)]}' { "log": [ { "commit": "e3d3f289a4ebd4ede448b2fa63e11b6a28698269", "tree": "33247999fa722b3545d875de178c94bc2876148a", "parents": [ "575f0567b05563d95a94270bdfc63ca55b27ad10" ], "author": { "name": "Thorsten Blum", "email": "thorsten.blum@linux.dev", "time": "Mon May 04 10:18:07 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon May 04 14:16:31 2026 +0200" }, "message": "drivers: dio: use tabs and avoid continuation logging in dio_init\n\nIndent multiple lines using tabs instead of spaces. Use pr_info() and\navoid continuation logging.\n\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nLink: https://patch.msgid.link/20260504081804.3260-5-thorsten.blum@linux.dev\n[geert: Correct format specifier for u8 dev-\u003eipl]\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\n" }, { "commit": "575f0567b05563d95a94270bdfc63ca55b27ad10", "tree": "ae9632d3ab6464f09605453615c6303011cfb660", "parents": [ "28e19a62a3f657dde1553a1a5aacf57c12480afd" ], "author": { "name": "Thorsten Blum", "email": "thorsten.blum@linux.dev", "time": "Mon May 04 10:18:05 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon May 04 14:13:05 2026 +0200" }, "message": "drivers: dio: replace deprecated strcpy with strscpy in dio_init\n\nstrcpy() has been deprecated [1] because it performs no bounds checking\non the destination buffer, which can lead to buffer overflows. While the\ncurrent code works correctly, replace strcpy() with the safer strscpy()\nto follow secure coding best practices.\n\n[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy\n\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nLink: https://patch.msgid.link/20260504081804.3260-3-thorsten.blum@linux.dev\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\n" }, { "commit": "28e19a62a3f657dde1553a1a5aacf57c12480afd", "tree": "7fee6c3bbc4b5b7ff08696ebda38f567b5af47a8", "parents": [ "e84e804f88d9af196943c7efb0980ed2a4b50032" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Fri Apr 24 12:40:11 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon May 04 14:12:16 2026 +0200" }, "message": "nubus: switch to dynamic root device\n\nDriver core expects devices to be dynamically allocated and will, for\nexample, complain loudly if a device that lacks a release function is\never freed.\n\nUse root_device_register() to allocate and register the root device\ninstead of open coding using a static device.\n\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nAcked-by: Finn Thain \u003cfthain@linux-m68k.org\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nLink: https://patch.msgid.link/20260424104011.2616970-1-johan@kernel.org\nSigned-off-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\n" }, { "commit": "e84e804f88d9af196943c7efb0980ed2a4b50032", "tree": "109853721337aa43fb107874be6f82474fae294e", "parents": [ "4ff8e797fed0b018ffde6e942d467884b846ecd9", "7fd2df204f342fc17d1a0bfcd474b24232fb0f32" ], "author": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon May 04 14:11:32 2026 +0200" }, "committer": { "name": "Geert Uytterhoeven", "email": "geert@linux-m68k.org", "time": "Mon May 04 14:11:32 2026 +0200" }, "message": "Merge tag \u0027v7.1-rc2\u0027\n\nLinux 7.1-rc2\n" }, { "commit": "7fd2df204f342fc17d1a0bfcd474b24232fb0f32", "tree": "9e0695e8c3234f6fcbbd3c2673e3a033c275f614", "parents": [ "f377d0025eb00c0590466f5be9f50decf9b9180e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 14:21:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 14:21:25 2026 -0700" }, "message": "Linux 7.1-rc2\n" }, { "commit": "f377d0025eb00c0590466f5be9f50decf9b9180e", "tree": "31365f471b763248bdd6de2966a54588ea77ccbc", "parents": [ "811129272de4f91da34f869ae1a1dd1fe608f64f", "b0aa5e4b087b686575f1b31ce54048b4d059b7b8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:58:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:58:42 2026 -0700" }, "message": "Merge tag \u0027sh-for-v7.1-tag2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux\n\nPull sh fix from John Paul Adrian Glaubitz:\n \"The ZERO_PAGE consolidation in v7.1, introduced a regression on sh\n which made these systems unbootable.\n\n The problem was that on sh, the initial boot parameters were\n previously referenced as an array and after 6215d9f4470f (\"arch, mm:\n consolidate empty_zero_page\"), they were referenced as a pointer which\n caused wrong code generation and boot hang.\n\n This changes the declaration back to being an array which fixes the\n boot hang\"\n\n* tag \u0027sh-for-v7.1-tag2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux:\n sh: Fix fallout from ZERO_PAGE consolidation\n" }, { "commit": "811129272de4f91da34f869ae1a1dd1fe608f64f", "tree": "ce815cc9a53454a0ab4b6ac756bb348c07d8ab91", "parents": [ "cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c", "5b31044e649e3e54c2caef135c09b371c2fbcd08" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:19:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:19:57 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Stable fixes for CONFIG_SMP\u003dn where _nolock() allocations in NMI both\n at kmalloc and page allocator levels are not properly protected by\n the spin_trylock() semantics on !SMP (Harry Yoo)\n\n* tag \u0027slab-for-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slab: return NULL early from kmalloc_nolock() in NMI on UP\n mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UP\n" }, { "commit": "cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c", "tree": "fcc437f9666cd2d2abe107ec59f88192746f79da", "parents": [ "c3cba36b394ba48b7920dcb99c46cee8ee59a116", "bc7304f3ae20972d11db6e0b1b541c63feda5f05" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:17:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:17:09 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-05-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fix from Ingo Molnar:\n \"Fix lockup in requeue-PI during signal/timeout wakeups, by Sebastian\n Andrzej Siewior\"\n\n* tag \u0027locking-urgent-2026-05-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n futex: Prevent lockup in requeue-PI during signal/ timeout wakeup\n" }, { "commit": "c3cba36b394ba48b7920dcb99c46cee8ee59a116", "tree": "57762c5df25b0c4d4e4d8dc041f3c604609f7f41", "parents": [ "66edb901bf874d9e0787326ba12d3548b2da8700", "3da56dc063cd77b9c0b40add930767fab4e389f3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:05:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 03 08:05:23 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-05-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix the delayed dequeue negative lag increase fix in the\n fair scheduler (Peter Zijlstra)\n\n - Fix wakeup_preempt_fair() to do proper delayed dequeue\n (Vincent Guittot)\n\n - Clear sched_entity::rel_deadline when initializing\n forked entities, which bug can cause all tasks to be\n EEVDF-ineligible, causing a NULL pointer dereference\n crash in pick_next_entity() (Zicheng Qu)\n\n* tag \u0027sched-urgent-2026-05-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Clear rel_deadline when initializing forked entities\n sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue\n sched/fair: Fix the negative lag increase fix\n" }, { "commit": "b0aa5e4b087b686575f1b31ce54048b4d059b7b8", "tree": "e95d3ce8d28ae83bb02c72416610efcde3e7c1cd", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Mike Rapoport (Microsoft)", "email": "rppt@kernel.org", "time": "Fri Apr 17 13:32:07 2026 +0300" }, "committer": { "name": "John Paul Adrian Glaubitz", "email": "glaubitz@physik.fu-berlin.de", "time": "Sun May 03 16:35:40 2026 +0200" }, "message": "sh: Fix fallout from ZERO_PAGE consolidation\n\nConsolidation of empty_zero_page declarations broke boot on sh.\n\nsh stores its initial boot parameters in a page reserved in\narch/sh/kernel/head_32.S. Before commit 6215d9f4470f (\"arch, mm:\nconsolidate empty_zero_page\") this page was referenced in C code\nas an array and after that commit it is referenced as a pointer.\n\nThis causes wrong code generation and boot hang.\n\nDeclare boot_params_page as an array to fix the issue.\n\nReported-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nTested-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nFixes: 6215d9f4470f (\"arch, mm: consolidate empty_zero_page\")\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nReviewed-by: John Paul Adrian Glaubitz \u003cglaubitz@physik.fu-berlin.de\u003e\nTested-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nTested-by: Artur Rojek \u003ccontact@artur-rojek.eu\u003e\nSigned-off-by: John Paul Adrian Glaubitz \u003cglaubitz@physik.fu-berlin.de\u003e\n" }, { "commit": "66edb901bf874d9e0787326ba12d3548b2da8700", "tree": "73fa19f9659b81c65f2fc32aa87e92e5cbd90822", "parents": [ "4c2ed2a3dbda5cad4d7b2f5f394c91522abbaa92", "5db6ef9847717329f12c5ea8aba7e9f588a980c0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 02 12:31:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 02 12:31:43 2026 -0700" }, "message": "Merge tag \u0027v7.1-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fix from Herbert Xu:\n\n - Reject algorithms with authsizes that are too short in authencesn\n\n* tag \u0027v7.1-p3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: authencesn - reject short ahash digests during instance creation\n" }, { "commit": "4c2ed2a3dbda5cad4d7b2f5f394c91522abbaa92", "tree": "74440b9cc9276e331221d4cd6e86061589f7b496", "parents": [ "f1a5e78a55ebf2b05777fd5eb738038ddae609d6", "9e9354075d5a15cfc0aba965f3d0d77b7d4303e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 02 12:25:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 02 12:25:57 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Fix a NULL pointer dereference in ntfs_index_walk_down() by\n validating index block allocation\n\n - Fix a memory leak of the symlink target string in\n ntfs_reparse_set_wsl_symlink() during error paths\n\n - Prevent VCN overflow and validate lowest_vcn in\n ntfs_mapping_pairs_decompress() to avoid runlist corruption\n\n - Fix a page reference leak in ntfs_write_iomap_end_resident()\n when attribute search context allocation fails\n\n - Fix an invalid PTR_ERR() usage on a valid folio pointer in\n __ntfs_bitmap_set_bits_in_run()\n\n - Correct directory link counting by dropping nlink only when\n the MFT record link count reaches zero for WIN32/DOS aliases\n\n - Fix an uninitialized variable in ntfs_mapping_pairs_decompress()\n by returning an error pointer directly\n\n* tag \u0027ntfs-for-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress()\n ntfs: drop nlink once for WIN32/DOS aliases\n ntfs: fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run()\n ntfs: fix error handling in ntfs_write_iomap_end_resident()\n ntfs: fix VCN overflow in ntfs_mapping_pairs_decompress()\n ntfs: fix WSL symlink target leak on reparse failure\n ntfs: fix NULL dereference in ntfs_index_walk_down()\n" }, { "commit": "f1a5e78a55ebf2b05777fd5eb738038ddae609d6", "tree": "fec25d0d7daa41637d8e6934587d3e453bf6b68b", "parents": [ "cd546f7ae2fce8b695c834143b50e712d62ebed8", "f0997a06e3e32898bcae667d6807fc46ebfd0eec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 16:56:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 16:56:08 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-02\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Fixes for rc2, the usual amdgpu/xe double header, I think xe had a\n couple of weeks combined due to some maintainer access issues,\n otherwise there\u0027s just a few misc fixes and documentation fixups.\n\n core and helpers:\n - calculate framebuffer geometry with format helpers\n - fix docs\n\n amdgpu:\n - GFX12 fix for CONFIG_DRM_DEBUG_MM configs\n - Fix DC analog support\n - Userq fixes\n - GART placement fix\n - Aldebaran SMU fixes\n - AMDGPU_INFO_READ_MMR_REG fix\n - UVD 3.1 fix\n - GC 6 TCC fix\n - Fix root reservation in amdgpu_vm_handle_fault()\n - RAS fix\n - Module reload fix for APUs\n - Fix build for CONFIG_DRM_FBDEV_EMULATION\u003dn\n - IGT DWB regression fix\n - GC 11.5.4 fix\n - VCN user fence fixes\n - JPEG user fence fixes\n - SMU 13.0.6 fix\n - VCN 3/4 IB parser fixes\n - NV3x+ dGPU vblank fix\n - DCE6/8 fixes for LVDS/eDP panels without an EDID\n\n amdkfd:\n - Fix for when CONFIG_HSA_AMD is not set\n - SVM fixes\n\n xe:\n - uapi: Add missing pad and extensions check\n - uapi: Reject unsafe PAT indices for CPU cached memory\n - Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge\n - Xe3p tuning and workaround fixes\n - USE drm mm instead of drm SA for CCS read/write\n - Fix leaks and null derefs\n - Fix Wa_18022495364\n\n appletbdrm:\n - allocate protocol buffers with kvzalloc()\n\n dma-buf:\n - fix docs\n\n imagination:\n - avoid segfault in debugfs\n\n ofdrm:\n - put PCI device reference on errors\n\n udl:\n - increase USB timeout\"\n\n* tag \u0027drm-fixes-2026-05-02\u0027 of https://gitlab.freedesktop.org/drm/kernel: (77 commits)\n drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR\n drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise\n drm/xe/xelp: Fix Wa_18022495364\n drm/xe/gsc: Fix BO leak on error in query_compatibility_version()\n drm/xe/eustall: Fix drm_dev_put called before stream disable in close\n drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()\n drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure\n drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()\n drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()\n drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked\n drm/xe/vf: Use drm mm instead of drm sa for CCS read/write\n drm/xe: Add memory pool with shadow support\n drm/xe/debugfs: Correct printing of register whitelist ranges\n drm/xe: Mark ROW_CHICKEN5 as a masked register\n drm/xe/tuning: Use proper register offset for GAMSTLB_CTRL\n drm/xe/xe3p_lpg: Add missing indirect ring state feature flag\n drm/xe: Drop redundant rtp entries for Wa_14019988906 \u0026 Wa_14019877138\n drm/xe/vm: Add missing pad and extensions check\n drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge()\n ...\n" }, { "commit": "cd546f7ae2fce8b695c834143b50e712d62ebed8", "tree": "dd255ca9984c837a4e89fd712789c1bfd3852bb7", "parents": [ "ef5f46b630235b75beec43174348c3d01d6fc49a", "030e8a40fff65ca6ac1c04a4d3c08afe72438922" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 16:32:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 16:32:42 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Avoid writing an uninitialised stack variable to POR_EL0 on sigreturn\n if the poe_context record is absent\n\n - Reserve one more page for the early 4K-page kernel mapping to cover\n the extra [_text, _stext) split introduced by the non-executable\n read-only mapping\n\n - Force the arch_local_irq_*() wrappers to be __always_inline so that\n noinstr entry and idle paths cannot call out-of-line, instrumentable\n copies\n\n - Fix potential sign extension in the arm64 SCS unwinder\u0027s DWARF\n advance_loc4 decoding\n\n - Tolerate arm64 ACPI platforms with only WFI and no deeper PSCI idle\n states, restoring cpuidle registration on such systems\n\n - Include the UAPI \u003casm/ptrace.h\u003e header in the arm64 GCS libc test\n rather than carrying a duplicate struct user_gcs definition (the\n original #ifdef NT_ARM_GCS was wrong to cover the structure\n definition as it would be masked out if the toolchain defined it)\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: signal: Preserve POR_EL0 if poe_context is missing\n arm64: Reserve an extra page for early kernel mapping\n kselftest/arm64: Include \u003casm/ptrace.h\u003e for user_gcs definition\n ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states\n arm64/irqflags: __always_inline the arch_local_irq_*() helpers\n arm64/scs: Fix potential sign extension issue of advance_loc4\n" }, { "commit": "ef5f46b630235b75beec43174348c3d01d6fc49a", "tree": "cec8a3cdd5b034da5d97219a9587a4d5b0fbaf14", "parents": [ "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "f92d542577db878acfd21cc18dab23d03023b217" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 13:19:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 13:19:14 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260501\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n\n - Ensure SELinux is always properly accessing its own sock LSM state\n\n - Only reserve an xattr slot for SELinux if it will be used\n\n - Fix a SELinux auditing regression in the directory avdcache\n\n* tag \u0027selinux-pr-20260501\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: fix avdcache auditing\n selinux: don\u0027t reserve xattr slot when we won\u0027t fill it\n selinux: use sk blob accessor in socket permission helpers\n" }, { "commit": "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "tree": "92cefa9cd46e9e431ed6be5e88a8486d59ab064e", "parents": [ "bb1d73f2cddccf717307e88c24cae619a9a80295" ], "author": { "name": "Davidlohr Bueso", "email": "dave@stgolabs.net", "time": "Fri May 01 12:41:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 13:12:34 2026 -0700" }, "message": "futex: Drop CLONE_THREAD requirement for private default hash alloc\n\nCurrently need_futex_hash_allocate_default() depends on strict pthread\nsemantics, abusing CLONE_THREAD. This breaks the non-concurrency\nassumptions when doing the mm-\u003efutex_ref pcpu allocations, leading to\nbugs[0] when sharing the mm in other ways; ie:\n\n BUG: KASAN: slab-use-after-free in futex_hash_put\n\n... where the +1 bias can end up on a percpu counter that mm-\u003efutex_ref\nno longer points at.\n\nLoosen the check to cover any CLONE_VM clone, except vfork(). Excluding\nvfork keeps the existing paths untouched (no overhead), and we can\u0027t\nrace in the first place: either the parent is suspended and the child\nruns alone, or mm-\u003efutex_ref is already allocated from an earlier\nCLONE_VM.\n\nLink: https://lore.kernel.org/all/CAL_bE8LsmCQ-FAtYDuwbJhOkt9p2wwYQwAbMh\u003dPifC\u003dVsiBM6A@mail.gmail.com/ [0]\nFixes: d9b05321e21e (\"futex: Move futex_hash_free() back to __mmput()\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bb1d73f2cddccf717307e88c24cae619a9a80295", "tree": "046957d8172265814d3975ef83b9001141dc3c26", "parents": [ "227c3d546e963874198aafc0cae8c3e8c24ae4ee", "b95e0e792822bad8fc9eb33ea3a90005e29e75e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 12:58:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 12:58:02 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - Reject zero-length writes from userspace that corrupt Debug Facility\n buffers\n\n - Replace one s390 PCI maintainer\n\n - Remove SCLP_OFB Kconfig option and enable the guarded code\n unconditionally\n\n - Replace incorrect use of phys_to_folio() to virt_to_folio() in\n do_secure_storage_access()\n\n* tag \u0027s390-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()\n s390/sclp: Remove SCLP_OFB Kconfig option\n MAINTAINERS: Replace one of the maintainers for s390/pci\n s390/debug: Reject zero-length input in debug_input_flush_fn()\n s390/debug: Reject zero-length input before trimming a newline\n" }, { "commit": "227c3d546e963874198aafc0cae8c3e8c24ae4ee", "tree": "97e895d22974327d98ffb395d9e99bc37acf848a", "parents": [ "6fe0be6dc7faf984599b1e356ead1c49b64ed3ca", "c444139cb747bf6de1922b39900fdf02281490f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 12:16:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 12:16:42 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc2-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix shutdown (stop sessions)\n\n - Fix readdir unsupported info level\n\n* tag \u0027v7.1-rc2-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: rewrite stop_sessions() with restartable iteration\n smb: server: handle readdir_info_level_struct_sz() error\n" }, { "commit": "6fe0be6dc7faf984599b1e356ead1c49b64ed3ca", "tree": "2d41c19662c37050d6eb53e23390a4c1e21f4de6", "parents": [ "9d88bb929aa1193f9c0b9595a0c46930d6699647", "7e36e03d192a5547757bd8f9d9052a60f64e6d17" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 11:26:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 11:26:15 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260430\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - MD pull request via Yu:\n - Fix a raid5 UAF on IO across the reshape position\n - Avoid failing RAID1/RAID10 devices for invalid IO errors\n - Fix RAID10 divide-by-zero when far_copies is zero\n - Restore bitmap grow through sysfs\n - Use mddev_is_dm() instead of open-coding gendisk checks\n - Use ATTRIBUTE_GROUPS() for md default sysfs attributes\n - Replace open-coded wait loops with wait_event helpers\n\n - NVMe pull request via Keith:\n - Target data transfer size configuation (Aurelien)\n - Enable P2P for RDMA (Shivaji Kant)\n - TCP target updates (Maurizio, Alistair, Chaitanya, Shivam Kumar)\n - TCP host updates (Alistair, Chaitanya)\n - Authentication updates (Alistair, Daniel, Chris Leech)\n - Multipath fixes (John Garry)\n - New quirks (Alan Cui, Tao Jiang)\n - Apple driver fix (Fedor Pchelkin)\n - PCI admin doorbell update fix (Keith)\n\n - Properly propagate CDROM read-only state to the block layer\n\n* tag \u0027block-7.1-20260430\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (35 commits)\n md: use ATTRIBUTE_GROUPS() for md default sysfs attributes\n md: use mddev_is_dm() instead of open-coding gendisk checks\n md/raid1: replace wait loop with wait_event_idle() in raid1_write_request()\n md/md-bitmap: add a none backend for bitmap grow\n md/md-bitmap: split bitmap sysfs groups\n md: factor bitmap creation away from sysfs handling\n md: use mddev_lock_nointr() in mddev_suspend_and_lock_nointr()\n md: replace wait loop with wait_event() in md_handle_request()\n md/raid10: fix divide-by-zero in setup_geo() with zero far_copies\n md/raid1,raid10: don\u0027t fail devices for invalid IO errors\n MAINTAINERS: Add Xiao Ni as md/raid reviewer\n md/raid5: Fix UAF on IO across the reshape position\n cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()\n nvme-auth: Hash DH shared secret to create session key\n nvme-pci: fix missed admin queue sq doorbell write\n nvme-auth: Include SC_C in RVAL controller hash\n nvme-tcp: teardown circular locking fixes\n nvmet-tcp: Don\u0027t clear tls_key when freeing sq\n Revert \"nvmet-tcp: Don\u0027t free SQ on authentication success\"\n nvme: skip trace completion for host path errors\n ...\n" }, { "commit": "9d88bb929aa1193f9c0b9595a0c46930d6699647", "tree": "88a14cef2c62fa046c251c5cac0d5c30e977ca73", "parents": [ "33d0c9c5f0945fc93a08d7ab20c4fb6d6976ed3b", "17666e2d7592c3e85260cafd3950121524acc2c5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 11:01:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 11:01:31 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260430\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Remove dead struct io_buffer_list member\n\n - Fix for incrementally consumed buffers with recvmsg multishot, which\n requires a minimum value left in a buffer for any receive for the\n headers. If there\u0027s still a bit of buffer left but it\u0027s smaller than\n that value, then userspace will see a spurious -EFAULT returned in\n the CQE\n\n - Locking fix for the DEFER_TASKRUN retry list, which otherwise could\n race with fallback cancelations. If the task is exiting with\n task_work left in both the normal and retry list AND the exit cleanup\n races with the task running task work, then entries could either be\n doubly completed or lost\n\n - Cap NAPI busy poll timeout to something sane, to avoid syzbot running\n into excessive polling and triggering warnings around that\n\n* tag \u0027io_uring-7.1-20260430\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/tw: serialize ctx-\u003eretry_llist with -\u003euring_lock\n io_uring/napi: cap busy_poll_to 10 msec\n io_uring/kbuf: support min length left for incremental buffers\n io_uring/kbuf: kill dead struct io_buffer_list \u0027nr_entries\u0027 member\n" }, { "commit": "33d0c9c5f0945fc93a08d7ab20c4fb6d6976ed3b", "tree": "2362cee27224848531f0c2e0ce507f9ca5cff542", "parents": [ "d8b0e2ef75076a706631a53a347e1944747de6f3", "8c0f9cd1df41ee029711baca839b99d9592c5dd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:51:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:51:38 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"There are a couple of nasty issues fixed here in the axiado and\n rockchip drivers. We\u0027ve also got more of the fixes from Johan here,\n this time for the two Cadence drivers, plus a couple of other similar\n fixes from John and Felix\"\n\n* tag \u0027spi-fix-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: amlogic-spisg: initialize completion before requesting IRQ\n spi: axiado: replace usleep_range() with udelay() in IRQ path\n spi: cadence-quadspi: fix runtime pm and clock imbalance on unbind\n spi: cadence-quadspi: fix unclocked access on unbind\n spi: cadence-quadspi: fix clock imbalance on probe failure\n spi: cadence-quadspi: fix runtime pm disable imbalance on probe failure\n spi: cadence: fix clock imbalance on probe failure\n spi: cadence: fix unclocked access on unbind\n spi: rockchip: Drop unused and broken CR0 macros\n spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ\n spi: rzv2h-rspi: Fix silent failure in clock setup error path\n" }, { "commit": "030e8a40fff65ca6ac1c04a4d3c08afe72438922", "tree": "0db4c2dbb9c334e55cee3670ebced4adac0932d7", "parents": [ "4d8e74ad4585672489da6145b3328d415f50db82" ], "author": { "name": "Kevin Brodsky", "email": "kevin.brodsky@arm.com", "time": "Mon Apr 27 13:03:33 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 01 17:44:25 2026 +0100" }, "message": "arm64: signal: Preserve POR_EL0 if poe_context is missing\n\nCommit 2e8a1acea859 (\"arm64: signal: Improve POR_EL0 handling to\navoid uaccess failures\") delayed the write to POR_EL0 in\nrt_sigreturn to avoid spurious uaccess failures. This change however\nrelies on the poe_context frame record being present: on a system\nsupporting POE, calling sigreturn without a poe_context record now\nresults in writing arbitrary data from the kernel stack into POR_EL0.\n\nFix this by adding a __valid_fields member to struct\nuser_access_state, and zeroing the struct on allocation.\nrestore_poe_context() then indicates that the por_el0 field is valid\nby setting the corresponding bit in __valid_fields, and\nrestore_user_access_state() only touches POR_EL0 if there is a valid\nvalue to set it to. This is in line with how POR_EL0 was originally\nhandled; all frame records are currently optional, except\nfpsimd_context.\n\nTo ensure that __valid_fields is kept in sync, fields (currently\njust por_el0) are now accessed via accessors and prefixed with __ to\ndiscourage direct access.\n\nFixes: 2e8a1acea859 (\"arm64: signal: Improve POR_EL0 handling to avoid uaccess failures\")\nCc: \u003cstable@vger.kernel.org\u003e\nReported-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Kevin Brodsky \u003ckevin.brodsky@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "d8b0e2ef75076a706631a53a347e1944747de6f3", "tree": "d9f69089f47653e6b0a11c6e06a3b7d46f664885", "parents": [ "a973736a287157ddd55a5fbc793a6f644c3374be", "7dfc0063022078a80fe5774815723c185e4b7b57" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:25:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:25:12 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"A fix from Arnd re-adding a dependency on gpiolib which was implicitly\n pulled in via an OF specific route which got removed as part of a\n cleanup\"\n\n* tag \u0027regulator-fix-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: rpi-panel-attiny: add back GPIOLIB dependency\n" }, { "commit": "a973736a287157ddd55a5fbc793a6f644c3374be", "tree": "eec6a8afaf27ab10b286c4f2d2c18158ebe45d79", "parents": [ "2b4d0215bec0f09bfb872e9a8aa1e1943a42d5e7", "4b7774eeab8d66c22f02f5c120602df154a87e12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:15:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 09:15:00 2026 -0700" }, "message": "Merge tag \u0027regmap-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fix from Mark Brown:\n \"A fix from Colin for a spelling mistake in a dev_warn() message\"\n\n* tag \u0027regmap-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: sdw-mbq: Fix spelling mistake \"undeferable\" -\u003e \"undeferrable\"\n" }, { "commit": "2b4d0215bec0f09bfb872e9a8aa1e1943a42d5e7", "tree": "fb7bda87bda8b2e3fbee69294a81977859e54941", "parents": [ "26fd6bff2c050196005312d1d306889220952a99", "99ebc509eef52675ae5bae86aa2a53e15594e4a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 08:45:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 01 08:45:23 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-04-30-15-39\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n \"20 hotfixes. All are for MM (and for MMish maintainers). 9 are\n cc:stable and the remainder are for post-7.0 issues or aren\u0027t deemed\n suitable for backporting.\n\n There are two DAMON series from SeongJae Park which address races\n which could lead to use-after-free errors, and avoid the possibility\n of presenting stale parameter values to users\"\n\n* tag \u0027mm-hotfixes-stable-2026-04-30-15-39\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm: memcontrol: fix rcu unbalance in get_non_dying_memcg_end()\n mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()\n MAINTAINERS: remove stale kdump project URL\n mm/damon/stat: detect and use fresh enabled value\n mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values\n mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values\n selftests/mm: specify requirement for PROC_MEM_ALWAYS_FORCE\u003dy\n mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lock\n mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock\n MAINTAINERS: update Li Wang\u0027s email address\n MAINTAINERS, mailmap: update email address for Qi Zheng\n MAINTAINERS: update Liam\u0027s email address\n mm/hugetlb_cma: round up per_node before logging it\n MAINTAINERS: fix regex pattern in CORE MM category\n mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()\n mm: start background writeback based on per-wb threshold for strictlimit BDIs\n kho: fix error handling in kho_add_subtree()\n liveupdate: fix return value on session allocation failure\n mailmap: update entry for Dan Carpenter\n vmalloc: fix buffer overflow in vrealloc_node_align()\n" }, { "commit": "4d8e74ad4585672489da6145b3328d415f50db82", "tree": "4269b911fcf194aa45e26a04ae769d91e504ba33", "parents": [ "bb7235e226888607e6aac1288062fcb1ac105589" ], "author": { "name": "Zhaoyang Huang", "email": "zhaoyang.huang@unisoc.com", "time": "Thu Apr 30 16:58:08 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 01 16:20:35 2026 +0100" }, "message": "arm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\nVIRTUAL PHYSICAL\nffffffed00601000 83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n PGD: ffffffecffd62da0 \u003d\u003e 10000000833fb003\n PMD: ffffff80033fb018 \u003d\u003e 10000000833fe003\n PTE: ffffff80033fe008 \u003d\u003e 68000083401f03\n PAGE: 83401000\n\n PTE PHYSICAL FLAGS\n68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)\n\n PAGE PHYSICAL MAPPING INDEX CNT FLAGS\nfffffffec00d0040 83401000 0 0 1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\nFixes: 5973a62efa34 (\"arm64: map [_text, _stext) virtual address range non-executable+read-only\")\nAssisted-by: TRAE:GLM-5.1\nSuggested-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Zhaoyang Huang \u003czhaoyang.huang@unisoc.com\u003e\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "bb7235e226888607e6aac1288062fcb1ac105589", "tree": "fe3c25f66dcd2bf1c366c4c1ba267876022ad5ab", "parents": [ "3ea4415015d690a51a3fb1f98dfc9a02f88f7bc4" ], "author": { "name": "Leo Yan", "email": "leo.yan@arm.com", "time": "Wed Apr 29 15:30:10 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 01 15:17:59 2026 +0100" }, "message": "kselftest/arm64: Include \u003casm/ptrace.h\u003e for user_gcs definition\n\nkselftest includes kernel uAPI headers with option:\n\n -isystem $(top_srcdir)/usr/include\n\nInclude \u003casm/ptrace.h\u003e in libc-gcs.c for the definition of struct\nuser_gcs from the uAPI headers, and remove the redundant definition in\ngcs-util.h. This fixes a compilation error on systems where the\ntoolchain defines NT_ARM_GCS.\n\nFixes: a505a52b4e29 (\"kselftest/arm64: Add a GCS test program built with the system libc\")\nSigned-off-by: Leo Yan \u003cleo.yan@arm.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "f0997a06e3e32898bcae667d6807fc46ebfd0eec", "tree": "e53d962ec1a108e044e9421873ba890499b744d3", "parents": [ "b006ef5fd643898b7cf77091a786d98544b95f4a", "662f9ddc8077792129440d05cbef2f944a07777a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 12:49:22 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 12:49:29 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-04-30\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nAPI Fixes:\n - Add missing pad and extensions check (Jonathan)\n - Reject unsafe PAT indices for CPU cached memory (Jia)\n\n Driver Fixes:\n - Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge (Brost)\n - Xe3p tuning and workaround fixes (Roper, Gustavo)\n - USE drm mm instead of drm SA for CCS read/write (Satya)\n - Fix leaks and null derefs (Shuicheng)\n - Fix Wa_18022495364 (Tvrtko)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/afO05KvmFMn_7qcY@intel.com\n" }, { "commit": "b006ef5fd643898b7cf77091a786d98544b95f4a", "tree": "cc1279649843d58d789006a63e3bed4c00318a84", "parents": [ "39436e1d91ec5000df9de4c681bdadac37ff0e36", "019155e2bd3e2cec425553195e9f9bc76bb0f848" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 11:00:33 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 12:48:57 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-04-30\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.1-2026-04-30:\n\namdgpu:\n- GFX12 fix for CONFIG_DRM_DEBUG_MM configs\n- Fix DC analog support\n- Userq fixes\n- GART placement fix\n- Aldebaran SMU fixes\n- AMDGPU_INFO_READ_MMR_REG fix\n- UVD 3.1 fix\n- GC 6 TCC fix\n- Fix root reservation in amdgpu_vm_handle_fault()\n- RAS fix\n- Module reload fix for APUs\n- Fix build for CONFIG_DRM_FBDEV_EMULATION\u003dn\n- IGT DWB regression fix\n- GC 11.5.4 fix\n- VCN user fence fixes\n- JPEG user fence fixes\n- SMU 13.0.6 fix\n- VCN 3/4 IB parser fixes\n- NV3x+ dGPU vblank fix\n- DCE6/8 fixes for LVDS/eDP panels without an EDID\n\namdkfd:\n- Fix for when CONFIG_HSA_AMD is not set\n- SVM fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260430135619.3929877-1-alexander.deucher@amd.com\n" }, { "commit": "8c0f9cd1df41ee029711baca839b99d9592c5dd4", "tree": "584c6b45f6a8bc1b1d096cf634875edfbfa5ecdc", "parents": [ "4f12ee0a4d06ba777adc840b22350020dfd35fcf", "ecea4f0e9db2fb6ab4a68a59c5aba0d8f59a9566" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 01 10:14:39 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 01 10:14:39 2026 +0900" }, "message": "spi: cadence: Probe and unbind fixes\n\nSeveral fixes from Johan for issues with unbind and error handling in\nprobe.\n" }, { "commit": "4f12ee0a4d06ba777adc840b22350020dfd35fcf", "tree": "0e6c872d1ee3868639f5403fea6d131bba82ba4a", "parents": [ "8d0189c1ea98b56481eb809e3d1bdbf85557e819", "5e8bb0cc72f1d52d8ac2a88f4c952e2e98056aed" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 01 10:12:57 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Fri May 01 10:12:57 2026 +0900" }, "message": "spi: cadence-quadspi: Probe and unbind fixes\n\nSeveral fixes from Johan for probe failure and unbind issues in the\ncadence-quadspi driver.\n" }, { "commit": "26fd6bff2c050196005312d1d306889220952a99", "tree": "f22dca7b2e6f07ba2a9ebce92e1e478808db2dd0", "parents": [ "cae4ef6f9a3ac71094da2b1083f6e2db699a2c1e", "135ac3b84bcedae1860e7a9512d63166f42b736e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:36:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:36:48 2026 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull mtd fixes from Miquel Raynal:\n \"Besides an out-of-bound bug, this is about properly supporting Winbond\n octal SPI NAND chips which use a specific pattern for stuffing more\n address bits in some operations. This uses the spi-mem flag in SPI\n NAND that was added to the spi-mem layer just before the merge window\n through the spi tree\"\n\n* tag \u0027mtd/fixes-for-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n mtd: spinand: winbond: Fix ODTR write VCR on W35NxxJW\n mtd: spinand: winbond: Set the packed page read flag to W35N02/04JW\n mtd: spinand: Add support for packed read data ODTR commands\n mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()\n" }, { "commit": "cae4ef6f9a3ac71094da2b1083f6e2db699a2c1e", "tree": "8aa2c7be37ce9437d37e6f1e9e201837db3f5d86", "parents": [ "74b54e9b1084cc51e2b655500a174214d3c38c0e", "36a96eda15bf66a18ca472aef9242e57551016ab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:20:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:20:45 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These fix leftover issues in the ACPI Time and Alarm Device (TAD)\n driver on top of the recently merged updates of it and address\n assorted issues in the ACPI support code:\n\n - Fix removal code ordering in the ACPI TAD driver, refine timer\n value computations and checks in its RTC class device interface,\n make it use the __ATTRIBUTE_GROUPS() macro, and fix a comment in it\n (Rafael Wysocki)\n\n - Fix EINJV2 memory error injection in APEI (Tony Luck)\n\n - Add missing notifier_block structure forward declaration to\n acpi_bus.h (Bartosz Golaszewski)\n\n - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC\n library (Jinjie Ruan)\n\n - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the\n ACPI video bus driver (Shivam Kalra)\"\n\n* tag \u0027acpi-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: bus: add missing forward declaration to acpi_bus.h\n ACPI: video: force native backlight on HP OMEN 16 (8A44)\n ACPI: TAD: Fix up a comment in acpi_tad_probe()\n ACPI: TAD: RTC: Refine timer value computations and checks\n ACPI: TAD: Use devres for all driver cleanup\n ACPI: TAD: Use __ATTRIBUTE_GROUPS() macro\n ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug\n ACPI: APEI: EINJ: Fix EINJV2 memory error injection\n ACPICA: Provide #defines for EINJV2 error types\n" }, { "commit": "74b54e9b1084cc51e2b655500a174214d3c38c0e", "tree": "3bb856449d10dcffa7489af3d6d6edefdc27d17b", "parents": [ "08d0d3466664000ba0670e0ef0d447f23459e0d4", "c208a2b95811d6e1ebae65d0d2fc13f73707f8e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:07:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 17:07:21 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - multichannel crediting fix\n\n - memory allocation improvement for smb2_compound_op\n\n - remove some dead code\n\n* tag \u0027v7.1-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: change_conf needs to be called for session setup\n smb: client: change allocation requirements in smb2_compound_op\n smb/client: remove unused smb3_parse_opt()\n" }, { "commit": "39436e1d91ec5000df9de4c681bdadac37ff0e36", "tree": "2355c64fedbc4e15d774573ff61bfc3029d3c1be", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731", "ac2c996675755c725a0065dbe3e2ebffded9080b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 08:16:33 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 01 08:17:29 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-04-30\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nDRM core and helpers:\n- calculate framebuffer geometry with format helpers\n- fix docs\n\nappletbdrm:\n- allocate protocol buffers with kvzalloc()\n\ndma-buf:\n- fix docs\n\nimagination:\n- avoid segfault in debugfs\n\nofdrm:\n- put PCI device reference on errors\n\nudl:\n- increase USB timeout\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260430064521.GA14957@linux.fritz.box\n" }, { "commit": "36a96eda15bf66a18ca472aef9242e57551016ab", "tree": "9e0ae38b098cc431203520feb03c52831a0ba6d4", "parents": [ "ad034486ada5860081565e2d7a2e41aa91c302c2", "0c00cfbcfcffa7085e4f0c7fd7a4caada4e7a90f", "ea216d3ae7305ad2c8256524e65b7219492d8685", "75141a770f4f8225d316f6c7e146723a32e9720e", "4b506ea5351a1f5937ac632a4a5c35f6f796cc41" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Apr 30 21:07:06 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Apr 30 21:07:06 2026 +0200" }, "message": "Merge branches \u0027acpi-apei\u0027, \u0027acpi-bus\u0027, \u0027acpi-cppc\u0027 and \u0027acpi-video\u0027\n\nMerge assorted ACPI support fixes for 7.1-rc2:\n\n - Fix EINJV2 memory error injection in APEI (Tony Luck)\n\n - Add missing notifier_block structure forward declaration to\n acpi_bus.h (Bartosz Golaszewski)\n\n - Fix related_cpus inconsistency during CPU hotplug in the ACPI CPPC\n library (Jinjie Ruan)\n\n - Add a quirk to force native backlight on HP OMEN 16 (8A44) in the\n ACPI video bus driver (Shivam Kalra)\n\n* acpi-apei:\n ACPI: APEI: EINJ: Fix EINJV2 memory error injection\n ACPICA: Provide #defines for EINJV2 error types\n\n* acpi-bus:\n ACPI: bus: add missing forward declaration to acpi_bus.h\n\n* acpi-cppc:\n ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug\n\n* acpi-video:\n ACPI: video: force native backlight on HP OMEN 16 (8A44)\n" }, { "commit": "08d0d3466664000ba0670e0ef0d447f23459e0d4", "tree": "5ec3400307dfa373fdfb64cc2338bf0eed5716cc", "parents": [ "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "1e01abec856593e02cd69fd95b784c10dd46880c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Current release - regressions:\n\n - ipmr: free mr_table after RCU grace period.\n\n Previous releases - regressions:\n\n - core: add net_iov_init() and use it to initialize -\u003epage_type\n\n - sched: taprio: fix NULL pointer dereference in class dump\n\n - netfilter: nf_tables:\n - use list_del_rcu for netlink hooks\n - fix strict mode inbound policy matching\n\n - tcp: make probe0 timer handle expired user timeout\n\n - vrf: fix a potential NPD when removing a port from a VRF\n\n - eth: ice:\n - fix NULL pointer dereference in ice_reset_all_vfs()\n - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\n Previous releases - always broken:\n\n - page_pool: fix memory-provider leak in error path\n\n - sched: sch_cake: annotate data-races in cake_dump_stats()\n\n - mptcp: fix scheduling with atomic in timestamp sockopt\n\n - psp: check for device unregister when creating assoc\n\n - tls: fix strparser anchor skb leak on offload RX setup failure\n\n - eth:\n - stmmac: prevent NULL deref when RX memory exhausted\n - airoha: do not read uninitialized fragment address\n - rtl8150: fix use-after-free in rtl8150_start_xmit()\n\n Misc:\n\n - add Ido Schimmel as IPv4/IPv6 maintainer\n\n - add David Heidelberg as NFC subsystem maintainer\"\n\n* tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)\n net/sched: cls_flower: revert unintended changes\n sfc: fix error code in efx_devlink_info_running_versions()\n net: tls: fix strparser anchor skb leak on offload RX setup failure\n ice: add dpll peer notification for paired SMA and U.FL pins\n ice: fix missing dpll notifications for SW pins\n dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n ice: fix SMA and U.FL pin state changes affecting paired pin\n ice: fix missing SMA pin initialization in DPLL subsystem\n ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n ice: fix NULL pointer dereference in ice_reset_all_vfs()\n iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n iavf: wait for PF confirmation before removing VLAN filters\n iavf: stop removing VLAN filters from PF on interface down\n iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n net: airoha: Do not return err in ndo_stop() callback\n hv_sock: fix ARM64 support\n MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n selftests: drv-net: clarify linters and frameworks in README\n ...\n" }, { "commit": "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "tree": "f97f638c106ae2b337ee198a868a70a8f828b4ab", "parents": [ "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "163f6494233e1679ec6fa6a4803f74ae7b1c94db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "message": "Merge tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Fix a reference leak on device_register() failure in pata_parport\n\n* tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: pata_parport: switch to dynamic root device\n" }, { "commit": "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "tree": "d23dfa6ede142650bdf84a2be288ed389ba77158", "parents": [ "e75a43c7cec459a07d91ed17de4de13ede2b7758", "e052a1f7199260eda4d6ca08a59c3b98738f8491" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A bunch of small fixes. One minor fix is found in the core side for\n data race in PCM OSS layer, while remaining changes are various\n device-specific fixes and quirks.\n\n - Core: PCM OSS data race fix\n\n - HD-audio: Fixes for TAS2781, CS35L56, and Realtek/Conexant quirks;\n avoidance of a WARN_ON for HDMI channel mapping\n\n - USB-audio: Improvements in UAC3 parsing robustness (leaks, size\n checks) and fixes for potential endless loops\n\n - ASoC: Driver-specific fixes for CS35L56, Intel bytcr_wm5102,\n Spacemit, AW88395, and others, plus a new quirk for Steam Deck\n OLED\n\n - Misc: A UAF fix in aloop driver, division by zero fix in ua101\n driver and leak fixes in caiaq driver\"\n\n* tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (32 commits)\n ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages \u003e1\n ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()\n ALSA: hda/conexant: Fix missing error check for jack detection\n ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks\n ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB\n ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size\n ASoC: spacemit: move hw constraints from hw_params to startup\n ASoC: codecs: ab8500: Fix casting of private data\n ASoC: cs35l56: Fix illegal writes to OTP_MEM registers\n ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error\n ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()\n ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams\n ALSA: caiaq: Don\u0027t abort when no input device is available\n ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path\n ASoC: aw88395: Fix kernel panic caused by invalid GPIO error pointer\n ALSA: caiaq: fix usb_dev refcount leak on probe failure\n sound: ua101: fix division by zero at probe\n ALSA: usb-audio: apply quirk for Playstation PDP Riffmaster\n ALSA: hda: Remove duplicate cmedia entries in codecs Makefile\n ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P\n ...\n" }, { "commit": "99ebc509eef52675ae5bae86aa2a53e15594e4a3", "tree": "4d4db7dfde35a6f8ee19fb5be89572fee73c96c4", "parents": [ "292411fda25bdcb8cd0cb513fa5583a36dd36354" ], "author": { "name": "Qi Zheng", "email": "zhengqi.arch@bytedance.com", "time": "Wed Apr 29 15:31:05 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu Apr 30 06:13:20 2026 -0700" }, "message": "mm: memcontrol: fix rcu unbalance in get_non_dying_memcg_end()\n\nCurrently, get_non_dying_memcg_start() and get_non_dying_memcg_end() both\nevaluate cgroup_subsys_on_dfl(memory_cgrp_subsys) independently to\ndetermine whether to acquire or release the RCU read lock.\n\nHowever, the result of cgroup_subsys_on_dfl() can change dynamically at\nruntime due to cgroup hierarchy rebinding (e.g., when the memory\ncontroller is moved between cgroup v1 and v2 hierarchies). This can cause\nthe following warning:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n WARNING: bad unlock balance detected!\n 7.0.0-next-20260420+ #83 Tainted: G W\n -------------------------------------\n memcg-repro/270 is trying to release lock (rcu_read_lock) at:\n [\u003cffffffff815f57f7\u003e] rcu_read_unlock+0x17/0x60\n but there are no more locks to release!\n\n other info that might help us debug this:\n 1 lock held by memcg-repro/270:\n #0: ffff888102fa2088 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x285/0x880\n\n stack backtrace:\n CPU: 0 UID: 0 PID: 270 Comm: memcg-repro Tainted: G W 7.0.0-next-20260420+ #\n Tainted: [W]\u003dWARN\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n ? rcu_read_unlock+0x17/0x60\n dump_stack_lvl+0x77/0xb0\n print_unlock_imbalance_bug+0xe0/0xf0\n ? rcu_read_unlock+0x17/0x60\n lock_release+0x21d/0x2a0\n rcu_read_unlock+0x1c/0x60\n do_pte_missing+0x233/0xb40\n __handle_mm_fault+0x80e/0xcd0\n handle_mm_fault+0x146/0x310\n do_user_addr_fault+0x303/0x880\n exc_page_fault+0x9b/0x270\n asm_exc_page_fault+0x26/0x30\n RIP: 0033:0x5590e4eb41ea\n Code: 61 cc 66 0f 6f e0 66 0f 61 c2 66 0f db cd 66 0f 69 e2 66 0f 6f d0 66 0f 69 d4 66 0f 61 0\n RSP: 002b:00007ffcad25f030 EFLAGS: 00010202\n RAX: 00005590e4eb8010 RBX: 00007ffcad260f7d RCX: 00007f73c474d44d\n RDX: 00005590e4eb80a0 RSI: 00005590e4eb503c RDI: 000000000000000f\n RBP: 00005590e4eb70a0 R08: 0000000000000000 R09: 00007f73c483a680\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 00007ffcad25f180 R14: 00005590e4eb6dd8 R15: 00007f73c4869020\n \u003c/TASK\u003e\n ------------[ cut here ]------------\n\nFix this by explicitly tracking the RCU lock state, ensuring that\nrcu_read_unlock() in get_non_dying_memcg_end() is strictly paired with the\nlock acquisition, regardless of any runtime rebinding events.\n\nLink: https://lore.kernel.org/20260429073105.44472-1-qi.zheng@linux.dev\nFixes: 8285917d6f38 (\"mm: memcontrol: prepare for reparenting non-hierarchical stats\")\nSigned-off-by: Qi Zheng \u003czhengqi.arch@bytedance.com\u003e\nAcked-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nReviewed-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Qi Zheng \u003czhengqi.arch@bytedance.com\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "17666e2d7592c3e85260cafd3950121524acc2c5", "tree": "9e9f1242cc1d8645e0cd5ba522d4689bde3d8680", "parents": [ "df8599ee18c0e5fe343ffe0b4c379636b8bb839a" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Mon Apr 27 14:29:02 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Apr 30 06:57:20 2026 -0600" }, "message": "io_uring/tw: serialize ctx-\u003eretry_llist with -\u003euring_lock\n\nThe DEFER_TASKRUN local task work paths all run under ctx-\u003euring_lock,\nwhich serializes them with each other and with the rest of the ring\u0027s\nhot paths. io_move_task_work_from_local() is the exception - it\u0027s called\nfrom io_ring_exit_work() on a kworker without holding the lock and from\nthe iopoll cancelation side right after dropping it.\n\n-\u003ework_llist is fine with this, as it\u0027s only ever updated via the\nexpected paths. But the -\u003eretry_llist is updated while runing, and hence\nit could potentially race between normal task_work running and the\ntask-has-exited shutdown path.\n\nSimply grab -\u003euring_lock while moving the local work to the fallback\nlist for exit purposes, which nicely serializes it across both the\nnormal additions and the exit prune path.\n\nCc: stable@vger.kernel.org\nFixes: f46b9cdb22f7 (\"io_uring: limit local tw done\")\nReported-by: Robert Femmer \u003crobert.femmer@x41-dsec.de\u003e\nReported-by: Christian Reitter \u003cinvd@inhq.net\u003e\nReported-by: Michael Rodler \u003cmichael.rodler@x41-dsec.de\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "1e01abec856593e02cd69fd95b784c10dd46880c", "tree": "8faa6af8c4511bf2689ef016fadea0c06857c1a3", "parents": [ "051ffb001b8a232cfa6e72f38bb5f51c4270a60b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Apr 29 09:39:11 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:47:01 2026 +0200" }, "message": "net/sched: cls_flower: revert unintended changes\n\nWhile applying the blamed commit 4ca07b9239bd (\"net: mctp i2c: check\nlength before marking flow active\"), I unintentionally included\nunrelated and unacceptable changes.\n\nRevert them.\n\nFixes: 4ca07b9239bd (\"net: mctp i2c: check length before marking flow active\")\nReported-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCloses: https://lore.kernel.org/netdev/bd8704fe0bd53e278add5cde4873256656623e2e.camel@codeconstruct.com.au/\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nLink: https://patch.msgid.link/043026a53ff84da88b17648c4b0d17f0331749cb.1777447863.git.pabeni@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "051ffb001b8a232cfa6e72f38bb5f51c4270a60b", "tree": "367d3065e8dbf4acdd6f2d0ed7bf3631fe2aef37", "parents": [ "58689498ca3384851145a754dbb1d8ed1cf9fb54" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Wed Apr 29 09:48:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:44:30 2026 +0200" }, "message": "sfc: fix error code in efx_devlink_info_running_versions()\n\nReturn -EIO if efx_mcdi_rpc() doesn\u0027t return enough space.\n\nFixes: 14743ddd2495 (\"sfc: add devlink info support for ef100\")\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nReviewed-by: Edward Cree \u003cecree.xilinx@gmail.com\u003e\nLink: https://patch.msgid.link/afGpsbLRHL4_H0KS@stanley.mountain\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "58689498ca3384851145a754dbb1d8ed1cf9fb54", "tree": "3cb276b27203c391f68522db2fd63018ae7b3a91", "parents": [ "47888597a3b41b5088e758ab8ca36bf624d46327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 16:15:59 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:38:29 2026 +0200" }, "message": "net: tls: fix strparser anchor skb leak on offload RX setup failure\n\nWhen tls_set_device_offload_rx() fails at tls_dev_add(), the error path\ncalls tls_sw_free_resources_rx() to clean up the SW context that was\ninitialized by tls_set_sw_offload(). This function calls\ntls_sw_release_resources_rx() (which stops the strparser via\ntls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),\nbut never frees the anchor skb that was allocated by alloc_skb(0) in\ntls_strp_init().\n\nNote that tls_sw_free_resources_rx() is exclusively used for this\n\"failed to start offload\" code path, there\u0027s no other caller.\n\nThe leak did not exist before commit 84c61fe1a75b (\"tls: rx: do not use\nthe standard strparser\"), because the standard strparser doesn\u0027t try\nto pre-allocate an skb.\n\nThe normal close path in tls_sk_proto_close() handles cleanup by calling\ntls_sw_strparser_done() (which calls tls_strp_done()) after dropping\nthe socket lock, because tls_strp_done() does cancel_work_sync() and\nthe strparser work handler takes the socket lock.\n\nFixes: 84c61fe1a75b (\"tls: rx: do not use the standard strparser\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260428231559.1358502-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47888597a3b41b5088e758ab8ca36bf624d46327", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6", "9e5dead140af10e8b5f975b8f04e46197d48d274" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:43 2026 +0200" }, "message": "Merge branch \u0027intel-wired-lan-update-2026-04-27-ice-iavf\u0027\n\nJacob Keller says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Update 2026-04-27 (ice, iavf)\n\nPetr Oros from RedHat has accumulated a number of fixes for the Intel ice\nand iavf drivers, bundled together in this series.\n\nFirst, a series of 4 fixes to resolve issues with the iavf driver logic for\nhandling VLAN filters. This includes keeping VLAN filters while the\ninterface is brought down, waiting for confirmation on filter deletion\nbefore deleting filters from the driver tracking structures, and handling\nthe VIRTCHNL_OP_ADD_VLAN for the old v1 VLAN_ADD command.\n\nA fix for a crash in ice_reset_all_vfs(), properly checking for errors when\nice_vf_rebuild_vsi() fails.\n\nA fix for a possible infinite recursion in ice_cfg_tx_topo() that occurs\nwhen trying to apply invalid Tx topology configuration.\n\nA fix to initialize the SMA pins in the DPLL subsystem properly.\n\nA fix to change the SMA and U.FL pin state for paired pins, ensuring that\nall flows changing one pin will also update its shared pin appropriately.\n\nA preparatory patch to export __dpll_pin_change_ntf() so that drivers can\nnotify pin changes while already holding the dpll_lock.\n\nA fix to ensure DPLL notifications are sent for the software-controlled\npins which wrap the physical CGU input/output pins.\n\nA fix to add DPLL notifications for peer pins when changing the SMA or U.FL\npins, ensuring DPLL subsystem is notified about the paired connected pins.\n\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-0-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9e5dead140af10e8b5f975b8f04e46197d48d274", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:23 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: add dpll peer notification for paired SMA and U.FL pins\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2). When one pin\u0027s state changes via a PCA9575 GPIO write,\nthe paired pin\u0027s state also changes, but no notification is sent for\nthe peer pin. Userspace consumers monitoring the peer via dpll netlink\nsubscribe never learn about the update.\n\nAdd ice_dpll_sw_pin_notify_peer() which sends a change notification for\nthe paired SW pin. Call it from ice_dpll_pin_sma_direction_set(),\nice_dpll_sma_pin_state_set(), and ice_dpll_ufl_pin_state_set() after\npf-\u003edplls.lock is released. Use __dpll_pin_change_ntf() because\ndpll_lock is still held by the dpll netlink layer (dpll_pin_pre_doit).\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-11-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7", "tree": "ae0f4e5fe3a86ab625e8cc72117f236f867d6f80", "parents": [ "620055cb1036a6125fd912e7a14b47a6572b809b" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:22 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix missing dpll notifications for SW pins\n\nThe SMA/U.FL pin redesign (commit 2dd5d03c77e2 (\"ice: redesign dpll\nsma/u.fl pins control\")) introduced software-controlled pins that wrap\nbacking CGU input/output pins, but never updated the notification and\ndata paths to propagate pin events to these SW wrappers.\n\nThe periodic work sends dpll_pin_change_ntf() only for direct CGU input\npins. SW pins that wrap these inputs never receive change or phase\noffset notifications, so userspace consumers such as synce4l monitoring\nSMA pins via dpll netlink never learn about state transitions or phase\noffset updates. Similarly, ice_dpll_phase_offset_get() reads the SW\npin\u0027s own phase_offset field which is never updated; the PPS monitor\nwrites to the backing CGU input\u0027s field instead.\n\nFix by introducing ice_dpll_pin_ntf(), a wrapper around\ndpll_pin_change_ntf() that also notifies any registered SMA/U.FL pin\nwhose backing CGU input matches. Replace all direct\ndpll_pin_change_ntf() calls in the periodic notification paths with\nthis wrapper. Fix ice_dpll_phase_offset_get() to return the backing\nCGU input\u0027s phase_offset for input-direction SW pins.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-10-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "620055cb1036a6125fd912e7a14b47a6572b809b", "tree": "5b2c64040626789e1f3b21897cfa7d43da8b82ff", "parents": [ "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Mon Apr 27 22:22:21 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n\nExport __dpll_pin_change_ntf() so that drivers can send pin change\nnotifications from within pin callbacks, which are already called\nunder dpll_lock. Using dpll_pin_change_ntf() in that context would\ndeadlock.\n\nAdd lockdep_assert_held() to catch misuse without the lock held.\n\nAcked-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44", "tree": "a6be3b768a9ab77971f9b0cac5ccce5a330b333e", "parents": [ "56a643aed0f0af5c29ebb4593d4917b78344dd48" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:20 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix SMA and U.FL pin state changes affecting paired pin\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2) controlled by the PCA9575 GPIO expander. Each pair can\nonly have one active pin at a time: SMA1 output and U.FL1 output share\nthe same CGU output, SMA2 input and U.FL2 input share the same CGU\ninput. The PCA9575 register bits determine which connector in each\npair owns the signal path.\n\nThe driver does not account for this pairing in two places:\n\nice_dpll_ufl_pin_state_set() modifies PCA9575 bits and disables the\nbacking CGU pin without checking whether the U.FL pin is currently\nactive. Disconnecting an already inactive U.FL pin flips bits that\nthe paired SMA pin relies on, breaking its connection.\n\nice_dpll_sma_direction_set() does not propagate direction changes to\nthe paired U.FL pin. For SMA2/U.FL2 the ICE_SMA2_UFL2_RX_DIS bit is\nnever managed, so U.FL2 stays disconnected after SMA2 switches to\noutput. For both pairs the backing CGU pin of the U.FL side is never\nenabled when a direction change activates it, so userspace sees the\npin as disconnected even though the routing is correct.\n\nFix by guarding the U.FL disconnect path against inactive pins and by\nupdating the paired U.FL pin fully on SMA direction changes: manage\nICE_SMA2_UFL2_RX_DIS for the SMA2/U.FL2 pair and enable the backing\nCGU pin whenever the peer becomes active.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-8-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "56a643aed0f0af5c29ebb4593d4917b78344dd48", "tree": "918eaa44dc55d8aac4681acb6fdabcf775469f2d", "parents": [ "70ad216411e030f67b1743774e245601194aee6a" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:19 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix missing SMA pin initialization in DPLL subsystem\n\nThe DPLL SMA/U.FL pin redesign introduced ice_dpll_sw_pin_frequency_get()\nwhich gates frequency reporting on the pin\u0027s active flag. This flag is\ndetermined by ice_dpll_sw_pins_update() from the PCA9575 GPIO expander\nstate. Before the redesign, SMA pins were exposed as direct HW\ninput/output pins and ice_dpll_frequency_get() returned the CGU\nfrequency unconditionally — the PCA9575 state was never consulted.\n\nThe PCA9575 powers on with all outputs high, setting ICE_SMA1_DIR_EN,\nICE_SMA1_TX_EN, ICE_SMA2_DIR_EN and ICE_SMA2_TX_EN. Nothing in the\ndriver writes the register during initialization, so\nice_dpll_sw_pins_update() sees all pins as inactive and\nice_dpll_sw_pin_frequency_get() permanently returns 0 Hz for every\nSW pin.\n\nFix this by writing a default SMA configuration in\nice_dpll_init_info_sw_pins(): clear all SMA bits, then set SMA1 and\nSMA2 as active inputs (DIR_EN\u003d0) with U.FL1 output and U.FL2 input\ndisabled. Each SMA/U.FL pair shares a physical signal path so only\none pin per pair can be active at a time. U.FL pins still report\nfrequency 0 after this fix: U.FL1 (output-only) is disabled by\nICE_SMA1_TX_EN which keeps the TX output buffer off, and U.FL2\n(input-only) is disabled by ICE_SMA2_UFL2_RX_DIS. They can be\nactivated by changing the corresponding SMA pin direction via dpll\nnetlink.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-7-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70ad216411e030f67b1743774e245601194aee6a", "tree": "e1494f675d4da476f6c896f0fdf3dc1783e7c55e", "parents": [ "54ef02487914c24170c7e1c061e45212dc55365e" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:18 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\nOn certain E810 configurations where firmware supports Tx scheduler\ntopology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo()\nmay need to apply a new 5-layer or 9-layer topology from the DDP\npackage. If the AQ command to set the topology fails (e.g. due to\ninvalid DDP data or firmware limitations), the global configuration\nlock must still be cleared via a CORER reset.\n\nCommit 86aae43f21cf (\"ice: don\u0027t leave device non-functional if Tx\nscheduler config fails\") correctly fixed this by refactoring\nice_cfg_tx_topo() to always trigger CORER after acquiring the global\nlock and re-initialize hardware via ice_init_hw() afterwards.\n\nHowever, commit 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end\nof deinit paths\") later moved ice_init_dev_hw() into ice_init_hw(),\nbreaking the reinit path introduced by 86aae43f21cf. This creates an\ninfinite recursive call chain:\n\n ice_init_hw()\n ice_init_dev_hw()\n ice_cfg_tx_topo() # topology change needed\n ice_deinit_hw()\n ice_init_hw() # reinit after CORER\n ice_init_dev_hw() # recurse\n ice_cfg_tx_topo()\n ... # stack overflow\n\nFix by moving ice_init_dev_hw() back out of ice_init_hw() and calling\nit explicitly from ice_probe() and ice_devlink_reinit_up(). The third\ncaller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw()\nduring its reinit, it only needs the core HW reinitialization. This\nbreaks the recursion cleanly without adding flags or guards.\n\nThe deinit ordering changes from commit 8a37f9e2ff40 (\"ice: move\nice_deinit_dev() to the end of deinit paths\") which fixed slow rmmod\nare preserved, only the init-side placement of ice_init_dev_hw() is\nreverted.\n\nFixes: 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end of deinit paths\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "54ef02487914c24170c7e1c061e45212dc55365e", "tree": "420a92651ea7be9dcdad0c6bca7e57540c7a0fa3", "parents": [ "34d33313b52eeac3a97ad2e3176d523ec70d9283" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:17 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix NULL pointer dereference in ice_reset_all_vfs()\n\nice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().\nWhen the VSI rebuild fails (e.g. during NVM firmware update via\nnvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,\nleaving txq_map and rxq_map as NULL. The subsequent unconditional call\nto ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in\nice_ena_vf_q_mappings() when it accesses vsi-\u003etxq_map[0].\n\nThe single-VF reset path in ice_reset_vf() already handles this\ncorrectly by checking the return value of ice_vf_reconfig_vsi() and\nskipping ice_vf_post_vsi_rebuild() on failure.\n\nApply the same pattern to ice_reset_all_vfs(): check the return value\nof ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and\nice_eswitch_attach_vf() on failure. The VF is left safely disabled\n(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can\nbe recovered via a VFLR triggered by a PCI reset of the VF\n(sysfs reset or driver rebind).\n\nNote that this patch does not prevent the VF VSI rebuild from failing\nduring NVM update — the underlying cause is firmware being in a\ntransitional state while the EMP reset is processed, which can cause\nAdmin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This\npatch only prevents the subsequent NULL pointer dereference that\ncrashes the kernel when the rebuild does fail.\n\n crash\u003e bt\n PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: \"kworker/u512:5\"\n #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee\n #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba\n #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540\n #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda\n #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997\n #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595\n #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2\n [exception RIP: ice_ena_vf_q_mappings+0x79]\n RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206\n RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000\n RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040\n R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000\n R13: 0000000000000010 R14: R15:\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice]\n #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice]\n #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice]\n #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4\n #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de\n #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663\n #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9\n\n The panic occurs attempting to dereference the NULL pointer in RDX at\n ice_sriov.c:294, which loads vsi-\u003etxq_map (offset 0x4b8 in ice_vsi).\n\n The faulting VSI is an allocated slab object but not fully initialized\n after a failed ice_vsi_rebuild():\n\n crash\u003e struct ice_vsi 0xff34c9efc27d4828\n netdev \u003d 0x0,\n rx_rings \u003d 0x0,\n tx_rings \u003d 0x0,\n q_vectors \u003d 0x0,\n txq_map \u003d 0x0,\n rxq_map \u003d 0x0,\n alloc_txq \u003d 0x10,\n num_txq \u003d 0x10,\n alloc_rxq \u003d 0x10,\n num_rxq \u003d 0x10,\n\n The nvmupdate64e process was performing NVM firmware update:\n\n crash\u003e bt 0xff34c9edd1a30000\n PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: \"nvmupdate64e\"\n #0 [ff72159bcd617618] __schedule at ffffffffab5333f8\n #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice]\n #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice]\n #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice]\n #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice]\n #8 [ff72159bcd6178b8] ice_read_flat_nvm at ffffffffc0a4034c [ice]\n #9 [ff72159bcd617918] ice_devlink_nvm_snapshot at ffffffffc0a6ffa5 [ice]\n\n dmesg:\n ice 0000:13:00.0: firmware recommends not updating fw.mgmt, as it\n may result in a downgrade. continuing anyways\n ice 0000:13:00.1: ice_init_nvm failed -5\n ice 0000:13:00.1: Rebuild failed, unload and reload driver\n\nFixes: 12bb018c538c (\"ice: Refactor VF reset\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-5-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "34d33313b52eeac3a97ad2e3176d523ec70d9283", "tree": "9e5bb72e361e644f61c5763bb573c71a85d6ee63", "parents": [ "bbcbe4ed70dea948849549af7edf44bd42bbd695" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:16 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n\nThe V1 ADD_VLAN opcode had no success handler; filters sent via V1\nstayed in ADDING state permanently. Add a fallthrough case so V1\nfilters also transition ADDING -\u003e ACTIVE on PF confirmation.\n\nCritically, add an `if (v_retval) break` guard: the error switch in\niavf_virtchnl_completion() does NOT return after handling errors,\nit falls through to the success switch. Without this guard, a\nPF-rejected ADD would incorrectly mark ADDING filters as ACTIVE,\ncreating a driver/HW mismatch where the driver believes the filter\nis installed but the PF never accepted it.\n\nFor V2, this is harmless: iavf_vlan_add_reject() in the error\nblock already kfree\u0027d all ADDING filters, so the success handler\nfinds nothing to transition.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-4-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bbcbe4ed70dea948849549af7edf44bd42bbd695", "tree": "7765699a79e01b685bae6f905800c1f751b1cfad", "parents": [ "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:15 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: wait for PF confirmation before removing VLAN filters\n\nThe VLAN filter DELETE path was asymmetric with the ADD path: ADD\nwaits for PF confirmation (ADD -\u003e ADDING -\u003e ACTIVE), but DELETE\nimmediately frees the filter struct after sending the DEL message\nwithout waiting for the PF response.\n\nThis is problematic because:\n - If the PF rejects the DEL, the filter remains in HW but the driver\n has already freed the tracking structure, losing sync.\n - Race conditions between DEL pending and other operations\n (add, reset) cannot be properly resolved if the filter struct\n is already gone.\n\nAdd IAVF_VLAN_REMOVING state to make the DELETE path symmetric:\n\n REMOVE -\u003e REMOVING (send DEL) -\u003e PF confirms -\u003e kfree\n -\u003e PF rejects -\u003e ACTIVE\n\nIn iavf_del_vlans(), transition filters from REMOVE to REMOVING\ninstead of immediately freeing them. The new DEL completion handler\nin iavf_virtchnl_completion() frees filters on success or reverts\nthem to ACTIVE on error.\n\nUpdate iavf_add_vlan() to handle the REMOVING state: if a DEL is\npending and the user re-adds the same VLAN, queue it for ADD so\nit gets re-programmed after the PF processes the DEL.\n\nThe !VLAN_FILTERING_ALLOWED early-exit path still frees filters\ndirectly since no PF message is sent in that case.\n\nAlso update iavf_del_vlan() to skip filters already in REMOVING\nstate: DEL has been sent to PF and the completion handler will\nfree the filter when PF confirms. Without this guard, the sequence\nDEL(pending) -\u003e user-del -\u003e second DEL could cause the PF to return\nan error for the second DEL (filter already gone), causing the\ncompletion handler to incorrectly revert a deleted filter back to\nACTIVE.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-3-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2", "tree": "fddd2a408a9276640ab1ea06a0d4d5f931a027c1", "parents": [ "70d62b669f1f9080a25278fc90b64309f4ae8959" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:14 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: stop removing VLAN filters from PF on interface down\n\nWhen a VF goes down, the driver currently sends DEL_VLAN to the PF for\nevery VLAN filter (ACTIVE -\u003e DISABLE -\u003e send DEL -\u003e INACTIVE), then\nre-adds them all on UP (INACTIVE -\u003e ADD -\u003e send ADD -\u003e ADDING -\u003e\nACTIVE). This round-trip is unnecessary because:\n\n 1. The PF disables the VF\u0027s queues via VIRTCHNL_OP_DISABLE_QUEUES,\n which already prevents all RX/TX traffic regardless of VLAN filter\n state.\n\n 2. The VLAN filters remaining in PF HW while the VF is down is\n harmless - packets matching those filters have nowhere to go with\n queues disabled.\n\n 3. The DEL+ADD cycle during down/up creates race windows where the\n VLAN filter list is incomplete. With spoofcheck enabled, the PF\n enables TX VLAN filtering on the first non-zero VLAN add, blocking\n traffic for any VLANs not yet re-added.\n\nRemove the entire DISABLE/INACTIVE state machinery:\n - Remove IAVF_VLAN_DISABLE and IAVF_VLAN_INACTIVE enum values\n - Remove iavf_restore_filters() and its call from iavf_open()\n - Remove VLAN filter handling from iavf_clear_mac_vlan_filters(),\n rename it to iavf_clear_mac_filters()\n - Remove DEL_VLAN_FILTER scheduling from iavf_down()\n - Remove all DISABLE/INACTIVE handling from iavf_del_vlans()\n\nVLAN filters now stay ACTIVE across down/up cycles. Only explicit\nuser removal (ndo_vlan_rx_kill_vid) or PF/VF reset triggers VLAN\nfilter deletion/re-addition.\n\nFixes: ed1f5b58ea01 (\"i40evf: remove VLAN filters on close\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-2-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70d62b669f1f9080a25278fc90b64309f4ae8959", "tree": "2de08f80a19a0edff011324a5bb342804ca748cf", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:13 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n\nRename the IAVF_VLAN_IS_NEW state to IAVF_VLAN_ADDING to better\ndescribe what the state represents: an ADD request has been sent to\nthe PF and is waiting for a response.\n\nThis is a pure rename with no behavioral change, preparing for a\ncleanup of the VLAN filter state machine.\n\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-1-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e75a43c7cec459a07d91ed17de4de13ede2b7758", "tree": "84382cb8f3addaf5ee15a6fa8c1ce24dac0f900f", "parents": [ "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix inverted check of registering the stats for branch tracing\n\n When calling register_stat_tracer() which returns zero on success and\n negative on error, the callers were checking the return of zero as an\n error and printing a warning message. Because this was just a normal\n printk() message and not a WARN(), it wasn\u0027t caught in any testing.\n\n Fix the check to print the warning message when an error actually\n happens.\n\n - Fix a typo in a comment in tracepoint.h\n\n - Limit the size of event probes to 3K in size\n\n It is possible to create a dynamic event probe via the tracefs system\n that is greater than the max size of an event that the ring buffer\n can hold. This basically causes the event to become useless.\n\n Limit the size of an event probe to be 3K as that should be large\n enough to handle any dynamic events being created, and fits within\n the PAGE_SIZE sub-buffers of the ring buffer.\n\n* tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probes: Limit size of event probe to 3K\n tracepoint: Fix typo in tracepoint.h comment\n tracing: branch: Fix inverted check on stat tracer registration\n" }, { "commit": "7dfc0063022078a80fe5774815723c185e4b7b57", "tree": "7372ba3e604e5515c39443db398c21955847162d", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Wed Apr 29 15:57:34 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Apr 30 13:12:29 2026 +0900" }, "message": "regulator: rpi-panel-attiny: add back GPIOLIB dependency\n\nThis driver provides a gpio chip, which is only possible when GPIOLIB\nis enabled, which was previously guaranteed by the CONFIG_OF_GPIO\ndependency that is now gone:\n\nERROR: modpost: \"gpiochip_get_data\" [drivers/regulator/rpi-panel-attiny-regulator.ko] undefined!\nERROR: modpost: \"devm_gpiochip_add_data_with_key\" [drivers/regulator/rpi-panel-attiny-regulator.ko] undefined!\n\nAdd an explicit GPIOLIB dependency instead.\n\nFixes: bf017304fce1 (\"regulator: drop unneeded dependencies on OF_GPIO\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260429135812.112514-1-arnd@kernel.org\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "5ef343614db766acdc01c56d66e780a1b43c6ac6", "tree": "0b31b19657617984e4945bb4afa0209289f1adb2", "parents": [ "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e" ], "author": { "name": "Hasan Basbunar", "email": "basbunarhasan@gmail.com", "time": "Tue Apr 28 19:07:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 19:11:49 2026 -0700" }, "message": "page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n\nWhen page_pool_create_percpu() fails on page_pool_list(), it falls\nthrough to its err_uninit: label, which calls page_pool_uninit().\nAt that point page_pool_init() has already taken two references\nwhen the user requested PP_FLAG_ALLOW_UNREADABLE_NETMEM:\n\n\tpool-\u003emp_ops-\u003einit(pool)\n\tstatic_branch_inc(\u0026page_pool_mem_providers);\n\nNeither is undone by page_pool_uninit(); both are only undone by\n__page_pool_destroy() (success-side teardown). The error path\ntherefore leaks the per-provider reference taken by mp_ops-\u003einit\n(io_zcrx_ifq-\u003erefs in the io_uring zcrx provider, the dmabuf\nbinding refcount in the devmem provider) plus one increment of\nthe page_pool_mem_providers static branch on every failure of\nxa_alloc_cyclic() inside page_pool_list().\n\nThe leaked io_zcrx_ifq-\u003erefs in turn pins everything\nio_zcrx_ifq_free() would release on cleanup: ifq-\u003euser (uid),\nifq-\u003emm_account (mmdrop), ifq-\u003edev (device refcount),\nifq-\u003enetdev_tracker (netdev refcount), and the rbuf region.\nThe leaked static branch increment forces all subsequent\npage_pool_alloc_netmems() and page_pool_return_page() callers to\ntake the slow mp_ops branch for the lifetime of the kernel.\n\nReachable via the io_uring zcrx path:\n\n\tio_uring_register(IORING_REGISTER_ZCRX_IFQ) /* CAP_NET_ADMIN */\n\t -\u003e __io_uring_register\n\t -\u003e io_register_zcrx\n\t -\u003e zcrx_register_netdev\n\t -\u003e netif_mp_open_rxq\n\t -\u003e driver ndo_queue_mem_alloc\n\t -\u003e page_pool_create_percpu\n\t -\u003e page_pool_init succeeds (mp_ops-\u003einit runs, branch++)\n\t -\u003e page_pool_list fails (xa_alloc_cyclic -ENOMEM)\n\t -\u003e goto err_uninit \u003c-- leak\n\nThe same shape applies to the devmem dmabuf provider via\nmp_dmabuf_devmem_init()/mp_dmabuf_devmem_destroy().\n\nRestore the cleanup symmetry by moving the mp_ops-\u003edestroy() and\nstatic_branch_dec() calls out of __page_pool_destroy() and into\npage_pool_uninit(), so page_pool_uninit() is again the strict\ninverse of page_pool_init(). page_pool_uninit() has only two\ncallers (the err_uninit: path and __page_pool_destroy()), so this\npreserves the single-call invariant on the success path while\nfixing the err path. The error path of page_pool_init() itself\nstill skips the mp_ops cleanup correctly: mp_ops-\u003einit is the\nlast action that takes a reference before page_pool_init() returns\n0, so when it returns an error neither the refcount nor the static\nbranch has been touched.\n\nTriggering the bug requires xa_alloc_cyclic() to fail with -ENOMEM,\nwhich under normal GFP_KERNEL retry behaviour is rare. It is\ndeterministic under CONFIG_FAULT_INJECTION with fail_page_alloc /\nxa fault injection, or under sustained memory pressure. The leak\nis silent: there is no warning, and the released kernel build\ncontinues running with a permanently-incremented static branch.\n\nFixes: 0f9214046893 (\"memory-provider: dmabuf devmem memory provider\")\nSigned-off-by: Hasan Basbunar \u003cbasbunarhasan@gmail.com\u003e\nLink: https://patch.msgid.link/20260428170739.34881-1-basbunarhasan@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e", "tree": "b29a78420378d62cea69de50210636f01b9ac31f", "parents": [ "4ca01292ea2f2363660610a65ba0285d7c3309ed" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 28 12:32:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:32:02 2026 -0700" }, "message": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n process_one_work kernel/workqueue.c:3302 [inline]\n process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n kthread+0x22a/0x280 kernel/kthread.c:436\n ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)\nTainted: [W]\u003dWARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\n\nFixes: 47e91f56008b (\"bonding: use RCU protection for 3ad xmit path\")\nReported-by: syzbot+9bb2ff2a4ab9e17307e1@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nCc: Andrew Lunn \u003candrew+netdev@lunn.ch\u003e\nLink: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ca01292ea2f2363660610a65ba0285d7c3309ed", "tree": "9db972c62902c0d9f0dcc771bae9887e055f9bbe", "parents": [ "b31681206e3f527970a7c7ed807fbf6a028fc25b" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Apr 28 08:53:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:29:54 2026 -0700" }, "message": "net: airoha: Do not return err in ndo_stop() callback\n\nAlways complete the airoha_dev_stop() routine regardless of the\nairoha_set_vip_for_gdm_port() return value, since errors from\nndo_stop() are ignored by the networking stack and the interface is\nalways considered down after the call.\n\nFixes: 23020f049327 (\"net: airoha: Introduce ethernet support for EN7581 SoC\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260428-airoha-ndo-stop-not-err-v1-1-674506d29a91@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b31681206e3f527970a7c7ed807fbf6a028fc25b", "tree": "ddfd6607f932c271a0d55281b1a894a5052df638", "parents": [ "e73cafaf4acea5445df2e5ee021a335d717c1697" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Tue Apr 28 08:53:39 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:30:45 2026 -0700" }, "message": "hv_sock: fix ARM64 support\n\nVMBUS ring buffers must be page aligned. Therefore, the current value of\n24K presents a challenge on ARM64 kernels (with 64K pages). So, use\nVMBUS_RING_SIZE() to ensure they are always aligned and large enough to\nhold all of the relevant data.\n\nCc: stable@vger.kernel.org\nFixes: 77ffe33363c0 (\"hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication\")\nTested-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nReviewed-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260428125339.13963-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e73cafaf4acea5445df2e5ee021a335d717c1697", "tree": "d809154cd32ce098ab99e043b88c2dc6f95f504f", "parents": [ "72e9647e2b20c31b4f2febf981566e3c5cdef90e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:39:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:52:33 2026 -0700" }, "message": "MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n\nThe IPv4/IPv6 and routing code is not very well separated from\nthe TCP/UDP code. Scope it down properly by providing a more\naccurate file list, instead of net/ipv4/ and net/ipv6/\n\nNow that the entry is more accurately representing layer 3\nand routing merge in the nexthop entry into it.\n\nAdd Ido Schimmel as a co-maintainer, Ido\u0027s git history speaks\nfor itself.\n\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260428203924.1229169-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72e9647e2b20c31b4f2febf981566e3c5cdef90e", "tree": "769d62592321826f880a9f536764626a65ba7c65", "parents": [ "c3388f8c1cbb5aae3731749b586499ed126b4156" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:33:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:48:21 2026 -0700" }, "message": "selftests: drv-net: clarify linters and frameworks in README\n\nMinor clarifications in the README:\n - call out what linters we expect to be clean\n - make it clear that by \"frameworks\" we mean code under lib/\n not just factoring code out in the same file\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n\n" }, { "commit": "c3388f8c1cbb5aae3731749b586499ed126b4156", "tree": "52808a0aa42c3d233682986b3e3aaa386c748e2e", "parents": [ "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9" ], "author": { "name": "David Heidelberg", "email": "david@ixit.cz", "time": "Tue Apr 28 16:24:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:46:51 2026 -0700" }, "message": "MAINTAINERS: Add myself as NFC subsystem maintainer\n\nAdd myself and update the mailing list.\n\nSigned-off-by: David Heidelberg \u003cdavid@ixit.cz\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9", "tree": "e91db943670e99cad9c3ae0fc10ff8e2baab6df5", "parents": [ "0c7a5ba011d336df4fcd1f667fcc16ea5549be12" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 19:53:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:40:08 2026 -0700" }, "message": "net: add net_iov_init() and use it to initialize -\u003epage_type\n\nCommit db359fccf212 (\"mm: introduce a new page type for page pool in\npage type\") added a page_type field to struct net_iov at the same\noffset as struct page::page_type, so that page_pool_set_pp_info() can\ncall __SetPageNetpp() uniformly on both pages and net_iovs.\n\nThe page-type API requires the field to hold the UINT_MAX \"no type\"\nsentinel before a type can be set; for real struct page that invariant\nis established by the page allocator on free. struct net_iov is not\nallocated through the page allocator, so the field is left as zero\n(io_uring zcrx, which uses __GFP_ZERO) or as slab garbage (devmem,\nwhich uses kvmalloc_objs() without zeroing). When the page pool then\ncalls page_pool_set_pp_info() on a freshly-bound niov,\n__SetPageNetpp()\u0027s VM_BUG_ON_PAGE(page-\u003epage_type !\u003d UINT_MAX) fires\nand the kernel BUGs. Triggered in selftests by io_uring zcrx setup\nthrough the fbnic queue restart path:\n\n kernel BUG at ./include/linux/page-flags.h:1062!\n RIP: 0010:page_pool_set_pp_info (./include/linux/page-flags.h:1062\n net/core/page_pool.c:716)\n Call Trace:\n \u003cTASK\u003e\n net_mp_niov_set_page_pool (net/core/page_pool.c:1360)\n io_pp_zc_alloc_netmems (io_uring/zcrx.c:1089 io_uring/zcrx.c:1110)\n fbnic_fill_bdq (./include/net/page_pool/helpers.h:160\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:906)\n __fbnic_nv_restart (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2470\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2874)\n fbnic_queue_start (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2903)\n netdev_rx_queue_reconfig (net/core/netdev_rx_queue.c:137)\n __netif_mp_open_rxq (net/core/netdev_rx_queue.c:234)\n io_register_zcrx (io_uring/zcrx.c:818 io_uring/zcrx.c:903)\n __io_uring_register (io_uring/register.c:931)\n __do_sys_io_uring_register (io_uring/register.c:1029)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63\n arch/x86/entry/syscall_64.c:94)\n \u003c/TASK\u003e\n\nThe same path is reachable through devmem dmabuf binding via\nnetdev_nl_bind_rx_doit() -\u003e net_devmem_bind_dmabuf_to_queue().\n\nAdd a net_iov_init() helper that stamps -\u003eowner, -\u003etype and the\n-\u003epage_type sentinel, and use it from both the devmem and io_uring\nzcrx niov init loops.\n\nFixes: db359fccf212 (\"mm: introduce a new page type for page pool in page type\")\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nAcked-by: Byungchul Park \u003cbyungchul@sk.com\u003e\nReviewed-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nAcked-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/20260428025320.853452-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c208a2b95811d6e1ebae65d0d2fc13f73707f8e7", "tree": "9a12e6db58e1af7cc2885c1df5b206d8ab6b82d8", "parents": [ "8e13b1b4093e0cbcb3dc2906c13b1fdc95cdf0a0" ], "author": { "name": "Shyam Prasad N", "email": "sprasad@microsoft.com", "time": "Mon Mar 30 16:19:59 2026 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Wed Apr 29 17:26:37 2026 -0500" }, "message": "cifs: change_conf needs to be called for session setup\n\nToday we skip calling change_conf for negotiates and session setup\nrequests. This can be a problem for mchan as the immediate next call\nafter session setup could be due to an I/O that is made on the\nmount point. For single channel, this is not a problem as\nthere will be several calls after setting up session.\n\nThis change enforces calling change_conf when the total credits contain\nenough for reservations for echoes and oplocks. We expect this to happen\nduring the last session setup response. This way, echoes and oplocks are\nnot disabled before the first request to the server. So if that first\nrequest is an open, it does not need to disable requesting leases.\n\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nSigned-off-by: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8e13b1b4093e0cbcb3dc2906c13b1fdc95cdf0a0", "tree": "867d83f1de636affad7b3afcd342b5317cb9cf79", "parents": [ "0cbc300257d9b399491909806777f504ec687c1d" ], "author": { "name": "Fredric Cover", "email": "fredric.cover.lkernel@gmail.com", "time": "Wed Apr 29 14:34:53 2026 -0700" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Wed Apr 29 17:26:07 2026 -0500" }, "message": "smb: client: change allocation requirements in smb2_compound_op\n\nCurrently, smb2_compound_op() allocates\nstruct smb2_compound_vars *vars using GFP_ATOMIC, although\nsmb2_compound_op() can sleep when it calls compound_send_recv()\nbefore vars is freed.\n\nAllocate vars using GFP_KERNEL.\n\nSigned-off-by: Fredric Cover \u003cfredric.cover.lkernel@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "9e9354075d5a15cfc0aba965f3d0d77b7d4303e9", "tree": "78908e713f19cea613189a90c37a85c6bd6a423c", "parents": [ "4ebcf3f94924d54706de0d2492c80944d85410fd" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Tue Apr 28 15:21:38 2026 -0400" }, "committer": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Thu Apr 30 07:05:48 2026 +0900" }, "message": "ntfs: Use return instead of goto in ntfs_mapping_pairs_decompress()\n\nClang warns (or errors with CONFIG_WERROR\u003dy / W\u003de):\n\n fs/ntfs/runlist.c:755:6: error: variable \u0027rl\u0027 is used uninitialized whenever \u0027if\u0027 condition is true [-Werror,-Wsometimes-uninitialized]\n 755 | if (overflows_type(lowest_vcn, vcn)) {\n | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n ...\n fs/ntfs/runlist.c:971:9: note: uninitialized use occurs here\n 971 | kvfree(rl);\n | ^~\n ...\n\nrl has not been allocated at this point so the \u0027goto err_out\u0027 should\nreally just be a return of the error pointer -EIO.\n\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Hyunchul Lee \u003chyc.lee@gmail.com\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\n" }, { "commit": "4ebcf3f94924d54706de0d2492c80944d85410fd", "tree": "4d9ce367804bba1d987eee9d968f783b9a7c2579", "parents": [ "d986ba0329dcca102e227995371135c9bbcefb6b" ], "author": { "name": "Hyunchul Lee", "email": "hyc.lee@gmail.com", "time": "Tue Apr 28 10:34:10 2026 +0900" }, "committer": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Thu Apr 30 07:05:46 2026 +0900" }, "message": "ntfs: drop nlink once for WIN32/DOS aliases\n\nNTFS could store a filename as paired WIN32 and DOS $FILE_NAME attributes\nfor directories. But ntfs_delete() deleted both attributes for unlinking\na directory, but it also called drop_nlink() for each attributes.\nThis could trigger warnings when unlinking directories.\n\nSigned-off-by: Hyunchul Lee \u003chyc.lee@gmail.com\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\n" }, { "commit": "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a", "tree": "4687d9d5c912c18448bda8fd59d5e4e8fe262648", "parents": [ "5ec07d5204b4544271f32f6261ee097fe53cb081" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 12:23:02 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Apr 29 16:07:38 2026 -0400" }, "message": "tracing/probes: Limit size of event probe to 3K\n\nThere currently isn\u0027t a max limit an event probe can be. One could make an\nevent greater than PAGE_SIZE, which makes the event useless because if\nit\u0027s bigger than the max event that can be recorded into the ring buffer,\nthen it will never be recorded.\n\nA event probe should never need to be greater than 3K, so make that the\nmax size. As long as the max is less than the max that can be recorded\nonto the ring buffer, it should be fine.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nFixes: 93ccae7a22274 (\"tracing/kprobes: Support basic types on dynamic events\")\nLink: https://patch.msgid.link/20260428122302.706610ba@gandalf.local.home\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "662f9ddc8077792129440d05cbef2f944a07777a", "tree": "d5bdefa88a887b9fac5e479794f99abca319aba2", "parents": [ "4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39" ], "author": { "name": "Jia Yao", "email": "jia.yao@intel.com", "time": "Fri Apr 17 05:59:17 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:21 2026 -0400" }, "message": "drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR\n\nAdd validation in xe_vm_bind_ioctl() to reject PAT indices\nwith XE_COH_NONE coherency mode when used with\nDRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR.\n\nCPU address mirror mappings use system memory that is CPU\ncached, which makes them incompatible with COH_NONE PAT\nindices. Allowing COH_NONE with CPU cached buffers is a\nsecurity risk, as the GPU may bypass CPU caches and read\nstale sensitive data from DRAM.\n\nAlthough CPU_ADDR_MIRROR does not create an immediate\nmapping, the backing system memory is still CPU cached.\nApply the same PAT coherency restrictions as\nDRM_XE_VM_BIND_OP_MAP_USERPTR.\n\nv2:\n- Correct fix tag\n\nv6:\n- No change\n\nv7:\n- Correct fix tag\n\nv8:\n- Rebase\n\nv9:\n- Limit the restrictions to iGPU\n\nv10:\n- Just add the iGPU logic but keep dGPU logic\n\nFixes: b43e864af0d4 (\"drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR\")\nCc: \u003cstable@vger.kernel.org\u003e # v6.15+\nCc: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nCc: Mathew Alwin \u003calwin.mathew@intel.com\u003e\nCc: Michal Mrozek \u003cmichal.mrozek@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nSigned-off-by: Jia Yao \u003cjia.yao@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nAcked-by: Michal Mrozek \u003cmichal.mrozek@intel.com\u003e\nSigned-off-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260417055917.2027459-3-jia.yao@intel.com\n(cherry picked from commit 4d58d7535e826a3175527b6174502f0db319d7f6)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39", "tree": "b34164fe007467cbbf0e58036f82591ebc7c740f", "parents": [ "0df99689eb790bcad3ad82b38fa4ce1cbf3cffa3" ], "author": { "name": "Jia Yao", "email": "jia.yao@intel.com", "time": "Fri Apr 17 05:59:16 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:21 2026 -0400" }, "message": "drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise\n\nAdd validation in xe_vm_madvise_ioctl() to reject PAT indices with\nXE_COH_NONE coherency mode when applied to CPU cached memory.\n\nUsing coh_none with CPU cached buffers is a security issue. When the\nkernel clears pages before reallocation, the clear operation stays in\nCPU cache (dirty). GPU with coh_none can bypass CPU caches and read\nstale sensitive data directly from DRAM, potentially leaking data from\npreviously freed pages of other processes.\n\nThis aligns with the existing validation in vm_bind path\n(xe_vm_bind_ioctl_validate_bo).\n\nv2(Matthew brost)\n- Add fixes\n- Move one debug print to better place\n\nv3(Matthew Auld)\n- Should be drm/xe/uapi\n- More Cc\n\nv4(Shuicheng Lin)\n- Fix kmem leak issues by the way\n\nv5\n- Remove kmem leak because it has been merged by another patch\n\nv6\n- Remove the fix which is not related to current fix\n\nv7\n- No change\n\nv8\n- Rebase\n\nv9\n- Limit the restrictions to iGPU\n\nv10\n- No change\n\nFixes: ada7486c5668 (\"drm/xe: Implement madvise ioctl for xe\")\nCc: \u003cstable@vger.kernel.org\u003e # v6.18+\nCc: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nCc: Mathew Alwin \u003calwin.mathew@intel.com\u003e\nCc: Michal Mrozek \u003cmichal.mrozek@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nSigned-off-by: Jia Yao \u003cjia.yao@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nAcked-by: Michal Mrozek \u003cmichal.mrozek@intel.com\u003e\nAcked-by: José Roberto de Souza \u003cjose.souza@intel.com\u003e\nSigned-off-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260417055917.2027459-2-jia.yao@intel.com\n(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "0df99689eb790bcad3ad82b38fa4ce1cbf3cffa3", "tree": "ff7f81618d5aeafb047772b09fbfbbab5c815808", "parents": [ "3762d6c36549accea7068c4a175483fafdd03657" ], "author": { "name": "Tvrtko Ursulin", "email": "tvrtko.ursulin@igalia.com", "time": "Mon Apr 20 14:16:03 2026 +0100" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:21 2026 -0400" }, "message": "drm/xe/xelp: Fix Wa_18022495364\n\nCommand parser relative MMIO addressing needs to be enabled when writing\nto the register.\n\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nFixes: ca33cd271ef9 (\"drm/xe/xelp: Add Wa_18022495364\")\nCc: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nReviewed-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nLink: https://patch.msgid.link/20260420131603.70357-1-tvrtko.ursulin@igalia.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 5627392001802a98ed6cf8cf79a303abd00d1c0f)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "3762d6c36549accea7068c4a175483fafdd03657", "tree": "ef8e2891d20157a9e3f1e42b381ef5fe20709e22", "parents": [ "dc2d9842c67d883d3200ae33b9c3859dd9492408" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Fri Apr 17 16:33:08 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe/gsc: Fix BO leak on error in query_compatibility_version()\n\nWhen xe_gsc_read_out_header() fails, query_compatibility_version()\nreturns directly instead of jumping to the out_bo label. This skips\nthe xe_bo_unpin_map_no_vm() call, leaving the BO pinned and mapped\nwith no remaining reference to free it.\n\nFix by using goto out_bo so the error path properly cleans up the BO,\nconsistent with the other error handling in the same function.\n\nFixes: 0881cbe04077 (\"drm/xe/gsc: Query GSC compatibility version\")\nCc: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nReviewed-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nLink: https://patch.msgid.link/20260417163308.3416147-1-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 8de86d0a843c32ca9d36864bdb92f0376a830bce)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "dc2d9842c67d883d3200ae33b9c3859dd9492408", "tree": "bc51cfd804645e7404e874775526c03b682e9785", "parents": [ "f3cc22d4df3ed58439ea7e21daa54c3608e03b78" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 15 22:54:28 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe/eustall: Fix drm_dev_put called before stream disable in close\n\nIn xe_eu_stall_stream_close(), drm_dev_put() is called before the\nstream is disabled and its resources are freed. If this drops the\nlast reference, the device structures could be freed while the\nsubsequent cleanup code still accesses them, leading to a\nuse-after-free.\n\nFix this by moving drm_dev_put() after all device accesses are\ncomplete. This matches the ordering in xe_oa_release().\n\nFixes: 9a0b11d4cf3b (\"drm/xe/eustall: Add support to init, enable and disable EU stall sampling\")\nCc: Harish Chegondi \u003charish.chegondi@intel.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nReviewed-by: Harish Chegondi \u003charish.chegondi@intel.com\u003e\nLink: https://patch.msgid.link/20260415225428.3399934-1-shuicheng.lin@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 35aff528f7297e949e5e19c9cd7fd748cf1cf21c)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "f3cc22d4df3ed58439ea7e21daa54c3608e03b78", "tree": "bbfe00b07f9233c818ce212ae93e04c8310af530", "parents": [ "111ab678471bf1f90d078d5513bb086b70596c3c" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 08 02:06:47 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\n to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\n preempt fence mode, xe_vm_add_compute_exec_queue() has already added\n the queue to the VM\u0027s compute exec queue list. Skipping the kill\n leaves the queue on that list, leading to a dangling pointer after\n the queue is freed.\n\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\n succeeded, the error path does not call\n xe_hw_engine_group_del_exec_queue() to remove the queue from the hw\n engine group list. The queue is then freed while still linked into\n the hw engine group, causing a use-after-free.\n\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\n to kill_exec_queue so that xe_exec_queue_kill() properly removes the\n queue from the VM\u0027s compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\n xa_alloc() failure path, which removes the queue from the hw engine\n group before proceeding with the rest of the cleanup.\n\nFixes: 7970cb36966c (\"\u0027drm/xe/hw_engine_group: Register hw engine group\u0027s exec queues\")\nCc: Francois Dugast \u003cfrancois.dugast@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Niranjana Vishwanathapura \u003cniranjana.vishwanathapura@intel.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408020647.3397933-1-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "111ab678471bf1f90d078d5513bb086b70596c3c", "tree": "ab8ae65f3ed6f1c098b7ecd8a482143c01f1af74", "parents": [ "93a528f67ce5095bcab46a69839eca97f43dd352" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 08 17:52:55 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()\n\nWhen xe_dma_buf_init_obj() fails, the attachment from\ndma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before\nreturning the error. Note: we cannot use goto out_err here because\nxe_dma_buf_init_obj() already frees bo on failure, and out_err would\ndouble-free it.\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Mattheq Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "93a528f67ce5095bcab46a69839eca97f43dd352", "tree": "2cee8c412dfaa498cbb6998d192d9773ab4afc17", "parents": [ "1d0adf2fd94fb0c0037c643fadd8f2cf3cffc009" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 08 17:52:54 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure\n\nWhen drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo\nis not freed. Add xe_bo_free(storage) before returning the error.\n\nxe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on\nerror. Therefore, xe_dma_buf_init_obj() must also free the bo on its own\nerror paths. Otherwise, since xe_gem_prime_import() cannot distinguish\nwhether the failure originated from xe_dma_buf_init_obj() or from\nxe_bo_init_locked(), it cannot safely decide whether the bo should be\nfreed.\n\nAdd comments documenting the ownership semantics: on success, ownership\nof storage is transferred to the returned drm_gem_object; on failure,\nstorage is freed before returning.\n\nv2: Add comments to explain the free logic.\n\nFixes: eb289a5f6cc6 (\"drm/xe: Convert xe_dma_buf.c for exhaustive eviction\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "1d0adf2fd94fb0c0037c643fadd8f2cf3cffc009", "tree": "fb32b69c05eefc705f757e90ac873de5c77608e3", "parents": [ "09a8f3c1c11977a6e10c167f26dd298790b31c32" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 08 17:52:53 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()\n\nWhen XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function\nreturns an error without freeing a caller-provided bo, violating the\ndocumented contract that bo is freed on failure.\n\nAdd xe_bo_free(bo) before returning the error.\n\nFixes: 5a3b0df25d6a (\"drm/xe: Allow bo mapping on multiple ggtts\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 3fbd6cf43cac7b60757f3ce3d95195d3843a902c)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "09a8f3c1c11977a6e10c167f26dd298790b31c32", "tree": "3244aab09003eccbef7698849e1c1f772da3b321", "parents": [ "f8c4151d50b12923b67819ebf03c1c6782c984c1" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Wed Apr 08 17:52:52 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:20 2026 -0400" }, "message": "drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()\n\nWhen type is ttm_bo_type_device and aligned_size !\u003d size, the function\nreturns an error without freeing a caller-provided bo, violating the\ndocumented contract that bo is freed on failure.\n\nAdd xe_bo_free(bo) before returning the error.\n\nFixes: 4e03b584143e (\"drm/xe/uapi: Reject bo creation of unaligned size\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 601c2aa087b6f21014300a3f107a08ee4dde7bdf)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "f8c4151d50b12923b67819ebf03c1c6782c984c1", "tree": "98aadabf5b2ded782230273264e0eb7e5a6c02a0", "parents": [ "1460eae74fbbb27d5c5b159dba021e41c6ace4c1" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Thu Apr 09 00:34:49 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:19 2026 -0400" }, "message": "drm/xe: Fix potential NULL deref in xe_exec_queue_tlb_inval_last_fence_put_unlocked\n\nxe_exec_queue_tlb_inval_last_fence_put_unlocked() uses q-\u003evm-\u003exe as the\nfirst argument to xe_assert(). This function is called unconditionally\nfrom xe_exec_queue_destroy() for all queues, including kernel queues\nthat have q-\u003evm \u003d\u003d NULL (e.g., queues created during GT init in\nxe_gt_record_default_lrcs() with vm\u003dNULL).\n\nWhile current compilers optimize away the q-\u003evm-\u003exe dereference (even\nin CONFIG_DRM_XE_DEBUG\u003dy builds, the compiler pushes the dereference\ninto the WARN branch that is only taken when the assert condition is\nfalse), the code is semantically incorrect and constitutes undefined\nbehavior in the C abstract machine for the NULL pointer case.\n\nUse gt_to_xe(q-\u003egt) instead, which is always valid for any exec queue.\nThis is consistent with how xe_exec_queue_destroy() itself obtains the\nxe_device pointer in its own xe_assert at the top of the function.\n\nFixes: b2d7ec41f2a3 (\"drm/xe: Attach last fence to TLB invalidation job queues\")\nAssisted-by: Claude:claude-opus-4.6\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260409003449.3405767-1-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 96078a1c68bf97f17fd1d08c3f58f5c5cc9ccd65)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "1460eae74fbbb27d5c5b159dba021e41c6ace4c1", "tree": "0f79311b9de565ff394abb58f0eb4bb5a44e6e46", "parents": [ "36c6bac158816ede655f298a3f76e5a350eaa90e" ], "author": { "name": "Satyanarayana K V P", "email": "satyanarayana.k.v.p@intel.com", "time": "Wed Apr 08 11:01:48 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:19 2026 -0400" }, "message": "drm/xe/vf: Use drm mm instead of drm sa for CCS read/write\n\nThe suballocator algorithm tracks a hole cursor at the last allocation\nand tries to allocate after it. This is optimized for fence-ordered\nprogress, where older allocations are expected to become reusable first.\n\nIn fence-enabled mode, that ordering assumption holds. In fence-disabled\nmode, allocations may be freed in arbitrary order, so limiting allocation\nto the current hole window can miss valid free space and fail allocations\ndespite sufficient total space.\n\nUse DRM memory manager instead of sub-allocator to get rid of this issue\nas CCS read/write operations do not use fences.\n\nFixes: 864690cf4dd6 (\"drm/xe/vf: Attach and detach CCS copy commands with BO\")\nSigned-off-by: Satyanarayana K V P \u003csatyanarayana.k.v.p@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\nCc: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408110145.1639937-6-satyanarayana.k.v.p@intel.com\n(cherry picked from commit 6c84b493012aeb05dec29c709377bf0e17ac6815)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "36c6bac158816ede655f298a3f76e5a350eaa90e", "tree": "2c24a40dcebce9b4cd09025bd30cdd7a7c9cd50e", "parents": [ "03f2499c51dffce611b065b2894406beb9f2ebe0" ], "author": { "name": "Satyanarayana K V P", "email": "satyanarayana.k.v.p@intel.com", "time": "Wed Apr 08 11:01:47 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 12:51:19 2026 -0400" }, "message": "drm/xe: Add memory pool with shadow support\n\nAdd a memory pool to allocate sub-ranges from a BO-backed pool\nusing drm_mm.\n\nSigned-off-by: Satyanarayana K V P \u003csatyanarayana.k.v.p@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\nCc: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260408110145.1639937-5-satyanarayana.k.v.p@intel.com\n(cherry picked from commit 1ce3229f8f269a245ff3b8c65ffae36b4d6afb93)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "03f2499c51dffce611b065b2894406beb9f2ebe0", "tree": "2b121f9264508cfbf2c3a57bfdda91af9db465d5", "parents": [ "9407936237c98104873550219efedc286f28bbe9" ], "author": { "name": "Matt Roper", "email": "matthew.d.roper@intel.com", "time": "Wed Apr 08 15:27:44 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:28:24 2026 -0400" }, "message": "drm/xe/debugfs: Correct printing of register whitelist ranges\n\nThe register-save-restore debugfs prints whitelist entries as offset\nranges. E.g.,\n\n REG[0x39319c-0x39319f]: allow read access\n\nfor a single dword-sized register. However the GENMASK value used to\nset the lower bits to \u00271\u0027 for the upper bound of the whitelist range\nincorrectly included one more bit than it should have, causing the\nwhitelist ranges to sometimes appear twice as large as they really were.\nFor example,\n\n REG[0x6210-0x6217]: allow rw access\n\nwas also intended to be a single dword-sized register whitelist (with a\nrange 0x6210-0x6213) but was printed incorrectly as a qword-sized range\nbecause one too many bits was flipped on. Similar \u0027off by one\u0027 logic\nwas applied when printing 4-dword register ranges and 64-dword register\nranges as well.\n\nCorrect the GENMASK logic to print these ranges in debugfs correctly.\nNo impact outside of correcting the misleading debugfs output.\n\nFixes: d855d2246ea6 (\"drm/xe: Print whitelist while applying\")\nReviewed-by: Stuart Summers \u003cstuart.summers@intel.com\u003e\nLink: https://patch.msgid.link/20260408-regsr_wl_range-v1-1-e9a28c8b4264@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 1a2a722ff96749734a5585dfe7f0bea7719caa8b)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "9407936237c98104873550219efedc286f28bbe9", "tree": "d334b23408c8cdd7e8d095c9ee194cdef3724846", "parents": [ "2299d73562e68e85e358289438924572b01cfe19" ], "author": { "name": "Matt Roper", "email": "matthew.d.roper@intel.com", "time": "Fri Apr 10 15:50:30 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:28:17 2026 -0400" }, "message": "drm/xe: Mark ROW_CHICKEN5 as a masked register\n\nROW_CHICKEN5 is a masked register (i.e., to adjust the value of any of\nthe lower 16 bits, the corresponding bit in the upper 16 bits must also\nbe set). Add the XE_REG_OPTION_MASKED to its definition; failure to do\nso will cause workaround updates of this register to not apply properly.\n\nBspec: 56853\nFixes: 835cd6cbb0d0 (\"drm/xe/xe3p_lpg: Add initial workarounds for graphics version 35.10\")\nReviewed-by: Gustavo Sousa \u003cgustavo.sousa@intel.com\u003e\nLink: https://patch.msgid.link/20260410-xe3p_tuning-v1-3-e206a62ee38f@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit cd84bfbba7feb4c1e72356f14de026dfda1a9e2a)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "2299d73562e68e85e358289438924572b01cfe19", "tree": "073baa4c49f697c03210a99537d2901f90ba7d62", "parents": [ "68fdf2c943bbba75d4f3a5c5546bc764f5886c13" ], "author": { "name": "Matt Roper", "email": "matthew.d.roper@intel.com", "time": "Fri Apr 10 15:50:29 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:28:10 2026 -0400" }, "message": "drm/xe/tuning: Use proper register offset for GAMSTLB_CTRL\n\nFrom Xe2 onward (i.e., all platforms officially supported by the Xe\ndriver), the GAMSTLB_CTRL register is located at offset 0x477C and\nrepresented by the macro \"GAMSTLB_CTRL\" in code. However the register\nformerly resided at offset 0xCF4C on Xe1-era platforms, and we also have\nmacro XEHP_GAMSTLB_CTRL that represents this old offset in the\nunofficial/developer-only Xe1 code. When tuning for the register was\nadded for Xe3p_LPG, the old Xe1-era macro was accidentally used instead\nof the proper macro for Xe2 and beyond, causing the tuning to not be\napplied properly. Use the proper definition so that the correct offset\nis written to.\n\nBspec: 59298\nFixes: 377c89bfaa5d (\"drm/xe/xe3p_lpg: Set STLB bank hash mode to 4KB\")\nReviewed-by: Gustavo Sousa \u003cgustavo.sousa@intel.com\u003e\nLink: https://patch.msgid.link/20260410-xe3p_tuning-v1-2-e206a62ee38f@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 0b1676eafdd1ba5a5436bdca0d2a25ce56699783)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "68fdf2c943bbba75d4f3a5c5546bc764f5886c13", "tree": "57bc08318dfa17f4dd68f69f56b01c28b958ff54", "parents": [ "9d7ca81b3019905c36c8cae9c306827325ba5878" ], "author": { "name": "Gustavo Sousa", "email": "gustavo.sousa@intel.com", "time": "Wed Apr 01 19:10:51 2026 -0300" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:28:02 2026 -0400" }, "message": "drm/xe/xe3p_lpg: Add missing indirect ring state feature flag\n\nEven though commit 8fcb7dfb8bbf (\"drm/xe/xe3p_lpg: Add support for\ngraphics IP 35.10\") mentions that the support for Indirect Ring State\nexists for Xe3p_LPG, it missed actually setting the feature flag in\ngraphics_xe3p_lpg. Fix that by adding the missing member.\n\nFixes: 8fcb7dfb8bbf (\"drm/xe/xe3p_lpg: Add support for graphics IP 35.10\")\nReviewed-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nLink: https://patch.msgid.link/20260401-xe3p_lpg-indirect-ring-state-v1-1-0e4b5edf6898@intel.com\nSigned-off-by: Gustavo Sousa \u003cgustavo.sousa@intel.com\u003e\n(cherry picked from commit ec4f4970eb744fd7d6d135f40f5c83bd05982e72)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "9d7ca81b3019905c36c8cae9c306827325ba5878", "tree": "0e22830bc65d913977e01d303349f572d26fe24c", "parents": [ "2bc0cce2724f74dde914d11fabb35b3a912c8329" ], "author": { "name": "Matt Roper", "email": "matthew.d.roper@intel.com", "time": "Wed Apr 01 13:12:44 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:27:54 2026 -0400" }, "message": "drm/xe: Drop redundant rtp entries for Wa_14019988906 \u0026 Wa_14019877138\n\nThere appears to have been a silent merge conflict between some commits\nupdating the workaround tables on Xe\u0027s -fixes and -next branches:\n\n - Commit bc6387a2e0c1 (\"drm/xe/xe2_hpg: Fix handling of Wa_14019988906\n \u0026 Wa_14019877138\") from the fixes branch moved the Xe2_HPG instance\n of two workarounds touching the PSS_CHICKEN register from the\n engine_was[] table to the lrc_was[] table; the equivalent\n implementation for all other platforms/IPs were already properly\n located on lrc_was[]. This commit on the fixes branch is a\n cherry-pick of commit e04c609eedf4 (\"drm/xe/xe2_hpg: Fix handling of\n Wa_14019988906 \u0026 Wa_14019877138\") that already existed on the next\n branch.\n\n - Commit 55b19abb6c44 (\"drm/xe: Consolidate workaround entries for\n Wa_14019877138\") and commit c2142a1a8415 (\"drm/xe: Consolidate\n workaround entries for Wa_14019988906\") consolidated the individual\n entries per IP generation for each workaround into single, larger\n range-based entries.\n\nDuring merge conflict resolution the Xe2_HPG-specific entries (i.e.,\nthose with rule \"GRAPHICS_VERSION_RANGE(2001, 2002)\") were accidentally\nresurrected, even though the table already contains the consolidated\nentries that match a superset of thse ranges. These redundant entries\ndon\u0027t cause any build failures but do trigger a dmesg error during probe\non BMG-G21 devices:\n\n xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000400, set: 00000400, masked: yes, mcr: yes): ret\u003d-22\n xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000020, set: 00000020, masked: yes, mcr: yes): ret\u003d-22\n\nRe-drop the Xe2_HPG-specific table entries to eliminate the error.\n\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7433\nFixes: 17b95278ae6a (\"Merge tag \u0027drm-xe-next-2026-03-02\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next\")\nCc: Dave Airlie \u003cairlied@redhat.com\u003e\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nReviewed-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nLink: https://patch.msgid.link/20260401-wa_merge_conflict-v1-1-b477ab53fedc@intel.com\nSigned-off-by: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\n(cherry picked from commit c79bc999442ff3c0908ab8bce92b2a3cb7d59861)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "2bc0cce2724f74dde914d11fabb35b3a912c8329", "tree": "eaad3914212bad045fd987e35489bbb598fe873a", "parents": [ "a0fc362f095330f7b3f68ac0c55ef8da18290c87" ], "author": { "name": "Jonathan Cavitt", "email": "jonathan.cavitt@intel.com", "time": "Tue Mar 31 18:12:17 2026 +0000" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:27:48 2026 -0400" }, "message": "drm/xe/vm: Add missing pad and extensions check\n\nAdd missing pad and extensions check to xe_vm_get_property_ioctl\n\nv2:\n- Combine with other check (Auld)\n\nFixes: 50c577eab051 (\"drm/xe/xe_vm: Implement xe_vm_get_property_ioctl\")\nSuggested-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nSigned-off-by: Jonathan Cavitt \u003cjonathan.cavitt@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260331181216.37775-2-jonathan.cavitt@intel.com\n(cherry picked from commit 896070686b16cc45cca7854be2049923b2b303d3)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "a0fc362f095330f7b3f68ac0c55ef8da18290c87", "tree": "e5b41d74df974e6cb22906c36f2e1bb4d67ad010", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Mar 26 14:01:16 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Wed Apr 29 11:27:38 2026 -0400" }, "message": "drm/xe: Drop registration of guc_submit_wedged_fini from xe_guc_submit_wedge()\n\nxe_guc_submit_wedge() runs in the DMA-fence signaling path, where\nGFP_KERNEL memory allocations are not permitted. However, registering\nguc_submit_wedged_fini via drmm_add_action_or_reset() triggers such an\nallocation.\n\nAvoid this by moving the logic from guc_submit_wedged_fini() into\nguc_submit_fini(), where wedged exec queue references are dropped during\nnormal teardown.\n\nFixes: 8ed9aaae39f3 (\"drm/xe: Force wedged state and block GT reset upon any GPU hang\")\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/20260326210116.202585-3-matthew.brost@intel.com\n(cherry picked from commit 4a706bd93c4fb156a13477e26ffdf2e633edeb10)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "c444139cb747bf6de1922b39900fdf02281490f4", "tree": "942fb4a3baa090c01e1896d8f8b6dc363e69e557", "parents": [ "ab4ad35e58a74c0fc51e5b0bcfb56523e97ff65f" ], "author": { "name": "DaeMyung Kang", "email": "charsyam@gmail.com", "time": "Sat Apr 25 18:38:28 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Wed Apr 29 10:25:37 2026 -0500" }, "message": "ksmbd: rewrite stop_sessions() with restartable iteration\n\nstop_sessions() walks conn_list with hash_for_each() and, for every\nentry, drops conn_list_lock across the transport -\u003eshutdown() call\nbefore re-acquiring the read lock to continue the loop. The hash\nwalk relies on cross-iteration state (the current bucket and the\nhlist position), which is not preserved across unlock/relock: if\nanother thread performs a list mutation during the unlocked window,\nthe ongoing iteration becomes unreliable and can re-visit\nconnections that have already been handled or skip connections that\nhave not. The outer `if (!hash_empty(conn_list)) goto again;` retry\nmasks the symptom in the common case but does not address the\nunsafe iteration itself.\n\nReframe the loop so it never relies on iterator state across\nunlock/relock. Under conn_list_lock held for read, pick the first\nconnection whose -\u003eshutdown() has not yet been issued by this path,\npin it by taking an extra reference, record that fact on the\nconnection and mark it EXITING while still inside the locked walk,\nthen drop the lock. Then call -\u003eshutdown() outside the lock, drop\nthe pin (freeing the connection if the handler already released its\nreference), and restart from the top.\n\nUse a new per-connection flag, conn-\u003estop_called, as the \"shutdown\nissued from stop_sessions()\" marker rather than reusing the status\nstate. ksmbd_conn_set_exiting() is also invoked by\nksmbd_sessions_deregister() on sibling channels of a multichannel\nsession without issuing a transport shutdown, so treating\nKSMBD_SESS_EXITING as \"already handled here\" would skip connections\nthat still need shutdown() to wake their handler out of recv(),\nleaving the outer retry waiting indefinitely for the hash to drain.\nstop_sessions() is serialised by init_lock in\nksmbd_conn_transport_destroy(), so writing stop_called under the\nread lock has no other writer.\n\nSet EXITING inside the locked walk so the selection, the stop_called\nmarker, and the status transition all happen together, and guard\nagainst regressing a connection that has already advanced to\nKSMBD_SESS_RELEASING on its own (for example, if the handler exited\nits receive loop for an unrelated reason between teardown steps).\n\nWhen the pin drop is the last put, release the transport and pair\nida_destroy(\u0026target-\u003easync_ida) with the ida_init() done in\nksmbd_conn_alloc(), so stop_sessions() retiring a connection on its\nown does not leak the xarray backing of the embedded async_ida.\n\nThe outer retry with msleep() is kept to wait for handler threads to\nreach ksmbd_conn_free() and drain the hash.\n\nObserved with an instrumented build that logs one line per visit and\nwidens the unlocked window before -\u003eshutdown() by 200 ms, under\nfive concurrent cifs mounts (nosharesock, one connection each):\n\n * Current code: the same connection address is revisited many\n times during a single stop_sessions() call and -\u003eshutdown() is\n invoked well beyond the number of live connections before the\n hash finally drains.\n\n * Rewritten code: each live connection produces exactly one\n -\u003eshutdown() call; the function returns as soon as the hash is\n empty.\n\nFunctional teardown via `ksmbd.control --shutdown` with the same\nfive mounts completes cleanly on the rewritten path.\n\nPerformance is observably unchanged. Tearing down N concurrent\nnosharesock cifs connections with `ksmbd.control --shutdown` +\n`rmmod ksmbd` takes essentially the same wall time before and after\nthe rewrite:\n\n N before after\n 10 4.93s 5.34s\n 30 7.34s 7.03s\n 50 7.31s 7.01s (3-run avg: 7.04s vs 7.25s)\n 100 6.98s 6.78s\n 200 6.77s 6.89s\n\nand the number of -\u003eshutdown() calls equals the number of live\nconnections on both paths when the race is not widened. The\nteardown is dominated by the msleep(100)-based outer retry waiting\nfor handler threads to run ksmbd_conn_free(), not by the iteration\nitself; the restartable loop\u0027s worst-case O(N^2) visit cost is in\nthe microseconds even at N\u003d200 and sits far below the msleep(100)\ngranularity.\n\nApplied alone on top of ksmbd-for-next-next, this patch does not\nintroduce a new leak site. Under the same reproducer (10x\nconcurrent-holders + ss -K + ksmbd.control --shutdown + rmmod), the\ntree still shows the pre-existing per-connection transport leak\ncount that arises when the last refcount drop lands in one of\nksmbd_conn_r_count_dec(), __free_opinfo() or session_fd_check() -\nall of which end with a bare kfree() today. kmemleak backtraces\nfor the unreferenced objects point into the TCP accept path\n(sk_clone -\u003e inet_csk_clone_lock, sock_alloc_inode) and none\ninvolve stop_sessions(). Plugging those bare-kfree sites is the\nresponsibility of the follow-up patch.\n\nFixes: e2f34481b24d (\"cifsd: add server-side procedures for SMB3\")\nCc: stable@vger.kernel.org\nSigned-off-by: DaeMyung Kang \u003ccharsyam@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "ab4ad35e58a74c0fc51e5b0bcfb56523e97ff65f", "tree": "f1a7adcddfcbd1c04ff85bd770c08bb683154dd7", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Marios Makassikis", "email": "mmakassikis@freebox.fr", "time": "Wed Apr 22 12:49:00 2026 +0200" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Wed Apr 29 10:25:37 2026 -0500" }, "message": "smb: server: handle readdir_info_level_struct_sz() error\n\nearly exit in smb2_populate_readdir_entry() if the requested info_level\nis unknown.\n\nSigned-off-by: Marios Makassikis \u003cmmakassikis@freebox.fr\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "019155e2bd3e2cec425553195e9f9bc76bb0f848", "tree": "bbcb9cecdf98bb437e5ea60d7f5e4b376f01ed73", "parents": [ "9ea16f64189bf7b6ba50fc7f0325b3c1f836d105" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:45 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:46 2026 -0400" }, "message": "drm/amd/display: Use EDID from VBIOS embedded panel info\n\nWhen an embedded panel has no DDC, read the EDID from\nthe VBIOS embedded panel info and use that.\n\nFixes: 7c7f5b15be65 (\"drm/amd/display: Refactor edid read.\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 399b9abc353c62f6e37d38325edbdb6c2c00411c)\n" }, { "commit": "9ea16f64189bf7b6ba50fc7f0325b3c1f836d105", "tree": "9c2d9e93d396046fdc62b65074ae66631da2fcfb", "parents": [ "60af4605ef35ecb7ad649a8534b83a2f7c69576d" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:44 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:40 2026 -0400" }, "message": "drm/amd/display: Read EDID from VBIOS embedded panel info\n\nSome board manufacturers hardcode the EDID for the embedded\npanel in the VBIOS. This EDID should be used when the panel\ndoesn\u0027t have a DDC.\n\nFor reference, see the legacy non-DC display code:\namdgpu_atombios_encoder_get_lcd_info()\n\nThis is necessary to support embedded connectors without DDC.\n\nFixes: 4562236b3bc0 (\"drm/amd/dc: Add dc display driver (v2)\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit eb105e63b474c11ef6a84a1c6b18100d851ff364)\n" }, { "commit": "60af4605ef35ecb7ad649a8534b83a2f7c69576d", "tree": "fcd0b29875b1c5dece285520f7c3edff34220fb4", "parents": [ "880498a1943f865529819f778df3b9945ca57262" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:43 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:34 2026 -0400" }, "message": "drm/amd/display: Allow constructing DCE8 link encoder without DDC\n\nWhen the DDC channel ID is set to CHANNEL_ID_UNKNOWN,\npass NULL to the AUX regs array.\n\nThis is necessary to support embedded connectors without DDC.\n\nFixes: 4562236b3bc0 (\"drm/amd/dc: Add dc display driver (v2)\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 155baf3038c1af50b602723022ed869b38e86a99)\n" }, { "commit": "880498a1943f865529819f778df3b9945ca57262", "tree": "5a448611fcdf941a8d36a1705da7f312313c9771", "parents": [ "ac27e3f99035f132f23bc0409d0e57f11f054c70" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:42 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:28 2026 -0400" }, "message": "drm/amd/display: Allow constructing DCE6 link encoder without DDC\n\nWhen the DDC channel ID is set to CHANNEL_ID_UNKNOWN,\npass NULL to the AUX regs array.\n\nThis is necessary to support embedded connectors without DDC.\n\nFixes: 7c15fd86aaec (\"drm/amd/display: dc/dce: add initial DCE6 support (v10)\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 38a70e50b22a188ff601740d64dd75f46213121f)\n" }, { "commit": "ac27e3f99035f132f23bc0409d0e57f11f054c70", "tree": "25dc9d18342163d0e76efd5f0b565b7e1314d828", "parents": [ "494941aa772dab79251543764db6cd14bd337e43" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:41 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:22 2026 -0400" }, "message": "drm/amd/display: Allow DCE link encoder without AUX registers\n\nAllow constructing the DCE link encoder without DDC,\nwhich means the AUX registers array will be NULL.\n\nThis is necessary to support embedded connectors without DDC.\n\nFixes: 4562236b3bc0 (\"drm/amd/dc: Add dc display driver (v2)\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 87f30b101af62590faf6020d106da07efdda199b)\n" }, { "commit": "494941aa772dab79251543764db6cd14bd337e43", "tree": "3e1773c18c0d49a4159593b003f87d75532eaf3e", "parents": [ "a1fc7bf6677eb547167cb72b3bcafdc34b976692" ], "author": { "name": "Timur Kristóf", "email": "timur.kristof@gmail.com", "time": "Tue Apr 28 13:40:40 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:41:15 2026 -0400" }, "message": "drm/amd/display: Allow embedded connectors without DDC\n\nOn some laptops, the embedded panel may not have\na DDC (display data channel) available. On these,\nthe EDID may be hardcoded in ACPI or the VBIOS.\n\nIn this case, use GPIO_DDC_LINE_UNKNOWN and don\u0027t fail.\n\nFixes: def3488eb0fd (\"drm/amd/display: refactor HPD to increase flexibility\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/work_items/5192\nSigned-off-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 75b8a6ca0e8bc3ce24572f854e95f8721b321179)\n" }, { "commit": "a1fc7bf6677eb547167cb72b3bcafdc34b976692", "tree": "b6e9a74dfeb9389a7003d2c05d1240a6b9d8fdb2", "parents": [ "65bce27ea6192320448c30267ffc17ffa094e713" ], "author": { "name": "Leo Li", "email": "sunpeng.li@amd.com", "time": "Wed Apr 22 12:29:56 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Apr 29 10:40:44 2026 -0400" }, "message": "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs\n\n[Why]\n\nRapid vblank off is causing flip-done timeouts for NV3x and newer\nfamily of GPUs that support more idle optimization features.\n\nA proper fix requires further investigation. In lieu of it, let\u0027s\nworkaround it for now.\n\n[How]\n\nFor NV3x and newer family of DGPUs, restore the old 5s vblank off timer.\n\nFixes: 9b47278cec98 (\"drm/amd/display: temp w/a for dGPU to enter idle optimizations\")\nLink: https://gitlab.freedesktop.org/drm/amd/-/issues/3787\nLink: https://lore.kernel.org/amd-gfx/20260217191632.1243826-1-sysdadmin@m1k.cloud/\nTested-by: Michele Palazzi \u003csysdadmin@m1k.cloud\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Leo Li \u003csunpeng.li@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit df482c2d441b090161633566b7a0755f1bbd55c2)\n" } ], "next": "57b8e2d666a31fa201432d58f5fe3469a0dd83ba" }