)]}' { "log": [ { "commit": "4549871118cf616eecdd2d939f78e3b9e1dddc48", "tree": "0c1e6dfaa1d911e14d43aa95f7bbfb0d54127258", "parents": [ "c68691dc1dcacbdaaef04edcf7639ce68e3eb58c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 15:37:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 15:37:58 2026 -0700" }, "message": "Linux 7.1-rc7\n" }, { "commit": "c68691dc1dcacbdaaef04edcf7639ce68e3eb58c", "tree": "0afbc0fb8009d6d88b087078c8d09485ea24286e", "parents": [ "09feffa073d8a5362739ecf0509c29ca7f6d9991", "6f6947b2387e94e405f80d472f8a189bfbf2bd6c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 13:12:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 13:12:29 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Add more AMD Zen6 models (Pratik Vishwakarma)\n\n - Avoid confusing bootup message by the Intel resctl enumeration\n code when running on certain AMD systems (Tony Luck)\n\n* tag \u0027x86-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/resctrl: Only check Intel systems for SNC\n x86/CPU/AMD: Add more Zen6 models\n" }, { "commit": "09feffa073d8a5362739ecf0509c29ca7f6d9991", "tree": "03a94443954b56121a956aa18805d09b2be36e9d", "parents": [ "77e8e6861bc000b90ad37b4cceccbe0da5f4fc6a", "d486b4934a8e504376b85cdb3766f306d57aff5b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 13:02:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 13:02:02 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Ingo Molnar:\n\n - Fix the arch_inlined_clockevent_set_next_coupled() prototype in the\n !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case (Naveen Kumar Chaudhary)\n\n - Fix an off-by-1 bug in the sys_settimeofday() usecs validation code\n (Naveen Kumar Chaudhary)\n\n - Mark vdso_k_*_data pointers as __ro_after_init (Thomas Weißschuh)\n\n - Fix livelock race in tmigr_handle_remote_up() (Amit Matityahu)\n\n* tag \u0027timers-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timers/migration: Fix livelock in tmigr_handle_remote_up()\n vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init\n time: Fix off-by-one in settimeofday() usec validation\n clockevents: Fix duplicate type specifier in stub function parameter\n" }, { "commit": "77e8e6861bc000b90ad37b4cceccbe0da5f4fc6a", "tree": "27aa783f1859087e6d1c54250700a1d6a3e0f0ad", "parents": [ "96c1ddbc16f4dd15d6d359ce55ba29e8cd80dc46", "6d99479799c69c3cb588fcda19c81d8f61d64ecd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:54:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:54:37 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull rseq fix from Ingo Molnar:\n\n - Fix uninitialized stack variable in rseq_exit_user_update() (Qing\n Wang)\n\n* tag \u0027sched-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()\n" }, { "commit": "96c1ddbc16f4dd15d6d359ce55ba29e8cd80dc46", "tree": "deae7dc76a2594b5db83ef74070218cb78bff9a7", "parents": [ "e2264c52e18bd54a4f762c393e341cb27fd5e5cd", "40a25d59e85b3c8709ac2424d44f65610467871e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:43:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:43:21 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI\n code (Ji\u0027an Zhou)\n\n - Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr\n Bueso)\n\n* tag \u0027locking-urgent-2026-06-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/rtmutex: Skip remove_waiter() when waiter is not enqueued\n futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock\n" }, { "commit": "e2264c52e18bd54a4f762c393e341cb27fd5e5cd", "tree": "5790bbf44fb824f5db9e8330c4b2f151f6073a4a", "parents": [ "33d8d8ec31b591952ded59d596c2f3db45004937", "29d87434cb91b7689de2917830ca82acfd2770f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:39:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 12:39:36 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"Arnd\u0027s randconfig testing turned up a missing selection of\n CONFIG_IRQ_DOMAIN which was causing build breaks\"\n\n* tag \u0027regulator-fix-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: mt6363: select CONFIG_IRQ_DOMAIN\n" }, { "commit": "33d8d8ec31b591952ded59d596c2f3db45004937", "tree": "2d594769492d71a4e0f8c429e114e545204901bc", "parents": [ "979c294509f9248fe1e7c358d582fb37dd5ca12d", "fb402386af4cdce108ff991a796386de55439735" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 08:40:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jun 07 08:40:53 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - two quirks for atkbd to deal with laptops that can not handle\n \"deactivate\" command on the keyboard PS/2 port\n\n* tag \u0027input-for-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: atkbd - skip deactivate for HONOR BCC-N\u0027s internal keyboard\n Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)\n" }, { "commit": "979c294509f9248fe1e7c358d582fb37dd5ca12d", "tree": "65c1326bd86a5021eb936392cf606791547f4988", "parents": [ "6086121dc424b6906602617449f0445aeab00277" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Thu Jun 04 17:33:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 15:08:36 2026 -0700" }, "message": "cfi: Include uaccess.h for get_kernel_nofault()\n\nAfter commit 0652a3daa787 (\"tracing: Fix CFI violation in probestub\nbeing called by tprobes\"), there are many build errors when building\nARCH\u003darm multi_v7_defconfig + CONFIG_CFI\u003dy like:\n\n In file included from drivers/base/devres.c:17:\n In file included from drivers/base/trace.h:16:\n In file included from include/linux/tracepoint.h:23:\n include/linux/cfi.h:44:6: error: call to undeclared function \u0027get_kernel_nofault\u0027; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]\n 44 | if (get_kernel_nofault(hash, func - cfi_get_offset()))\n | ^\n 1 error generated.\n\nget_kernel_nofault() is called in the generic version of\ncfi_get_func_hash() but nothing ensures uaccess.h is always included for\na proper expansion and prototype. Include uaccess.h in cfi.h to clear\nup the errors.\n\nCc: stable@vger.kernel.org\nFixes: 0652a3daa787 (\"tracing: Fix CFI violation in probestub being called by tprobes\")\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Sami Tolvanen \u003csamitolvanen@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fb402386af4cdce108ff991a796386de55439735", "tree": "d20e2eaca5ed24d5427e3d9113f1d6e423bf0c02", "parents": [ "ad0979fe053e9f2db82da82188256ef6eb41095a" ], "author": { "name": "Cryolitia PukNgae", "email": "cryolitia.pukngae@linux.dev", "time": "Fri Jun 05 15:27:21 2026 +0800" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Sat Jun 06 12:57:41 2026 -0700" }, "message": "Input: atkbd - skip deactivate for HONOR BCC-N\u0027s internal keyboard\n\nAfter commit 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 (\"Input: atkbd -\ndo not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID\"), HONOR\nBCC-N, aka HONOR MagicBook 14 2026\u0027s internal keyboard stops\nworking. Adding the atkbd_deactivate_fixup quirk fixes it.\n\nDMI: HONOR BCC-N/BCC-N-PCB, BIOS 1.04 04/07/2026\n\nFixes: 9cf6e24c9fbf17e52de9fff07f12be7565ea6d61 (\"Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID\")\nReported-by: Hongfei Ren \u003clcrhf@outlook.com\u003e\nLink: https://github.com/colorcube/Linux-on-Honor-Magicbook-14-Pro/issues/1#issuecomment-4562679891\nTested-by: Hongfei Ren \u003clcrhf@outlook.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Cryolitia PukNgae \u003ccryolitia.pukngae@linux.dev\u003e\nLink: https://patch.msgid.link/20260605-honor-v1-1-78e05e491193@linux.dev\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "6086121dc424b6906602617449f0445aeab00277", "tree": "a716842246557dba6a0df12a1d7272de1a4d5772", "parents": [ "d054796f8bb7d0aa9068d83feda76fe3b215f991", "2b5ff4db5d7aa5b981d966df02e687f79ad7b311" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 09:49:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 09:49:16 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"It\u0027s getting calmer, but we still came up with a handful of small\n fixes, including two core fixes. All look sane and safe.\n\n Core:\n - Fix wait queue list corruption in snd_pcm_drain() on linked streams\n - Fix UMP event stack overread in seq dummy driver\n\n USB-audio:\n - Add quirk for AB13X USB Audio\n - Fix the regression with sticky mixer volumes in 7.1-rc\n\n ASoC:\n - Fix 32-slot TDM breakage on Freescale SAI\n - Varioud DMI quirks for AMD ACP\"\n\n* tag \u0027sound-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: seq: dummy: fix UMP event stack overread\n ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio\n ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n ASoC: amd: acp70: add standalone RT721 SoundWire machine\n ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table\n ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write\n ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF\n ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11\n ALSA: usb-audio: Set the value of potential sticky mixers to maximum\n" }, { "commit": "d054796f8bb7d0aa9068d83feda76fe3b215f991", "tree": "b6579e573b1093b75f93267d065fd6625d5b6a39", "parents": [ "76351effa53d49114907dc9fd228110c2115292b", "905b06d32a52afe32fcf5f30cf298c9ea6359f11" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 09:44:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 09:44:42 2026 -0700" }, "message": "Merge tag \u0027rust-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix \u0027rustc-option\u0027 (the Makefile one) when cross-compiling that\n leads to build or boot failures in certain configs\n\n - Work around a Rust compiler bug (already fixed for Rust 1.98.0)\n thats lead to boot failures in certain configs due to missing\n \u0027uwtable\u0027 LLVM module flags\n\n - Support a Rust compiler change (starting with Rust 1.98.0) in the\n unstable target specification JSON files\n\n - Forbid Rust + arm + KASAN configs, which do not build\n\n \u0027kernel\u0027 crate:\n\n - Fix NOMMU build by adding a missing helper\"\n\n* tag \u0027rust-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: x86: support Rust \u003e\u003d 1.98.0 target spec\n rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES\n rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds\n rust: kasan/kbuild: fix rustc-option when cross-compiling\n ARM: Do not select HAVE_RUST when KASAN is enabled\n" }, { "commit": "76351effa53d49114907dc9fd228110c2115292b", "tree": "30d10fb6be491d8fb951f0a3d4180daae56d1e3e", "parents": [ "8e65320d91cdc3b241d4b94855c88459b91abf66", "2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 07:28:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jun 06 07:28:59 2026 -0700" }, "message": "Merge tag \u0027vfs-7.1-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Fix error handling in ovl_cache_get()\n\n - Tighten access checks for exited tasks in pidfd_getfd()\n\n - Fix selftests leak in __wait_for_test()\n\n - Limit FUSE_NOTIFY_RETRIEVE to uptodate folios\n\n - Reject fuse_notify() pagecache ops on directories\n\n - Clear JOBCTL_PENDING_MASK for caller in zap_other_threads()\n\n - Fix failure to unlock in nfsd4_create_file()\n\n - Fix pointer arithmetic in qnx6 directory iteration\n\n - Fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh()\n\n - Avoid potential null folio-\u003emapping deref during iomap error\n reporting\n\n* tag \u0027vfs-7.1-rc7.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n iomap: avoid potential null folio-\u003emapping deref during error reporting\n fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh()\n fs/qnx6: fix pointer arithmetic in directory iteration\n VFS: fix possible failure to unlock in nfsd4_create_file()\n signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()\n fuse: reject fuse_notify() pagecache ops on directories\n fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios\n selftests: harness: fix pidfd leak in __wait_for_test\n pidfd: refuse access to tasks that have started exiting harder\n ovl: keep err zero after successful ovl_cache_get()\n" }, { "commit": "8e65320d91cdc3b241d4b94855c88459b91abf66", "tree": "580b90c2a982879e38eb6bacda6720229cce4382", "parents": [ "c10130c234c81f4a7a143edbf413080235f8d8ce", "1a4f03d22fb655e5f192244fb2c87d8066fcfca2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 18:02:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 18:02:23 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-06-06\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly drm fixes, not contributing to things settling down\n unfortunately. Lots of driver fixes for various bounds checks, leaks\n and UAF type things, i915/xe probably the most sane, amdgpu has a mix\n of fixes all over, then ethosu has lots of small fixes.\n\n The problem of fixing thing in private has really hit us with the\n change handle ioctl, and \"Sima was right\" and we should have disabled\n the ioctl, since it was only introduced a couple of kernels ago and\n failed to upstream it\u0027s tests in time.\n\n The patch here fixes the problems Sima identified, but disables the\n ioctl as well, with a list of known problems in it and a request for\n proper tests to be written and upstreamed. It\u0027s a niche user ioctl\n designed for CRIU with AMD ROCm, so I think it\u0027s fine to just disable\n it.\n\n Maybe this week will settle down.\n\n core:\n - disable the gem change handle ioctl for security reasons (plan to\n fix it on list later with proper test coverage)\n\n dumb-buffer:\n - remove strict limits on buffer geometry\n\n amdgpu:\n - BT.2020 fix for DCE\n - DC bounds checking fixes\n - SDMA 7.1 fix\n - UserQ fixes\n - SI fix\n - SMU 13 fixes\n - SMU 14 fixes\n - GC 12.1 fix\n - Userptr fix\n - GC 10.1 fix\n - GART fix for non-4K pages\n\n amdkfd:\n - UAF race fix\n - Fix a potential NULL pointer dereference\n - GC 11 buffer overflow fix for SDMA\n\n xe:\n - Revert removing support for unpublished NVL-S GuC\n - Suspend fixes related to multi-queue\n\n i915:\n - Fix color blob reference handling in intel_plane_state\n - Revert \"drm/i915/backlight: Remove try_vesa_interface\"\n\n ethosu:\n - reject unsupported NPU_OP_RESIZE\n - fix index of IFM region\n - fix weight index\n - fix overflows in DMA-size calculations\n - reject DMA commands with uninitialized length\n - fix OOB write in ethosu_gem_cmdstream_copy_and_validate\n\n imx:\n - fix kernel-doc warnings\n\n ivpu:\n - add overflow checks in firmware handling and get_info_ioctl\n\n v3d:\n - wait for pending L2T flush before cleaning caches\n - fix leak of vaddr\n - skip CSD when it has zeroed workgroups\n - fix ref counting in performance monitoring\"\n\n* tag \u0027drm-fixes-2026-06-06\u0027 of https://gitlab.freedesktop.org/drm/kernel: (50 commits)\n drm/gem: Try to fix change_handle ioctl, attempt 4\n Revert \"drm/i915/backlight: Remove try_vesa_interface\"\n accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()\n accel/ethosu: reject DMA commands with uninitialized length\n accel/ethosu: fix arithmetic issues in dma_length()\n accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85\n accel/ethosu: reject NPU_OP_RESIZE commands from userspace\n accel/ethosu: fix IFM region index out-of-bounds in command stream parser\n drm/v3d: Fix global performance monitor reference counting\n drm/xe/multi_queue: skip submit when primary queue is suspended\n drm/xe: Clear pending_disable before signaling suspend fence\n Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\n drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range\n drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems\n drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy\n drm/amdgpu: improve the userq seq BO free bit lookup\n drm/amdgpu/userq: remove the vital queue unmap logging\n drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n drm/amdkfd: fix NULL dereference in get_queue_ids()\n drm/amdgpu: set noretry\u003d1 as default for GFX 10.1.x (Navi10/12/14)\n ...\n" }, { "commit": "1a4f03d22fb655e5f192244fb2c87d8066fcfca2", "tree": "d13ace3e1b71a174b1cf3481761492a545baa6ea", "parents": [ "8ff3adc8c322a9b5a987bf29f52ba727f8b5c406" ], "author": { "name": "Simona Vetter", "email": "simona.vetter@ffwll.ch", "time": "Thu Jun 04 21:44:37 2026 +0200" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 06 08:54:55 2026 +1000" }, "message": "drm/gem: Try to fix change_handle ioctl, attempt 4\n\n[airlied: just added some comments on how to reenable]\nOn-list because the cat is out of the bag and we\u0027re clearly not good\nenough to figure this out in private. The story thus far:\n\n5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in\nchange_handle\") tried to fix a race condition between the gem_close and\ngem_change_handle ioctls, but got a few things wrong:\n\n- There\u0027s a confusion with the local variable handle, which is actually\n the new handle, and so the two-stage trick was actually applied to the\n wrong idr slot. 7164d78559b0 (\"drm/gem: fix race between\n change_handle and handle_delete\") tried to fix that by adding yet\n another code block, but forgot to add the error handling. Which meant\n we now have two paths, both kinda wrong.\n\n- dc366607c41c (\"drm: Replace old pointer to new idr\") tried to apply\n another fix, but inconsistently, again because of the handle confusion\n - this would be the right fix (kinda, somewhat, it\u0027s a mess) if we\u0027d\n do the two-stage approach for the new handle. Except that wasn\u0027t the\n intent of the original fix.\n\nWe also didn\u0027t have an igt merged for the original ioctl, which is a big\nno-go. This was attempted to address off-list in the original bugfix,\nand amd QA people claimed the bug was fixed now. Very clearly that\u0027s not\nthe case. Here\u0027s my attempt to sort this out:\n\n- Rename the local variable to new_handle, the old aliasing with\n args-\u003ehandle is just too dangerously confusing.\n\n- Merge the gem obj lookup with the two-stage idr_replace so that we\n avoid getting ourselves confused there.\n\n- This means we don\u0027t have a surplus temporary reference anymore, only\n an inherited from the idr. A concurrent gem_close on the new_handle\n could steal that. Fix that with the same two-stage approach\n create_tail uses. This is a bit overkill as documented in the comment,\n but I also don\u0027t trust my ability to understand this all correctly, so\n go with the established pattern we have from other ioctls instead for\n maximum paranoia.\n\n- Adjust error paths. I\u0027ve tried to make the error and success paths\n common, because they are identical except for which handle is removed\n and on which we call idr_replace to (re)install the object again. But\n that made things messier to read, so I\u0027ve left it at the more verbose\n version, which unfortunately hides the symmetry in the entire code\n flow a bit.\n\n- While at it, also replace the 7 space indent with 1 tab.\n\nAnd finally, because I flat out don\u0027t trust my abilities here at all\nanymore:\n\n- Disable the ioctl until we have the igt situation and everything else\n sorted out on-list and with full consensus.\n\nv2:\n\nSashiko noticed that I didn\u0027t handle the error path for idr_replace\ncorrectly, it must be checked with IS_ERR_OR_NULL like in\ngem_handle_delete. So yeah, definitely should just the existing paths\n1:1 because this is endless amounts of tricky.\n\nAlso add the Fixes: line for the original ioctl, I forgot that too.\n\nReported-by: DARKNAVY (@DarkNavyOrg) \u003cvr@darknavy.com\u003e\nSigned-off-by: Simona Vetter \u003csimona.vetter@ffwll.ch\u003e\nFixes: dc366607c41c (\"drm: Replace old pointer to new idr\")\nCc: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com\nCc: stable@vger.kernel.org\nCc: Edward Adam Davis \u003ceadavis@qq.com\u003e\nCc: Dave Airlie \u003cairlied@redhat.com\u003e\nCc: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nCc: Maxime Ripard \u003cmripard@kernel.org\u003e\nCc: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nCc: David Francis \u003cDavid.Francis@amd.com\u003e\nCc: Puttimet Thammasaeng \u003cpwn8official@gmail.com\u003e\nCc: Christian Koenig \u003cChristian.Koenig@amd.com\u003e\nFixes: 7164d78559b0 (\"drm/gem: fix race between change_handle and handle_delete\")\nCc: Zhenghang Xiao \u003ckipreyyy@gmail.com\u003e\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nReviewed-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/20260604194437.1725314-1-simona.vetter@ffwll.ch\n" }, { "commit": "8ff3adc8c322a9b5a987bf29f52ba727f8b5c406", "tree": "41bba5eb0e3b639993e52c43cb6f2213b1cba3e4", "parents": [ "f80cbe57ec4169c6e9eafa4f1d31feced32177d3", "2914709c914101eb704e01bed2351070d4161ccf" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 06 08:42:14 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 06 08:42:15 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-06-05\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix color blob reference handling in intel_plane_state (Chaitanya Kumar Borah)\n- Revert \"drm/i915/backlight: Remove try_vesa_interface\" [backlight] (Suraj Kandpal)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aiKgmwz7VGOaFXIv@linux\n" }, { "commit": "f80cbe57ec4169c6e9eafa4f1d31feced32177d3", "tree": "c9a7d62a8eaf744769d383c40a50162dc31e2d96", "parents": [ "9317df76ca54bf837eb97e0f372e8fc14e4d6fe6", "c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 06 08:37:21 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Jun 06 08:38:26 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-06-05\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\ndumb-buffer:\n- remove strict limits on buffer geometry\n\nethosu:\n- reject unsupported NPU_OP_RESIZE\n- fix index of IFM region\n- fix weight index\n- fix overflows in DMA-size calculations\n- reject DMA commands with uninitialized length\n- fix OOB write in ethosu_gem_cmdstream_copy_and_validate\n\nimx:\n- fix kernel-doc warnings\n\nivpu:\n- add overflow checks in firmware handling and get_info_ioctl\n\nv3d:\n- wait for pending L2T flush before cleaning caches\n- fix leak of vaddr\n- skip CSD when it has zeroed workgroups\n- fix ref counting in performance monitoring\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260605072602.GA268798@linux.fritz.box\n" }, { "commit": "c10130c234c81f4a7a143edbf413080235f8d8ce", "tree": "2df9e75d904b69f481646c6a99cadbbdbe72101f", "parents": [ "06121e12c27aef6e1a09b4cdec809b9c91f6eb59", "ed46f39c47eb5530a9c161481a2080d3a869cfaf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 13:52:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 13:52:15 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260605\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fix from Jens Axboe:\n \"A single fix for a missing flag mask when multishot is used with\n an incrementally consumed buffer ring, potentially leading to\n application confusion because of lack of IORING_CQE_F_BUF_MORE\n consistency\"\n\n* tag \u0027io_uring-7.1-20260605\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries\n" }, { "commit": "06121e12c27aef6e1a09b4cdec809b9c91f6eb59", "tree": "356d6ce91cec951e8adeff0c5f7940df0dbfc29c", "parents": [ "95b78879a80ab034cd56cc70f057c3cb4f2612a6", "65b09bfa8aa7ebe087093b591525385efb2d58b0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 11:16:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 11:16:15 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fix from Nicolas Schier:\n \"A single simple commit that fixes the currently broken kconfig\n selftests\"\n\n* tag \u0027kbuild-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n kconfig: Fix repeated include selftest expectation\n" }, { "commit": "95b78879a80ab034cd56cc70f057c3cb4f2612a6", "tree": "0bcf23729bccc2b27b6f88f863985294d93ef119", "parents": [ "d1b0937f0eadbc30b528d37589ec7fb6ce9f4114", "7ec0360122d8f5033177ed0210d5ad71ec5b50c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 10:38:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 10:38:45 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"arm64:\n - Correctly drop the ITS translation cache reference when it actually\n gets invalidated\n\n - Take the SRCU lock for SW page table walks\n\n - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming\n inaccessible from EL0 after running a guest\n\n - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init\n and MMU notifiers are mutually exclusive\n\n - Correctly handle FEAT_XNX at stage-2\n\n s390:\n - More fixes for the new page table management and nested\n virtualization\n\n x86:\n - More fixes for GHCB issues:\n - Read start/end indices of page size change requests exactly once\n per vmexit\n - Unmap and unpin the GHCB as needed on vCPU free\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (23 commits)\n KVM: arm64: Correctly identify executable PTEs at stage-2\n KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX\n KVM: arm64: Reassign nested_mmus array behind mmu_lock\n KVM: arm64: Restore POR_EL0 access to host EL0\n KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation\n KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry\n KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free\n KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA\n KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()\n KVM: Don\u0027t WARN if memory is dirtied without a vCPU when the VM is dying\n KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT\n KVM: SEV: Add an anonymous \"psc\" struct to track current PSC metadata\n KVM: SEV: Make it more obvious when KVM is writing back the current PSC index\n KVM: s390: Remove ptep_zap_softleaf_entry()\n KVM: s390: Fix possible reference leak in fault-in code\n KVM: s390: Prevent memslots outside the ASCE range\n KVM: s390: Lock pte when making page secure\n KVM: s390: Fix fault-in code\n KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()\n KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl()\n ...\n" }, { "commit": "d1b0937f0eadbc30b528d37589ec7fb6ce9f4114", "tree": "7b5039464479e93aedc3d571de9f20e3d2827f27", "parents": [ "a8dc5f60d127f1d147a8e778563fcef7715d1316", "85e0f27dd1396307913ffc5745b0c05137e9beac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 10:33:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 10:33:32 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing/probes fix from Masami Hiramatsu:\n \"Fix the eprobe event parser to point error position correctly\"\n\n* tag \u0027probes-fixes-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probes: Point the error offset correctly for eprobe argument error\n" }, { "commit": "65b09bfa8aa7ebe087093b591525385efb2d58b0", "tree": "43cc87c8fe9577de499c75b9b6b66353e027001f", "parents": [ "e43ffb69e0438cddd72aaa30898b4dc446f664f8" ], "author": { "name": "Zhou Yuhang", "email": "zhouyuhang@kylinos.cn", "time": "Wed May 20 15:08:00 2026 +0800" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Fri Jun 05 19:24:49 2026 +0200" }, "message": "kconfig: Fix repeated include selftest expectation\n\nThe err_repeated_inc test was added with an expected stderr fixture\nthat does not match the diagnostic printed by kconfig.\n\nRunning \"make testconfig\" currently fails in that test even though the\nparser reports the duplicated include correctly:\n\n [stderr]\n Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3\n Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3\n\nThe fixture expects \"Repeated\" and \"Location\" with capital letters, but\nthe diagnostic emitted by scripts/kconfig/util.c uses lowercase words.\nUpdate the fixture to match the real message.\n\nFixes: 102d712ded3e (\"kconfig: Error out on duplicated kconfig inclusion\")\nSigned-off-by: Zhou Yuhang \u003czhouyuhang@kylinos.cn\u003e\nTested-by: Nicolas Schier \u003cnsc@kernel.org\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260520070800.2265479-1-zhouyuhang1010@163.com\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "7ec0360122d8f5033177ed0210d5ad71ec5b50c7", "tree": "59dbc9485582ccbaa987471af20e8dd85a8dd420", "parents": [ "bd2e19cf8f3028620428c698f6783de5306a6342", "17f073f78fc43280891ecde8f8ec3f84f98bb37c" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Jun 05 18:54:37 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Fri Jun 05 18:54:37 2026 +0200" }, "message": "Merge tag \u0027kvmarm-fixes-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.1, take #5\n\n- Correctly drop the ITS translation cache reference when it actually\n gets invalidated\n\n- Take the SRCU lock for SW page table walks\n\n- Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming\n inaccessible from EL0 after running a guest\n\n- Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init\n and MMU notifiers are mutually exclusive\n\n- Correctly handle FEAT_XNX at stage-2\n" }, { "commit": "a8dc5f60d127f1d147a8e778563fcef7715d1316", "tree": "d43698828bec4e5ff561297d9423c1203cef5c34", "parents": [ "6a5358410af387fd48251a5e5cc4cf73dc16de52", "317d5146fb399ad1e87b310ee7d018fe648d40ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 09:34:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 09:34:14 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.1-2\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs\n\nPull NFS client fix from Trond Myklebust:\n\n - Fix a use after free in nfs_write_completion\n\n* tag \u0027nfs-for-7.1-2\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs:\n NFS: write_completion: dereference loop-local req, not hdr-\u003ereq\n" }, { "commit": "6a5358410af387fd48251a5e5cc4cf73dc16de52", "tree": "9a640eeebffb87ce0fe8947e80b808a339c5ab68", "parents": [ "2b389a573b76f4e3e1e17654eeaced3eb48c2972", "dabfaca8140f64535a79020f0f86ea56f5db5bb2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:34:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:34:32 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"A collection of fixes mostly for the RT device, including a small\n refactor that has no functional change\"\n\n* tag \u0027xfs-fixes-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: Remove mention of PageWriteback\n xfs: abort mount if xfs_fs_reserve_ag_blocks fails\n xfs: factor rtgroup geom write pointer reporting into a helper\n xfs: drop the RTG reference later in xfs_ioc_rtgroup_geometry\n xfs: fix rtgroup cleanup in CoW fork repair\n xfs: fix error returns in CoW fork repair\n xfs: fix overlapping extents returned for pNFS LAYOUTGET\n xfs: fix use of uninitialized imap in xfs_fs_map_blocks error path\n xfs: handle racing deletions in xfs_zone_gc_iter_irec\n" }, { "commit": "2b389a573b76f4e3e1e17654eeaced3eb48c2972", "tree": "9c40d69dd9f28a8c2866fd3699785d17d29c2ced", "parents": [ "e4a9638a0b2295fc6b69500b25d01510aa8d66ac", "27f2d085bd72abe4235689d34d8654cfc876d568" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:28:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:28:10 2026 -0700" }, "message": "Merge tag \u0027erofs-for-7.1-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fixes from Gao Xiang:\n\n - Fix a UAF of sbi-\u003esync_decompress when compressed I/Os\n race with unmount\n\n - Fix a regression introduced this development cycle that\n incorrectly rejects multiple-algorithm images\n\n* tag \u0027erofs-for-7.1-rc7-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()\n erofs: fix use-after-free on sbi-\u003esync_decompress\n" }, { "commit": "e4a9638a0b2295fc6b69500b25d01510aa8d66ac", "tree": "9dfc19e3ff92b47dc0570a4174392d1e2d35d912", "parents": [ "ddd664bbff63e09e7a7f9acae9c43605d4cf185f", "f580d27e8928828693df44ba2db0fffdbe11dfea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:23:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jun 05 08:23:02 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc7-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix use after free in SMB2_CANCEL\n\n - Fix race in ksmbd_reopen_durable_fd\n\n - Fix oplock and lease break potential NULL-dref\n\n* tag \u0027v7.1-rc7-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd\n ksmbd: fix NULL-deref of opinfo-\u003econn in oplock/lease break notifiers\n" }, { "commit": "17f073f78fc43280891ecde8f8ec3f84f98bb37c", "tree": "1cee89ee69d1c7e0303435970264254657165213", "parents": [ "49b32ddb87a3a109afecea89e55d70f73956b8bc" ], "author": { "name": "Oliver Upton", "email": "oupton@kernel.org", "time": "Tue Jun 02 09:59:01 2026 -0700" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 14:07:57 2026 +0100" }, "message": "KVM: arm64: Correctly identify executable PTEs at stage-2\n\nKVM invalidates the I-cache before installing an executable PTE on\nimplementations without DIC. Unfortunately, support for FEAT_XNX\nbroke this check as KVM_PTE_LEAF_ATTR_HI_S2_XN was expanded to a\nbitfield.\n\nFix it by reusing kvm_pgtable_stage2_pte_prot() and testing the abstract\npermission bits instead.\n\nFixes: 2608563b466b (\"KVM: arm64: Add support for FEAT_XNX stage-2 permissions\")\nReported-by: Sashiko (gemini/gemini-3.1-pro-preview)\nSigned-off-by: Oliver Upton \u003coupton@kernel.org\u003e\nReviewed-by: Wei-Lin Chang \u003cweilin.chang@arm.com\u003e\nLink: https://patch.msgid.link/20260602165901.52800-3-oupton@kernel.org\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "49b32ddb87a3a109afecea89e55d70f73956b8bc", "tree": "359b6370b8c14316aa37b2ca840ac97c2ec28a00", "parents": [ "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8" ], "author": { "name": "Oliver Upton", "email": "oupton@kernel.org", "time": "Tue Jun 02 09:59:00 2026 -0700" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 14:07:06 2026 +0100" }, "message": "KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX\n\nXN has already been extracted from its bitfield position so using\nFIELD_PREP() on the mask that clears XN[0] is completely broken, having\nthe effect of unconditionally granting execute permissions...\n\nFix the obvious mistake by manipulating the right bit.\n\nCc: stable@vger.kernel.org\nFixes: d93febe2ed2e (\"KVM: arm64: nv: Forward FEAT_XNX permissions to the shadow stage-2\")\nReviewed-by: Wei-Lin Chang \u003cweilin.chang@arm.com\u003e\nSigned-off-by: Oliver Upton \u003coupton@kernel.org\u003e\nLink: https://patch.msgid.link/20260602165901.52800-2-oupton@kernel.org\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\n" }, { "commit": "ed46f39c47eb5530a9c161481a2080d3a869cfaf", "tree": "e6480f9669522aaf67e76484505012b8670b0129", "parents": [ "a88c02915d9c6160cfc7ab1b26ed64b2993e2b94" ], "author": { "name": "Clément Léger", "email": "cleger@meta.com", "time": "Thu Jun 04 09:07:13 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jun 05 05:20:25 2026 -0600" }, "message": "io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries\n\nWhen a bundle recv retries inside io_recv_finish(), the merge logic OR\nthe saved cflags from the previous iteration with the cflags returned by\nthe new iteration:\n cflags \u003d req-\u003ecqe.flags | (cflags \u0026 CQE_F_MASK);\n\nBits listed in CQE_F_MASK are inherited from the new iteration, and all\nother bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the\nsaved cflags. Before this change CQE_F_MASK covered only\nIORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE.\n\nWhen using provided buffer rings (IOU_PBUF_RING_INC) with incremental\nmode, and bundle recv, io_kbuf_inc_commit() can leave the head ring\nentry partially consumed, __io_put_kbufs() then sets\nIORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the\nbuffer ID will be reused for subsequent completions.\n\nBecause IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above\nsilently dropped it whenever the final retry iteration partially\nconsumed the buffer, and the subsequent req-\u003ecqe.flags \u003d cflags \u0026\n~CQE_F_MASK save would have left a stale IORING_CQE_F_BUF_MORE in the\ncarried-over cflags had one been present. Userspace would then\nwrongfully advance it ring head past an entry the kernel still uses.\n\nAdd IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from the\nnew iteration into the user-visible CQE and stripped from the saved\ncflags between iterations.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Clément Léger \u003ccleger@meta.com\u003e\nAssisted-by: Claude:claude-opus-4.6\nFixes: ae98dbf43d75 (\"io_uring/kbuf: add support for incremental buffer consumption\")\nLink: https://patch.msgid.link/20260604160715.2482972-1-cleger@meta.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8", "tree": "00e28d99df41621ec3c5933b89c46b1eb68be059", "parents": [ "cbaffe843a942c0d3102e0f9bce0e72b029b2594" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Fri Jun 05 17:27:01 2026 +0900" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 11:48:41 2026 +0100" }, "message": "KVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm-\u003earch.nested_mmus[] is walked under kvm-\u003emmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -\u003e kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm-\u003earch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well.\n\nFixes: 4f128f8e1aaac (\"KVM: arm64: nv: Support multiple nested Stage-2 mmu structures\")\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nReviewed-by: Oliver Upton \u003coupton@kernel.org\u003e\nLink: https://patch.msgid.link/aiKIVVeIr1aAB1yp@v4bel\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger,kernel.org\n" }, { "commit": "cbaffe843a942c0d3102e0f9bce0e72b029b2594", "tree": "684d1bc5ba99ceef37617856bad6ea0ec773f4c5", "parents": [ "f2ca45b50d4216c9cc7ffabf50d9ad1932209251" ], "author": { "name": "Joey Gouly", "email": "joey.gouly@arm.com", "time": "Thu Jun 04 11:54:34 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 11:48:24 2026 +0100" }, "message": "KVM: arm64: Restore POR_EL0 access to host EL0\n\nCPTR_EL2.E0POE was being cleared in __deactivate_cptr_traps_vhe(), which meant\nthat any accesses to POR_EL0 from host EL0 would trap and be reported to\nuserspace as an Illegal instruction. This would happen after running any VM,\nregardless if it used POE or not.\n\nSigned-off-by: Joey Gouly \u003cjoey.gouly@arm.com\u003e\nLink: https://sashiko.dev/#/patchset/20260602155430.2088142-1-maz@kernel.org?part\u003d1\nLink: https://patch.msgid.link/20260604105434.2297268-1-joey.gouly@arm.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger,kernel.org\n" }, { "commit": "2914709c914101eb704e01bed2351070d4161ccf", "tree": "c0f013af5a030b6098979986dfc950f1988a5ff6", "parents": [ "26eb7c0a7ab09d83eec833db6a5a2bc60b9d4d9a" ], "author": { "name": "Suraj Kandpal", "email": "suraj.kandpal@intel.com", "time": "Sun May 17 08:17:09 2026 +0530" }, "committer": { "name": "Tvrtko Ursulin", "email": "tursulin@ursulin.net", "time": "Fri Jun 05 11:07:24 2026 +0100" }, "message": "Revert \"drm/i915/backlight: Remove try_vesa_interface\"\n\nThis reverts commit 40d2f5820951dee818d05c14677277048bd85f9f.\n\nRemoving the try_vesa_interface gate caused a backlight regression on\npanels whose VBT correctly reports INTEL_BACKLIGHT_DISPLAY_DDI and whose\nPWM path is the actual backlight control, but whose DPCD optimistically\nadvertises DP_EDP_BACKLIGHT_AUX_ENABLE_CAP / _BRIGHTNESS_AUX_SET_CAP.\nAfter the commit such panels silently bind to the VESA AUX backlight\nfuncs; AUX writes complete but the panel ignores them, leaving\nbrightness stuck (no-op backlight). Observed on at least KBL and TGL\neDP setups.\n\nSigned-off-by: Suraj Kandpal \u003csuraj.kandpal@intel.com\u003e\nReviewed-by: Ankit Nautiyal \u003cankit.k.nautiyal@intel.com\u003e\nLink: https://patch.msgid.link/20260517024709.1016121-1-suraj.kandpal@intel.com\n(cherry picked from commit f30fddb4402313aa5301a74d721638d343395269)\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\n" }, { "commit": "f2ca45b50d4216c9cc7ffabf50d9ad1932209251", "tree": "2b700cfa0ec2263c27660e4b71b8e30fedead223", "parents": [ "13031fb6b8357fbbcded2a7f4cba73e4781ee594" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Wed Jun 03 21:09:33 2026 +0900" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 10:39:25 2026 +0100" }, "message": "KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation\n\nwalk_s1() and kvm_walk_nested_s2() expect to be called while holding\nkvm-\u003esrcu to guard against memslot changes. While this is generally\nthe case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the\nrespective walkers without taking kvm-\u003esrcu.\n\nFix by acquiring kvm-\u003esrcu prior to the table walk in both instances.\n\nCc: stable@vger.kernel.org\nFixes: 50f77dc87f13 (\"KVM: arm64: Populate level on S1PTW SEA injection\")\nFixes: be04cebf3e78 (\"KVM: arm64: nv: Add emulation of AT S12E{0,1}{R,W}\")\nSuggested-by: Oliver Upton \u003coupton@kernel.org\u003e\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nReviewed-by: Oliver Upton \u003coupton@kernel.org\u003e\nLink: https://patch.msgid.link/aiAZfdeyanIvP8SD@v4bel\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\n" }, { "commit": "13031fb6b8357fbbcded2a7f4cba73e4781ee594", "tree": "185ba2875cba79432808074d2bddcd9e37384281", "parents": [ "83726330748981372bde86ed5411d7b306612991" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Mon Jun 01 23:53:26 2026 +0900" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Jun 05 10:38:52 2026 +0100" }, "message": "KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry\n\nvgic_its_invalidate_cache() walks the per-ITS translation cache with\nxa_for_each() and drops the cache\u0027s reference on each entry with\nvgic_put_irq(). It puts the iterated pointer, though, rather than the\nvalue returned by xa_erase().\n\nThe function is called from contexts that do not exclude one another: the\nITS command handlers hold its_lock, the GITS_CTLR write path holds\ncmd_lock, and the path that clears EnableLPIs in a redistributor\u0027s\nGICR_CTLR holds neither. Two or more of them can drain the same cache\nconcurrently, and if each one observes the same entry, erases it and then\nputs it, the single reference the cache holds on that entry is dropped\nmore than once. The entry can then be freed while an ITE still maps it.\n\nxa_erase() is atomic and returns the previous entry, so put only the entry\nthat this context actually removed. The cache reference is then dropped\nexactly once per entry even when the invalidations run concurrently, and\nthe behavior is unchanged when only one context runs.\n\nFixes: 8201d1028caa (\"KVM: arm64: vgic-its: Maintain a translation cache per ITS\")\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nReviewed-by: Oliver Upton \u003coupton@kernel.org\u003e\nLink: https://patch.msgid.link/ah2c5lu4JbUg7dj-@v4bel\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "6f6947b2387e94e405f80d472f8a189bfbf2bd6c", "tree": "b2ef01be7676ac0654ee70a9ea180fa08ba6bc06", "parents": [ "b5f53e6d3d32f2884d71500bb6d773c7bfe21f2e" ], "author": { "name": "Tony Luck", "email": "tony.luck@intel.com", "time": "Thu Jun 04 21:46:49 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Jun 05 11:09:34 2026 +0200" }, "message": "x86/resctrl: Only check Intel systems for SNC\n\ntopology_num_nodes_per_package() reports values greater than one on certain\nAMD systems resulting in resctrl\u0027s Intel model specific SNC detection\nprinting the confusing message:\n\n \"CoD enabled system? Resctrl not supported\"\n\nAdd a check for Intel systems before looking at the topology.\n\n[ reinette: Add Closes tag, fix tag typos, rework changelog ]\n\nFixes: 59674fc9d0bf (\"x86/resctrl: Fix SNC detection\")\nReported-by: Babu Moger \u003cbabu.moger@amd.com\u003e\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nSigned-off-by: Reinette Chatre \u003creinette.chatre@intel.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nTested-by: Babu Moger \u003cbabu.moger@amd.com\u003e\nLink: https://patch.msgid.link/9849330f45ac86344cc5ac54df2d313906d70bc4.1780634584.git.reinette.chatre@intel.com\nCloses: https://lore.kernel.org/lkml/37ac0376-43a3-4283-a3d5-4d57b3bec578@amd.com/\n" }, { "commit": "2b5ff4db5d7aa5b981d966df02e687f79ad7b311", "tree": "faf75d419abbf4db327a9d546cf255e639a7646c", "parents": [ "d76b56b06b2734c6e0ff519599126919fa4f154b" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Fri Jun 05 01:02:04 2026 -0700" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri Jun 05 10:08:57 2026 +0200" }, "message": "ALSA: seq: dummy: fix UMP event stack overread\n\nThe dummy sequencer port forwards events by copying an incoming\nstruct snd_seq_event into a stack temporary, rewriting source and\ndestination, and dispatching the temporary to subscribers. That legacy\nevent storage is smaller than struct snd_seq_ump_event.\n\nWhen a UMP event reaches the dummy client, the copy leaves the UMP flag\nset but only provides legacy-sized stack storage. The subscriber\ndelivery path then uses snd_seq_event_packet_size() and copies a\nUMP-sized packet from that stack object, reading past the end of the\ntemporary.\n\nUse the existing union __snd_seq_event storage and copy the packet size\nreported for the incoming event before rewriting the common routing\nfields. This preserves the full UMP packet for UMP events while keeping\nlegacy event handling unchanged.\n\nFixes: 32cb23a0f911 (\"ALSA: seq: dummy: Allow UMP conversion\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nLink: https://patch.msgid.link/20260605080204.32045-1-kylebot@openai.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d", "tree": "228a83d47b6e6d188617b8514831eb3ffefdf871", "parents": [ "d9d021218162b6c4fe0bdf42b2b340f1aae23a12" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sat May 23 19:08:43 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 22:07:59 2026 -0500" }, "message": "accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()\n\nThe command stream parsing loop increments the index variable a second\ntime when a 64-bit command word is encountered (bit 14 set), but does\nnot re-check the loop bound before writing the second word:\n\n for (i \u003d 0; i \u003c size / 4; i++) {\n bocmds[i] \u003d cmds[0];\n if (cmd \u0026 0x4000) {\n i++;\n bocmds[i] \u003d cmds[1]; /* unchecked */\n }\n }\n\nThe buffer bocmds is backed by a DMA allocation of exactly size bytes\nfrom drm_gem_dma_create(ddev, size), giving valid indices [0, size/4-1].\n\nWhen i \u003d\u003d size/4 - 1 on entry to an iteration and bit 14 of cmds[0] is\nset, bocmds[size/4-1] is written in bounds, i is then incremented to\nsize/4, and bocmds[size/4] writes four bytes past the end of the\nallocation.\n\nUserspace controls both the buffer contents and the size argument via\nthe ioctl, making this a userspace-triggerable heap out-of-bounds write.\n\nFix by checking the incremented index against the buffer bound before\nthe second write and returning -EINVAL if the buffer is too small to\ncontain the extended command.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260523190843.33977-1-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "d9d021218162b6c4fe0bdf42b2b340f1aae23a12", "tree": "ab060e51fd6b1d54e094d809ebe9caaafc3d183b", "parents": [ "ee6d9b6e51626f259c6f0e38d94f91be4fd14754" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sun May 24 13:03:19 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 17:43:43 2026 -0500" }, "message": "accel/ethosu: reject DMA commands with uninitialized length\n\ncmd_state_init() initializes the command state with memset(0xff),\nleaving dma-\u003elen at U64_MAX to signal missing setup. The only setter\nis NPU_SET_DMA0_LEN; if userspace omits this command and issues\nNPU_OP_DMA_START, dma-\u003elen remains U64_MAX.\n\nIn dma_length(), a positive stride added to U64_MAX wraps to a small\nvalue. With size0 \u003d\u003d 1, check_mul_overflow() does not trigger and\ndma_length() returns 0 instead of U64_MAX. The caller\u0027s U64_MAX check\nthen passes, region_size[] stays 0, and the bounds check in\nethosu_job.c is bypassed, allowing hardware to execute DMA with stale\nphysical addresses.\n\nFix by checking for U64_MAX at the start of dma_length() before any\narithmetic, consistent with the sentinel value used throughout the\ndriver to detect uninitialized fields.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260524130319.12747-1-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "ee6d9b6e51626f259c6f0e38d94f91be4fd14754", "tree": "93e92e6c9bd7efd70b906ec5783d1a7b27fd2f95", "parents": [ "e703843f242b28e35ac79408de571ae110c740b5" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sun May 24 10:37:10 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 17:43:27 2026 -0500" }, "message": "accel/ethosu: fix arithmetic issues in dma_length()\n\ndma_length() derives DMA region usage from command stream values and\nupdates region_size[]:\n\n len \u003d ((len + stride[0]) * size0 + stride[1]) * size1\n region_size[region] \u003d max(..., len + dma-\u003eoffset)\n\nSeveral arithmetic issues can corrupt the derived region size:\n\n- signed stride values may underflow when added to len\n- intermediate multiplications may overflow\n- len + dma-\u003eoffset may overflow during region_size updates\n- dma_length() error returns were not validated by the caller\n\nregion_size[] is later used by ethosu_job.c to validate command stream\naccesses against GEM buffer sizes. Arithmetic wraparound can therefore\nunder-report region usage and bypass the bounds validation.\n\nFix by validating signed additions, using overflow helpers for\nmultiplications and offset updates, and propagating dma_length()\nfailures to the caller.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260524103710.47397-1-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "e703843f242b28e35ac79408de571ae110c740b5", "tree": "16983ee5971b0c0d110abb3555df806b33dd5e7e", "parents": [ "ef911805d86a05363d3ec2fa9835a41def83bb7e" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sat May 23 21:07:53 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 17:41:46 2026 -0500" }, "message": "accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85\n\nOn non-U65 hardware (e.g. U85), opcode 0x4093 is NPU_SET_WEIGHT2_LENGTH.\nThe BASE handler for the same opcode correctly assigns to\nst.weight[2].base, but the LENGTH handler mistakenly assigns cmds[1]\nto st.weight[1].length instead of st.weight[2].length.\n\nThis leaves weight[2].length at its initialised sentinel value of\n0xffffffff and corrupts weight[1].length with the user-supplied value,\nbreaking the software bounds-check state for both weight buffers on U85.\n\nFix the index to match the BASE handler.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260523210840.92039-3-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "ef911805d86a05363d3ec2fa9835a41def83bb7e", "tree": "1b1e129e93e3d6f33b6548e39d7de6fb9b3d79e4", "parents": [ "00f547e0dfecf83014fb32bcba587c6b684c1362" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sat May 23 21:07:52 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 17:41:46 2026 -0500" }, "message": "accel/ethosu: reject NPU_OP_RESIZE commands from userspace\n\nNPU_OP_RESIZE is a U85-only command that the driver does not yet\nimplement. The existing WARN_ON(1) placeholder fires unconditionally\nwhenever userspace submits this command via DRM_IOCTL_ETHOSU_GEM_CREATE,\ncausing unbounded kernel log spam.\n\nIf panic_on_warn is set the kernel panics, giving any unprivileged user\nwith access to the DRM device a trivial denial-of-service primitive.\n\nReplace the WARN_ON(1) with an explicit -EINVAL return so the ioctl\nrejects the command before it reaches hardware.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260523210840.92039-2-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "00f547e0dfecf83014fb32bcba587c6b684c1362", "tree": "22fa4381c1bfaf23cf07237756ccedd3a388c56c", "parents": [ "6bf7e2affc6e62da7add393d7f352d4040f5bc27" ], "author": { "name": "Muhammad Bilal", "email": "meatuni001@gmail.com", "time": "Sat May 23 19:51:59 2026 +0000" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Jun 04 17:31:41 2026 -0500" }, "message": "accel/ethosu: fix IFM region index out-of-bounds in command stream parser\n\nNPU_SET_IFM_REGION extracts the region index with param \u0026 0x7f, giving\na maximum value of 127. However region_size[] and output_region[] in\nstruct ethosu_validated_cmdstream_info are both sized to\nNPU_BASEP_REGION_MAX (8), giving valid indices [0..7].\n\nEvery other region assignment in the same switch uses param \u0026 0x7:\n NPU_SET_OFM_REGION: st.ofm.region \u003d param \u0026 0x7;\n NPU_SET_IFM2_REGION: st.ifm2.region \u003d param \u0026 0x7;\n NPU_SET_WEIGHT_REGION: st.weight[0].region \u003d param \u0026 0x7;\n NPU_SET_SCALE_REGION: st.scale[0].region \u003d param \u0026 0x7;\n\nThe 0x7f mask on IFM is inconsistent and appears to be a typo.\n\nfeat_matrix_length() and calc_sizes() use the region index directly\nas an array subscript into the kzalloc\u0027d info struct:\n info-\u003eregion_size[fm-\u003eregion] \u003d max(...);\n\nA userspace caller supplying NPU_SET_IFM_REGION with param \u003e 7 causes\na write up to 127*8 \u003d 1016 bytes past the start of region_size[],\ncorrupting adjacent kernel heap data.\n\nFix by applying the same \u0026 0x7 mask used by all other region\nassignments.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Muhammad Bilal \u003cmeatuni001@gmail.com\u003e\nLink: https://patch.msgid.link/20260523195159.55801-1-meatuni001@gmail.com\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "ddd664bbff63e09e7a7f9acae9c43605d4cf185f", "tree": "e679c38664049eb79787147fdfadaf20f9cf171c", "parents": [ "44ed32d16c9d0e0f3a4b594982a2bb168d2f56ea", "b6197b386677ae5268d4702e23849d9ad53051ad" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 14:35:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 14:35:55 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Netfilter, wireless and Bluetooth.\n\n Current release - fix to a fix:\n\n - Bluetooth: MGMT: fix backward compatibility with bluetoothd\n which adds stray bytes to MGMT_OP_ADD_EXT_ADV_DATA\n\n Previous releases - regressions:\n\n - af_unix: fix inq_len update inaccuracy on partial read\n\n - eth: fec: fix pinctrl default state restore order on resume\n\n - wifi: iwlwifi:\n - mvm: don\u0027t support the reset handshake for old firmwares\n - pcie: simplify the resume flow if fast resume is not used,\n work around NIC access failures\n\n Previous releases - always broken:\n\n - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n\n - sctp: fix a couple of bugs in COOKIE_ECHO processing\n\n - sched: fix pedit partial COW leading to page cache corruption\n\n - wifi: nl80211: reject oversized EMA RNR lists\n\n - netfilter:\n - conntrack_irc: fix possible out-of-bounds read\n - bridge: make ebt_snat ARP rewrite writable\n\n - appletalk: zero-initialize aarp_entry to prevent heap info leak\n\n - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\n - mptcp: fix number of bugs reported by AI scans and discovered\n during NVMe over MPTCP testing\"\n\n* tag \u0027net-7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (85 commits)\n Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"\n udp: clear skb-\u003edev before running a sockmap verdict\n sctp: purge outqueue on stale COOKIE-ECHO handling\n bonding: annotate data-races arcound churn variables\n net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr\n rtase: Avoid sleeping in get_stats64()\n ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n ipv6: mcast: Fix use-after-free when processing MLD queries\n selftests: net: add vxlan vnifilter notification test\n vxlan: vnifilter: fix spurious notification on VNI update\n vxlan: vnifilter: send notification on VNI add\n rtase: Reset TX subqueue when clearing TX ring\n octeontx2-af: npc: Fix CPT channel mask in npc_install_flow\n dt-bindings: ethernet: eswin: fix hsp-sp-csr backward compatibility\n sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n net/sched: fix pedit partial COW leading to page cache corruption\n vsock/vmci: fix sk_ack_backlog leak on failed handshake\n net: bonding: fix NULL pointer dereference in bond_do_ioctl()\n geneve: fix length used in GRO hint UDP checksum adjustment\n net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown\n ...\n" }, { "commit": "9317df76ca54bf837eb97e0f372e8fc14e4d6fe6", "tree": "3023ac9c14c3fc8f3d4c7b7c968f3e4a89732e3a", "parents": [ "36cda56d7e44e9c3b438f2305012ba5bf3dd95c1", "ec4cbdd163f9bb2a2bd44eb93ecf4a2fa0e912a9" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 05 07:18:09 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jun 05 07:18:36 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-06-04\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Revert removing support for unpublished NVL-S GuC (Daniele)\n- Suspend fixes related to multi-queue (Niranjana)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aiHPGiPrAyHgwBZl@intel.com\n" }, { "commit": "44ed32d16c9d0e0f3a4b594982a2bb168d2f56ea", "tree": "78b862ffdaa6e0f882064ee05575754385707322", "parents": [ "6a08076f009e3d9460bebae9f209c1dc1d8a46b7", "0652a3daa78723f955b1ebeb621665ce72bec53e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 13:38:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 13:38:42 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fix from Steven Rostedt:\n\n - Fix CFI violation in probestub function\n\n The probestub is a function to allow tprobes to hook to a tracepoint\n to gain access to its parameters.\n\n The function itself is only referenced by the tracepoint structure\n which lives in the __tracepoint section. objtool explicitly ignores\n that section and when processing functions in the kernel, if it\n detects one that has no references it will seal it to have its ENDBR\n stripped on boot up.\n\n This means the probstub function will have its ENDBR stripped and if\n a tprobe is attached to it with IBT enabled, it will go *boom*.\n\n* tag \u0027trace-v7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix CFI violation in probestub being called by tprobes\n" }, { "commit": "6a08076f009e3d9460bebae9f209c1dc1d8a46b7", "tree": "cd9f599772f850b3e43821eb97283321cbf2fe0e", "parents": [ "9154c4af7829b6f82712b4d1a2a720adddacdb8d", "7c6535c37dbc03c1c35926b7420d66fb122b513a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 12:31:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 04 12:31:20 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - Enable IOMMUFD and VFIO cdev such that PCI pass-through to\n QEMU/KVM can optionally utilize native IOMMUFD\n\n - With HAVE_ARCH_BUG_FORMAT enabled the BUG infrastructure might\n misinterpret flags or fault. Fix this by moving the \"format\"\n field emission into __BUG_ENTRY()\n\n - The generic version of _THIS_IP_ is known to be brittle and may\n break with current and future GCC and Clang optimizations. Fix\n it by overriding _THIS_IP_\n\n* tag \u0027s390-7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390: Implement _THIS_IP_ using inline asm\n s390/bug: Always emit format word in __BUG_ENTRY\n s390/configs: Enable IOMMUFD and VFIO cdev in defconfigs\n" }, { "commit": "b6197b386677ae5268d4702e23849d9ad53051ad", "tree": "7763c40a6482720e27c3a5727ecb040fce27b7ce", "parents": [ "3c94f241f776562c489876ff506f366224565c21" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 12:58:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 09:02:37 2026 -0700" }, "message": "Reapply \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"\n\nThis reverts commit 850d9248d2eac662f869c766a598c877690c74e5.\nThis reapplies commit 325eb217e41f (\"bnxt_en: bring back rtnl_lock()\nin the bnxt_open() path\").\n\nBreno reports a lockdep warning in bnxt. During FW reset the driver\nmay end up calling netif_set_real_num_tx_queues() (if queue count\nchanges), so calls to bnxt_open() still require rtnl_lock.\n\n net/sched/sch_generic.c:1416 suspicious rcu_dereference_protected() usage!\n\n dev_qdisc_change_real_num_tx+0x54/0xe0\n netif_set_real_num_tx_queues+0x4ed/0xa80\n __bnxt_open_nic+0x9cb/0x3490\n bnxt_open+0x1cb/0x370\n bnxt_fw_reset_task+0x80d/0x1e80\n process_scheduled_works+0x9c1/0x13b0\n\nThe reverted commit was just an optimization / experiment\nso let\u0027s go back to taking the lock.\n\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://lore.kernel.org/ah726OtFX-Qw3U-R@gmail.com\nFixes: 850d9248d2ea (\"Revert \"bnxt_en: bring back rtnl_lock() in the bnxt_open() path\"\")\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260603195845.2574426-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c94f241f776562c489876ff506f366224565c21", "tree": "689c3855ef03894700de847840f97b568a62eb92", "parents": [ "e374b22e9b07b72a25909621464ff74096151bfb" ], "author": { "name": "Sechang Lim", "email": "rhkrqnwk98@gmail.com", "time": "Wed Jun 03 16:27:33 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 09:01:51 2026 -0700" }, "message": "udp: clear skb-\u003edev before running a sockmap verdict\n\nOn the UDP receive path skb-\u003edev is repurposed as dev_scratch (the\ntruesize/state cache set by udp_set_dev_scratch()), through the\nunion { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.\n\nWhen a UDP socket is in a sockmap, sk_data_ready is\nsk_psock_verdict_data_ready(), which calls udp_read_skb() -\u003e recv_actor()\n(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.\nIf that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,\nbpf_skc_lookup_tcp), bpf_skc_lookup() does:\n\n\tif (skb-\u003edev)\n\t\tcaller_net \u003d dev_net(skb-\u003edev);\n\nskb-\u003edev still holds the dev_scratch value (a non-NULL integer), so dev_net()\ndereferences it as a struct net_device * and the kernel takes a general\nprotection fault on a non-canonical address in softirq:\n\n Oops: general protection fault, probably for non-canonical address 0x1010000800004a0\n CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full)\n RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline]\n RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047\n Call Trace:\n \u003cIRQ\u003e\n bpf_prog_4675cb904b7071f8+0x12e/0x14e\n bpf_prog_run_pin_on_cpu+0xc6/0x1f0\n sk_psock_verdict_recv+0x1ba/0x350\n udp_read_skb+0x31a/0x370\n sk_psock_verdict_data_ready+0x2e3/0x600\n __udp_enqueue_schedule_skb+0x4c8/0x650\n udpv6_queue_rcv_one_skb+0x3ec/0x740\n udp6_unicast_rcv_skb+0x11d/0x140\n ip6_protocol_deliver_rcu+0x61e/0x950\n ip6_input_finish+0xa9/0x150\n NF_HOOK+0x286/0x2f0\n ip6_input+0x117/0x220\n NF_HOOK+0x286/0x2f0\n __netif_receive_skb+0x85/0x200\n process_backlog+0x374/0x9a0\n __napi_poll+0x4f/0x1c0\n net_rx_action+0x3b0/0x770\n handle_softirqs+0x15a/0x460\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nThe rmem charge that dev_scratch accounted for is released by skb_recv_udp() on\ndequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear\nskb-\u003edev so bpf_skc_lookup() falls back to sock_net(skb-\u003esk), which\nskb_set_owner_sk_safe() set just above.\n\nFixes: 965b57b469a5 (\"net: Introduce a new proto_ops -\u003eread_skb()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sechang Lim \u003crhkrqnwk98@gmail.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260603162737.697215-1-rhkrqnwk98@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e374b22e9b07b72a25909621464ff74096151bfb", "tree": "891e41366a7929c25e7e43b6f1b0d7110a2e1f6f", "parents": [ "b47ff80f280e18ad2310f44293cc057d9b64ff11" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Wed Jun 03 14:11:44 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 09:01:25 2026 -0700" }, "message": "sctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n sctp_sched_fcfs_dequeue+0x13a/0x140\n sctp_outq_flush+0x1603/0x33e0\n sctp_do_sm+0x31c9/0x5d30\n sctp_assoc_bh_rcv+0x392/0x6f0\n sctp_inq_push+0x1db/0x270\n sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths.\n\nFixes: 5bbbbe32a431 (\"sctp: introduce stream scheduler foundations\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Yuqi Xu \u003cxuyq21@lenovo.com\u003e\nReported-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/94318159b9052907a6cbb7256aee8b5f8dfbfccb.1780510304.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b47ff80f280e18ad2310f44293cc057d9b64ff11", "tree": "e9752f48578ae1b7513ea5a1f43607b6e525b7bc", "parents": [ "7561c7fbc694308da73300f036719e63e42bf0b4" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jun 03 12:35:14 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:58:18 2026 -0700" }, "message": "bonding: annotate data-races arcound churn variables\n\nThese fields are updated asynchronously by the bonding state machine\nin ad_churn_machine() while holding bond-\u003emode_lock.\n\nbond_info_show_slave() and bond_fill_slave_info() read them without\nbond-\u003emode_lock being held, we need to add READ_ONCE() and\nWRITE_ONCE() annotations.\n\nNote that AD_CHURN_MONITOR, AD_CHURN, and AD_NO_CHURN are defined\nexclusively in (kernel private) include/net/bond_3ad.h header.\n\nThey should be moved to include/uapi/linux/if_bonding.h or userspace\ntools will have to hardcode their values.\n\nFixes: 4916f2e2f3fc (\"bonding: print churn state via netlink\")\nFixes: 14c9551a32eb (\"bonding: Implement port churn-machine (AD standard 43.4.17).\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260603123514.388226-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7561c7fbc694308da73300f036719e63e42bf0b4", "tree": "dc18277075afdc04993fb6afc75b825153319f36", "parents": [ "9fc237f8d49f06d05f0f8e80361047b718894e81" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Wed Jun 03 14:00:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:52:41 2026 -0700" }, "message": "net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr\n\nIn mrp_pdu_parse_vecattr(), vector attribute events are encoded three\nper byte and valen tracks the number of events left to process.\n\nThe parser decrements valen after processing the first and second events\nfrom each event byte, but not after processing the third one. When valen\nis exactly a multiple of three, the loop continues after the last valid\nevent and consumes the next byte as a new event byte, applying a\nspurious event to the MRP applicant state.\n\nAdditionally, when valen is zero the parser unconditionally consumes\nattrlen bytes as FirstValue and advances the offset, even though per\nIEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of\nzero and no FirstValue or Vector fields. This corrupts the offset for\nsubsequent PDU parsing.\n\nAlso, when valen exceeds three the loop crosses byte boundaries but\nthe attribute value is not incremented between the last event of one\nbyte and the first event of the next. This causes the first event of\nthe next byte to use the same attribute value as the third event\nrather than the next consecutive value.\n\nDecrement valen after processing the third event, skip FirstValue\nconsumption when valen is zero, and increment the attribute value at\nthe end of each loop iteration.\n\nFixes: febf018d2234 (\"net/802: Implement Multiple Registration Protocol (MRP)\")\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nLink: https://patch.msgid.link/20260603060016.21522-1-zhaoyz24@mails.tsinghua.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9fc237f8d49f06d05f0f8e80361047b718894e81", "tree": "ab50391bb55c0f30956fffb9c55b680a71df4640", "parents": [ "3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3" ], "author": { "name": "Justin Lai", "email": "justinlai0215@realtek.com", "time": "Wed Jun 03 14:18:16 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:52:24 2026 -0700" }, "message": "rtase: Avoid sleeping in get_stats64()\n\nThe .ndo_get_stats64 callback must not sleep because it can be\ncalled when reading /proc/net/dev.\n\nrtase_get_stats64() calls rtase_dump_tally_counter(), which polls\nthe tally counter dump bit with read_poll_timeout(). This may\nsleep while waiting for the hardware counter dump to complete.\n\nUse read_poll_timeout_atomic() instead to avoid sleeping in the\nget_stats64() path.\n\nFixes: 079600489960 (\"rtase: Implement net_device_ops\")\nCc: stable@vger.kernel.org\nSigned-off-by: Justin Lai \u003cjustinlai0215@realtek.com\u003e\nLink: https://patch.msgid.link/20260603061816.31356-1-justinlai0215@realtek.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3", "tree": "89b3ec6a668e5b39e87ae933afcd3a3a6f8a5896", "parents": [ "791c91dc7a9dfb2457d5e29b8216a6484b9c4b40" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jun 03 07:29:55 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:51:32 2026 -0700" }, "message": "ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()\n\nThe aoe driver (or similar) generates a non-IPv6 packet\n(e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()\non a 6LoWPAN interface (configured by the user or test case).\n\nSince the packet is not IPv6, the 6LoWPAN header_ops-\u003ecreate function\n(lowpan_header_create or header_create) returns early without initializing\nthe lowpan_addr_info structure in the skb headroom.\n\nIn the transmit function (lowpan_xmit), the driver calls lowpan_header\n(or setup_header) which unconditionally copies and uses the lowpan_addr_info\nfrom the headroom, which contains uninitialized data.\n\nFix this by dropping non IPv6 packets.\n\nA similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().\n\nFixes: 4dc315e267fe (\"ieee802154: 6lowpan: move transmit functionality\")\nReported-by: syzbot+f13c19f75e1097abd116@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6a1fd763.278b5b03.2bcf39.0049.GAE@google.com/T/#u\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://patch.msgid.link/20260603072955.4032221-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "791c91dc7a9dfb2457d5e29b8216a6484b9c4b40", "tree": "b7c81b6dce0748d25916c490912d79204532b207", "parents": [ "05ef0afa1bd63ae36a594e9b8e92057660e3b3a2" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Wed Jun 03 13:18:11 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:50:33 2026 -0700" }, "message": "ipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\u003c/TASK\u003e\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\nFixes: 97300b5fdfe2 (\"[MCAST] IPv6: Check packet size when process Multicast\")\nReported-by: Leo Lin \u003cleo@depthfirst.com\u003e\nReviewed-by: David Ahern \u003cdahern@nvidia.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20260603101811.612594-1-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "05ef0afa1bd63ae36a594e9b8e92057660e3b3a2", "tree": "c785e68b6c90a0006d56789889efcfa3d866d889", "parents": [ "ab1ecaabe74b7d86c38ab2ab44bd56cdcc33645a", "8df1c84e7272a5e24b563df7e50111dc81014d4a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:47:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:47:48 2026 -0700" }, "message": "Merge branch \u0027vxlan-vnifilter-fix-vni-add-update-notifications\u0027\n\nAndy Roulin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvxlan: vnifilter: fix VNI add/update notifications\n\nWhen a vxlan device has vnifilter enabled, userspace observers\n(e.g., bridge monitor vni) miss VNI add events and see spurious\nnotifications on no-op VNI re-adds.\n\nPatch 1 fixes the missing notification on VNI add: vxlan_vni_add()\nguarded the notification on a \u0027changed\u0027 flag that vxlan_vni_update_group()\nonly sets when a multicast group or remote is supplied, so VNIs added\nwithout a group (e.g., L3 VXLAN) were silently created.\n\nPatch 2 fixes the spurious notification on VNI update: vxlan_vni_update()\ntested \u0027if (changed)\u0027 against a bool pointer instead of dereferencing it,\nso every re-add produced a notification regardless of whether anything\nactually changed.\n\nPatch 3 adds a selftest covering both bugs along with a few related\ncases (add with remote, remote update, delete-nonexistent).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260602185138.253265-1-aroulin@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8df1c84e7272a5e24b563df7e50111dc81014d4a", "tree": "c785e68b6c90a0006d56789889efcfa3d866d889", "parents": [ "84683b5b60c7274e2c8f7f413d39d78d3db5540f" ], "author": { "name": "Andy Roulin", "email": "aroulin@nvidia.com", "time": "Tue Jun 02 11:51:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:47:45 2026 -0700" }, "message": "selftests: net: add vxlan vnifilter notification test\n\nAdd a selftest for VXLAN vnifilter netlink notifications that verifies\nRTM_NEWTUNNEL and RTM_DELTUNNEL are sent correctly when VNIs are added,\ndeleted, or updated, and that no spurious notifications are sent when\na VNI is re-added with the same attributes.\n\nSigned-off-by: Andy Roulin \u003caroulin@nvidia.com\u003e\nAcked-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nLink: https://patch.msgid.link/20260602185138.253265-4-aroulin@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "84683b5b60c7274e2c8f7f413d39d78d3db5540f", "tree": "9a747be88694409c7ca040991cce01d46c784fd3", "parents": [ "aa6ca1c5c338907817374b59f7551fd855a88754" ], "author": { "name": "Andy Roulin", "email": "aroulin@nvidia.com", "time": "Tue Jun 02 11:51:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:47:45 2026 -0700" }, "message": "vxlan: vnifilter: fix spurious notification on VNI update\n\nWhen a VNI is re-added with the same attributes (e.g. same group or no\ngroup), vxlan_vni_update() sends a spurious RTM_NEWTUNNEL notification\neven though nothing changed.\n\nThe bug is that \u0027if (changed)\u0027 tests whether the pointer is non-NULL,\nnot the bool value it points to. Since every caller passes a valid\npointer, the condition is always true and the notification fires\nunconditionally.\n\nFix by dereferencing the pointer: \u0027if (*changed)\u0027.\n\nReproducer:\n\n # ip link add vxlan100 type vxlan dstport 4789 local 10.0.0.1 \\\n nolearning external vnifilter\n # ip link set vxlan100 up\n # bridge monitor vni \u0026\n # bridge vni add vni 1000 dev vxlan100\n # bridge vni add vni 1000 dev vxlan100 # spurious notification\n\nFixes: f9c4bb0b245c (\"vxlan: vni filtering support on collect metadata device\")\nSigned-off-by: Andy Roulin \u003caroulin@nvidia.com\u003e\nReviewed-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nLink: https://patch.msgid.link/20260602185138.253265-3-aroulin@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aa6ca1c5c338907817374b59f7551fd855a88754", "tree": "118ba2b0e60695f7d4600062fbab8ce8143dcb3d", "parents": [ "ab1ecaabe74b7d86c38ab2ab44bd56cdcc33645a" ], "author": { "name": "Andy Roulin", "email": "aroulin@nvidia.com", "time": "Tue Jun 02 11:51:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:47:45 2026 -0700" }, "message": "vxlan: vnifilter: send notification on VNI add\n\nWhen a new VNI is added to a vxlan device with vnifilter enabled,\nno RTM_NEWTUNNEL notification is sent to userspace. This means\n\u0027bridge monitor vni\u0027 never shows VNI add events, even though\nVNI delete events are reported correctly.\n\nThe bug is in vxlan_vni_add(), where the notification is guarded by\n\u0027if (changed)\u0027. The \u0027changed\u0027 flag is set by vxlan_vni_update_group()\nonly when the multicast group or remote IP is modified, but for a\nnew VNI added without a group (e.g. in L3 VxLAN interface scenarios),\nthe function returns early without setting changed\u003dtrue. Since this\nis a new VNI, the notification should be sent unconditionally.\n\nThe notification is not guarded by the return value of\nvxlan_vni_update_group() because, at this point, the VNI has already\nbeen inserted into the hash table and list with no rollback on error.\nThe VNI will be visible in \u0027bridge vni show\u0027 regardless, so userspace\nshould be informed. This is consistent with vxlan_vni_del() which also\nnotifies unconditionally.\n\nThe \u0027if (changed)\u0027 guard remains correct in vxlan_vni_update(), which\nhandles the case where a VNI already exists and is being re-added --\nthere, we only want to notify if the group/remote actually changed.\n\nReproducer:\n\n # ip link add vxlan100 type vxlan dstport 4789 local 10.0.0.1 \\\n nolearning external vnifilter\n # ip link set vxlan100 up\n # bridge monitor vni \u0026\n # bridge vni add vni 1000 dev vxlan100 # no notification\n # bridge vni delete vni 1000 dev vxlan100 # notification received\n\nFixes: f9c4bb0b245c (\"vxlan: vni filtering support on collect metadata device\")\nReported-by: Chirag Shah \u003cchirag@nvidia.com\u003e\nSigned-off-by: Andy Roulin \u003caroulin@nvidia.com\u003e\nReviewed-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nLink: https://patch.msgid.link/20260602185138.253265-2-aroulin@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab1ecaabe74b7d86c38ab2ab44bd56cdcc33645a", "tree": "82de85759ada47d11f6500d6c26839cf3c75f224", "parents": [ "1d31eb27e570daa04f5373345f9ac98c95863be9" ], "author": { "name": "Justin Lai", "email": "justinlai0215@realtek.com", "time": "Tue Jun 02 19:46:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:35:30 2026 -0700" }, "message": "rtase: Reset TX subqueue when clearing TX ring\n\nrtase_tx_clear() clears the TX ring and resets the ring indexes.\nHowever, the TX queue state and BQL accounting are not reset at\nthe same time.\n\nThis may leave __QUEUE_STATE_STACK_XOFF asserted after\nrtase_sw_reset(), preventing new TX packets from being scheduled.\n\nReset the TX subqueue when clearing the TX ring so the TX queue\nstate and BQL accounting are restored together.\n\nFixes: 5a2a2f15244c (\"rtase: Implement the rtase_down function\")\nCc: stable@vger.kernel.org\nSigned-off-by: Justin Lai \u003cjustinlai0215@realtek.com\u003e\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nLink: https://patch.msgid.link/20260602114659.12335-1-justinlai0215@realtek.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d31eb27e570daa04f5373345f9ac98c95863be9", "tree": "cab775bd28e2978461bd8b44e1f3f0460348a568", "parents": [ "1232b3104b4b2c0267f31608fe0f8a8758428f28" ], "author": { "name": "Nithin Dabilpuram", "email": "ndabilpuram@marvell.com", "time": "Tue Jun 02 10:28:53 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:32:06 2026 -0700" }, "message": "octeontx2-af: npc: Fix CPT channel mask in npc_install_flow\n\nUse the CPT-aware NIX channel mask in the npc_install_flow path so that\nwhen the host PF installs steering rules in kernel for a VF used from\nuserspace (e.g. DPDK), MCAM entries see the same channel mask semantics as\nother RX paths.\n\nFixes: 56bcef528bd8 (\"octeontx2-af: Use npc_install_flow API for promisc and broadcast entries\")\nCc: Naveen Mamindlapalli \u003cnaveenm@marvell.com\u003e\nSigned-off-by: Nithin Dabilpuram \u003cndabilpuram@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260602045853.1558530-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1232b3104b4b2c0267f31608fe0f8a8758428f28", "tree": "3d70f4a4abc88100ad5d886e75831ddb62d15b6b", "parents": [ "0861615c28de668669d748ef4eb913ea9262d13b" ], "author": { "name": "Zhi Li", "email": "lizhi2@eswincomputing.com", "time": "Tue Jun 02 09:45:28 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:30:37 2026 -0700" }, "message": "dt-bindings: ethernet: eswin: fix hsp-sp-csr backward compatibility\n\nCommit c36069c6f46c (\"dt-bindings: ethernet: eswin: add optional TXD and\nRXD delay register offsets\") added two optional cells to eswin,hsp-sp-csr\nbut omitted minItems: 4.\n\nAs a result, dt-schema implicitly required all 6 cells, which broke\nbackward compatibility with existing 4-cell device trees.\n\nAdd minItems: 4 to preserve backward compatibility.\n\nFixes: c36069c6f46c (\"dt-bindings: ethernet: eswin: add optional TXD and RXD delay register offsets\")\nReported-by: Sashiko AI \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260519022334.35742C2BCB7@smtp.kernel.org/\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nSigned-off-by: Zhi Li \u003clizhi2@eswincomputing.com\u003e\nLink: https://patch.msgid.link/20260602014528.2076-1-lizhi2@eswincomputing.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0861615c28de668669d748ef4eb913ea9262d13b", "tree": "b165fa098021ca0474b5d7d0ee46db43ef2bad14", "parents": [ "899ee91156e57784090c5565e4f31bd7dbffbc5a" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Mon Jun 01 21:06:06 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:30:07 2026 -0700" }, "message": "sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Brian Geffon \u003cbgeffon@google.com\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/eb60825fa22d6f9e663c7d4dbb69f397b5d34d42.1780362366.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "899ee91156e57784090c5565e4f31bd7dbffbc5a", "tree": "2b86ddaf944d4fa41b32636415608f27264ccf3f", "parents": [ "c05fa14db43ebef3bd862ca9d073981c0358b3f0" ], "author": { "name": "Rajat Gupta", "email": "rajat.gupta@oss.qualcomm.com", "time": "Sun May 31 08:32:21 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jun 04 08:29:02 2026 -0700" }, "message": "net/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW\u0027d.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined.\n\nFixes: 8b796475fd78 (\"net/sched: act_pedit: really ensure the skb is writable\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nReported-by: Keenan Dong \u003ckeenanat2000@gmail.com\u003e\nReported-by: Han Guidong \u003c2045gemini@gmail.com\u003e\nReported-by: Zhang Cen \u003crollkingzzc@gmail.com\u003e\nReviewed-by: Han Guidong \u003c2045gemini@gmail.com\u003e\nTested-by: Han Guidong \u003c2045gemini@gmail.com\u003e\nReviewed-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nTested-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nTested-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Rajat Gupta \u003crajat.gupta@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d76b56b06b2734c6e0ff519599126919fa4f154b", "tree": "d4501adc3369a548f55692351bbef66f406556d5", "parents": [ "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b" ], "author": { "name": "Lianqin Hu", "email": "hulianqin@vivo.com", "time": "Thu Jun 04 12:40:28 2026 +0000" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 04 17:27:35 2026 +0200" }, "message": "ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: new full-speed USB device number 2 using xhci-hcd\nusb 1-1: New USB device found, idVendor\u003d3c20, idProduct\u003d3d21\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: AB13X USB Audio\nusb 1-1: Manufacturer: Generic\nusb 1-1: SerialNumber: 20210726905926\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/TYUPR06MB62174610061C213260E1A992D2102@TYUPR06MB6217.apcprd06.prod.outlook.com\n" }, { "commit": "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b", "tree": "c42310a7be73cf7083633816e2b22d0c8bba6ffc", "parents": [ "b734412619821f3ed63ba63533f539672cb7a76d" ], "author": { "name": "Ji\u0027an Zhou", "email": "eilaimemedsnaimel@gmail.com", "time": "Thu Jun 04 14:25:59 2026 +0000" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 04 17:24:26 2026 +0200" }, "message": "ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK. The orphaned wait entry\nremains on the unlinked substream sleep queue. On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists. A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait. init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up. finish_wait safely handles both the already-removed\nand still-queued cases.\n\nFixes: 9b1dbd69ba6f (\"ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain\")\nSigned-off-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nLink: https://patch.msgid.link/20260604142559.3840881-1-eilaimemedsnaimel@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "b734412619821f3ed63ba63533f539672cb7a76d", "tree": "bda3035a3667723e8215d3a4bd099ef71ec0a34c", "parents": [ "aa2f4addab44407c7aa742321de5dc1914ab5762", "d2dcd85f9e09fe3566d4cdcd357856a42ac73f93" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 04 17:21:01 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Jun 04 17:21:01 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc6\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nThere\u0027s only one actual fix here, for the TDM configuration on the\nFreescale SAI controller, everytihng else is DMI quirks for AMD systems.\nOne of those is relatively large as it adds a bunch of different structs\nbut it\u0027s all data.\n" }, { "commit": "6bf7e2affc6e62da7add393d7f352d4040f5bc27", "tree": "082266a14ef9280c016c36c3fc50c43585e61a8a", "parents": [ "30252e6f71ba974ecf9cd8ce395b73b9900bc378" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Sun May 31 17:18:55 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Thu Jun 04 11:37:28 2026 -0300" }, "message": "drm/v3d: Fix global performance monitor reference counting\n\nIn the SET_GLOBAL ioctl, v3d_perfmon_find() bumps the reference count on\nthe perfmon it returns, but v3d_perfmon_set_global_ioctl() and\nv3d_perfmon_delete() fail to release that reference on several paths:\n\n 1. v3d_perfmon_set_global_ioctl() leaks the reference on its error\n paths.\n\n 2. CLEAR_GLOBAL leaks both the find reference and the reference\n previously stashed in v3d-\u003eglobal_perfmon by the SET_GLOBAL ioctl\n that configured it.\n\n 3. Destroying a perfmon that is the current global perfmon leaks the\n reference stashed by the SET_GLOBAL ioctl.\n\nRelease each of these references explicitly.\n\nCc: stable@vger.kernel.org\nFixes: c6eabbab359c (\"drm/v3d: Add DRM_IOCTL_V3D_PERFMON_SET_GLOBAL\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nLink: https://patch.msgid.link/20260531-v3d-perfmon-lifetime-v2-1-60ed4485a203@igalia.com\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "ec4cbdd163f9bb2a2bd44eb93ecf4a2fa0e912a9", "tree": "855f4da91e4b674f67d8e5c3b1da81cb7ebd7a64", "parents": [ "54f2a0442a30fe7a0f6bc8345e81f8b2db8effbd" ], "author": { "name": "Niranjana Vishwanathapura", "email": "niranjana.vishwanathapura@intel.com", "time": "Wed Jun 03 16:39:47 2026 -0700" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Thu Jun 04 09:04:09 2026 -0400" }, "message": "drm/xe/multi_queue: skip submit when primary queue is suspended\n\nReturn early in submit path when the multi-queue primary exec\nqueue is suspended to avoid submitting while suspended.\n\nv2: Remove idle_skip_suspend fix as that feature is being\nreverted here https://patchwork.freedesktop.org/series/167262/\n\nFixes: bc5775c59258 (\"drm/xe/multi_queue: Add GuC interface for multi queue support\")\nCc: stable@vger.kernel.org # v7.0+\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nReviewed-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nSigned-off-by: Niranjana Vishwanathapura \u003cniranjana.vishwanathapura@intel.com\u003e\nLink: https://patch.msgid.link/20260603233946.863663-2-niranjana.vishwanathapura@intel.com\n(cherry picked from commit b7fb55cc3364ca128cfff9d50649ffd4327cd01e)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "54f2a0442a30fe7a0f6bc8345e81f8b2db8effbd", "tree": "421239247f775d5098eff1b155ce6cc0a11f020a", "parents": [ "fa7c84726dc217ce0c183926ef9411636c7a2213" ], "author": { "name": "Tangudu Tilak Tirumalesh", "email": "tilak.tirumalesh.tangudu@intel.com", "time": "Wed Jun 03 12:22:16 2026 +0530" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Thu Jun 04 09:04:03 2026 -0400" }, "message": "drm/xe: Clear pending_disable before signaling suspend fence\n\nIn the schedule-disable done path for suspend, we\nsignal the suspend fence before clearing pending_disable.\n\nThat wakeup can let suspend_wait complete and resume be queued\nimmediately. The resume path may then reach enable_scheduling()\nwhile pending_disable is still set and hit the\n!exec_queue_pending_disable(q) assertion.\n\nFix this by clearing pending_disable before signaling\nthe suspend fence, so any resumed transition observes a\nconsistent state.\n\nFixes: 87651f31ae4e (\"drm/xe/guc_submit: fix race around suspend_pending\")\nCc: stable@vger.kernel.org # v7.0+\nSigned-off-by: Tangudu Tilak Tirumalesh \u003ctilak.tirumalesh.tangudu@intel.com\u003e\nReviewed-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nLink: https://patch.msgid.link/20260603065217.3131066-3-tilak.tirumalesh.tangudu@intel.com\n(cherry picked from commit 4b1ae138b0e103d753773956a84eebc2edbf62c4)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "fa7c84726dc217ce0c183926ef9411636c7a2213", "tree": "9abbf465ba848f41789c23c141d5a4b662e97e77", "parents": [ "42445de1765547f56f48d107c0b8f3482c98458e" ], "author": { "name": "Tangudu Tilak Tirumalesh", "email": "tilak.tirumalesh.tangudu@intel.com", "time": "Wed Jun 03 12:22:15 2026 +0530" }, "committer": { "name": "Rodrigo Vivi", "email": "rodrigo.vivi@intel.com", "time": "Thu Jun 04 09:03:57 2026 -0400" }, "message": "Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\n\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\n\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\nperform the context switch that flushes TLB entries for invalidated\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\ninvalidation and page faults during userptr invalidation tests.\n\nRestore unconditional schedule toggling on suspend so the context-switch\nTLB flush is always performed.\n\nThis optimization will be reintroduced with a fix that does not skip\nsuspend in LR/preempt-fence VM mode.\n\nFixes: 8533051ce920 (\"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\")\nCc: stable@vger.kernel.org # v7.0+\nSuggested-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Tangudu Tilak Tirumalesh \u003ctilak.tirumalesh.tangudu@intel.com\u003e\nReviewed-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nLink: https://patch.msgid.link/20260603065217.3131066-2-tilak.tirumalesh.tangudu@intel.com\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n" }, { "commit": "d486b4934a8e504376b85cdb3766f306d57aff5b", "tree": "dee445f75dab52d8676ed16a41f74041463528bd", "parents": [ "3f7fbde4cdd4a25c199a60849897459a63907ca5" ], "author": { "name": "Amit Matityahu", "email": "amitmat@amazon.com", "time": "Wed Jun 03 17:01:39 2026 +0000" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Thu Jun 04 14:35:33 2026 +0200" }, "message": "timers/migration: Fix livelock in tmigr_handle_remote_up()\n\ntmigr_handle_remote_cpu() skips timer_expire_remote() when cpu \u003d\u003d\nsmp_processor_id(), assuming the local softirq path already handled this\nCPU\u0027s timers.\n\nThis assumption is wrong because jiffies can advance after the handling of\nthe CPU\u0027s global timers in run_timer_base(BASE_GLOBAL) and before\ntmigr_handle_remote() evaluates the expiry times.\n\nAs a consequence a timer which expires after the CPU local timer wheel\nadvanced and becomes expired in the remote handling is ignored and the\ncallback is never invoked and removed from the timer wheel.\n\nWhat\u0027s worse is that fetch_next_timer_interrupt_remote() keeps reporting it\nas expired, and the event is re-queued with expires \u003d\u003d now on each\niteration. The goto-again loop spins indefinitely.\n\nFix this by calling timer_expire_remote() unconditionally. That\u0027s minimal\noverhead for the common case as __run_timer_base() returns immediately if\nthere is nothing to expire in the local wheel.\n\n[ tglx: Amend change log and add a comment ]\n\nFixes: 7ee988770326 (\"timers: Implement the hierarchical pull model\")\nReported-by: Alon Kariv \u003calonka@amazon.com\u003e\nSigned-off-by: Amit Matityahu \u003camitmat@amazon.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260603170139.33628-1-amitmat@amazon.com\n" }, { "commit": "c05fa14db43ebef3bd862ca9d073981c0358b3f0", "tree": "0841759ebe77ba5a89f490ea1ee9ed85aec3c035", "parents": [ "a764b0e8317a863006e05732e1aefe821b9d8c2d" ], "author": { "name": "Raf Dickson", "email": "rafdog35@gmail.com", "time": "Tue May 26 10:43:56 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 04 13:08:02 2026 +0200" }, "message": "vsock/vmci: fix sk_ack_backlog leak on failed handshake\n\nWhen vmci_transport_recv_connecting_server() returns an error,\nvmci_transport_recv_listen() calls vsock_remove_pending() but never\ncalls sk_acceptq_removed(). This leaves sk_ack_backlog incremented\npermanently.\n\nRepeated handshake failures (malformed packets, queue pair alloc\nfailure, event subscribe failure) cause sk_ack_backlog to climb\ntoward sk_max_ack_backlog. Once it reaches the limit the listener\npermanently refuses all new connections with -ECONNREFUSED, a\nsilent denial of service requiring a process restart to recover.\n\nThe two existing sk_acceptq_removed() calls in af_vsock.c do not\ncover this path: line 764 checks vsock_is_pending() which returns\nfalse after vsock_remove_pending(), and line 1889 is only reached\non successful accept().\n\nFix by balancing sk_acceptq_added() with sk_acceptq_removed() on\nthe error path.\n\nFixes: d021c344051a (\"VSOCK: Introduce VM Sockets\")\nCc: stable@vger.kernel.org\nSigned-off-by: Raf Dickson \u003crafdog35@gmail.com\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260526104356.469928-1-rafdog35@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d2dcd85f9e09fe3566d4cdcd357856a42ac73f93", "tree": "b569c8c3745778f03e452cc90123d946d8b61b74", "parents": [ "cad530a8371124da988608f11df30b7dd82391ef" ], "author": { "name": "Aleksander Pshenitsyn", "email": "brains.fatman@gmail.com", "time": "Sun May 31 13:11:59 2026 +0300" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 04 11:35:06 2026 +0100" }, "message": "ASoC: amd: acp70: add standalone RT721 SoundWire machine\n\nThe ASUS Vivobook 18 M1807GA (AMD ACP7.x, PCI 1022:15e2, subsystem\n1043:3531) exposes a single Realtek RT721 SDCA codec on SoundWire link 1.\nThe BIOS reports the ACP audio config flag as 0 (SoundWire mode), so\nsnd_pci_ps claims the device, brings up the SoundWire managers and\nenumerates the RT721 peripheral (sdw:0:1:025d:0721:01); the rt721-sdca\ncodec driver binds successfully.\n\nNo sound card is created, however: acp63_sdw_machine_select() walks\nsnd_soc_acpi_amd_acp70_sdw_machines[] and finds no entry whose declared\nSoundWire peripherals are all present on the bus. The only existing RT721\nentry, acp70_rt721_l1u0_tas2783x2_l1u8b, additionally requires two\nTAS2783 amplifiers and deliberately exposes the RT721 as jack + DMIC\nonly. This M1807GA variant has no external amplifiers - the RT721\u0027s\ninternal AIF2 amplifier path drives the speakers - so that entry never\nmatches and no machine device is registered.\n\nAdd a standalone RT721 machine entry for link 1 exposing all three RT721\nendpoints (jack/AIF1, speaker amplifier/AIF2, DMIC/AIF3), mirroring the\nstandalone RT722 configuration. Place it after the TAS2783 combo entry so\nplatforms that do have the external amplifiers continue to match the more\nspecific entry first.\n\nACPI _ADR of the codec: 0x000130025D072101\n(link_id\u003d1 version\u003d3 mfg_id\u003d0x025d Realtek part_id\u003d0x0721 class\u003d0x01).\n\nVerified on the hardware: with the entry present the amd_sdw machine\nbinds, an \"amd-soundwire\" card is registered exposing the rt721-sdca\nAIF1 (SimpleJack) and AIF2 (SmartAmp) PCM devices, and audio plays out\nof the built-in speakers.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221282\nSigned-off-by: Aleksander Pshenitsyn \u003cbrains.fatman@gmail.com\u003e\nLink: https://patch.msgid.link/20260531101159.14241-1-brains.fatman@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "cad530a8371124da988608f11df30b7dd82391ef", "tree": "45ec63f69155235767b5ebfaee47e1daf157b530", "parents": [ "4790af1cc2e8871fb31f28c66e42b9a949a23992" ], "author": { "name": "David Glushkov", "email": "david.glushkov@sntiq.com", "time": "Sun May 31 23:45:12 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 04 11:20:33 2026 +0100" }, "message": "ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table\n\nThe MSI Raider A18 HX A9WJG has an internal digital microphone\nconnected through AMD ACP6x, but this machine does not expose the\nAcpDmicConnected ACPI property, so acp_yc_mach does not bind.\n\nAdd a DMI quirk for this model.\n\nThis was tested on an MSI Raider A18 HX A9WJG with board MS-182L,\nBIOS E182LAMS.31A, AMD ACP6x rev 0x62, and Realtek ALC274. After\napplying the quirk, the internal microphone appears as an acp6x DMIC\ncapture device and records correctly.\n\nSigned-off-by: David Glushkov \u003cdavid.glushkov@sntiq.com\u003e\nLink: https://patch.msgid.link/20260531214512.170716-1-david.glushkov@sntiq.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "4790af1cc2e8871fb31f28c66e42b9a949a23992", "tree": "be8d9148f8e0398f301b696f00c190c2913b4c3f", "parents": [ "c9c64820a48dcc739311fd7a9138511888539d02" ], "author": { "name": "Chancel Liu", "email": "chancel.liu@nxp.com", "time": "Mon Jun 01 17:33:27 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Jun 04 11:16:58 2026 +0100" }, "message": "ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write\n\nWhen configuring 32 slots TDM (channels \u003d\u003d slots \u003d\u003d 32), the xMR\n(Mask Register) write used:\n~0UL - ((1 \u003c\u003c min(channels, slots)) - 1)\n\nThe literal \"1\" is a signed 32-bit int. Shifting it by 32 positions is\nundefined behaviour which may set this register to 0xFFFFFFFF, masking\nall 32 slots.\n\nUse GENMASK_U32() macro instead. For 32 slots this produces a zero mask:\n~GENMASK_U32(31, 0) \u003d ~0xFFFFFFFF \u003d 0x00000000\nBehaviour for fewer than 32 slots is unchanged.\n\nFixes: 770f58d7d2c5 (\"ASoC: fsl_sai: Support multiple data channel enable bits\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chancel Liu \u003cchancel.liu@nxp.com\u003e\nReviewed-by: Shengjiu Wang \u003cshengjiu.wang@gmail.com\u003e\nLink: https://patch.msgid.link/20260601083327.1535185-1-chancel.liu@oss.nxp.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "a764b0e8317a863006e05732e1aefe821b9d8c2d", "tree": "0d01eb8cd7e5a747649024ed6336eb63c61a7bbf", "parents": [ "1231623fd3b5aa6b41cce799ffb0d82e10914be4" ], "author": { "name": "ZhaoJinming", "email": "zhaojinming@uniontech.com", "time": "Mon Jun 01 16:56:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 04 11:38:51 2026 +0200" }, "message": "net: bonding: fix NULL pointer dereference in bond_do_ioctl()\n\nIn bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which\ncan return NULL if the requested interface name does not exist. However,\nthe subsequent slave_dbg() call is placed before the NULL check:\n\n slave_dev \u003d __dev_get_by_name(net, ifr-\u003eifr_slave);\n slave_dbg(bond_dev, slave_dev, \"slave_dev\u003d%p:\\n\", slave_dev); //here\n if (!slave_dev)\n return -ENODEV;\n\nThe slave_dbg() macro expands to netdev_dbg(bond_dev, \"(slave %s): \" fmt,\n(slave_dev)-\u003ename, ...) which unconditionally dereferences slave_dev-\u003ename\nbefore the NULL check is performed. This results in a NULL pointer\ndereference kernel oops when a user calls bonding ioctl (e.g.\nSIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave\ninterface name.\n\nThis is reachable from userspace via the bonding ioctl interface with\nCAP_NET_ADMIN capability, making it a potential local denial-of-service\nvector.\n\nFix by moving the slave_dbg() call after the NULL check.\n\nFixes: e2a7420df2e0 (\"bonding/main: convert to using slave printk macros\")\nCc: stable@vger.kernel.org # v5.2+\nSigned-off-by: ZhaoJinming \u003czhaojinming@uniontech.com\u003e\nLink: https://patch.msgid.link/20260601085649.4029067-1-zhaojinming@uniontech.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0652a3daa78723f955b1ebeb621665ce72bec53e", "tree": "aca0bd8b26a5c6361fa1537431c3b337888e895f", "parents": [ "e43ffb69e0438cddd72aaa30898b4dc446f664f8" ], "author": { "name": "Eva Kurchatova", "email": "eva.kurchatova@virtuozzo.com", "time": "Wed Jun 03 18:31:42 2026 +0300" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Jun 04 05:03:56 2026 -0400" }, "message": "tracing: Fix CFI violation in probestub being called by tprobes\n\nThe probestub is a function to allow tprobes to hook to a tracepoint to\ngain access to its parameters. The function itself is only referenced by\nthe tracepoint structure which lives in the __tracepoint section. objtool\nexplicitly ignores that section and when processing functions in the\nkernel, if it detects one that has no references it will seal it to have\nits ENDBR stripped on boot up.\n\nThis means when a tprobe is attached to the sched_wakeup tracepoint, when it\nis triggered it will call __probestub_sched_wakeup and due to the missing\nENDBR on a CFI-enabled machine it will take a #CP exception.\n\nFix this by adding CFI_NOSEAL annotation to probestub declaration.\n\nCc: stable@vger.kernel.org\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nLink: https://patch.msgid.link/20260603153147.573589-1-eva.kurchatova@virtuozzo.com\nFixes: d5173f753750 (\"objtool: Exclude __tracepoints data from ENDBR checks\")\nSigned-off-by: Eva Kurchatova \u003ceva.kurchatova@virtuozzo.com\u003e\n[ Updated change log ]\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "1231623fd3b5aa6b41cce799ffb0d82e10914be4", "tree": "5f86172c294050a66e9d71055504e1c6b14a7b8c", "parents": [ "060c1daac7e0d01651cff326c8e0326b3787b272" ], "author": { "name": "Antoine Tenart", "email": "atenart@kernel.org", "time": "Fri May 29 16:47:00 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jun 04 10:48:46 2026 +0200" }, "message": "geneve: fix length used in GRO hint UDP checksum adjustment\n\nIn geneve_post_decap_hint the length used for adjusting the UDP checksum\nshould be \u0027skb-\u003elen - gro_hint-\u003enested_tp_offset\u0027 (UDP length) instead\nof \u0027skb-\u003elen - gro_hint-\u003enested_nh_offset\u0027 (IP length).\n\nFixes: fd0dd796576e (\"geneve: use GRO hint option in the RX path\")\nCc: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260521131436.748832-1-jhs%40mojatatu.com\nSigned-off-by: Antoine Tenart \u003catenart@kernel.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260529144713.780938-1-atenart@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2eea7f44b9c8b42fd7d3a1a87c06a7cd1b99c327", "tree": "a4b5983d6d425668295f63207540d2c590b26a7a", "parents": [ "40ab6644b99685755f740b872c00ef40d9aa870e" ], "author": { "name": "Joanne Koong", "email": "joannelkoong@gmail.com", "time": "Wed Jun 03 18:18:58 2026 -0700" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Jun 04 10:02:56 2026 +0200" }, "message": "iomap: avoid potential null folio-\u003emapping deref during error reporting\n\nWhen a buffered read fails, iomap_finish_folio_read() reports the error\nwith fserror_report_io(folio-\u003emapping-\u003ehost, ...). This is called after\nifs-\u003eread_bytes_pending has been decremented by the bytes attempted to\nbe read.\n\nFor a folio split across multiple read completions, the folio is only\nguaranteed to stay locked while read_bytes_pending \u003e 0. Once\niomap_finish_folio_read() decrements read_bytes_pending, another\nin-flight read can complete and end the read on the folio, which unlocks\nit. This allows truncate logic to run and detach the folio (set\nfolio-\u003emapping to NULL). The error reporting path then can dereference a\nNULL folio-\u003emapping. As reported by Sam Sun, this is the race that can\noccur:\n\nCPU0: failed completion CPU1: final completion CPU2: truncate\n----------------------- ---------------------- --------------\nread_bytes_pending -\u003d len\nfinished \u003d false\n/* preempted before\n fserror_report_io() */\n\t\t\t read_bytes_pending -\u003d len\n\t\t\t finished \u003d true\n\t\t\t folio_end_read()\n\t\t\t\t\t\t\ttruncate clears\n\t\t\t\t\t\t\tfolio-\u003emapping\nfserror_report_io(\n folio-\u003emapping-\u003ehost, ...)\n\t ^ NULL deref\n\nFix this by reporting the error first before decrementing\nifs-\u003eread_bytes_pending.\n\nFixes: a9d573ee88af (\"iomap: report file I/O errors to the VFS\")\nCc: stable@vger.kernel.org\nReported-by: Sam Sun \u003csamsun1006219@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-fsdevel/CAEkJfYPhWdd59RKmuNLJg-bkypHz7xiOwaWyNVu3A8CUqQCnvg@mail.gmail.com/\nSigned-off-by: Joanne Koong \u003cjoannelkoong@gmail.com\u003e\nLink: https://patch.msgid.link/20260604011858.2297561-1-joannelkoong@gmail.com\nReviewed-by: \"Darrick J. Wong\" \u003cdjwong@kernel.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "40ab6644b99685755f740b872c00ef40d9aa870e", "tree": "5c3a0e1640da4128cf9176334ae740bfd36a71b2", "parents": [ "89c4a1167f3a0a0efd2ec3e1801036d2eb65ae1a" ], "author": { "name": "Jann Horn", "email": "jannh@google.com", "time": "Wed Jun 03 21:31:57 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Jun 04 09:39:50 2026 +0200" }, "message": "fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh()\n\nmay_decode_fh() accesses mount::mnt_ns without holding any locks; that\nmeans the mount can concurrently be unmounted, and the mnt_namespace can\nconcurrently be freed after an RCU grace period.\n\nThis race can happens as follows, assuming that the mount point was\ncreated by open_tree(..., OPEN_TREE_CLONE):\n\nthread 1 thread 2 RCU\n __do_sys_open_by_handle_at\n do_handle_open\n handle_to_path\n may_decode_fh\n is_mounted\n [mount::mnt_ns access]\n [mount::mnt_ns access]\n__do_sys_close\n fput_close_sync\n __fput\n dissolve_on_fput\n umount_tree\n class_namespace_excl_destructor\n namespace_unlock\n free_mnt_ns\n mnt_ns_tree_remove\n call_rcu(mnt_ns_release_rcu)\n mnt_ns_release_rcu\n mnt_ns_release\n kfree\n [mnt_namespace::user_ns access] **UAF**\n\nFix it by taking rcu_read_lock() around the mount::mnt_ns access, like\nin __prepend_path().\nAdditionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE()\nfor writers that can race with lockless readers.\n\nThis bug is unreachable unless one of the following is set:\n\n - CONFIG_PREEMPTION\n - CONFIG_RCU_STRICT_GRACE_PERIOD\n\nbecause it requires an RCU grace period to happen during a syscall without\nan explicit preemption.\n\nThis doesn\u0027t seem to have interesting security impact; worst-case, it could\nleak the result of an integer comparison to userspace (from the level\ncheck in cap_capable()), cause an endless loop, or crash the kernel by\ndereferencing an invalid address.\n\nFixes: 620c266f3949 (\"fhandle: relax open_by_handle_at() permission checks\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nLink: https://patch.msgid.link/20260603-vfs-fhandle-uaf-fix-v2-1-d05db76a5084@google.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "060c1daac7e0d01651cff326c8e0326b3787b272", "tree": "c407a812995141d8817a12eec0b7fa2419209a7f", "parents": [ "d20da913083042203221c16bc19bd2f3c12d171f", "80df409e1a483676826a6c66e693dba6ac507751" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:15:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:15:34 2026 -0700" }, "message": "Merge branch \u0027fix-use-after-free-in-metadata-dst-teardown-in-airoha_eth-and-mtk_eth_soc-drivers\u0027\n\nLorenzo Bianconi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix use-after-free in metadata dst teardown in airoha_eth and mtk_eth_soc drivers\n\nairoha_metadata_dst_free() and mtk_free_dev() call metadata_dst_free()\nwhich frees the metadata_dst with kfree() immediately, bypassing the RCU\ngrace period.\nReplace metadata_dst_free() with dst_release() which properly goes\nthrough the refcount path and runs call_rcu_hurry() if refcount goes to\nzero.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-0-3aaa99d83351@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "80df409e1a483676826a6c66e693dba6ac507751", "tree": "c407a812995141d8817a12eec0b7fa2419209a7f", "parents": [ "b38cae85d1c45ff189d7ecb6ac36f41cdc3d84d0" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Jun 02 11:21:05 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:15:32 2026 -0700" }, "message": "net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown\n\nmtk_free_dev() calls metadata_dst_free() which frees the metadata_dst\nwith kfree() immediately, bypassing the RCU grace period.\nIn the RX path, skb_dst_set_noref() sets a non-refcounted pointer from\nthe skb to the metadata_dst. This function requires RCU read-side\nprotection and the dst must remain valid until all RCU readers complete.\nSince metadata_dst_free() calls kfree() directly, a use-after-free can\noccur if any skb still holds a noref pointer to the dst when the driver\ntears it down.\nReplace metadata_dst_free() with dst_release() which properly goes\nthrough the refcount path: when the refcount drops to zero, it schedules\nthe actual free via call_rcu_hurry(), ensuring all RCU readers have\ncompleted before the memory is freed.\n\nFixes: 2d7605a72906 (\"net: ethernet: mtk_eth_soc: enable hardware DSA untagging\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-2-3aaa99d83351@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b38cae85d1c45ff189d7ecb6ac36f41cdc3d84d0", "tree": "8e57ae1de56965c96ae99239162a0513479f6fbc", "parents": [ "d20da913083042203221c16bc19bd2f3c12d171f" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Jun 02 11:21:04 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:15:32 2026 -0700" }, "message": "net: airoha: Fix use-after-free in metadata dst teardown\n\nairoha_metadata_dst_free() runs metadata_dst_free() which frees the\nmetadata_dst with kfree() immediately, bypassing the RCU grace period.\nIn the RX path, skb_dst_set_noref() sets a non-refcounted pointer from\nthe skb to the metadata_dst. This function requires RCU read-side\nprotection and the dst must remain valid until all RCU readers complete.\nSince metadata_dst_free() calls kfree() directly, an use-after-free can\noccur if any skb still holds a noref pointer to the dst when the driver\ntears it down.\nReplace metadata_dst_free() with dst_release() which properly goes\nthrough the refcount path: when the refcount drops to zero, it schedules\nthe actual free via call_rcu_hurry(), ensuring all RCU readers have\ncompleted before the memory is freed.\n\nFixes: af3cf757d5c9 (\"net: airoha: Move DSA tag in DMA descriptor\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-airoha-mtk-metadata-uaf-fix-v1-1-3aaa99d83351@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d20da913083042203221c16bc19bd2f3c12d171f", "tree": "47e3d4cf34a9a67c6277e8b983acbac18d4b3ec7", "parents": [ "ac056099822eb6ffba2ad5d793348bc5a8d7552f", "149324fc762c2a7acef9c26790566f81f475e51f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:07:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:07:47 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-06-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_core: fix memory leak in error path of hci_alloc_dev()\n - hci_sync: reject oversized Broadcast Announcement prepend\n - MGMT: Fix backward compatibility with userspace\n - MGMT: validate advertising TLV before type checks\n - L2CAP: reject BR/EDR signaling packets over MTUsig\n - RFCOMM: validate skb length in MCC handlers\n - RFCOMM: hold listener socket in rfcomm_connect_ind()\n - ISO: Fix not releasing hdev reference on iso_conn_big_sync\n - ISO: Fix a use-after-free of the hci_conn pointer\n - ISO: Fix data-race on iso_pi fields in hci_get_route calls\n - SCO: Fix data-race on sco_pi fields in sco_connect\n - BNEP: reject short frames before parsing\n\n* tag \u0027for-net-2026-06-03\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: MGMT: Fix backward compatibility with userspace\n Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect\n Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls\n Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer\n Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync\n Bluetooth: fix memory leak in error path of hci_alloc_dev()\n Bluetooth: bnep: reject short frames before parsing\n Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n Bluetooth: RFCOMM: validate skb length in MCC handlers\n Bluetooth: MGMT: validate advertising TLV before type checks\n Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260603162714.342496-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac056099822eb6ffba2ad5d793348bc5a8d7552f", "tree": "82435a55d4db5d0987abbe0a77d13ad6ea24d7ca", "parents": [ "11c31f8ee9fb650e3ed6968d4c65c79afb3b9935", "cb9959ab5f99611d27a06586add84811fe8102dc" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:07:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:07:35 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-06-03\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nThings are finally quieting down:\n - iwlwifi:\n - FW reset handshake removal for older devices\n - NIC access fix in fast resume\n - avoid too large command for some BIOSes\n - fix TX power constraints in AP mode\n - cfg80211:\n - fix netlink parse overflow\n - fix potential 6 GHz scan memory leak\n - enforce HE/EHT consistency to avoid mac80211 crash\n - mac80211: guard radiotap antenna parsing\n\n* tag \u0027wireless-2026-06-03\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: cfg80211: enforce HE/EHT cap/oper consistency\n wifi: fix leak if split 6 GHz scanning fails\n wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap\n wifi: nl80211: reject oversized EMA RNR lists\n wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used\n wifi: iwlwifi: mvm: avoid oversized UATS command copy\n wifi: iwlwifi: mld: send tx power constraints before link activation\n wifi: iwlwifi: mvm: don\u0027t support the reset handshake for old firmwares\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260603113208.171874-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "11c31f8ee9fb650e3ed6968d4c65c79afb3b9935", "tree": "1ca95857982b1625955885cb6fe1140a8d2d3df9", "parents": [ "672bd0519e27c357c43b7f8c0d653fce3817d06e", "bd34fa0257261b76964df1c98f44b3cb4ee14620" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:47 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-1-rc7\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.1-rc7\n\nHere are various unrelated fixes:\n\n- Patch 1: fix missing wakeups when multiple threads are reading from\n the same fd. A fix for v5.7.\n\n- Patch 2: fix retransmission loop when MPTCP checksum is enabled. A fix\n for v5.14.\n\n- Patch 3: fix a TOCTOU race while computing rcv_wnd. A fix for v5.11.\n\n- Patch 4: allow subflows receive window to shrink if needed. A fix for\n v5.19.\n\n- Patches 5-6: avoid \u0027extra_subflows\u0027 to underflow with the userspace\n PM. A fix for v5.19.\n\n- Patch 7: report errors if one subflow cannot set SO_TIMESTAMPING. A\n fix for v5.14.\n\n- Patch 8: try to set TCP_MAXSEG on all subflows, before reporting\n errors, if any. A fix for v6.17.\n\n- Patch 9: check desc-\u003ecount in read_sock, to act as expected. A fix\n for v7.0.\n\n- Patch 10: fix an uninit value in mptcp_established_options, reported\n by syzbot. A fix for v7.1-rc1.\n\n- Patch 11: fix a similar issue than the previous patch, exposed by the\n same modification from v7.1-rc1, but was already causing issues since\n v5.15.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-0-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd34fa0257261b76964df1c98f44b3cb4ee14620", "tree": "1ca95857982b1625955885cb6fe1140a8d2d3df9", "parents": [ "5e939544f9d2b4d5c052a07cfcde97de44263946" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Jun 02 22:14:18 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:27 2026 -0700" }, "message": "mptcp: add-addr: always drop other suboptions\n\nWhen an ADD_ADDR needs to be sent, it could be prepared if there is\nenough remaining space and even if the packet is not a pure ACK. But it\nwould be dropped soon after.\n\nIndeed, in mptcp_pm_add_addr_signal(), there is enough space to fit a\nDSS of 20 octets and an ADD_ADDR echo containing an IPv4 address on 8\noctets for example. In this case, the packet would be prepared, the\nMPTCP_ADD_ADDR_ECHO bit would be removed from pm-\u003eaddr_signal, but the\noption would be silently dropped in mptcp_established_options_add_addr()\nnot to override DSS info in the union from \u0027struct mptcp_out_options\u0027,\nand also because mptcp_write_options() will enforce mutually exclusion\nwith DSS.\n\nInstead, don\u0027t even try to send an ADD_ADDR if it is not a pure ACK.\nRetry for each new packet until a pure-ACK is emitted. That\u0027s fine to do\nthat, because each time an ADD_ADDR (echo) is scheduled, a pure ACK is\nqueued.\n\nThis also simplifies the code, and the skb checks can be done earlier,\nbefore the lock.\n\nNote: also, since commit 6d0060f600ad (\"mptcp: Write MPTCP DSS headers\nto outgoing data packets\"), opts-\u003eahmac would not have been set to 0\nwhen other suboptions were not dropped, and when sending an ADD_ADDR\necho. That would have resulted in sending an ADD_ADDR using garbage\ninfo, where there was not enough space, instead of an echo one without\nthe ADD_ADDR HMAC.\n\nFixes: 1bff1e43a30e (\"mptcp: optimize out option generation\")\nCc: stable@vger.kernel.org\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-11-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e939544f9d2b4d5c052a07cfcde97de44263946", "tree": "55de690c25b4650d761af8132ac44b4b56504d40", "parents": [ "c378b1a6f8dd3e02eb08661f4d5d50f236eead03" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 02 22:14:17 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:27 2026 -0700" }, "message": "mptcp: fix uninit-value in mptcp_established_options\n\nsyzbot reported the following uninit splat:\n\n BUG: KMSAN: uninit-value in mptcp_write_data_fin net/mptcp/options.c:542 [inline]\n BUG: KMSAN: uninit-value in mptcp_established_options_dss net/mptcp/options.c:590 [inline]\n BUG: KMSAN: uninit-value in mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874\n mptcp_write_data_fin net/mptcp/options.c:542 [inline]\n mptcp_established_options_dss net/mptcp/options.c:590 [inline]\n mptcp_established_options+0x112f/0x3530 net/mptcp/options.c:874\n tcp_established_options+0x312/0xcc0 net/ipv4/tcp_output.c:1192\n __tcp_transmit_skb+0x5dc/0x5fe0 net/ipv4/tcp_output.c:1575\n __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499\n tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4505\n mptcp_subflow_shutdown+0x164/0x690 net/mptcp/protocol.c:3137\n mptcp_check_send_data_fin+0x31b/0x3d0 net/mptcp/protocol.c:3218\n __mptcp_wr_shutdown net/mptcp/protocol.c:3234 [inline]\n __mptcp_close+0x860/0x1360 net/mptcp/protocol.c:3313\n mptcp_close+0x42/0x260 net/mptcp/protocol.c:3367\n inet_release+0x1ee/0x2a0 net/ipv4/af_inet.c:442\n __sock_release net/socket.c:722 [inline]\n sock_close+0xd6/0x2f0 net/socket.c:1514\n __fput+0x60e/0x1010 fs/file_table.c:510\n ____fput+0x25/0x30 fs/file_table.c:538\n task_work_run+0x208/0x2b0 kernel/task_work.c:233\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]\n exit_to_user_mode_loop+0x306/0x1b60 kernel/entry/common.c:98\n __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]\n syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]\n __do_fast_syscall_32+0x2c7/0x460 arch/x86/entry/syscall_32.c:310\n do_fast_syscall_32+0x37/0x80 arch/x86/entry/syscall_32.c:332\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:370\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n\n Local variable opts created at:\n __tcp_transmit_skb+0x4d/0x5fe0 net/ipv4/tcp_output.c:1536\n __tcp_send_ack+0x967/0xad0 net/ipv4/tcp_output.c:4499\n\nThe output path currently omits initializing the mptcp extension\n`use_map` flag in a few corner cases.\n\nAddress the issue always zeroing all the extensions flags before\neventually initializing the individual bits. To that extent, introduce\nand use a struct_group to avoid multiple bitwise operations.\n\nFixes: cfcceb7a39fc (\"tcp: shrink per-packet memset in __tcp_transmit_skb()\")\nCc: stable@vger.kernel.org\nReported-by: syzbot+ff020673c5e3d94d9478@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dff020673c5e3d94d9478\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-10-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c378b1a6f8dd3e02eb08661f4d5d50f236eead03", "tree": "e5f78e704186d471de8765d19facf192e3b35fab", "parents": [ "7690137e70ab0fb1f8b5a30e6f087f8ee908b680" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Tue Jun 02 22:14:16 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "mptcp: check desc-\u003ecount in read_sock\n\n__tcp_read_sock() checks desc-\u003ecount after each skb is consumed and\nbreaks the loop when it reaches 0. The MPTCP variant lacks this check.\n\nThis is a functional bug, other subsystems also rely on this check:\nTLS strparser sets desc-\u003ecount to 0 once a full TLS record is assembled\nand depends on this break to stop reading.\n\nAdd the same desc-\u003ecount check to __mptcp_read_sock(), mirroring\n__tcp_read_sock().\n\nFixes: 250d9766a984 (\"mptcp: implement .read_sock\")\nCc: stable@vger.kernel.org\nCo-developed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-9-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7690137e70ab0fb1f8b5a30e6f087f8ee908b680", "tree": "cc221719cb221820fc3fab3788a36d4da90ba203", "parents": [ "57132affbc89c02e1bf73fdf5724311bdc9a29da" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Jun 02 22:14:15 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "mptcp: sockopt: set sockopt on all subflows\n\nThe mptcp_setsockopt_all_sf(), currently used only with TCP_MAXSEG,\nstopped when one subflow returned an error.\n\nEven if it is not wrong, this is different from the other helpers trying\nto set the option on all subflows, and then returning an error if at\nleast one of them had an issue.\n\nFollow this behaviour, for a question of uniformity.\n\nFixes: 51c5fd09e1b4 (\"mptcp: add TCP_MAXSEG sockopt support\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-8-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57132affbc89c02e1bf73fdf5724311bdc9a29da", "tree": "b3ee65f7b128916ef8815c28e467425dd5d2c46c", "parents": [ "06fd2bec7aebf393288e4b78924482fe170caabc" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Jun 02 22:14:14 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "mptcp: sockopt: check timestamping ret value\n\nsock_set_timestamping() can fail for different reasons. The returned\nvalue should then be checked.\n\nIf sock_set_timestamping() fails for at least one subflow, the first\nerror is now reported to the userspace, similar to what is done with\nother socket options.\n\nFixes: 9061f24bf82e (\"mptcp: sockopt: propagate timestamp request to subflows\")\nCc: stable@vger.kernel.org\nReported-by: Willem de Bruijn \u003cwillemdebruijn.kernel@gmail.com\u003e\nCloses: https://lore.kernel.org/willemdebruijn.kernel.178a41a53d041@gmail.com\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-7-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "06fd2bec7aebf393288e4b78924482fe170caabc", "tree": "5352ee7515b4a77e14e01e0ccdd0a068cb15aa42", "parents": [ "14e9fea30b68fc75b2b3d97396a7e6adb544bd2a" ], "author": { "name": "Tao Cui", "email": "cuitao@kylinos.cn", "time": "Tue Jun 02 22:14:13 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "selftests: mptcp: add test for extra_subflows underflow on userspace PM\n\nAdd a test to verify that when userspace PM fails to create a subflow\n(e.g. using an unreachable address), the extra_subflows counter is not\ndecremented below zero.\n\nFixes: 77e4b94a3de6 (\"mptcp: update userspace pm infos\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-6-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14e9fea30b68fc75b2b3d97396a7e6adb544bd2a", "tree": "91a01a8dfe7cc58ba824527c3ac42704f4bfa186", "parents": [ "da23be77e1292cd611e736c3aa17da633d7ddce7" ], "author": { "name": "Tao Cui", "email": "cuitao@kylinos.cn", "time": "Tue Jun 02 22:14:12 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation\n\nThe userspace PM increments extra_subflows after __mptcp_subflow_connect()\nsucceeds, but __mptcp_subflow_connect() calls mptcp_pm_close_subflow()\non failure to roll back the pre-increment done by the kernel PM\u0027s fill_*()\nhelpers. Because the userspace PM hasn\u0027t incremented yet at that point,\nthis decrement is spurious and causes extra_subflows to underflow.\n\nFix it by aligning the userspace PM with the kernel PM: increment\nextra_subflows before calling __mptcp_subflow_connect(), so the existing\nerror path in subflow.c correctly rolls it back on failure. Also simplify\nthe error handling by taking pm.lock only when needed for cleanup.\n\nFixes: 77e4b94a3de6 (\"mptcp: update userspace pm infos\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-5-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "da23be77e1292cd611e736c3aa17da633d7ddce7", "tree": "8b45701448bb6d7c5f6562e3be993670b8eed843", "parents": [ "8ab24fdebc369c0dfb90f82c1650b1e66662bb45" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 02 22:14:11 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:26 2026 -0700" }, "message": "mptcp: allow subflow rcv wnd to shrink\n\nIn MPTCP connection, the `window` field in the TCP header refers to the\nMPTCP-level rcv_nxt and it\u0027s right edge should not move backward. Such\nconstraint is enforced at DSS option generation time.\n\nAt the same time, the TCP stack ensures independently that the TCP-level\nrcv wnd right\u0027s edge does not move backward. That in turn causes artificial\ninflating of the MPTCP rcv window when the incoming data is acked at the\nTCP level and is OoO in the MPTCP sequence space (or lands in the backlog).\n\nAs a consequence, the incoming traffic can exceed the receiver rcvbuf size\neven when the sender is not misbehaving.\n\nPrevent such scenario forcibly allowing the TCP subflow to shrink the\nTCP-level rcv wnd regardless of the current netns setting.\n\nFixes: f3589be0c420 (\"mptcp: never shrink offered window\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-4-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8ab24fdebc369c0dfb90f82c1650b1e66662bb45", "tree": "9ced6f920f4b79e73519968054ae4a68886c3670", "parents": [ "d1918b36edcaed0ec4ef6888b2358c6b1ddcff47" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 02 22:14:10 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:25 2026 -0700" }, "message": "mptcp: close TOCTOU race while computing rcv_wnd\n\nThe MPTCP output path access locklessly the MPTCP-level ack_seq\nin multiple times, using possibly different values for the data_ack\nin the DSS option and to compute the announced rcv wnd for the same\npacket.\n\nRefactor the cote to avoid inconsistencies which may confuse the\npeer. Also ensure that the MPTCP level rcv wnd is updated only when\nthe egress packet actually contains a DSS ack.\n\nFixes: fa3fe2b15031 (\"mptcp: track window announced to peer\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-3-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d1918b36edcaed0ec4ef6888b2358c6b1ddcff47", "tree": "da8c2655fca3d861f9bea20e6ba3c8a0a395980a", "parents": [ "9d8d28738f24b75616d6ca7a27cb4aed88520343" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 02 22:14:09 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:25 2026 -0700" }, "message": "mptcp: fix retransmission loop when csum is enabled\n\nSashiko noted that retransmission with csum enabled can actually\ntransmit new data, but currently the relevant code does not update\naccordingly snd_nxt.\n\nThe may cause incoming ack drop and an endless retransmission loop.\n\nAddress the issue incrementing snd_nxt as needed.\n\nFixes: 4e14867d5e91 (\"mptcp: tune re-injections for csum enabled mode\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-2-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9d8d28738f24b75616d6ca7a27cb4aed88520343", "tree": "6f8b1c05f45a06c3f90c6a286c73339cc2fb0f7f", "parents": [ "672bd0519e27c357c43b7f8c0d653fce3817d06e" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jun 02 22:14:08 2026 +1000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 19:04:25 2026 -0700" }, "message": "mptcp: fix missing wakeups in edge scenarios\n\nThe mptcp_recvmsg() can fill MPTCP socket receive queue via\nmptcp_move_skbs(), but currently does not try to wakeup any listener,\nbecause the same process is going to check the receive queue soon.\n\nWhen multiple threads are reading from the same fd, the above can\ncause stall. Add the missing wakeup.\n\nFixes: 6771bfd9ee24 (\"mptcp: update mptcp ack sequence from work queue\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260602-net-mptcp-misc-fixes-7-1-rc7-v2-1-856831229976@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "672bd0519e27c357c43b7f8c0d653fce3817d06e", "tree": "1846fe3f96a8d59ad4a3e32cb8e5abf00458ea96", "parents": [ "d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c" ], "author": { "name": "Kurt Kanzenbach", "email": "kurt@linutronix.de", "time": "Fri May 29 19:11:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 18:58:54 2026 -0700" }, "message": "ptp: vclock: Switch from RCU to SRCU\n\nThe usage of PTP vClocks leads immediately to the following issues with\nptp4l with LOCKDEP and DEBUG_ATOMIC_SLEEP enabled: \"BUG: sleeping function\ncalled from invalid context\".\n\nptp_convert_timestamp() acquires a mutex_t within a RCU read section. This\nis illegal, because acquiring a mutex_t can result in voluntary scheduling\nrequest which is not allowed within a RCU read section.\n\nReplace the RCU usage with SRCU where sleeping is allowed.\n\nReported-by: Florian Zeitz \u003cflorian.zeitz@schettke.com\u003e\nCloses: https://lore.kernel.org/all/00a8cce8-410e-4038-98af-49be6d93d7bd@schettke.com/\nFixes: 67d93ffc0f3c (\"ptp: vclock: use mutex to fix \"sleep on atomic\" bug\")\nSigned-off-by: Kurt Kanzenbach \u003ckurt@linutronix.de\u003e\nReviewed-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nLink: https://patch.msgid.link/20260529-vclock_rcu-v2-1-02a5531fab92@linutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c", "tree": "177165bb241519138849933d95bdf99ebbddd845", "parents": [ "c8e14cc9ccf999336d65bd3f638329e8bb7800ef" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jun 02 16:15:47 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 18:53:14 2026 -0700" }, "message": "ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\nThis patch restricts setting Loose Source and Record Route (LSRR)\nand Strict Source and Record Route (SSRR) IP options to users\nwith CAP_NET_RAW capability.\n\nThis prevents unprivileged applications from forcing packets to route\nthrough attacker-controlled nodes to leak TCP ISN and possibly other\nprotocol information.\n\nWhile LSRR and SSRR are commonly filtered in many network environments,\nthey may still be supported and forwarded along some network paths.\n\nRFC 7126 (Recommendations on Filtering of IPv4 Packets Containing\nIPv4 Options) recommend to drop these options in 4.3 and 4.4.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Tamir Shahar \u003ctamirthesis@gmail.com\u003e\nReported-by: Amit Klein \u003caksecurity@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260602161547.2642155-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c8e14cc9ccf999336d65bd3f638329e8bb7800ef", "tree": "9dbbd2b8dd8e1dad1675e68f5aa0fef199fe5896", "parents": [ "9a85ec3dc28b6df246801c19e4d9bae6297a25b0", "dd8975ad710ea1f3d7c7a36295072fd5ee59ca0a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 18:52:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jun 03 18:52:29 2026 -0700" }, "message": "Merge branch \u0027af_unix-fix-inq_len-update-issue\u0027\n\nJianyu Li says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\naf_unix: Fix inq_len update issue\n\nFrom: Jianyu Li \u003cjianyu.li@mediatek.com\u003e\n\nThis series fix the problem that inq_len is inconsistent with\nactual remaining byte count when only part of a skb is consumed.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260601113640.231897-1-jianyu.li@mediatek.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "dd8975ad710ea1f3d7c7a36295072fd5ee59ca0a" }