbecome visible between the two walks, so the fill walk processes an\nexit_handler the sizing walk did not count and used runs past\nreserved_words. If the sizing walk counted nothing, fgraph_data is NULL\nand the first write_fprobe_header() faults:\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:fprobe_fgraph_entry+0xa38/0xf10 kernel/trace/fprobe.c:167\n Call Trace:\n \u003cTASK\u003e\n function_graph_enter_regs+0x44c/0xa10 kernel/trace/fgraph.c:677\n ftrace_graph_func+0xc5/0x140 arch/x86/kernel/ftrace.c:671\n __kernel_text_address+0x9/0x40 kernel/extable.c:78\n arch_stack_walk+0x117/0x170 arch/x86/kernel/stacktrace.c:26\n kmem_cache_free+0x188/0x580 mm/slub.c:6378\n tcp_data_queue+0x18d/0x6550 net/ipv4/tcp_input.c:5590\n [...]\n \u003c/TASK\u003e\n\nThe list cannot be frozen across the two walks, so skip a node that does\nnot fit the reservation and count it as missed.\n\nLink: https://lore.kernel.org/all/20260619184425.3824774-1-rhkrqnwk98@gmail.com/\n\nFixes: 4346ba160409 (\"fprobe: Rewrite fprobe on function-graph tracer\")\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "9a667b7750dda88cbf1cca96a53a2163b2ee71f7", "tree": "a2adcc7fe719e262d1ab2184cc30d4bdeca7384c", "parents": [ "206b25c09080cc20fd4c2bea12d59df4b7ba2121" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Jun 25 08:34:47 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:19 2026 +0900" }, "message": "tracing/probes: Fix double addition of offset for @+FOFFSET\n\nSince commit 533059281ee5 (\"tracing: probeevent: Introduce new argument\n fetching code\") wrongly use @offset local variable during the parsing,\nthe offset value is added twice when dereferencing.\nReset the @offset after setting it in FETCH_OP_FOFFS.\n\nLink: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/\n\nFixes: 533059281ee5 (\"tracing: probeevent: Introduce new argument fetching code\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "206b25c09080cc20fd4c2bea12d59df4b7ba2121", "tree": "bc70dbb7591e71bf459751e440dfe6568d22f5f0", "parents": [ "cda1fbfc5313bb90daa271d45eea4a8d317a8544" ], "author": { "name": "Martin Kaiser", "email": "martin@kaiser.cx", "time": "Thu Jun 25 08:34:46 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:19 2026 +0900" }, "message": "tracing: eprobe: read the complete FILTER_PTR_STRING pointer\n\nFor a char * element in an event, the FILTER_PTR_STRING filter type is\nused. When the event occurs, a pointer is stored in the ringbuffer.\n\nIf an eprobe references such a char * element of a \"base event\", the\nstored pointer is truncated when it\u0027s read from the ringbuffer.\n\n$ cd /sys/kernel/tracing\n$ echo \u0027e rcu.rcu_utilization $s:x64 $s:string\u0027 \u003e dynamic_events\n$ echo 1 \u003e tracing_on\n$ echo 1 \u003e events/eprobes/enable\n$ sleep 1\n$ echo 0 \u003e events/eprobes/enable\n$ cat trace\n \u003cidle\u003e-0 ...: (rcu.rcu_utilization) arg1\u003d0x4f arg2\u003d(fault)\n \u003cidle\u003e-0 ...: (rcu.rcu_utilization) arg1\u003d0x2 arg2\u003d(fault)\n\nThe problem is in get_event_field\n\n\tval \u003d (unsigned long)(*(char *)addr);\n\naddr points to the position in the ringbuffer where the pointer was\nstored. The assignment reads only the lowest byte of the pointer.\n\nFix the cast to read the whole pointer. The output of the test above\nis now\n\n\u003cidle\u003e-0 ... arg1\u003d0xffffffff81c7d3f3 arg2\u003d\"Start scheduler-tick\"\n\u003cidle\u003e-0 ... arg1\u003d0xffffffff81c57340 arg2\u003d\"End scheduler-tick\"\n\nLink: https://lore.kernel.org/all/20260620145339.3234726-1-martin@kaiser.cx/\n\nFixes: f04dec93466a (\"tracing/eprobes: Fix reading of string fields\")\nSigned-off-by: Martin Kaiser \u003cmartin@kaiser.cx\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "cda1fbfc5313bb90daa271d45eea4a8d317a8544", "tree": "93f527e1a7a6b3848b6c0dfcc0cf7eb5cc9992d7", "parents": [ "251a8fe1b9aedccd298b77bc28426d564c5a923f" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Jun 25 08:34:46 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:19 2026 +0900" }, "message": "tracing/events: Fix to check the simple_tsk_fn creation\n\nSashiko pointed that this sample code does not correctly handle the\nfailure of thread creation because kthread_run() can return -errno.\n\nCheck the simple_tsk_fn is correctly initialized (created) or not.\n\nLink: https://lore.kernel.org/all/178165817322.269421.3992299509400184196.stgit@devnote2/\n\nLink: https://sashiko.dev/#/patchset/178092865666.163648.10457567771536160909.stgit%40devnote2\n\nFixes: 9cfe06f8cd5c (\"tracing/events: add trace-events-sample\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "251a8fe1b9aedccd298b77bc28426d564c5a923f", "tree": "4d5647e9dfdf9315971e2e581a631198c11ca81d", "parents": [ "72c8646956ffc8050bb8be5988a0f28fc37e1ac4" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Thu Jun 25 08:34:46 2026 +0900" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Tue Jun 30 23:58:19 2026 +0900" }, "message": "tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg\n\nSashiko found that user can cause this WARN_ON_ONCE() easily\nwith adding a kprobe event based on a raw address with BTF\nparameter.\n\nSince this is not an unexpected condition, remove the\nWARN_ON_ONCE().\n\nLink: https://lore.kernel.org/all/178177265367.2059927.13789953014706792126.stgit@mhiramat.tok.corp.google.com/\n\nLink: https://sashiko.dev/#/patchset/178165816303.269421.7302603996990753309.stgit%40devnote2\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nFixes: b576e09701c7 (\"tracing/probes: Support function parameters if BTF is available\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4", "tree": "fab0413526fad744beee6f4b72df2ef6eb6296be", "parents": [ "9b51a6155d14389876916726430da30eabb1d4ed" ], "author": { "name": "Matt Bobrowski", "email": "mattbobrowski@google.com", "time": "Sun Jun 28 20:11:03 2026 +0000" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Tue Jun 30 16:31:56 2026 +0200" }, "message": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\n\nWhen CONFIG_BPF_LSM\u003dy is set, BPF inode storage maps\n(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,\nif the BPF LSM is not explicitly enabled at boot time (e.g. omitted\nfrom the \"lsm\u003d\" boot parameter), lsm_prepare() is never executed for\nthe BPF LSM.\n\nConsequently, the BPF inode security blob offset\n(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at\nits default compiled size of 8 bytes instead of being updated to a\nvalid offset past the reserved struct rcu_head (typically 16 bytes\nor more).\n\nWhen a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE\nmap, bpf_inode() evaluates inode-\u003ei_security + 8. This erroneously\naliases the struct rcu_head.func callback pointer at the beginning\nof the inode-\u003ei_security blob. During subsequent map element cleanup\nor inode destruction, writing NULL to owner_storage clears the queued\nRCU callback pointer. When rcu_do_batch() later executes the queued\ncallback, it attempts an instruction fetch at address 0x0, triggering\nan immediate kernel panic.\n\nFix this by introducing a global bpf_lsm_initialized boolean flag\nmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()\nwhen the LSM framework successfully registers the BPF LSM. Gate map\nallocation in inode_storage_map_alloc() on this flag, returning\n-EOPNOTSUPP if the BPF LSM is in turn uninitialized.\n\nThis fail-fast approach prevents userspace from allocating inode\nstorage maps when the supporting BPF LSM infrastructure is absent,\navoiding zombie map states.\n\nFixes: 8ea636848aca (\"bpf: Implement bpf_local_storage for inodes\")\nReported-by: oxsignal \u003cawo@kakao.com\u003e\nSigned-off-by: Matt Bobrowski \u003cmattbobrowski@google.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nReviewed-by: Amery Hung \u003cameryhung@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com\n" }, { "commit": "2a00517db8de4be7df3d483b215c5544fb30a191", "tree": "ba59a665168c011885462079eac2977b095aa898", "parents": [ "e5b811fe793166aecc59b085c1b7c31262ef2316" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Mon Jun 29 10:21:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 30 15:14:35 2026 +0200" }, "message": "bridge: stp: Fix a potential use-after-free when deleting a bridge\n\nThe three STP timers are not supposed to be armed while the bridge is\nadministratively down. They are synchronously deactivated when the\nbridge is put administratively down and the various call sites check for\n\u0027IFF_UP\u0027 before arming them.\n\nThis check is missing from br_topology_change_detection() and it is\npossible to engineer a situation in which the topology change timer is\narmed while the bridge is administratively down, resulting in a\nuse-after-free [1] when the bridge is deleted.\n\nFix by adding the missing check and for good measures synchronously\nshutdown the three timers when the bridge is deleted.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Noam Rathaus \u003cnoamr@ssd-disclosure.com\u003e\nReported-by: Neil Young \u003ccontact@ssd-disclosure.com\u003e\nAcked-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260629072117.497959-1-idosch@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e5b811fe793166aecc59b085c1b7c31262ef2316", "tree": "b216a2832369671689d39fc8595610f40062f86f", "parents": [ "dbf803bc4a8b0522c9a12560c20905a5952d1cb9" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sun Jun 28 07:12:29 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 30 13:15:30 2026 +0200" }, "message": "net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF\n\nThe teql master-\u003eslaves singly linked list is not protected against\nmultiple writes. It can be mod\u0027ed concurently from teql_master_xmit(),\nteql_dequeue(), teql_init() and teql_destroy() without holding any list\nlock or RCU protection.\n\nzdi-disclosures@trendmicro.com has demonstrated that the qdisc is freed\nafter an RCU grace period, but teql_master_xmit() running on another\nCPU can still hold a stale pointer into the list, resulting in a\nslab-use-after-free:\n\nBUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0\nRead of size 8 at addr ffff888013fb0440 by task poc/332\nFreed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512)\n\nThe fix?\nAdd a per-master slaves_lock spinlock that serializes all mutations of\nmaster-\u003eslaves and the NEXT_SLAVE() links in teql_destroy() and\nteql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock\naround those updates.\nAnnotate master-\u003eslaves and the per-slave -\u003enext pointer with __rcu and\nuse the appropriate RCU accessors everywhere they are touched:\nrcu_assign_pointer() on the writer side (under slaves_lock),\nrcu_dereference_protected() for the writer-side loads (also under\nslaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and\nrtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(),\nwhich run under RTNL.\nPair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list\ntraversal in teql_master_xmit(), so that readers either observe a fully\nlinked list or are deferred until the in-flight mutation completes. The two\nearly-return paths in teql_master_xmit() are updated to release the RCU-bh\nread-side critical section before returning, since leaving it held would\ndisable BH on that CPU for good.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: zdi-disclosures@trendmicro.com\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260628111229.669751-1-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "dbf803bc4a8b0522c9a12560c20905a5952d1cb9" }