)]}' { "log": [ { "commit": "b77b21fbd0ee0bab64acbbe63d0a2ebcc9f14373", "tree": "c212ed854b49be86b893b5454730844e18828fbc", "parents": [ "e10f05597453c20edcf77b850159d16608bc2840", "028ef9c96e96197026887c0f092424679298aae8" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon Apr 13 12:09:38 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon Apr 13 12:09:38 2026 +0200" }, "message": "Merge tag \u0027v7.0\u0027\n\nLinux 7.0\n" }, { "commit": "e10f05597453c20edcf77b850159d16608bc2840", "tree": "f3477203d38b91582b18fcff73202935c23e37e0", "parents": [ "0cb6eb906c0fb4ca679ad8f2ce655dec25414bc6" ], "author": { "name": "Kuan-Wei Chiu", "email": "visitorckw@gmail.com", "time": "Sun Apr 12 21:19:51 2026 +0000" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon Apr 13 12:09:10 2026 +0200" }, "message": "power: reset: Add QEMU virt-ctrl driver\n\nAdd a new driver for the \u0027virt-ctrl\u0027 device found on QEMU virt machines\n(e.g. m68k). This device provides a simple interface for system reset\nand power off [1].\n\nThis driver utilizes the modern system-off API to register callbacks\nfor both system restart and power off. It also registers a reboot\nnotifier to catch SYS_HALT events, ensuring that LINUX_REBOOT_CMD_HALT\nis properly handled. It is designed to be generic and can be reused by\nother architectures utilizing this QEMU device.\n\nLink: https://gitlab.com/qemu-project/qemu/-/blob/v10.2.0/hw/misc/virt_ctrl.c [1]\nSigned-off-by: Kuan-Wei Chiu \u003cvisitorckw@gmail.com\u003e\nAcked-by: Sebastian Reichel \u003csebastian.reichel@collabora.com\u003e\nLink: https://patch.msgid.link/20260412211952.3564033-2-visitorckw@gmail.com\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\n" }, { "commit": "0cb6eb906c0fb4ca679ad8f2ce655dec25414bc6", "tree": "f4d031b7880978ee227b3dc416eec9c130eae1e0", "parents": [ "a6b8c4537a43a9efd3ae0a39a3769af09d0695eb" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon Apr 13 12:08:30 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon Apr 13 12:08:30 2026 +0200" }, "message": "Revert \"power: reset: Add QEMU virt-ctrl driver\"\n\nThis reverts commit 9235a5300a42e40c9be3f140a40453717e4a5a4e.\n\nIt causes sparse warnings.\n" }, { "commit": "028ef9c96e96197026887c0f092424679298aae8", "tree": "6e2e13adb3ebf0a7a19583d58009f8372b592387", "parents": [ "10d97b74e2eef787d823f9bc05cb044b47d25c41" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 13:48:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 13:48:06 2026 -0700" }, "message": "Linux 7.0\n" }, { "commit": "10d97b74e2eef787d823f9bc05cb044b47d25c41", "tree": "c7b0507c7975e01dcdb3bde9cdf22073b24bcf7e", "parents": [ "35bdc192d829164a6e47184d06401918fe3d7f1f", "51520e03e70d6c73e33ee7cbe0319767d05764fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 11:56:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 11:56:07 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - Fix the error path ordering when the driver-private descriptor\n allocation fails\n\n* tag \u0027edac_urgent_for_7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/mc: Fix error path ordering in edac_mc_alloc()\n" }, { "commit": "35bdc192d829164a6e47184d06401918fe3d7f1f", "tree": "a4de9ee9b0132cf296df9df029da7210841e6ec3", "parents": [ "ab3dee26406be0ed0a26af70311dcdc760db3996", "703ccb63ae9f7444d6ff876d024e17f628103c69" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 10:42:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 10:42:40 2026 -0700" }, "message": "Merge tag \u0027wq-for-7.0-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fix from Tejun Heo:\n \"This is a fix for a stall which triggers on ordered workqueues when\n there are multiple inactive work items during workqueue property\n changes through sysfs, which doesn\u0027t happen that frequently.\n\n While really late, the fix is very low risk as it just repeats an\n operation which is already being performed:\n\n - Fix incomplete activation of multiple inactive works when\n unplugging a pool_workqueue, where the pending_pwqs list\n wasn\u0027t being updated for subsequent works\"\n\n* tag \u0027wq-for-7.0-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works\n" }, { "commit": "ab3dee26406be0ed0a26af70311dcdc760db3996", "tree": "c2858a4f499072dc4e145bb547b4f63bc0879b30", "parents": [ "02640d8886a13a78d20a834d94d3eda9269a0606", "d6e152d905bdb1f32f9d99775e2f453350399a6a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 10:01:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 10:01:55 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Thomas Gleixner:\n \"Two fixes for the time/timers subsystem:\n\n - Invert the inverted fastpath decision in check_tick_dependency(),\n which prevents NOHZ full to stop the tick. That\u0027s a regression\n introduced in the 7.0 merge window.\n\n - Prevent a unpriviledged DoS in the clockevents code, where user\n space can starve the timer interrupt by arming a timerfd or posix\n interval timer in a tight loop with an absolute expiry time in the\n past. The fix turned out to be incomplete and was was amended\n yesterday to make it work on some 20 years old AMD machines as\n well. All issues with it have been confirmed to be resolved by\n various reporters\"\n\n* tag \u0027timers-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n clockevents: Prevent timer interrupt starvation\n tick/nohz: Fix inverted return value in check_tick_dependency() fast path\n" }, { "commit": "02640d8886a13a78d20a834d94d3eda9269a0606", "tree": "78de7fcf3526b29463ed5b6a397164c926f1ba1d", "parents": [ "d71358127c6277521e2c31566b95b2fd20a38be9", "14a857056466be9d3d907a94e92a704ac1be149b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:30:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:30:20 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n \"Fix DL server related slowdown to deferred fair tasks\"\n\n* tag \u0027sched-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/deadline: Use revised wakeup rule for dl_server\n" }, { "commit": "d71358127c6277521e2c31566b95b2fd20a38be9", "tree": "1294839b719a83b09f928f6e214cd52f137293b2", "parents": [ "c919577eeed096bd80d6147a386701221df10484", "0422b07bc4c296b736e240d95d21fbfebbfaa2ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:27:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:27:09 2026 -0700" }, "message": "Merge tag \u0027ras-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 MCE fix from Ingo Molnar:\n \"Fix incorrect hardware errors reported on Zen3 CPUs, such as bogus\n L3 cache deferred errors (Yazen Ghannam)\"\n\n* tag \u0027ras-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mce/amd: Filter bogus hardware errors on Zen3 clients\n" }, { "commit": "c919577eeed096bd80d6147a386701221df10484", "tree": "f3ca1ae30ea6e6ab22a06b63348946e05449e031", "parents": [ "8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d", "16bcbe6738bea7b4aee0a29324ce12c21c4b0ea0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:17:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:17:52 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Ingo Molnar:\n \"Four Intel uncore PMU driver fixes by Zide Chen\"\n\n* tag \u0027perf-urgent-2026-04-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel/uncore: Remove extra double quote mark\n perf/x86/intel/uncore: Fix die ID init and look up bugs\n perf/x86/intel/uncore: Skip discovery table for offline dies\n perf/x86/intel/uncore: Fix iounmap() leak on global_init failure\n" }, { "commit": "8648ac819d4bc08f7d2a1e0bc9ec2d83de31f19d", "tree": "cbae1e7a9f157adee5a9b2c3fde23f88204f2c78", "parents": [ "f5459048c38a00fc583658d6dcd0f894aff6df8f", "3d14bd48e3a77091cbce637a12c2ae31b4a1687c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:11:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 12 08:11:02 2026 -0700" }, "message": "Merge tag \u0027v7.0-p5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Enforce rx socket buffer limit in af_alg\n\n - Fix array overflow in af_alg_pull_tsgl\n\n - Fix out-of-bounds access when parsing extensions in X.509\n\n - Fix minimum rx size check in algif_aead\n\n* tag \u0027v7.0-p5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: algif_aead - Fix minimum RX size check for decryption\n X.509: Fix out-of-bounds access when parsing extensions\n crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n crypto: af_alg - limit RX SG extraction by receive buffer budget\n" }, { "commit": "3d14bd48e3a77091cbce637a12c2ae31b4a1687c", "tree": "071d9381c94e2d2572b5439e626b28d1fa9ecf1a", "parents": [ "d702c3408213bb12bd570bb97204d8340d141c51" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sun Apr 12 13:32:21 2026 +0800" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sun Apr 12 13:38:19 2026 +0800" }, "message": "crypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption. Fix this by adding the\nrequired extra length.\n\nReported-by: syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com\nReported-by: Daniel Pouzzner \u003cdouzzer@mega.nu\u003e\nFixes: d887c52d6ae4 (\"crypto: algif_aead - overhaul memory management\")\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "d702c3408213bb12bd570bb97204d8340d141c51", "tree": "9a18534c1e1ff8193ee49be0612a78066a1525f1", "parents": [ "31d00156e50ecad37f2cb6cbf04aaa9a260505ef" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Tue Apr 07 12:58:18 2026 +0200" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sun Apr 12 13:38:19 2026 +0800" }, "message": "X.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length. Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list.\n\nFixes: 30eae2b037af (\"KEYS: X.509: Parse Basic Constraints for CA\")\nFixes: 567671281a75 (\"KEYS: X.509: Parse Key Usage\")\nReported-by: Leo Lin \u003cleo@depthfirst.com\u003e # off-list\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nReviewed-by: Ignat Korchagin \u003cignat@linux.win\u003e\nCc: stable@vger.kernel.org # v6.4+\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "31d00156e50ecad37f2cb6cbf04aaa9a260505ef", "tree": "4c3c33ab33c116e7f0f977adbd1672aaec8a5d9f", "parents": [ "8eceab19eba9dcbfd2a0daec72e1bf48aa100170" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sat Apr 04 08:29:58 2026 +0800" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sun Apr 12 13:38:19 2026 +0800" }, "message": "crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn\u0027t updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument.\n\nReported-by: syzbot+d23888375c2737c17ba5@syzkaller.appspotmail.com\nFixes: e870456d8e7c (\"crypto: algif_skcipher - overhaul memory management\")\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "f5459048c38a00fc583658d6dcd0f894aff6df8f", "tree": "a2f381b94e2a54f27fd25298ea0b954243e40b21", "parents": [ "e753c16cb3dd1e8feee6977c330d21fbe0e2db0b", "0637a3086b4fc4165460b21c12b845be6be71be7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 17:06:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 17:06:05 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.0-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fix from Wolfram Sang:\n\n - imx: set dma_slave_config to 0 and avoid uninitialized fields\n\n* tag \u0027i2c-for-7.0-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: imx: zero-initialize dma_slave_config for eDMA\n" }, { "commit": "e753c16cb3dd1e8feee6977c330d21fbe0e2db0b", "tree": "ec08bbe6137f09a5f3cc948d5246a59af5a15c47", "parents": [ "e8ab3110525dfceba34c1bb777a92f156095c6da", "705355a82b8ea86e0afe44560e970eedc74c05d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 12:49:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 12:49:21 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of changes here, one update to MAINTAINERS for the AMD\n controller and a chnage from Pei Xiao which in spite of the changelog\n is actually a fix - previously the zynq-qspi driver leaked a clock\n enable for every flash operation it did which isn\u0027t good, these extra\n enables were removed when doing the enable cleanup which are probably\n a good idea anyway\"\n\n* tag \u0027spi-fix-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n MAINTAINERS: Update AMD SPI driver maintainers\n spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()\n" }, { "commit": "e8ab3110525dfceba34c1bb777a92f156095c6da", "tree": "97607eafc0c8b9497b93d222399a621f5732d181", "parents": [ "086aca1030cff9e4729785bcfafaf4b8c489a892", "b1baaff4e5231f0d7db209f72a43112cd2d29257" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 12:35:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 12:35:16 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"One last fix for v7.0, the BD72720 incorrectly described which DCDC is\n tied to the LDO for its LDON-HEAD mode which automates using the DCDC\n to more efficiently drop a supply for delivery via the LDO\"\n\n* tag \u0027regulator-fix-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: bd71828-regulator.c: Fix LDON-HEAD mode\n" }, { "commit": "086aca1030cff9e4729785bcfafaf4b8c489a892", "tree": "dd1fcbb119ebc07b3a5ae6695b6a056952246b98", "parents": [ "558b9206d59c317186786ec21c1b616ab6a6f0a4", "1fe7294dfb7d26f70bc8f6d7aff26bf76ed32214" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:45:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:45:20 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"s390:\n - vsie: Fix races with partial gmap invalidations\n\n x86:\n - Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: s390: vsie: Fix races with partial gmap invalidations\n KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs\n" }, { "commit": "558b9206d59c317186786ec21c1b616ab6a6f0a4", "tree": "24945dd4205ddef7dcf40a56036b7d166a2fe8c4", "parents": [ "6b5199f4cf8d87e0952043c814cc3c6d45ae9ef6", "4346be6577aaa04586167402ae87bbdbe32484a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:33:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:33:08 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing probe fix from Masami Hiramatsu:\n \"Reject non-closed empty immediate strings\n\n Fix a buffer index underflow bug that occurred when passing an\n non-closed empty immediate string to the probe event\"\n\n* tag \u0027probes-fixes-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probe: reject non-closed empty immediate strings\n" }, { "commit": "6b5199f4cf8d87e0952043c814cc3c6d45ae9ef6", "tree": "737b343a1140ec2e7a759e2c0924f42a73884fc5", "parents": [ "778322a06e217e768ba3dc550a6f599f73ed781d", "5a1140404cbf7ba40137dfb1fb96893aa9a67d68" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:30:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:30:18 2026 -0700" }, "message": "Merge tag \u0027usb-7.0-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fix from Greg KH:\n \"Here is a single USB fix for a reported regression in a recent USB\n typec patch for 7.0-final. Sorry for the late submission, but it does\n fix a problem that people have been seeing with 7.0-rc7 and the stable\n kernels (due to a backported fix from there.)\n\n This has been in linux-next this week with no reported issues, and the\n reporter (Takashi), has said it resolves the problem they were seeing\"\n\n* tag \u0027usb-7.0-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: typec: ucsi: skip connector validation before init\n" }, { "commit": "778322a06e217e768ba3dc550a6f599f73ed781d", "tree": "7e7375227ba8d8ced7c7899c64d9c891c2ced251", "parents": [ "e774d5f1bc27a85f858bce7688509e866f8e8a4e", "ff14dafde15c11403fac61367a34fea08926e9ee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:12:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 11 11:12:38 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n \"Two fixes for force feedback handling in uinput driver:\n\n - fix circular locking dependency in uinput\n\n - fix potential corruption of uinput event queue\"\n\n* tag \u0027input-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: uinput - take event lock when submitting FF request \"event\"\n Input: uinput - fix circular locking dependency with ff-core\n" }, { "commit": "1fe7294dfb7d26f70bc8f6d7aff26bf76ed32214", "tree": "771edc5a73a49185b472483f6999779b616cf220", "parents": [ "0e9b0e012459af5a1644473ec242e80015ceab76", "3ffe5eb4a5f248c0d4b849f050af973396656f85" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Apr 11 14:11:23 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Apr 11 14:11:23 2026 +0200" }, "message": "Merge tag \u0027kvm-s390-master-7.0-4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD\n\nKVM: s390: One very last second fix\n\nFix one more gmap-rewrite issue: races with partial gmap invalidations.\n" }, { "commit": "0e9b0e012459af5a1644473ec242e80015ceab76", "tree": "ed76a7bf5dff279728189dbfc4ccb5412e160cbe", "parents": [ "591cd656a1bf5ea94a222af5ef2ee76df029c1d2", "2619da73bb2f10d88f7e1087125c40144fdf0987" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Apr 11 14:10:44 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Apr 11 14:10:44 2026 +0200" }, "message": "Merge tag \u0027kvm-x86-fixes-7.1\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM x86 fixes for 7.1\n\nDeclare flexible arrays in uAPI structures using __DECLARE_FLEX_ARRAY() so\nthat KVM\u0027s uAPI headers can be included in C++ projects.\n" }, { "commit": "e774d5f1bc27a85f858bce7688509e866f8e8a4e", "tree": "8d689ac21221c3fd067a411e21e71991a5cdf49a", "parents": [ "c43adb3613a8b1be0396d0a38a8ab6be633d48d8", "08ee1559052be302f1d3752f48360b89517d9f8d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 17:27:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 17:27:08 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-v7.0-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V updates from Paul Walmsley:\n \"Before v7.0 is released, fix a few issues with the CFI patchset,\n merged earlier in v7.0-rc, that primarily affect interfaces to\n non-kernel code:\n\n - Improve the prctl() interface for per-task indirect branch landing\n pad control to expand abbreviations and to resemble the speculation\n control prctl() interface\n\n - Expand the \"LP\" and \"SS\" abbreviations in the ptrace uapi header\n file to \"branch landing pad\" and \"shadow stack\", to improve\n readability\n\n - Fix a typo in a CFI-related macro name in the ptrace uapi header\n file\n\n - Ensure that the indirect branch tracking state and shadow stack\n state are unlocked immediately after an exec() on the new task so\n that libc subsequently can control it\n\n - While working in this area, clean up the kernel-internal,\n cross-architecture prctl() function names by expanding the\n abbreviations mentioned above\"\n\n* tag \u0027riscv-for-linus-v7.0-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n prctl: cfi: change the branch landing pad prctl()s to be more descriptive\n riscv: ptrace: cfi: expand \"SS\" references to \"shadow stack\" in uapi headers\n prctl: rename branch landing pad implementation functions to be more explicit\n riscv: ptrace: expand \"LP\" references to \"branch landing pads\" in uapi headers\n riscv: cfi: clear CFI lock status in start_thread()\n riscv: ptrace: cfi: fix \"PRACE\" typo in uapi header\n" }, { "commit": "c43adb3613a8b1be0396d0a38a8ab6be633d48d8", "tree": "22c0018f8dfdb12c9cbfae024fe9b842eda0fdd2", "parents": [ "7c6c4ed80b874f721bc7c2c937e098c56e37d2f0", "b3be33f2c18f7e3663d103a92cdd00b4771b4aa7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 17:18:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 17:18:20 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-04-11\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Last set of fixes, a few vc4, and i915, one xe and one ethosu Kconfig\n fix.\n\n xe:\n - Fix HW engine idleness unit conversion\n\n i915:\n - Drop check for changed VM in EXECBUF\n - Fix refcount underflow race in intel_engine_park_heartbeat\n - Do not use pipe_src as borders for SU area in PSR\n\n vc4:\n - runtime pm reference fix\n - memory leak fixes\n - locking fix\n\n ethosu:\n - make ARM only\"\n\n* tag \u0027drm-fixes-2026-04-11\u0027 of https://gitlab.freedesktop.org/drm/kernel:\n drm/i915/gem: Drop check for changed VM in EXECBUF\n drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat\n drm/xe: Fix bug in idledly unit conversion\n drm/i915/psr: Do not use pipe_src as borders for SU area\n accel: ethosu: Add hardware dependency hint\n drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock\n drm/vc4: Fix a memory leak in hang state error path\n drm/vc4: Fix memory leak of BO array in hang state\n drm/vc4: Release runtime PM reference after binding V3D\n" }, { "commit": "b3be33f2c18f7e3663d103a92cdd00b4771b4aa7", "tree": "29ccb1754e84c842a46dbac446e0c98115bc001a", "parents": [ "93be8c74b614a86a745b6ef1da0402a6c50e97de", "a13edf9b92fc4700b3020d7ea547a3d64dd33b63" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 11 07:35:21 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 11 07:35:22 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-04-09\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Drop check for changed VM in EXECBUF\n- Fix refcount underflow race in intel_engine_park_heartbeat\n- Do not use pipe_src as borders for SU area in PSR\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/add6fPHRC7Bc8Uri@jlahtine-mobl\n" }, { "commit": "d6e152d905bdb1f32f9d99775e2f453350399a6a", "tree": "f9bff2a5977ccc4f3073d252fefa7f21637326bc", "parents": [ "82b915051d32a68ea3bbe261c93f5620699ff047" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Tue Apr 07 10:54:17 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Apr 10 22:45:38 2026 +0200" }, "message": "clockevents: Prevent timer interrupt starvation\n\nCalvin reported an odd NMI watchdog lockup which claims that the CPU locked\nup in user space. He provided a reproducer, which sets up a timerfd based\ntimer and then rearms it in a loop with an absolute expiry time of 1ns.\n\nAs the expiry time is in the past, the timer ends up as the first expiring\ntimer in the per CPU hrtimer base and the clockevent device is programmed\nwith the minimum delta value. If the machine is fast enough, this ends up\nin a endless loop of programming the delta value to the minimum value\ndefined by the clock event device, before the timer interrupt can fire,\nwhich starves the interrupt and consequently triggers the lockup detector\nbecause the hrtimer callback of the lockup mechanism is never invoked.\n\nAs a first step to prevent this, avoid reprogramming the clock event device\nwhen:\n - a forced minimum delta event is pending\n - the new expiry delta is less then or equal to the minimum delta\n\nThanks to Calvin for providing the reproducer and to Borislav for testing\nand providing data from his Zen5 machine.\n\nThe problem is not limited to Zen5, but depending on the underlying\nclock event device (e.g. TSC deadline timer on Intel) and the CPU speed\nnot necessarily observable.\n\nThis change serves only as the last resort and further changes will be made\nto prevent this scenario earlier in the call chain as far as possible.\n\n[ tglx: Updated to restore the old behaviour vs. !force and delta \u003c\u003d 0 and\n \tfixed up the tick-broadcast handlers as pointed out by Borislav ]\n\nFixes: d316c57ff6bf (\"[PATCH] clockevents: add core functionality\")\nReported-by: Calvin Owens \u003ccalvin@wbinvd.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nTested-by: Calvin Owens \u003ccalvin@wbinvd.org\u003e\nTested-by: Borislav Petkov \u003cbp@alien8.de\u003e\nLink: https://lore.kernel.org/lkml/acMe-QZUel-bBYUh@mozart.vkv.me/\nLink: https://patch.msgid.link/20260407083247.562657657@kernel.org\n" }, { "commit": "7c6c4ed80b874f721bc7c2c937e098c56e37d2f0", "tree": "6e388c10e8f3a4edf98bdf04c0ae7b8fdb81c5cd", "parents": [ "96463e4e0268dddbdb60fd1b96800736aa2bade9", "cb76a81c7cec37bdf525164561b02665cd763421" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:40:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:40:49 2026 -0700" }, "message": "Merge tag \u0027vfs-7.0-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"The kernfs rbtree is keyed by (hash, ns, name) where the hash\n is seeded with the raw namespace pointer via init_name_hash(ns).\n\n The resulting hash values are exposed to userspace through\n readdir seek positions, and the pointer-based ordering in\n kernfs_name_compare() is observable through entry order.\n\n Switch from raw pointers to ns_common::ns_id for both hashing\n and comparison.\n\n A preparatory commit first replaces all const void * namespace\n parameters with const struct ns_common * throughout kernfs, sysfs,\n and kobject so the code can access ns-\u003ens_id. Also compare the\n ns_id when hashes match in the rbtree to handle crafted collisions.\n\n Also fix eventpoll RCU grace period issue and a cachefiles refcount\n problem\"\n\n* tag \u0027vfs-7.0-rc8.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n kernfs: make directory seek namespace-aware\n kernfs: use namespace id instead of pointer for hashing and comparison\n kernfs: pass struct ns_common instead of const void * for namespace tags\n eventpoll: defer struct eventpoll free to RCU grace period\n cachefiles: fix incorrect dentry refcount in cachefiles_cull()\n" }, { "commit": "96463e4e0268dddbdb60fd1b96800736aa2bade9", "tree": "09d7f956c3e00eb1866f6209e2895c0f5cbb3185", "parents": [ "017102b40c34b5a67de46230bdfb06096dd11716", "ba893caead54745595e29953f0531cf3651610aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:36:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:36:32 2026 -0700" }, "message": "Merge tag \u0027turbostat-fixes-for-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux\n\nPull turbostat fixes from Len Brown:\n\n - Fix a memory allocation issue that could corrupt output values or\n SEGV\n\n - Fix a perf initilization issue that could exit on some HW + kernels\n\n - Minor fixes\n\n* tag \u0027turbostat-fixes-for-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:\n tools/power turbostat: Allow execution to continue after perf_l2_init() failure\n tools/power turbostat: Fix delimiter bug in print functions\n tools/power turbostat: Fix --show/--hide for individual cpuidle counters\n tools/power turbostat: Fix incorrect format variable\n tools/power turbostat: Consistently use print_float_value()\n tools/power/turbostat: Fix microcode patch level output for AMD/Hygon\n tools/power turbostat: Eliminate unnecessary data structure allocation\n tools/power turbostat: Fix swidle header vs data display\n tools/power turbostat: Fix illegal memory access when SMT is present and disabled\n" }, { "commit": "017102b40c34b5a67de46230bdfb06096dd11716", "tree": "724035df8b1ddfa64f1caf861ecb62b7fb2d58d7", "parents": [ "77c3c619d2af2540b15e63dca768c0d86be746c9", "57df6923ca53b524d06d2347b896d9de74b3bc86" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:32:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:32:30 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - gracefully handle missing regmap in gpio-bd72720\n\n - fix IRQ resource release in gpio-tegra\n\n - return -ENOMEM on devm_kzalloc() failure instead of -ENODEV in\n gpio-tegra\n\n* tag \u0027gpio-fixes-for-v7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: tegra: return -ENOMEM on allocation failure in probe\n gpio: tegra: fix irq_release_resources calling enable instead of disable\n gpio: bd72720: handle missing regmap\n" }, { "commit": "77c3c619d2af2540b15e63dca768c0d86be746c9", "tree": "0697b90ea3652206ab89c71ae59eae15727065f2", "parents": [ "9a9c8ce300cd3859cc87b408ef552cd697cc2ab7", "db5b8cecbdf479ad13156af750377e5b43853fab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:26:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 10 08:26:40 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n \"Some late pin control fixes. I\u0027m not happy to have bugs so late in the\n kernel cycle, but they are all driver specifics so I guess it\u0027s how it\n is.\n\n - Three fixes for the Intel pin control driver fixing the feature set\n for the new silicon\n\n - One fix for an IRQ storm in the MCP23S08 pin controller/GPIO\n expander\"\n\n* tag \u0027pinctrl-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: mcp23s08: Disable all pin interrupts during probe\n pinctrl: intel: Enable 3-bit PAD_OWN feature\n pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer)\n pinctrl: intel: Improve capability support\n" }, { "commit": "ba893caead54745595e29953f0531cf3651610aa", "tree": "553364c7e4fd81d94709bb2106495ac6e65bf20a", "parents": [ "cdbefe9d4029d4834d404f7ba13a960b38a69e88" ], "author": { "name": "David Arcari", "email": "darcari@redhat.com", "time": "Thu Mar 19 10:03:07 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Fri Apr 10 09:04:32 2026 -0400" }, "message": "tools/power turbostat: Allow execution to continue after perf_l2_init() failure\n\nCurrently, if perf_l2_init() fails turbostat exits after issuing the\nfollowing error (which was encountered on AlderLake):\n\nturbostat: perf_l2_init(cpu0, 0x0, 0xff24) REFS: Invalid argument\n\nThis occurs because perf_l2_init() calls err(). However, the code has been\nwritten in such a manner that it is able to perform cleanup and continue.\nTherefore, this issue can be addressed by changing the appropriate calls\nto err() to warnx().\n\nAdditionally, correct the PMU type arguments passed to the warning strings\nin the ecore and lcore blocks so the logs accurately reflect the failing\ncounter type.\n\nSigned-off-by: David Arcari \u003cdarcari@redhat.com\u003e\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "57df6923ca53b524d06d2347b896d9de74b3bc86", "tree": "01a27774a6d1b534bdf5ee900e846e6ce06b04fe", "parents": [ "1561d96f5f55c1bca9ff047ace5813f4f244eea6" ], "author": { "name": "Samasth Norway Ananda", "email": "samasth.norway.ananda@oracle.com", "time": "Thu Apr 09 11:58:53 2026 -0700" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Fri Apr 10 09:01:24 2026 +0200" }, "message": "gpio: tegra: return -ENOMEM on allocation failure in probe\n\ndevm_kzalloc() failure in tegra_gpio_probe() returns -ENODEV, which\nindicates \"no such device\". The correct error code for a memory\nallocation failure is -ENOMEM.\n\nSigned-off-by: Samasth Norway Ananda \u003csamasth.norway.ananda@oracle.com\u003e\nLink: https://patch.msgid.link/20260409185853.2163034-1-samasth.norway.ananda@oracle.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "93be8c74b614a86a745b6ef1da0402a6c50e97de", "tree": "87a5d24b8984ab229f2d6effe6b4799ccb50f64c", "parents": [ "03f6973665e45b64019d2ef066d62a4314d480cc", "857fa8f2a5b184c206c703a3d9ce05cea683cfed" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 10 14:25:48 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 10 14:25:57 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-04-09\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nSeveral fixes for v3d about memory leak, runtime PM, and locking, and a\nKconfig improvement for ethosu.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260409-omniscient-tomato-coucal-edbadc@penduick\n" }, { "commit": "9a9c8ce300cd3859cc87b408ef552cd697cc2ab7", "tree": "c01649d7f924c164d5b20d4267630104eabcf8e5", "parents": [ "b42ed3bb884e6b399b46d19df3f5cf015a79c804", "deb4605671cfae3b2803cfbbf4739e7245248398" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 16:48:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 16:48:44 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nathan Chancellor:\n\n - Make modules-cpio-pkg respect INSTALL_MOD_PATH so that it can be\n used with distribution initramfs files that have a merged /usr,\n such as Fedora\n\n - Silence an instance of -Wunused-but-set-global, a strengthening\n of -Wunused-but-set-variable in tip of tree Clang, in modpost,\n as the variable for extra warnings is currently unused\n\n* tag \u0027kbuild-fixes-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n modpost: Declare extra_warn with unused attribute\n kbuild: modules-cpio-pkg: Respect INSTALL_MOD_PATH\n" }, { "commit": "b42ed3bb884e6b399b46d19df3f5cf015a79c804", "tree": "7af7291738d0f84e75867e428aa15c3c8fb1c28a", "parents": [ "bb2ea74eeb6735eed29bd74695f90f0e5af09f5c", "5241c2ca33bb181bf7abb7cb4bba1cc67d1b6278" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:21:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:21:21 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"Fix an incorrect preprocessor conditional that may result in duplicate\n instances of sysfb_primary_display on x86\"\n\n* tag \u0027efi-fixes-for-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n firmware: efi: Never declare sysfb_primary_display on x86\n" }, { "commit": "bb2ea74eeb6735eed29bd74695f90f0e5af09f5c", "tree": "616e4622177dd458d44e68bf0c8a02af914ba7d7", "parents": [ "4e1538b1f166e08e28740ec74fb79f05b8965525", "00afb1811fa638dacf125dd1c343b7a181624dfd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:17:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:17:16 2026 -0700" }, "message": "Merge tag \u0027sound-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Still a bit higher amount than wished, but nothing looks really scary,\n and all changes are about nice and smooth device-specific fixes.\n\n - HD-audio quirks, one revert for a regression and another oneliner\n\n - AMD ACP quirks\n\n - Fixes for SDCA interrupt handling\n\n - A few Intel SOF, avs and NVL fixes\n\n - Fixes for TAS2552 DT, NAU8325, and STM32\"\n\n* tag \u0027sound-7.0\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms\n ASoC: SDCA: Unregister IRQ handlers on module remove\n ASoC: SDCA: mask Function_Status value\n ASoC: SDCA: Fix overwritten var within for loop\n ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J\n ASoC: SOF: Intel: hda: modify period size constraints for ACE4\n ALSA: hda/intel: enforce stricter period-size alignment for Intel NVL\n ASoC: nau8325: Add software reset during probe\n Revert \"ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone\"\n ASoC: Intel: avs: Fix memory leak in avs_register_i2s_test_boards()\n ASoC: SOF: Intel: fix iteration in is_endpoint_present()\n ASoC: SOF: Intel: Fix endpoint index if endpoints are missing\n ASoC: SDCA: Fix errors in IRQ cleanup\n ASoC: amd: acp: add Lenovo P16s G5 AMD quirk for legacy SDW machine\n ASoC: dt-bindings: ti,tas2552: Add sound-dai-cells\n ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10\n" }, { "commit": "4e1538b1f166e08e28740ec74fb79f05b8965525", "tree": "a974774870dbae5b6448579d770a19a350cc610a", "parents": [ "d58305b2dbe3434c9b21ede210329b97c44ee9e8", "8f4d20a710225ec7a565f6a0459862d3b1f32330" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:13:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:13:15 2026 -0700" }, "message": "Merge tag \u0027mmc-v7.0-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fixes from Ulf Hansson:\n\n - vub300: Fix use-after-free and NULL-deref on disconnect\n\n* tag \u0027mmc-v7.0-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: vub300: fix use-after-free on disconnect\n mmc: vub300: fix NULL-deref on disconnect\n" }, { "commit": "d58305b2dbe3434c9b21ede210329b97c44ee9e8", "tree": "64c06cb03102eb666faa7a3185853ca3266ec612", "parents": [ "3ffcd57823c4feb829efe46dd5135cd5fbf28e36", "c2812c0cb909211a1d2e7cec862406e32833b9de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:09:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:09:12 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - imx: Prevent hang at power down for imx8mp-blk-ctrl\n\n - thead: Fix buffer overflow for TH1520 AON driver\n\n - Change Ulf Hansson\u0027s email\n\n* tag \u0027pmdomain-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n MAINTAINERS, mailmap: Change Ulf Hansson\u0027s email\n pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled\n firmware: thead: Fix buffer overflow and use standard endian macros\n" }, { "commit": "3ffcd57823c4feb829efe46dd5135cd5fbf28e36", "tree": "b55b129ad2ce5fe6bb401a89abdd017585fa3efc", "parents": [ "a55f7f5f29b32c2c53cc291899cf9b0c25a07f7c", "3d48c9fd78dd0b1809669ec49c4d0997b8127512" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:02:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 11:02:35 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.0-2026-04-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fix from Marek Szyprowski:\n \"A fix for DMA-mapping subsystem, which hides annoying, false-positive\n warnings from DMA-API debug on coherent platforms like x86_64 (Mikhail\n Gavrilov)\"\n\n* tag \u0027dma-mapping-7.0-2026-04-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma-debug: suppress cacheline overlap warning when arch has no DMA alignment requirement\n" }, { "commit": "a55f7f5f29b32c2c53cc291899cf9b0c25a07f7c", "tree": "5d760fb7bbf41cc1ace3ee31368c17d8b9eba942", "parents": [ "8b02520ec5f7b0d976e8bbc072242275acd472d0", "b4afe3fa76a88ee7d3d8802b43fde89aa02f8e0d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:39:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:39:25 2026 -0700" }, "message": "Merge tag \u0027net-7.0-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter, IPsec and wireless. This is again\n considerably bigger than the old average. No known outstanding\n regressions.\n\n Current release - regressions:\n\n - net: increase IP_TUNNEL_RECURSION_LIMIT to 5\n\n - eth: ice: fix PTP timestamping broken by SyncE code on E825C\n\n Current release - new code bugs:\n\n - eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure\n\n Previous releases - regressions:\n\n - core: fix cross-cache free of KFENCE-allocated skb head\n\n - sched: act_csum: validate nested VLAN headers\n\n - rxrpc: fix call removal to use RCU safe deletion\n\n - xfrm:\n - wait for RCU readers during policy netns exit\n - fix refcount leak in xfrm_migrate_policy_find\n\n - wifi: rt2x00usb: fix devres lifetime\n\n - mptcp: fix slab-use-after-free in __inet_lookup_established\n\n - ipvs: fix NULL deref in ip_vs_add_service error path\n\n - eth:\n - airoha: fix memory leak in airoha_qdma_rx_process()\n - lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\n Previous releases - always broken:\n\n - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\n - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group\n dump\n\n - bridge: guard local VLAN-0 FDB helpers against NULL vlan group\n\n - xsk: tailroom reservation and MTU validation\n\n - rxrpc:\n - fix to request an ack if window is limited\n - fix RESPONSE authenticator parser OOB read\n\n - netfilter: nft_ct: fix use-after-free in timeout object destroy\n\n - batman-adv: hold claim backbone gateways by reference\n\n - eth:\n - stmmac: fix PTP ref clock for Tegra234\n - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling\n - ipa: fix GENERIC_CMD register field masks for IPA v5.0+\"\n\n* tag \u0027net-7.0-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (104 commits)\n net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n net: lan966x: fix page pool leak in error paths\n net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()\n nfc: pn533: allocate rx skb before consuming bytes\n l2tp: Drop large packets with UDP encap\n net: ipa: fix event ring index not programmed for IPA v5.0+\n net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+\n MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver\n devlink: Fix incorrect skb socket family dumping\n af_unix: read UNIX_DIAG_VFS data under unix_state_lock\n Revert \"mptcp: add needs_id for netlink appending addr\"\n mptcp: fix slab-use-after-free in __inet_lookup_established\n net: txgbe: leave space for null terminators on property_entry\n net: ioam6: fix OOB and missing lock\n rxrpc: proc: size address buffers for %pISpc output\n rxrpc: only handle RESPONSE during service challenge\n rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()\n rxrpc: Fix leak of rxgk context in rxgk_verify_response()\n rxrpc: Fix integer overflow in rxgk_verify_response()\n rxrpc: Fix missing error checks for rxkad encryption/decryption failure\n ...\n" }, { "commit": "8b02520ec5f7b0d976e8bbc072242275acd472d0", "tree": "4bf197955ae65ee6fc67315b2b5bdd9c1f811f5f", "parents": [ "acfa7a35442571e316e1b3f391f481e2f92ac076", "7e0548525abd2bff9694e016b6a469ccd2d5a053" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:36:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:36:31 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull IOMMU fix from Will Deacon:\n\n - Fix regression introduced by the empty MMU gather fix in -rc7, where\n the -\u003eiotlb_sync() callback can be elided incorrectly, resulting in\n boot failures (hangs), crashes and potential memory corruption.\n\n* tag \u0027iommu-fixes-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu: Ensure .iotlb_sync is called correctly\n" }, { "commit": "acfa7a35442571e316e1b3f391f481e2f92ac076", "tree": "303f37e9dc85fe15b4f79dedccb777e8025f53f0", "parents": [ "7f87a5ea75f011d2c9bc8ac0167e5e2d1adb1594", "5d486669b3db11ccc2d1b9f4e42c11c2766f35ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:34:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 09 08:34:08 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform drivers fixes from Ilpo Järvinen:\n\n - amd/pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug\n\n - asus-armoury: Add support for FA607NU, GU605MU, and GV302XU.\n\n - intel-uncore-freq: Handle autonomous UFS status bit\n\n - ISST: Handle cases with less than max buckets correctly\n\n - intel-uncore-freq \u0026 ISST: Mark minor version 3 supported (no\n additional driver changes required)\n\n* tag \u0027platform-drivers-x86-v7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: asus-armoury: add support for GU605MU\n platform/x86: asus-armoury: add support for FA607NU\n platform/x86: asus-armoury: add support for GV302XU\n platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug\n platform/x86/intel-uncore-freq: Increase minor version\n platform/x86: ISST: Increase minor version\n platform/x86/intel-uncore-freq: Handle autonomous UFS status bit\n platform/x86: ISST: Reset core count to 0\n" }, { "commit": "b4afe3fa76a88ee7d3d8802b43fde89aa02f8e0d", "tree": "1e3630e385e86065a460f4aec2604a590157482e", "parents": [ "c71ba669b570c7b3f86ec875be222ea11dacb352", "59c3d55a946cacdb4181600723c20ac4f4c20c84" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 15:17:25 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 15:17:25 2026 +0200" }, "message": "Merge branch \u0027net-lan966x-fix-page_pool-error-handling-and-error-paths\u0027\n\nDavid Carlier says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: lan966x: fix page_pool error handling and error paths\n\nThis series fixes error handling around the lan966x page pool:\n\n 1/3 adds the missing IS_ERR check after page_pool_create(), preventing\n a kernel oops when the error pointer flows into\n xdp_rxq_info_reg_mem_model().\n\n 2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and\n lan966x_fdma_init() error paths, now reachable after 1/3.\n\n 3/3 fixes a use-after-free and page pool leak in the\n lan966x_fdma_reload() restore path, where the hardware could\n resume DMA into pages already returned to the page pool.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260405055241.35767-1-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "59c3d55a946cacdb4181600723c20ac4f4c20c84", "tree": "1e3630e385e86065a460f4aec2604a590157482e", "parents": [ "076344a6ad9d1308faaed1402fdcfdda68b604ab" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sun Apr 05 06:52:41 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 15:17:23 2026 +0200" }, "message": "net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path.\n\nFixes: 89ba464fcf54 (\"net: lan966x: refactor buffer reload function\")\nCc: stable@vger.kernel.org\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nLink: https://patch.msgid.link/20260405055241.35767-4-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "076344a6ad9d1308faaed1402fdcfdda68b604ab", "tree": "5292db058a330055dcae89513132574c3e2b68ea", "parents": [ "3fd0da4fd8851a7e62d009b7db6c4a05b092bc19" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sun Apr 05 06:52:40 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 15:17:23 2026 +0200" }, "message": "net: lan966x: fix page pool leak in error paths\n\nlan966x_fdma_rx_alloc() creates a page pool but does not destroy it if\nthe subsequent fdma_alloc_coherent() call fails, leaking the pool.\n\nSimilarly, lan966x_fdma_init() frees the coherent DMA memory when\nlan966x_fdma_tx_alloc() fails but does not destroy the page pool that\nwas successfully created by lan966x_fdma_rx_alloc(), leaking it.\n\nAdd the missing page_pool_destroy() calls in both error paths.\n\nFixes: 11871aba1974 (\"net: lan96x: Use page_pool API\")\nCc: stable@vger.kernel.org\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nLink: https://patch.msgid.link/20260405055241.35767-3-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3fd0da4fd8851a7e62d009b7db6c4a05b092bc19", "tree": "7f38804a6232e3362c63e2ea09374c3ade401a38", "parents": [ "c71ba669b570c7b3f86ec875be222ea11dacb352" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Sun Apr 05 06:52:39 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 15:17:23 2026 +0200" }, "message": "net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()\n\npage_pool_create() can return an ERR_PTR on failure. The return value\nis used unconditionally in the loop that follows, passing the error\npointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),\nwhich dereferences it, causing a kernel oops.\n\nAdd an IS_ERR check after page_pool_create() to return early on failure.\n\nFixes: 11871aba1974 (\"net: lan96x: Use page_pool API\")\nCc: stable@vger.kernel.org\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nLink: https://patch.msgid.link/20260405055241.35767-2-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "cb76a81c7cec37bdf525164561b02665cd763421", "tree": "a4c89dd9f0d46e75f79248246ce7d4718b0b0f90", "parents": [ "1fe989e1c42a315c7e7918e7b812377137085036" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 02 09:12:11 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 09 14:36:52 2026 +0200" }, "message": "kernfs: make directory seek namespace-aware\n\nThe rbtree backing kernfs directories is ordered by (hash, ns_id, name)\nbut kernfs_dir_pos() only searches by hash when seeking to a position\nduring readdir. When two nodes from different namespaces share the same\nhash value, the binary search can land on a node in the wrong namespace.\nThe subsequent skip-forward loop walks rb_next() and may overshoot the\ncorrect node, silently dropping an entry from the readdir results.\n\nWith the recent switch from raw namespace pointers to public namespace\nids as hash seeds, computing hash collisions became an offline operation.\nAn unprivileged user could unshare into a new network namespace, create\na single interface whose name-hash collides with a target entry in\ninit_net, and cause a victim\u0027s seekdir/readdir on /sys/class/net to miss\nthat entry.\n\nFix this by extending the rbtree search in kernfs_dir_pos() to also\ncompare namespace ids when hashes match. Since the rbtree is already\nordered by (hash, ns_id, name), this makes the seek land directly in the\ncorrect namespace\u0027s range, eliminating the wrong-namespace overshoot.\n\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "1fe989e1c42a315c7e7918e7b812377137085036", "tree": "069b64ecf25420fb5ab3b17c51b25c6ea92c1415", "parents": [ "e3b2cf6e5dba416a03152f299d99982dfe1e861d" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Apr 01 12:21:16 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 09 14:36:52 2026 +0200" }, "message": "kernfs: use namespace id instead of pointer for hashing and comparison\n\nkernfs uses the namespace tag as both a hash seed (via init_name_hash())\nand a comparison key in the rbtree. The resulting hash values are exposed\nto userspace through directory seek positions (ctx-\u003epos), and the raw\npointer comparisons in kernfs_name_compare() encode kernel pointer\nordering into the rbtree layout.\n\nThis constitutes a KASLR information leak since the hash and ordering\nderived from kernel pointers can be observed from userspace.\n\nFix this by using the 64-bit namespace id (ns_common::ns_id) instead of\nthe raw pointer value for both hashing and comparison. The namespace id\nis a stable, non-secret identifier that is already exposed to userspace\nthrough other interfaces (e.g., /proc/pid/ns/, ioctl NS_GET_NSID).\n\nIntroduce kernfs_ns_id() as a helper that extracts the namespace id from\na potentially-NULL ns_common pointer, returning 0 for the no-namespace\ncase.\n\nAll namespace equality checks in the directory iteration and dentry\nrevalidation paths are also switched from pointer comparison to ns_id\ncomparison for consistency.\n\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "e3b2cf6e5dba416a03152f299d99982dfe1e861d", "tree": "d10833a41819fac2d0c066bd80def58a36453228", "parents": [ "07712db80857d5d09ae08f3df85a708ecfc3b61f" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Apr 01 12:15:58 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Apr 09 14:36:52 2026 +0200" }, "message": "kernfs: pass struct ns_common instead of const void * for namespace tags\n\nkernfs has historically used const void * to pass around namespace tags\nused for directory-level namespace filtering. The only current user of\nthis is sysfs network namespace tagging where struct net pointers are\ncast to void *.\n\nReplace all const void * namespace parameters with const struct\nns_common * throughout the kernfs, sysfs, and kobject namespace layers.\nThis includes the kobj_ns_type_operations callbacks, kobject_namespace(),\nand all sysfs/kernfs APIs that accept or return namespace tags.\n\nPassing struct ns_common is needed because various codepaths require\naccess to the underlying namespace. A struct ns_common can always be\nconverted back to the concrete namespace type (e.g., struct net) via\ncontainer_of() or to_ns_common() in the reverse direction.\n\nThis is a preparatory change for switching to ns_id-based directory\niteration to prevent a KASLR pointer leak through the current use of\nraw namespace pointers as hash seeds and comparison keys.\n\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "7e0548525abd2bff9694e016b6a469ccd2d5a053", "tree": "10df7b6c91436d9b3a155c1c2a4935b77adae14f", "parents": [ "8b72aa5704c77380742346d4ac755b074b7f9eaa" ], "author": { "name": "Robin Murphy", "email": "robin.murphy@arm.com", "time": "Wed Apr 08 15:40:57 2026 +0100" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Thu Apr 09 13:07:13 2026 +0100" }, "message": "iommu: Ensure .iotlb_sync is called correctly\n\nMany drivers have no reason to use the iotlb_gather mechanism, but do\nstill depend on .iotlb_sync being called to properly complete an unmap.\nSince the core code is now relying on the gather to detect when there\nis legitimately something to sync, it should also take care of encoding\na successful unmap when the driver does not touch the gather itself.\n\nFixes: 90c5def10bea (\"iommu: Do not call drivers for empty gathers\")\nReported-by: Jon Hunter \u003cjonathanh@nvidia.com\u003e\nCloses: https://lore.kernel.org/r/8800a38b-8515-4bbe-af15-0dae81274bf7@nvidia.com\nSigned-off-by: Robin Murphy \u003crobin.murphy@arm.com\u003e\nTested-by: Jon Hunter \u003cjonathanh@nvidia.com\u003e\nReviewed-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nTested-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "c71ba669b570c7b3f86ec875be222ea11dacb352", "tree": "8c40916d8c87f40f5e8ff38ddfe03dd27a3f857a", "parents": [ "ebe560ea5f54134279356703e73b7f867c89db13" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Sun Apr 05 08:40:00 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 13:54:37 2026 +0200" }, "message": "nfc: pn533: allocate rx skb before consuming bytes\n\npn532_receive_buf() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already hand\na complete frame to pn533_recv_frame() before allocating a fresh receive\nbuffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted.\n\nFixes: c656aa4c27b1 (\"nfc: pn533: add UART phy driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260405094003.3-pn533-v2-pengpeng@iscas.ac.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a13edf9b92fc4700b3020d7ea547a3d64dd33b63", "tree": "a293f81d5c49c3132fb2cb8a0b2d7920203a47cb", "parents": [ "4c71fd099513bfa8acab529b626e1f0097b76061" ], "author": { "name": "Joonas Lahtinen", "email": "joonas.lahtinen@linux.intel.com", "time": "Thu Apr 09 08:31:11 2026 +0300" }, "committer": { "name": "Joonas Lahtinen", "email": "joonas.lahtinen@linux.intel.com", "time": "Thu Apr 09 12:57:15 2026 +0300" }, "message": "drm/i915/gem: Drop check for changed VM in EXECBUF\n\nSince the introduction of d4433c7600f7 (\"drm/i915/gem: Use the proto-context\nto handle create parameters (v5)\") it has not been possible for VM to change\nafter context creation so the check will never fail.\n\nSima\u0027s analysis:\n\n This check was added in f7ce8639f6ff (\"drm/i915/gem: Split the context\u0027s\n obj:vma lut into its own mutex\") but without any hint in the commit\n message as to why. In another hunk of that commit there\u0027s a hint though in\n __eb_add_lut:\n\n /* user racing with ctx set-vm */\n\n This would mean that this bug was introduced in e0695db7298e (\"drm/i915:\n Create/destroy VM (ppGTT) for use with contexts\"), which allowed to change\n the gem_ctx-\u003evm at runtime, opening up the race that was partially fixed\n in the earlier referenced commit about a year later.\n\n But it cannot be exploited anymore in anything remotely recent because\n with the introduction of proto-contexts we\u0027ve made gem_ctx-\u003evm invariant\n again, exactly to preemptively close all these potential issues.\n Specifically d4433c7600f7 (\"drm/i915/gem: Use the proto-context to handle\n create parameters (v5)\") is the vm specific part of the proto-context\n work.\n\nv3:\n- Include Sima\u0027s analysis and WARN_ON_ONCE\n\nv4:\n- Focus only on latest mainline codebase\n\nReferences: https://lore.kernel.org/all/20260324151741.29338-1-sosohero200@gmail.com/\nReported-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linuxfoundation.org\u003e\nCc: Simona Vetter \u003csimona.vetter@ffwll.ch\u003e\nCc: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\nCc: Andi Shyti \u003candi.shyti@kernel.org\u003e\nSigned-off-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nLink: https://patch.msgid.link/20260409053111.8914-1-joonas.lahtinen@linux.intel.com\n(cherry picked from commit f6d4afc9ec6a0bc326151b35a7a3369369180079)\nSigned-off-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\n" }, { "commit": "1561d96f5f55c1bca9ff047ace5813f4f244eea6", "tree": "f0f9a9b41755a9488da90bb17eb5cec09fdb9056", "parents": [ "828ec7f803f41588a120e6d804297e74a482ab9d" ], "author": { "name": "Samasth Norway Ananda", "email": "samasth.norway.ananda@oracle.com", "time": "Tue Apr 07 14:02:47 2026 -0700" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Apr 09 10:35:33 2026 +0200" }, "message": "gpio: tegra: fix irq_release_resources calling enable instead of disable\n\ntegra_gpio_irq_release_resources() erroneously calls tegra_gpio_enable()\ninstead of tegra_gpio_disable(). When IRQ resources are released, the\nGPIO configuration bit (CNF) should be cleared to deconfigure the pin as\na GPIO. Leaving it enabled wastes power and can cause unexpected behavior\nif the pin is later reused for an alternate function via pinctrl.\n\nFixes: 66fecef5bde0 (\"gpio: tegra: Convert to gpio_irq_chip\")\nSigned-off-by: Samasth Norway Ananda \u003csamasth.norway.ananda@oracle.com\u003e\nLink: https://patch.msgid.link/20260407210247.1737938-1-samasth.norway.ananda@oracle.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "ebe560ea5f54134279356703e73b7f867c89db13", "tree": "4213702338e3e4aaf6bd000baaba97f422389813", "parents": [ "56007972c0b1e783ca714d6f1f4d6e66e531d21f" ], "author": { "name": "Alice Mikityanska", "email": "alice@isovalent.com", "time": "Fri Apr 03 20:49:49 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 10:19:05 2026 +0200" }, "message": "l2tp: Drop large packets with UDP encap\n\nsyzbot reported a WARN on my patch series [1]. The actual issue is an\noverflow of 16-bit UDP length field, and it exists in the upstream code.\nMy series added a debug WARN with an overflow check that exposed the\nissue, that\u0027s why syzbot tripped on my patches, rather than on upstream\ncode.\n\nsyzbot\u0027s repro:\n\nr0 \u003d socket$pppl2tp(0x18, 0x1, 0x1)\nr1 \u003d socket$inet6_udp(0xa, 0x2, 0x0)\nconnect$inet6(r1, \u0026(0x7f00000000c0)\u003d{0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)\nconnect$pppl2tp(r0, \u0026(0x7f0000000240)\u003d@pppol2tpin6\u003d{0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4\u003d{\u0027\\x00\u0027, \u0027\\xff\\xff\u0027, @empty}}}}, 0x32)\nwritev(r0, \u0026(0x7f0000000080)\u003d[{\u0026(0x7f0000000000)\u003d\"ee\", 0x34000}], 0x1)\n\nIt basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP\nencapsulation, and l2tp_xmit_core doesn\u0027t check for overflows when it\nassigns the UDP length field. The value gets trimmed to 16 bites.\n\nAdd an overflow check that drops oversized packets and avoids sending\npackets with trimmed UDP length to the wire.\n\nsyzbot\u0027s stack trace (with my patch applied):\n\nlen \u003e\u003d 65536u\nWARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957\nModules linked in:\nCPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]\nRIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]\nRIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327\nCode: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 \u003c0f\u003e 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f\nRSP: 0018:ffffc90003d67878 EFLAGS: 00010293\nRAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000\nRDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff\nRBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004\nR10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900\nR13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000\nFS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n sock_write_iter+0x503/0x550 net/socket.c:1195\n do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1\n vfs_writev+0x33c/0x990 fs/read_write.c:1059\n do_writev+0x154/0x2e0 fs/read_write.c:1105\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f636479c629\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629\nRDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003\nRBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0\n \u003c/TASK\u003e\n\n[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/\n\nFixes: 3557baabf280 (\"[L2TP]: PPP over L2TP driver core\")\nReported-by: syzbot+ci3edea60a44225dec@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/69a1dfba.050a0220.3a55be.0026.GAE@google.com/\nSigned-off-by: Alice Mikityanska \u003calice@isovalent.com\u003e\nLink: https://patch.msgid.link/20260403174949.843941-1-alice.kernel@fastmail.im\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "56007972c0b1e783ca714d6f1f4d6e66e531d21f", "tree": "b6eb8bda4ad369fb1dca299b7b27224cc88e4e50", "parents": [ "9709b56d908acc120fe8b4ae250b3c9d749ea832" ], "author": { "name": "Alexander Koskovich", "email": "akoskovich@pm.me", "time": "Fri Apr 03 18:43:48 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 09:47:31 2026 +0200" }, "message": "net: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.\n\nFixes: faf0678ec8a0 (\"net: ipa: add IPA v5.0 GSI register definitions\")\nSigned-off-by: Alexander Koskovich \u003cakoskovich@pm.me\u003e\nSigned-off-by: Luca Weiss \u003cluca.weiss@fairphone.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260403-milos-ipa-v1-2-01e9e4e03d3e@fairphone.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9709b56d908acc120fe8b4ae250b3c9d749ea832", "tree": "7bb9f1344e5143227e932edfdd9406949c2b92da", "parents": [ "2607c0907d6d2737727ff0740015dde82a3fc103" ], "author": { "name": "Alexander Koskovich", "email": "akoskovich@pm.me", "time": "Fri Apr 03 18:43:47 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 09 09:47:31 2026 +0200" }, "message": "net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+\n\nFix the field masks to match the hardware layout documented in\ndownstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*).\n\nNotably this fixes a WARN I was seeing when I tried to send \"stop\"\nto the MPSS remoteproc while IPA was up.\n\nFixes: faf0678ec8a0 (\"net: ipa: add IPA v5.0 GSI register definitions\")\nSigned-off-by: Alexander Koskovich \u003cakoskovich@pm.me\u003e\nSigned-off-by: Luca Weiss \u003cluca.weiss@fairphone.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260403-milos-ipa-v1-1-01e9e4e03d3e@fairphone.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "00afb1811fa638dacf125dd1c343b7a181624dfd", "tree": "68abc175005f32fb44faf215091af0a0e7a41985", "parents": [ "082c192c0dd03f685514c9ce2eb0a80fd28e2175", "6b6f7263d626886a96fce6352f94dfab7a24c339" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Apr 09 07:00:53 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Apr 09 07:00:53 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.0-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.0\n\nA somewhat larger set of fixes than I\u0027d like unfortunatey, not from any\none place but rather spread out over different drivers. We\u0027ve got a\nbunch more fixes for the SDCA interrupt support, several relatively\nminor SOF fixes, a few more driver specific fixes and a couple more AMD\nquirks.\n" }, { "commit": "03f6973665e45b64019d2ef066d62a4314d480cc", "tree": "281343c32cf4743418fc6b6ad2b0719d95e36315", "parents": [ "591cd656a1bf5ea94a222af5ef2ee76df029c1d2", "7596459f3c93d8d45a1bf12d4d7526b50c15baa2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Apr 09 14:38:01 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu Apr 09 14:38:06 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-04-08\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Fix HW engine idleness unit conversion (Vinay)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ada0IQSyELI2V0Og@intel.com\n" }, { "commit": "2607c0907d6d2737727ff0740015dde82a3fc103", "tree": "13754c622092aeb43708f8b76921c3eb935bba63", "parents": [ "30f3b767aed45fdaf8f887e66e1f19bd0cbd4483", "d3baa34a470771399c1495bc04b1e26ac15d598e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 20:05:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 20:05:10 2026 -0700" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-04-06 (idpf, ice, ixgbe, ixgbevf, igb, e1000)\n\nEmil converts to use spinlock_t for virtchnl transactions to make\nconsistent use of the xn_bm_lock when accessing the free_xn_bm bitmap,\nwhile also avoiding nested raw/bh spinlock issue on PREEMPT_RT kernels.\nHe also sets payload size before calling the async handler, to make sure\nit doesn\u0027t error out prematurely due to invalid size check for idpf.\n\nKohei Enju changes WARN_ON for missing PTP control PF to a dev_info() on\nice as there are cases where this is expected and acceptable.\n\nPetr Oros fixes conditions in which error paths failed to call\nice_ptp_port_phy_restart() breaking PTP functionality on ice.\n\nAlex significantly reduces reporting of driver information, and time\nunder RTNL locl, on ixgbe e610 devices by reducing reads of flash info\nonly on events that could change it.\n\nMichal Schmidt adds missing Hyper-V op on ixgbevf.\n\nAlex Dvoretsky removes call to napi_synchronize() in igb_down() to\nresolve a deadlock.\n\nAgalakov Daniil adds error check on e1000 for failed EEPROM read.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n e1000: check return value of e1000_read_eeprom\n igb: remove napi_synchronize() in igb_down()\n ixgbevf: add missing negotiate_features op to Hyper-V ops table\n ixgbe: stop re-reading flash on every get_drvinfo for e610\n ice: fix PTP timestamping broken by SyncE code on E825C\n ice: ptp: don\u0027t WARN when controlling PF is unavailable\n idpf: set the payload size before calling the async handler\n idpf: improve locking around idpf_vc_xn_push_free()\n idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260406213038.444732-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "30f3b767aed45fdaf8f887e66e1f19bd0cbd4483", "tree": "aec13a64bfe8bd729db3deb79395c77b3ecedfba", "parents": [ "0006c6f1091bbeea88b8a88a6548b9fb2f803c74" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Mon Apr 06 13:08:16 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:43:13 2026 -0700" }, "message": "MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver\n\nAdd Prashanth as an additional maintainer for the amd-xgbe Ethernet\ndriver to help with ongoing development and maintenance.\n\nCc: Prashanth Kumar K R \u003cPrashanthKumar.K.R@amd.com\u003e\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260406073816.3218387-1-Raju.Rangoju@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0006c6f1091bbeea88b8a88a6548b9fb2f803c74", "tree": "c4c1f76216d53e4b034966589b71ca2c313907fc", "parents": [ "39897df386376912d561d4946499379effa1e7ef" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Mon Apr 06 22:27:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:34:38 2026 -0700" }, "message": "devlink: Fix incorrect skb socket family dumping\n\nThe devlink_fmsg_dump_skb function was incorrectly using the socket\ntype (sk-\u003esk_type) instead of the socket family (sk-\u003esk_family)\nwhen filling the \"family\" field in the fast message dump.\n\nThis patch fixes this to properly display the socket family.\n\nFixes: 3dbfde7f6bc7b8 (\"devlink: add devlink_fmsg_dump_skb() function\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nLink: https://patch.msgid.link/20260407022730.2393-1-lirongqing@baidu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "39897df386376912d561d4946499379effa1e7ef", "tree": "2a473c5d11438c9071e90d7fc0804cd900ff6626", "parents": [ "8e2760eaab778494fc1fa257031e0e1799647f46" ], "author": { "name": "Jiexun Wang", "email": "wangjiexun2025@gmail.com", "time": "Tue Apr 07 16:00:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:33:52 2026 -0700" }, "message": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu-\u003epath. Meanwhile, unix_release_sock() clears u-\u003epath under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built.\n\nFixes: 5f7b0569460b (\"unix_diag: Unix inode info NLA\")\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nCo-developed-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSuggested-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nTested-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Jiexun Wang \u003cwangjiexun2025@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260407080015.1744197-1-n05ec@lzu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e2760eaab778494fc1fa257031e0e1799647f46", "tree": "d7869013ac2fe4dc342a9a39439e36d1f9a460ef", "parents": [ "9b55b253907e7431210483519c5ad711a37dafa1" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Apr 07 10:41:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:31:16 2026 -0700" }, "message": "Revert \"mptcp: add needs_id for netlink appending addr\"\n\nThis commit was originally adding the ability to add MPTCP endpoints\nwith ID 0 by accident. The in-kernel PM, handling MPTCP endpoints at the\nnet namespace level, is not supposed to handle endpoints with such ID,\nbecause this ID 0 is reserved to the initial subflow, as mentioned in\nthe MPTCPv1 protocol [1], a per-connection setting.\n\nNote that \u0027ip mptcp endpoint add id 0\u0027 stops early with an error, but\nother tools might still request the in-kernel PM to create MPTCP\nendpoints with this restricted ID 0.\n\nIn other words, it was wrong to call the mptcp_pm_has_addr_attr_id\nhelper to check whether the address ID attribute is set: if it was set\nto 0, a new MPTCP endpoint would be created with ID 0, which is not\nexpected, and might cause various issues later.\n\nFixes: 584f38942626 (\"mptcp: add needs_id for netlink appending addr\")\nCc: stable@vger.kernel.org\nLink: https://datatracker.ietf.org/doc/html/rfc8684#section-3.2-9 [1]\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260407-net-mptcp-revert-pm-needs-id-v2-1-7a25cbc324f8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b55b253907e7431210483519c5ad711a37dafa1", "tree": "6ddf2e6e6beee97cfa54afdca56885402315e4fa", "parents": [ "5a37d228799b0ec2c277459c83c814a59d310bc3" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Mon Apr 06 11:15:10 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:30:08 2026 -0700" }, "message": "mptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP\u0027s mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(\u0026tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache.\n\nFixes: b19bc2945b40 (\"mptcp: implement delegated actions\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260406031512.189159-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a37d228799b0ec2c277459c83c814a59d310bc3", "tree": "453d7a12cc06377c4a51e0570fa5c8b63cfe667c", "parents": [ "b30b1675aa2bcf0491fd3830b051df4e08a7c8ca" ], "author": { "name": "Fabio Baltieri", "email": "fabio.baltieri@gmail.com", "time": "Sun Apr 05 23:20:13 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:11:37 2026 -0700" }, "message": "net: txgbe: leave space for null terminators on property_entry\n\nLists of struct property_entry are supposed to be terminated with an\nempty property, this driver currently seems to be allocating exactly the\namount of entry used.\n\nChange the struct definition to leave an extra element for all\nproperty_entry.\n\nFixes: c3e382ad6d15 (\"net: txgbe: Add software nodes to support phylink\")\nSigned-off-by: Fabio Baltieri \u003cfabio.baltieri@gmail.com\u003e\nTested-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260405222013.5347-1-fabio.baltieri@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b30b1675aa2bcf0491fd3830b051df4e08a7c8ca", "tree": "9964a4698417a6c276daaaed576bc91b9d6a41c0", "parents": [ "d65b175cfac64ee65506eea7fa573d291a9694ca" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@gmail.com", "time": "Sat Apr 04 15:41:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 19:08:56 2026 -0700" }, "message": "net: ioam6: fix OOB and missing lock\n\nWhen trace-\u003etype.bit6 is set:\n\n if (trace-\u003etype.bit6) {\n ...\n queue \u003d skb_get_tx_queue(dev, skb);\n qdisc \u003d rcu_dereference(queue-\u003eqdisc);\n\nThis code can lead to an out-of-bounds access of the dev-\u003e_tx[] array\nwhen is_input is true. In such a case, the packet is on the RX path and\nskb-\u003equeue_mapping contains the RX queue index of the ingress device. If\nthe ingress device has more RX queues than the egress device (dev) has\nTX queues, skb_get_queue_mapping(skb) will exceed dev-\u003enum_tx_queues.\nAdd a check to avoid this situation since skb_get_tx_queue() does not\nclamp the index. This issue has also revealed that per queue visibility\ncannot be accurate and will be replaced later as a new feature.\n\nWhile at it, add missing lock around qdisc_qstats_qlen_backlog(). The\nfunction __ioam6_fill_trace_data() is called from both softirq and\nprocess contexts, hence the use of spin_lock_bh() here.\n\nFixes: b63c5478e9cb (\"ipv6: ioam: Support for Queue depth data field\")\nReported-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nCloses: https://lore.kernel.org/netdev/20260403214418.2233266-2-kuba@kernel.org/\nSigned-off-by: Justin Iurman \u003cjustin.iurman@gmail.com\u003e\nLink: https://patch.msgid.link/20260404134137.24553-1-justin.iurman@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d65b175cfac64ee65506eea7fa573d291a9694ca", "tree": "2c6721cba3c14e0db2e81846310bcf845c12377a", "parents": [ "84ac9a922d8d2b1a93848cf0f219ae844765dea9", "ea245d78dec594372e27d8c79616baf49e98a4a1" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:56:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:56:17 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-04-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nA few last-minute fixes:\n - rfkill: prevent boundless event list\n - rt2x00: fix USB resource management\n - brcmfmac: validate firmware IDs\n - brcmsmac: fix DMA free size\n\n* tag \u0027wireless-2026-04-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n net: rfkill: prevent unlimited numbers of rfkill events from being created\n wifi: rt2x00usb: fix devres lifetime\n wifi: brcmfmac: validate bsscfg indices in IF events\n wifi: brcmsmac: Fix dma_free_coherent() size\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260408081802.111623-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "84ac9a922d8d2b1a93848cf0f219ae844765dea9", "tree": "0ef98a5eb5f1b8501e4d96965a6702d632c41fce", "parents": [ "d614e0186bf37bb46a76d92e474c11f6a5cbc547", "426c355742f02cf743b347d9d7dbdc1bfbfa31ef" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:54:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:54:32 2026 -0700" }, "message": "Merge tag \u0027ipsec-2026-04-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-04-08\n\n1) Clear trailing padding in build_polexpire() to prevent\n leaking unititialized memory. From Yasuaki Torimaru.\n\n2) Fix aevent size calculation when XFRMA_IF_ID is used.\n From Keenan Dong.\n\n3) Wait for RCU readers during policy netns exit before\n freeing the policy hash tables.\n\n4) Fix dome too eaerly dropped references on the netdev\n when uding transport mode. From Qi Tang.\n\n5) Fix refcount leak in xfrm_migrate_policy_find().\n From Kotlyarov Mihail.\n\n6) Fix two fix info leaks in build_report() and\n in build_mapping(). From Greg Kroah-Hartman.\n\n7) Zero aligned sockaddr tail in PF_KEY exports.\n From Zhengchuan Liang.\n\n* tag \u0027ipsec-2026-04-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n net: af_key: zero aligned sockaddr tail in PF_KEY exports\n xfrm_user: fix info leak in build_report()\n xfrm_user: fix info leak in build_mapping()\n xfrm: fix refcount leak in xfrm_migrate_policy_find\n xfrm: hold dev ref until after transport_finish NF_HOOK\n xfrm: Wait for RCU readers during policy netns exit\n xfrm: account XFRMA_IF_ID in aevent size calculation\n xfrm: clear trailing padding in build_polexpire()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260408095925.253681-1-steffen.klassert@secunet.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d614e0186bf37bb46a76d92e474c11f6a5cbc547", "tree": "b7af7da3755d489d2bf161de8dabb04b499d19fb", "parents": [ "1ee3b19a267ff2f54d340378d91a9627e540ab97", "82d8701b2c930d0e96b0dbc9115a218d791cb0d2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:50:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:50:27 2026 -0700" }, "message": "Merge tag \u0027batadv-net-pullrequest-20260408\u0027 of https://git.open-mesh.org/linux-merge\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are two batman-adv bugfixes:\n\n - reject oversized global TT response buffers, by Ruide Cao\n\n - hold claim backbone gateways by reference, by Haoze Xie\n\n* tag \u0027batadv-net-pullrequest-20260408\u0027 of https://git.open-mesh.org/linux-merge:\n batman-adv: hold claim backbone gateways by reference\n batman-adv: reject oversized global TT response buffers\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260408110255.976389-1-sw@simonwunderlich.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1ee3b19a267ff2f54d340378d91a9627e540ab97", "tree": "c64307b56314e4c46cd7ff15b122694dd6c9cd5b", "parents": [ "cade36eed7173e5d341ea31b59c61435fe08a8ff", "dde1a6084c5ca9d143a562540d5453454d79ea15" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:48:44 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:48:44 2026 -0700" }, "message": "Merge tag \u0027nf-26-04-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter updates for net\n\nI only included crash fixes, as we\u0027re closer to a release, rest will\nbe handled via -next.\n\n1) Fix a NULL pointer dereference in ip_vs_add_service error path, from\n Weiming Shi, bug added in 6.2 development cycle.\n\n2) Don\u0027t leak kernel data bytes from allocator to userspace: nfnetlink_log\n needs to init the trailing NLMSG_DONE terminator. From Xiang Mei.\n\n3) xt_multiport match lacks range validation, bogus userspace request will\n cause out-of-bounds read. From Ren Wei.\n\n4) ip6t_eui64 match must reject packets with invalid mac header before\n calling eth_hdr. Make existing check unconditional. From Zhengchuan\n Liang.\n\n5) nft_ct timeout policies are free\u0027d via kfree() while they may still\n be reachable by other cpus that process a conntrack object that\n uses such a timeout policy. Existing reaping of entries is not\n sufficient because it doesn\u0027t wait for a grace period. Use kfree_rcu().\n From Tuan Do.\n\n6/7) Make nfnetlink_queue hash table per queue. As-is we can hit a page\n fault in case underlying page of removed element was free\u0027d. Per-queue\n hash prevents parallel lookups. This comes with a test case that\n demonstrates the bug, from Fernando Fernandez Mancera.\n\n* tag \u0027nf-26-04-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n selftests: nft_queue.sh: add a parallel stress test\n netfilter: nfnetlink_queue: make hash table per queue\n netfilter: nft_ct: fix use-after-free in timeout object destroy\n netfilter: ip6t_eui64: reject invalid MAC header for all packets\n netfilter: xt_multiport: validate range encoding in checkentry\n netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator\n ipvs: fix NULL deref in ip_vs_add_service error path\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260408163512.30537-1-fw@strlen.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cade36eed7173e5d341ea31b59c61435fe08a8ff", "tree": "a885f0a83a60bcb366d5edd4fb74ffaa3440b122", "parents": [ "c09ea768bdb975e828f8e17293c397c3d14ad85d", "a44ce6aa2efb61fe44f2cfab72bb01544bbca272" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:45:32 2026 -0700" }, "message": "Merge branch \u0027rxrpc-miscellaneous-fixes\u0027\n\nDavid Howells says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nrxrpc: Miscellaneous fixes\n\nHere are some fixes for rxrpc:\n\n (1) Fix key quota calculation.\n\n (2) Fix a memory leak.\n\n (3) Fix rxrpc_new_client_call_for_sendmsg() to substitute NULL for an\n empty key.\n\n Might want to remove this substitution entirely or handle it in\n rxrpc_init_client_call_security() instead.\n\n (4) Fix deletion of call-\u003elink to be RCU safe.\n\n (5) Fix missing bounds checks when parsing RxGK tickets.\n\n (6) Fix use of wrong skbuff to get challenge serial number. Also actually\n substitute the newer response skbuff and release the older one.\n\n (7) Fix unexpected RACK timer warning to report old mode.\n\n (8) Fix call key refcount leak.\n\n (9) Fix the interaction of jumbograms with Tx window space, setting the\n request-ack flag when the window space is getting low, typically\n because each jumbogram take a big bite out of the window and fewer UDP\n packets get traded.\n\n(10) Don\u0027t call rxrpc_put_call() with a NULL pointer.\n\n(11) Reject undecryptable rxkad response tickets by checking result of\n decryption.\n\n(12) Fix buffer bounds calculation in the RESPONSE authenticator parser.\n\n(13) Fix oversized response length check.\n\n(14) Fix refcount leak on multiple setting of server keyring.\n\n(15) Fix checks made by RXRPC_SECURITY_KEY and RXRPC_SECURITY_KEYRING (both\n should be allowed).\n\n(16) Fix lack of result checking on calls to crypto_skcipher_en/decrypt().\n\n(17) Fix token_len limit check in rxgk_verify_response().\n\n(18) Fix rxgk context leak in rxgk_verify_response().\n\n(19) Fix read beyond end of buffer in rxgk_do_verify_authenticator().\n\n(20) Fix parsing of RESPONSE packet on a connection that has already been set\n from a prior response.\n\n(21) Fix size of buffers used for rendering addresses into for procfiles.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260408121252.2249051-1-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a44ce6aa2efb61fe44f2cfab72bb01544bbca272", "tree": "a885f0a83a60bcb366d5edd4fb74ffaa3440b122", "parents": [ "c43ffdcfdbb5567b1f143556df8a04b4eeea041c" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Wed Apr 08 13:12:49 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:45:32 2026 -0700" }, "message": "rxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter\u0027s maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example\n\nFixes: 75b54cb57ca3 (\"rxrpc: Add IPv6 support\")\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Anderson Nascimento \u003canderson@allelesecurity.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-22-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c43ffdcfdbb5567b1f143556df8a04b4eeea041c", "tree": "67a9d399e75f8c5bbd46f65d44e7e99407a81a36", "parents": [ "f564af387c8c28238f8ebc13314c589d7ba8475d" ], "author": { "name": "Wang Jie", "email": "jiewang2024@lzu.edu.cn", "time": "Wed Apr 08 13:12:48 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:45:05 2026 -0700" }, "message": "rxrpc: only handle RESPONSE during service challenge\n\nOnly process RESPONSE packets while the service connection is still in\nRXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before\nrunning response verification and security initialization, then use a local\nsecured flag to decide whether to queue the secured-connection work after\nthe state transition. This keeps duplicate or late RESPONSE packets from\nre-running the setup path and removes the unlocked post-transition state\ntest.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nCo-developed-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSuggested-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Jie Wang \u003cjiewang2024@lzu.edu.cn\u003e\nSigned-off-by: Yang Yang \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-21-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f564af387c8c28238f8ebc13314c589d7ba8475d", "tree": "ec1a09e3c9bb332a0f06b744b3cb5f1b532d6381", "parents": [ "7e1876caa8363056f58a21d3b31b82c2daf7e608" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:47 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:34 2026 -0700" }, "message": "rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()\n\nFix rxgk_do_verify_authenticator() to check the buffer size before checking\nthe nonce.\n\nFixes: 9d1d2b59341f (\"rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)\")\nCloses: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-20-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7e1876caa8363056f58a21d3b31b82c2daf7e608", "tree": "7d44c91dc4de9e2c7fcad8ac592c08da5a73afde", "parents": [ "699e52180f4231c257821c037ed5c99d5eb0edb8" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:46 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:34 2026 -0700" }, "message": "rxrpc: Fix leak of rxgk context in rxgk_verify_response()\n\nFix rxgk_verify_response() to clean up the rxgk context it creates.\n\nFixes: 9d1d2b59341f (\"rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)\")\nCloses: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-19-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "699e52180f4231c257821c037ed5c99d5eb0edb8", "tree": "fc4b986b54ff01d900ec288f31e242d967d4f641", "parents": [ "f93af41b9f5f798823d0d0fb8765c2a936d76270" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:45 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:34 2026 -0700" }, "message": "rxrpc: Fix integer overflow in rxgk_verify_response()\n\nIn rxgk_verify_response(), there\u0027s a potential integer overflow due to\nrounding up token_len before checking it, thereby allowing the length check to\nbe bypassed.\n\nFix this by checking the unrounded value against len too (len is limited as\nthe response must fit in a single UDP packet).\n\nFixes: 9d1d2b59341f (\"rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)\")\nCloses: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-18-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f93af41b9f5f798823d0d0fb8765c2a936d76270", "tree": "d2e1fe746c72ee44c64aab0a04a1e78841640922", "parents": [ "2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:44 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:34 2026 -0700" }, "message": "rxrpc: Fix missing error checks for rxkad encryption/decryption failure\n\nAdd error checking for failure of crypto_skcipher_en/decrypt() to various\nrxkad function as the crypto functions can fail with ENOMEM at least.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nCloses: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-17-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2afd86ccbb2082a3c4258aea8c07e5bb6267bc2f", "tree": "123e39fc41d06a768e53819d938b66ada76461eb", "parents": [ "f125846ee79fcae537a964ce66494e96fa54a6de" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:43 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:34 2026 -0700" }, "message": "rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)\n\nAn AF_RXRPC socket can be both client and server at the same time. When\nsending new calls (ie. it\u0027s acting as a client), it uses rx-\u003ekey to set the\nsecurity, and when accepting incoming calls (ie. it\u0027s acting as a server),\nit uses rx-\u003esecurities.\n\nsetsockopt(RXRPC_SECURITY_KEY) sets rx-\u003ekey to point to an rxrpc-type key\nand setsockopt(RXRPC_SECURITY_KEYRING) sets rx-\u003esecurities to point to a\nkeyring of rxrpc_s-type keys.\n\nNow, it should be possible to use both rx-\u003ekey and rx-\u003esecurities on the\nsame socket - but for userspace AF_RXRPC sockets rxrpc_setsockopt()\nprevents that.\n\nFix this by:\n\n (1) Remove the incorrect check rxrpc_setsockopt(RXRPC_SECURITY_KEYRING)\n makes on rx-\u003ekey.\n\n (2) Move the check that rxrpc_setsockopt(RXRPC_SECURITY_KEY) makes on\n rx-\u003ekey down into rxrpc_request_key().\n\n (3) Remove rxrpc_request_key()\u0027s check on rx-\u003esecurities.\n\nThis (in combination with a previous patch) pushes the checks down into the\nfunctions that set those pointers and removes the cross-checks that prevent\nboth key and keyring being set.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nCloses: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Anderson Nascimento \u003canderson@allelesecurity.com\u003e\ncc: Luxiao Xu \u003crakukuip@gmail.com\u003e\ncc: Yuan Tan \u003cyuantan098@gmail.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-16-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f125846ee79fcae537a964ce66494e96fa54a6de", "tree": "50205b14e6ae23e7b53b7bd2d9e726be9d9f3814", "parents": [ "a2567217ade970ecc458144b6be469bc015b23e5" ], "author": { "name": "Luxiao Xu", "email": "rakukuip@gmail.com", "time": "Wed Apr 08 13:12:42 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx-\u003esecurities is already set.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nCo-developed-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSuggested-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nTested-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Luxiao Xu \u003crakukuip@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-15-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a2567217ade970ecc458144b6be469bc015b23e5", "tree": "5c7987ec14cf3e7a843ff7de56bbf3657d5dfeb8", "parents": [ "3e3138007887504ee9206d0bfb5acb062c600025" ], "author": { "name": "Keenan Dong", "email": "keenanat2000@gmail.com", "time": "Wed Apr 08 13:12:41 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload.\n\nFixes: 9d1d2b59341f (\"rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)\")\nSigned-off-by: Keenan Dong \u003ckeenanat2000@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: Willy Tarreau \u003cw@1wt.eu\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-14-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3e3138007887504ee9206d0bfb5acb062c600025", "tree": "71b6f15bcb0563208be109b9968b7afebf363dd9", "parents": [ "fe4447cd95623b1cfacc15f280aab73a6d7340b2" ], "author": { "name": "Keenan Dong", "email": "keenanat2000@gmail.com", "time": "Wed Apr 08 13:12:40 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: fix RESPONSE authenticator parser OOB read\n\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAllocated by task 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvert the byte count to __be32 units before constructing the parser\nlimit.\n\nFixes: 9d1d2b59341f (\"rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)\")\nSigned-off-by: Keenan Dong \u003ckeenanat2000@gmail.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: Willy Tarreau \u003cw@1wt.eu\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-13-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe4447cd95623b1cfacc15f280aab73a6d7340b2", "tree": "93b6696f2cdaa0cd24121a116f28a9c7ec90c496", "parents": [ "6331f1b24a3e85465f6454e003a3e6c22005a5c5" ], "author": { "name": "Yuqi Xu", "email": "xuyuqiabc@gmail.com", "time": "Wed Apr 08 13:12:39 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: reject undecryptable rxkad response tickets\n\nrxkad_decrypt_ticket() decrypts the RXKAD response ticket and then\nparses the buffer as plaintext without checking whether\ncrypto_skcipher_decrypt() succeeded.\n\nA malformed RESPONSE can therefore use a non-block-aligned ticket\nlength, make the decrypt operation fail, and still drive the ticket\nparser with attacker-controlled bytes.\n\nCheck the decrypt result and abort the connection with RXKADBADTICKET\nwhen ticket decryption fails.\n\nFixes: 17926a79320a (\"[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both\")\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nCo-developed-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nSuggested-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nTested-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Yuqi Xu \u003cxuyuqiabc@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-12-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6331f1b24a3e85465f6454e003a3e6c22005a5c5", "tree": "fd4b809856acb422dcac4eb1d4ba37857c94bc7b", "parents": [ "0cd3e3f3f2ec1a45aa559e2c0f3d57fac5eb3c25" ], "author": { "name": "Douya Le", "email": "ldy3087146292@gmail.com", "time": "Wed Apr 08 13:12:38 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: Only put the call ref if one was acquired\n\nrxrpc_input_packet_on_conn() can process a to-client packet after the\ncurrent client call on the channel has already been torn down. In that\ncase chan-\u003ecall is NULL, rxrpc_try_get_call() returns NULL and there is\nno reference to drop.\n\nThe client-side implicit-end error path does not account for that and\nunconditionally calls rxrpc_put_call(). This turns a protocol error\npath into a kernel crash instead of rejecting the packet.\n\nOnly drop the call reference if one was actually acquired. Keep the\nexisting protocol error handling unchanged.\n\nFixes: 5e6ef4f1017c (\"rxrpc: Make the I/O thread take over the call and local processor work\")\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Douya Le \u003cldy3087146292@gmail.com\u003e\nCo-developed-by: Yuan Tan \u003ctanyuan98@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003ctanyuan98@gmail.com\u003e\nSuggested-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Ao Zhou \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-11-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0cd3e3f3f2ec1a45aa559e2c0f3d57fac5eb3c25", "tree": "44b0f25ebc370256323aa4ec39018c3f52a05b58", "parents": [ "d666540d217e8d420544ebdfbadeedd623562733" ], "author": { "name": "Marc Dionne", "email": "marc.c.dionne@gmail.com", "time": "Wed Apr 08 13:12:37 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:33 2026 -0700" }, "message": "rxrpc: Fix to request an ack if window is limited\n\nPeers may only send immediate acks for every 2 UDP packets received.\nWhen sending a jumbogram, it is important to check that there is\nsufficient window space to send another same sized jumbogram following\nthe current one, and request an ack if there isn\u0027t. Failure to do so may\ncause the call to stall waiting for an ack until the resend timer fires.\n\nWhere jumbograms are in use this causes a very significant drop in\nperformance.\n\nFixes: fe24a5494390 (\"rxrpc: Send jumbo DATA packets\")\nSigned-off-by: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-10-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d666540d217e8d420544ebdfbadeedd623562733", "tree": "a48376d55b3b45d08d6e3192a09337d6b9c3ca53", "parents": [ "65b3ffe0972ed023acc3981a0f7e1ae5d0208bd3" ], "author": { "name": "Anderson Nascimento", "email": "anderson@allelesecurity.com", "time": "Wed Apr 08 13:12:36 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:32 2026 -0700" }, "message": "rxrpc: Fix key reference count leak from call-\u003ekey\n\nWhen creating a client call in rxrpc_alloc_client_call(), the code obtains\na reference to the key. This is never cleaned up and gets leaked when the\ncall is destroyed.\n\nFix this by freeing call-\u003ekey in rxrpc_destroy_call().\n\nBefore the patch, it shows the key reference counter elevated:\n\n$ cat /proc/keys | grep afs@54321\n1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka\n$\n\nAfter the patch, the invalidated key is removed when the code exits:\n\n$ cat /proc/keys | grep afs@54321\n$\n\nFixes: f3441d4125fc (\"rxrpc: Copy client call parameters into rxrpc_call earlier\")\nSigned-off-by: Anderson Nascimento \u003canderson@allelesecurity.com\u003e\nCo-developed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-9-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65b3ffe0972ed023acc3981a0f7e1ae5d0208bd3", "tree": "ac3b55bffe1d7d7baa47a546760648030e2b6509", "parents": [ "b33f5741bb187db8ff32e8f5b96def77cc94dfca" ], "author": { "name": "Alok Tiwari", "email": "alok.a.tiwari@oracle.com", "time": "Wed Apr 08 13:12:35 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:32 2026 -0700" }, "message": "rxrpc: Fix rack timer warning to report unexpected mode\n\nrxrpc_rack_timer_expired() clears call-\u003erack_timer_mode to OFF before\nthe switch. The default case warning therefore always prints OFF and\ndoesn\u0027t identify the unexpected timer mode.\n\nLog the saved mode value instead so the warning reports the actual\nunexpected rack timer mode.\n\nFixes: 7c482665931b (\"rxrpc: Implement RACK/TLP to deal with transmission stalls [RFC8985]\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-8-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b33f5741bb187db8ff32e8f5b96def77cc94dfca", "tree": "d0a5eb8e8443cd867aa075fba9787a6421decd4a", "parents": [ "d179a868dd755b0cfcf7582e00943d702b9943b8" ], "author": { "name": "Alok Tiwari", "email": "alok.a.tiwari@oracle.com", "time": "Wed Apr 08 13:12:34 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:32 2026 -0700" }, "message": "rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial\n\nIn rxrpc_post_response(), the code should be comparing the challenge serial\nnumber from the cached response before deciding to switch to a newer\nresponse, but looks at the newer packet private data instead, rendering the\ncomparison always false.\n\nFix this by switching to look at the older packet.\n\nFix further[1] to substitute the new packet in place of the old one if\nnewer and also to release whichever we don\u0027t use.\n\nFixes: 5800b1cf3fd8 (\"rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com [1]\nLink: https://patch.msgid.link/20260408121252.2249051-7-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d179a868dd755b0cfcf7582e00943d702b9943b8", "tree": "9be41ad98b280539d8955d3927247d42441e2a58", "parents": [ "146d4ab94cf129ee06cd467cb5c71368a6b5bad6" ], "author": { "name": "Oleh Konko", "email": "security@1seal.org", "time": "Wed Apr 08 13:12:33 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:32 2026 -0700" }, "message": "rxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation. When the raw\nlength is \u003e\u003d 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n memcpy calls do not re-read from the token, eliminating a class of\n TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected.\n\nFixes: 0ca100ff4df6 (\"rxrpc: Add YFS RxGK (GSSAPI) security class\")\nSigned-off-by: Oleh Konko \u003csecurity@1seal.org\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-6-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "146d4ab94cf129ee06cd467cb5c71368a6b5bad6", "tree": "e0d68a288db5302a03531888ab42408d92dfe0c8", "parents": [ "6a59d84b4fc2f27f7b40e348506cc686712e260b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:32 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:32 2026 -0700" }, "message": "rxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet-\u003ecalls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that\u0027s\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere\u0027s no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs.\n\nFixes: 2baec2c3f854 (\"rxrpc: Support network namespacing\")\nCloses: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-5-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a59d84b4fc2f27f7b40e348506cc686712e260b", "tree": "3f247aff7e6c6cce5099db0397e2ad540f355429", "parents": [ "b555912b9b21075e8298015f888ffe3ff60b1a97" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:31 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:31 2026 -0700" }, "message": "rxrpc: Fix anonymous key handling\n\nIn rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to\nbe substituted for a NULL key pointer, but the variable this is done with\nis subsequently not used.\n\nFix this by using \"key\" rather than \"rx-\u003ekey\" when filling in the\nconnection parameters.\n\nNote that this only affects direct use of AF_RXRPC; the kAFS filesystem\ndoesn\u0027t use sendmsg() directly and so bypasses the issue. Further,\nAF_RXRPC passes a NULL key in if no key is set, so using an anonymous key\nin that manner works. Since this hasn\u0027t been noticed to this point, it\nmight be better just to remove the \"key\" variable and the code that sets it\n- and, arguably, rxrpc_init_client_call_security() would be a better place\nto handle it.\n\nFixes: 19ffa01c9c45 (\"rxrpc: Use structs to hold connection params and protocol info\")\nCloses: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-4-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b555912b9b21075e8298015f888ffe3ff60b1a97", "tree": "b4af2c0b28dac84527e03a54c0227389e5ab4e0e", "parents": [ "bdbfead6d38979475df0c2f4bad2b19394fe9bdc" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:30 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:31 2026 -0700" }, "message": "rxrpc: Fix key parsing memleak\n\nIn rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token-\u003erxgk can be\nleaked in a few error paths after it\u0027s allocated.\n\nFix this by freeing it in the \"reject_token:\" case.\n\nFixes: 0ca100ff4df6 (\"rxrpc: Add YFS RxGK (GSSAPI) security class\")\nCloses: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-3-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdbfead6d38979475df0c2f4bad2b19394fe9bdc", "tree": "69795fa8f4e245cb832d4f4ccdfd3c62714a6fd3", "parents": [ "c09ea768bdb975e828f8e17293c397c3d14ad85d" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Apr 08 13:12:29 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:44:31 2026 -0700" }, "message": "rxrpc: Fix key quota calculation for multitoken keys\n\nIn the rxrpc key preparsing, every token extracted sets the proposed quota\nvalue, but for multitoken keys, this will overwrite the previous proposed\nquota, losing it.\n\nFix this by adding to the proposed quota instead.\n\nFixes: 8a7a3eb4ddbe (\"KEYS: RxRPC: Use key preparsing\")\nCloses: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Jeffrey Altman \u003cjaltman@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\ncc: stable@kernel.org\nLink: https://patch.msgid.link/20260408121252.2249051-2-dhowells@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c09ea768bdb975e828f8e17293c397c3d14ad85d", "tree": "296cddc31fab016e699a985ede60d88382c7652b", "parents": [ "f821664dde29302e8450aa0597bf1e4c7c5b0a22" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Sun Apr 05 14:51:52 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 08 18:42:08 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop\n\nSwitch to device_for_each_child_node_scoped() to auto-release fwnode\nreferences on early exit.\n\nFixes: 24e31e474769 (\"net: mdio: Add RTL9300 MDIO driver\")\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260405-rtl9300-v1-1-08e4499cf944@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7f87a5ea75f011d2c9bc8ac0167e5e2d1adb1594", "tree": "44eaebaa3cb8e2550b770df6ff5bd43cf24fd8ed", "parents": [ "52f657e34d7b21b47434d9d8b26fa7f6778b63a0", "45065a5095c7773fb98c35d60c20c3b513540597" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 08 13:38:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 08 13:38:30 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026040801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - handling of new keycodes for contextual AI usages (Akshai Murari)\n\n - fix for UAF in hid-roccat (Benoît Sevens)\n\n - deduplication of error logging in amd_sfh (Maximilian Pezzullo)\n\n - various device-specific quirks and device ID additions (Even Xu, Lode\n Willems, Leo Vriska)\n\n* tag \u0027hid-for-linus-2026040801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n Input: add keycodes for contextual AI usages (HUTRR119)\n HID: Kysona: Add support for VXE Dragonfly R1 Pro\n HID: amd_sfh: don\u0027t log error when device discovery fails with -EOPNOTSUPP\n HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3\n HID: roccat: fix use-after-free in roccat_report_event\n HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs\n HID: Intel-thc-hid: Intel-quicki2c: Add NVL Device IDs\n" }, { "commit": "52f657e34d7b21b47434d9d8b26fa7f6778b63a0", "tree": "17c82247d560acf441f7d08af34306455bd9aaf7", "parents": [ "3036cd0d3328220a1858b1ab390be8b562774e8a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 08 13:18:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 08 13:18:57 2026 -0700" }, "message": "x86: shadow stacks: proper error handling for mmap lock\n\n김영민 reports that shstk_pop_sigframe() doesn\u0027t check for errors from\nmmap_read_lock_killable(), which is a silly oversight, and also shows\nthat we haven\u0027t marked those functions with \"__must_check\", which would\nhave immediately caught it.\n\nSo let\u0027s fix both issues.\n\nReported-by: 김영민 \u003cosori@hspace.io\u003e\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Dave Hansen \u003cdave.hansen@intel.com\u003e\nAcked-by: Rick Edgecombe \u003crick.p.edgecombe@intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ff14dafde15c11403fac61367a34fea08926e9ee", "tree": "0dfcc9879e4dba6a0c9cedd7e47f7ca810358b48", "parents": [ "4cda78d6f8bf2b700529f2fbccb994c3e826d7c2" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Tue Apr 07 22:16:27 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Wed Apr 08 10:16:49 2026 -0700" }, "message": "Input: uinput - take event lock when submitting FF request \"event\"\n\nTo avoid racing with FF playback events and corrupting device\u0027s event\nqueue take event_lock spinlock when calling uinput_dev_event() when\nsubmitting a FF upload or erase \"event\".\n\nTested-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nLink: https://patch.msgid.link/adXkf6MWzlB8LA_s@google.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "6b6f7263d626886a96fce6352f94dfab7a24c339", "tree": "113d3a164c0c19a4b3c88d12b463417940d02201", "parents": [ "0b8757b220f94421bd4ff50cce03886387c4e71c" ], "author": { "name": "Syed Saba Kareem", "email": "Syed.SabaKareem@amd.com", "time": "Wed Apr 08 19:00:06 2026 +0530" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 08 17:04:47 2026 +0100" }, "message": "ASoC: amd: acp: update DMI quirk and add ACP DMIC for Lenovo platforms\n\nReplace DMI_EXACT_MATCH with DMI_MATCH for Lenovo SKU entries (21YW,\n21YX) so the quirk applies to all variants of these models, not just\nexact SKU matches.\n\nAdd ASOC_SDW_ACP_DMIC flag alongside ASOC_SDW_CODEC_SPKR in driver_data\nfor these Lenovo platform entries, as these platforms use ACP PDM DMIC\ninstead of SoundWire DMIC for digital microphone support.\n\nFixes: 3acf517e1ae0 (\"ASoC: amd: amd_sdw: add machine driver quirk for Lenovo models\")\nTested-by: Mark Pearson \u003cmpearson-lenovo@squebb.ca\u003e\nReviewed-by: Mark Pearson \u003cmpearson-lenovo@squebb.ca\u003e\nSigned-off-by: Syed Saba Kareem \u003cSyed.SabaKareem@amd.com\u003e\nReviewed-by: Vijendar Mukunda \u003cVijendar.Mukunda@amd.com\u003e\nLink: https://patch.msgid.link/20260408133029.1368317-1-syed.sabakareem@amd.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0b8757b220f94421bd4ff50cce03886387c4e71c", "tree": "1e8b8ba65031f75bf8b8cfa96bef6fb4ddf31065", "parents": [ "58dec4fac4c46b42b8264f2d8aa6972ff951c18b" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Wed Apr 08 10:38:34 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 08 16:55:30 2026 +0100" }, "message": "ASoC: SDCA: Unregister IRQ handlers on module remove\n\nEnsure that all interrupt handlers are unregistered before the parent\nregmap_irq is unregistered.\n\nsdca_irq_cleanup() was only called from the component_remove(). If the\nmodule was loaded and removed without ever being component probed the\nFDL interrupts would not be unregistered and this would hit a WARN\nwhen devm called regmap_del_irq_chip() during the removal of the\nparent IRQ.\n\nFixes: 4e53116437e9 (\"ASoC: SDCA: Fix errors in IRQ cleanup\")\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260408093835.2881486-5-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "58dec4fac4c46b42b8264f2d8aa6972ff951c18b", "tree": "e57a246dd2f38f73763b0737e3f225fc93f40f17", "parents": [ "23e0cbe55736de222ed975863cf06baf29bee5fe" ], "author": { "name": "Maciej Strozek", "email": "mstrozek@opensource.cirrus.com", "time": "Wed Apr 08 10:38:32 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 08 16:55:29 2026 +0100" }, "message": "ASoC: SDCA: mask Function_Status value\n\nAccording to the SDCA specification [1], when writing Function_Status during\nhandling this control, the value should mask off bit 7.\n\n[1] MIPI Specification for SoundWire Device Class for Audio, version\n 1.1, section 7.14.1.3 (Host Software Handling of Function_Status)\n\nSigned-off-by: Maciej Strozek \u003cmstrozek@opensource.cirrus.com\u003e\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260408093835.2881486-3-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" } ], "next": "23e0cbe55736de222ed975863cf06baf29bee5fe" }