)]}' { "log": [ { "commit": "591cd656a1bf5ea94a222af5ef2ee76df029c1d2", "tree": "d2a02c7eefde8d5525e2df2f8286f1ca2ad334d2", "parents": [ "85fb6da43ac58dc7d1a6242e7b2102fd1d4954bc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 15:26:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 15:26:23 2026 -0700" }, "message": "Linux 7.0-rc7\n" }, { "commit": "85fb6da43ac58dc7d1a6242e7b2102fd1d4954bc", "tree": "d1abaff066cc387f5a7264ece5cdf4ea24cef15f", "parents": [ "10b76a429a8716545cd6dcaf4578594e74dcd21b", "9156585280f161fc1c3552cf1860559edb2bb7e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 14:43:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 14:43:47 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n\n - Fix a CONFIG_SPARSEMEM crash on RV32 by avoiding early phys_to_page()\n\n - Prevent runtime const infrastructure from being used by modules,\n similar to what was done for x86\n\n - Avoid problems when shutting down ACPI systems with IOMMUs by adding\n a device dependency between IOMMU and devices that use it\n\n - Fix a bug where the CPU pointer masking state isn\u0027t properly reset\n when tagged addresses aren\u0027t enabled for a task\n\n - Fix some incorrect register assignments, and add some missing ones,\n in kgdb support code\n\n - Fix compilation of non-kernel code that uses the ptrace uapi header\n by replacing BIT() with _BITUL()\n\n - Fix compilation of the validate_v_ptrace kselftest by working around\n kselftest macro expansion issues\n\n* tag \u0027riscv-for-linus-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n ACPI: RIMT: Add dependency between iommu and devices\n selftests: riscv: Add braces around EXPECT_EQ()\n riscv: use _BITUL macro rather than BIT() in ptrace uapi and kselftests\n riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set\n riscv: make runtime const not usable by modules\n riscv: patch: Avoid early phys_to_page()\n riscv: kgdb: fix several debug register assignment bugs\n" }, { "commit": "10b76a429a8716545cd6dcaf4578594e74dcd21b", "tree": "0ce3cbf3e29de31eed3c837a57fd0e2b70a37e5b", "parents": [ "2ab99ad7faef1f0a4529e8bae92009fa56242bd4", "b981e9e94c687b7b19ae8820963f005b842cb2f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:53:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:53:07 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix kexec crash on KCOV-instrumented kernels (Aleksandr Nogikh)\n\n - Fix Geode platform driver on-stack property data use-after-return\n bug (Dmitry Torokhov)\n\n* tag \u0027x86-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/platform/geode: Fix on-stack property data use-after-return bug\n x86/kexec: Disable KCOV instrumentation after load_segments()\n" }, { "commit": "2ab99ad7faef1f0a4529e8bae92009fa56242bd4", "tree": "1119fd3ab17f538c3395c2ff31abe8fdb7c9b96d", "parents": [ "7bba6c86225cc3fb54876b50ee74773538079e2c", "e08d007f9d813616ce7093600bc4fdb9c9d81d89" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:45:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:45:37 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix zero_vruntime tracking again (Peter Zijlstra)\n\n - Fix avg_vruntime() usage in sched_debug (Peter Zijlstra)\n\n* tag \u0027sched-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/debug: Fix avg_vruntime() usage\n sched/fair: Fix zero_vruntime tracking fix\n" }, { "commit": "7bba6c86225cc3fb54876b50ee74773538079e2c", "tree": "39bc6a943a1037c1cf3e8d9834d290580e97f208", "parents": [ "1391af03649278921a3b62cec4497fa23a587229", "dbde07f06226438cd2cf1179745fa1bec5d8914a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:43:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:43:26 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fix from Ingo Molnar:\n\n - Fix potential bad container_of() in intel_pmu_hw_config() (Ian\n Rogers)\n\n* tag \u0027perf-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86: Fix potential bad container_of in intel_pmu_hw_config\n" }, { "commit": "1391af03649278921a3b62cec4497fa23a587229", "tree": "22f9da2a4b3f01c7625ff226371b5695dfba93aa", "parents": [ "5401b9adebc9e5f68df58226f51493ef0e6ceb4d", "af416cd9b3fb9d17ac7f4cfa12d1ea83dfd0e4be" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:40:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 13:40:58 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fix from Ingo Molnar:\n\n - Fix RISC-V APLIC irqchip driver setup errors on ACPI systems (Jessica\n Liu)\n\n* tag \u0027irq-urgent-2026-04-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/riscv-aplic: Restrict genpd notifier to device tree only\n" }, { "commit": "5401b9adebc9e5f68df58226f51493ef0e6ceb4d", "tree": "a743fde152e65e85bb255b2662d83295af74c2d1", "parents": [ "eb3765aa711ff93664cd5ffcf0c2df02da2d9c26" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 12:42:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 12:42:25 2026 -0700" }, "message": "i915: don\u0027t use a vma that didn\u0027t match the context VM\n\nIn eb_lookup_vma(), the code checks that the context vm matches before\nincrementing the i915 vma usage count, but for the non-matching case it\ndidn\u0027t clear the non-matching vma pointer, so it would then mistakenly\nbe returned, causing potential UaF and refcount issues.\n\nReported-by: Yassine Mounir \u003csosohero200@gmail.com\u003e\nSuggested-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "eb3765aa711ff93664cd5ffcf0c2df02da2d9c26", "tree": "eed6a30457abd7c455c5319297a350039ccd581c", "parents": [ "1791c390149f56313c425e8add1fd15baf40afb8", "01cc50ea5167bb14117257ec084637abe9e5f691" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 11:29:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 11:29:07 2026 -0700" }, "message": "Merge tag \u0027mips-fixes_7.0_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS fixes from Thomas Bogendoerfer:\n\n - Fix TLB uniquification for systems with TLB not initialised by\n firmware\n\n - Fix allocation in TLB uniquification\n\n - Fix SiByte cache initialisation\n\n - Check uart parameters from firmware on Loongson64 systems\n\n - Fix clock id mismatch for Ralink SoCs\n\n - Fix GCC version check for __mutli3 workaround\n\n* tag \u0027mips-fixes_7.0_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:\n mips: mm: Allocate tlb_vpn array atomically\n MIPS: mm: Rewrite TLB uniquification for the hidden bit feature\n MIPS: mm: Suppress TLB uniquification on EHINV hardware\n MIPS: Always record SEGBITS in cpu_data.vmbits\n MIPS: Fix the GCC version check for `__multi3\u0027 workaround\n MIPS: SiByte: Bring back cache initialisation\n mips: ralink: update CPU clock index\n MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously\n" }, { "commit": "1791c390149f56313c425e8add1fd15baf40afb8", "tree": "7a5ad3d2f0b3c9026c84badde1519f55333d568e", "parents": [ "7a60c79bd0547adba3cefde40ced4a1f376305be", "f387e2e2b9d302688dbdceebe9aade221c90f09e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:09:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:09:33 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc/iio driver fixes from Greg KH:\n \"Here are a relativly large number of small char/misc/iio and other\n driver fixes for 7.0-rc7. There\u0027s a bunch, but overall they are all\n small fixes for issues that people have been having that I finally\n caught up with getting merged due to delays on my end.\n\n The \"largest\" change overall is just some documentation updates to the\n security-bugs.rst file to hopefully tell the AI tools (and any users\n that actually read the documentation), how to send us better security\n bug reports as the quantity of reports these past few weeks has\n increased dramatically due to tools getting better at \"finding\"\n things.\n\n Included in here are:\n - lots of small IIO driver fixes for issues reported in 7.0-rc\n - gpib driver fixes\n - comedi driver fixes\n - interconnect driver fix\n - nvmem driver fixes\n - mei driver fix\n - counter driver fix\n - binder rust driver fixes\n - some other small misc driver fixes\n\n All of these have been in linux-next this week with no reported issues\"\n\n* tag \u0027char-misc-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits)\n Documentation: fix two typos in latest update to the security report howto\n Documentation: clarify the mandatory and desirable info for security reports\n Documentation: explain how to find maintainers addresses for security reports\n Documentation: minor updates to the security contacts\n .get_maintainer.ignore: add myself\n nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy\n nvmem: imx: assign nvmem_cell_info::raw_len\n misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe\n misc: fastrpc: possible double-free of cctx-\u003eremote_heap\n comedi: dt2815: add hardware detection to prevent crash\n comedi: runflags cannot determine whether to reclaim chanlist\n comedi: Reinit dev-\u003espinlock between attachments to low-level drivers\n comedi: me_daq: Fix potential overrun of firmware buffer\n comedi: me4000: Fix potential overrun of firmware buffer\n comedi: ni_atmio16d: Fix invalid clean-up after failed attach\n gpib: fix use-after-free in IO ioctl handlers\n gpib: lpvo_usb: fix memory leak on disconnect\n gpib: Fix fluke driver s390 compile issue\n lis3lv02d: Omit IRQF_ONESHOT if no threaded handler is provided\n lis3lv02d: fix kernel-doc warnings\n ...\n" }, { "commit": "7a60c79bd0547adba3cefde40ced4a1f376305be", "tree": "b64c95c7da00ebe5005c43839a3129f64cd4e892", "parents": [ "aea7c84f28f1117653f7443806905d7aeef13ba8", "3ddbea7542ae529c1a88ef9a8b1ce169126211f6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:04:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:04:28 2026 -0700" }, "message": "Merge tag \u0027tty-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty fixes from Greg KH:\n \"Here are two small tty vt fixes for 7.0-rc7 to resolve some reported\n issues with the resize ability of the alt screen buffer. Both of these\n have been in linux-next all week with no reported issues\"\n\n* tag \u0027tty-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n vt: resize saved unicode buffer on alt screen exit after resize\n vt: discard stale unicode buffer on alt screen exit after resize\n" }, { "commit": "aea7c84f28f1117653f7443806905d7aeef13ba8", "tree": "60d0eb2902c68386671299f702e947dbbc57a14d", "parents": [ "3aae9383f42f687221c011d7ee87529398e826b3", "bf3781a35c27978341c31f59f1460dcaabf2e726" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:00:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 05 10:00:26 2026 -0700" }, "message": "Merge tag \u0027usb-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB/Thunderbolt fixes from Greg KH:\n \"Here are a bunch of USB and Thunderbolt fixes (most all are USB) for\n 7.0-rc7. More than I normally like this late in the release cycle,\n partly due to my recent travels, and partly due to people banging away\n on the USB gadget interfaces and apis more than normal (big shoutout\n to Android for getting the vendors to actually work upstream on this,\n that\u0027s a huge win overall for everyone here)\n\n Included in here are:\n - Small thunderbolt fix\n - new USB serial driver ids added\n - typec driver fixes\n - gadget driver fixes for some disconnect issues\n - other usb gadget driver fixes for reported problems with binding\n and unbinding devices as happens when a gadget device connects /\n disconnects from a system it is plugged into (or it switches device\n mode at a user\u0027s request, these things are complex little\n beasts...)\n - usb offload fixes (where USB audio tunnels through the controller\n while the main CPU is asleep) for when EMP spikes hit the system\n causing disconnects to happen (as often happens with static\n electricity in the winter months). This has been much reported by\n at least one vendor, and resolves the issues they have been seeing\n with this codepath. Can\u0027t wait for the \"formal methods are the\n answer!\" people to try to model that one properly...\n - Other small usb driver fixes for issues reported.\n\n All of these have been in linux-next this week, and before, with no\n reported issues, and I\u0027ve personally been stressing these harder than\n normal on my systems here with no problems\"\n\n* tag \u0027usb-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (39 commits)\n usb: gadget: f_hid: move list and spinlock inits from bind to alloc\n usb: host: xhci-sideband: delegate offload_usage tracking to class drivers\n usb: core: use dedicated spinlock for offload state\n usb: cdns3: gadget: fix state inconsistency on gadget init failure\n usb: dwc3: imx8mp: fix memory leak on probe failure path\n usb: gadget: f_uac1_legacy: validate control request size\n usb: ulpi: fix double free in ulpi_register_interface() error path\n usb: misc: usbio: Fix URB memory leak on submit failure\n USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam\n usb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n usb: core: phy: avoid double use of \u0027usb3-phy\u0027\n USB: serial: option: add MeiG Smart SRM825WN\n usb: gadget: f_rndis: Fix net_device lifecycle with device_move\n usb: gadget: f_subset: Fix net_device lifecycle with device_move\n usb: gadget: f_eem: Fix net_device lifecycle with device_move\n usb: gadget: f_ecm: Fix net_device lifecycle with device_move\n usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts\n usb: gadget: f_rndis: Protect RNDIS options with mutex\n usb: gadget: f_subset: Fix unbalanced refcnt in geth_free\n dt-bindings: connector: add pd-disable dependency\n ...\n" }, { "commit": "9156585280f161fc1c3552cf1860559edb2bb7e3", "tree": "4d0b027cc080371223a0d8dd2c241a07ce7fe5f6", "parents": [ "511361fe7a8856e2f415010942808c237a1b8061" ], "author": { "name": "Sunil V L", "email": "sunilvl@oss.qualcomm.com", "time": "Tue Mar 03 11:46:05 2026 +0530" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:38:03 2026 -0600" }, "message": "ACPI: RIMT: Add dependency between iommu and devices\n\nEPROBE_DEFER ensures IOMMU devices are probed before the devices that\ndepend on them. During shutdown, however, the IOMMU may be removed\nfirst, leading to issues. To avoid this, a device link is added\nwhich enforces the correct removal order.\n\nFixes: 8f7729552582 (\"ACPI: RISC-V: Add support for RIMT\")\nSigned-off-by: Sunil V L \u003csunilvl@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "511361fe7a8856e2f415010942808c237a1b8061", "tree": "54b05b9834121f82f9bdb8a5741c195407f23c8a", "parents": [ "87ad7cc9aa7f0a202189640c5015aa985e7e8f3b" ], "author": { "name": "Charlie Jenkins", "email": "thecharlesjenkins@gmail.com", "time": "Mon Mar 09 18:52:11 2026 -0700" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:37:57 2026 -0600" }, "message": "selftests: riscv: Add braces around EXPECT_EQ()\n\nEXPECT_EQ() expands to multiple lines, breaking up one-line if\nstatements. This issue was not present in the patch on the mailing list\nbut was instead introduced by the maintainer when attempting to fix up\ncheckpatch warnings. Add braces around EXPECT_EQ() to avoid the error\neven though checkpatch suggests them to be removed:\n\nvalidate_v_ptrace.c:626:17: error: ‘else’ without a previous ‘if’\n\nFixes: 3789d5eecd5a (\"selftests: riscv: verify syscalls discard vector context\")\nFixes: 30eb191c895b (\"selftests: riscv: verify ptrace rejects invalid vector csr inputs\")\nFixes: 849f05ae1ea6 (\"selftests: riscv: verify ptrace accepts valid vector csr values\")\nSigned-off-by: Charlie Jenkins \u003cthecharlesjenkins@gmail.com\u003e\nReviewed-and-tested-by: Sergey Matyukevich \u003cgeomatsi@gmail.com\u003e\nLink: https://patch.msgid.link/20260309-fix_selftests-v2-2-9d5a553a531e@gmail.com\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "87ad7cc9aa7f0a202189640c5015aa985e7e8f3b", "tree": "a1dff0c8edab00437c9f458416229c24ab6e4c87", "parents": [ "3033b2b1e3949274f33a140e2a97571b5a307298" ], "author": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Thu Apr 02 17:18:03 2026 -0600" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:37:54 2026 -0600" }, "message": "riscv: use _BITUL macro rather than BIT() in ptrace uapi and kselftests\n\nFix the build of non-kernel code that includes the RISC-V ptrace uapi\nheader, and the RISC-V validate_v_ptrace.c kselftest, by using the\n_BITUL() macro rather than BIT(). BIT() is not available outside\nthe kernel.\n\nBased on patches and comments from Charlie Jenkins, Michael Neuling,\nand Andreas Schwab.\n\nFixes: 30eb191c895b (\"selftests: riscv: verify ptrace rejects invalid vector csr inputs\")\nFixes: 2af7c9cf021c (\"riscv/ptrace: expose riscv CFI status and state via ptrace and in core files\")\nCc: Andreas Schwab \u003cschwab@suse.de\u003e\nCc: Michael Neuling \u003cmikey@neuling.org\u003e\nCc: Charlie Jenkins \u003cthecharlesjenkins@gmail.com\u003e\nLink: https://patch.msgid.link/20260330024248.449292-1-mikey@neuling.org\nLink: https://lore.kernel.org/linux-riscv/20260309-fix_selftests-v2-1-9d5a553a531e@gmail.com/\nLink: https://lore.kernel.org/linux-riscv/20260309-fix_selftests-v2-3-9d5a553a531e@gmail.com/\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "3033b2b1e3949274f33a140e2a97571b5a307298", "tree": "d445b2dffc12970d6e0d903d3c2144bd5e495c71", "parents": [ "57f0253bc1538446ee46a4550fe85d91235fb678" ], "author": { "name": "Zishun Yi", "email": "vulab@iscas.ac.cn", "time": "Mon Mar 23 00:00:22 2026 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:37:45 2026 -0600" }, "message": "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set\n\nIn set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen\nis correctly set to 0, but it forgets to reset pmm. This results in the\nCPU pmm state not corresponding to the software pmlen state.\n\nFix this by resetting pmm along with pmlen.\n\nFixes: 2e1743085887 (\"riscv: Add support for the tagged address ABI\")\nSigned-off-by: Zishun Yi \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Samuel Holland \u003csamuel.holland@sifive.com\u003e\nLink: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "57f0253bc1538446ee46a4550fe85d91235fb678", "tree": "8d6cce9c7cfb99a0152731f7b63e5b7a5eb45c02", "parents": [ "6b60a128c2f43180664a614830f3c529497e0394" ], "author": { "name": "Jisheng Zhang", "email": "jszhang@kernel.org", "time": "Sat Feb 21 10:37:31 2026 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:37:31 2026 -0600" }, "message": "riscv: make runtime const not usable by modules\n\nSimilar as commit 284922f4c563 (\"x86: uaccess: don\u0027t use runtime-const\nrewriting in modules\") does, make riscv\u0027s runtime const not usable by\nmodules too, to \"make sure this doesn\u0027t get forgotten the next time\nsomebody wants to do runtime constant optimizations\". The reason is\nwell explained in the above commit: \"The runtime-const infrastructure\nwas never designed to handle the modular case, because the constant\nfixup is only done at boot time for core kernel code.\"\n\nSigned-off-by: Jisheng Zhang \u003cjszhang@kernel.org\u003e\nLink: https://patch.msgid.link/20260221023731.3476-1-jszhang@kernel.org\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "6b60a128c2f43180664a614830f3c529497e0394", "tree": "5f5419dd65397cab89fec2229c6d4528b1b5ed39", "parents": [ "834911eb8eef2501485d819b4eabebadc25c3497" ], "author": { "name": "Vivian Wang", "email": "wangruikang@iscas.ac.cn", "time": "Mon Mar 23 17:43:47 2026 -0600" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:37:03 2026 -0600" }, "message": "riscv: patch: Avoid early phys_to_page()\n\nSimilarly to commit 8d09e2d569f6 (\"arm64: patching: avoid early\npage_to_phys()\"), avoid using phys_to_page() for the kernel address case\nin patch_map().\n\nSince this is called from apply_boot_alternatives() in setup_arch(), and\ncommit 4267739cabb8 (\"arch, mm: consolidate initialization of SPARSE\nmemory model\") has moved sparse_init() to after setup_arch(),\nphys_to_page() is not available there yet, and it panics on boot with\nSPARSEMEM on RV32, which does not use SPARSEMEM_VMEMMAP.\n\nReported-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nCloses: https://lore.kernel.org/r/20260223144108-dcace0b9-02e8-4b67-a7ce-f263bed36f26@linutronix.de/\nFixes: 4267739cabb8 (\"arch, mm: consolidate initialization of SPARSE memory model\")\nSuggested-by: Mike Rapoport \u003crppt@kernel.org\u003e\nSigned-off-by: Vivian Wang \u003cwangruikang@iscas.ac.cn\u003e\nAcked-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nTested-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nLink: https://patch.msgid.link/20260310-riscv-sparsemem-alternatives-fix-v1-1-659d5dd257e2@iscas.ac.cn\n[pjw@kernel.org: fix the subject line to align with the patch description]\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e\n" }, { "commit": "834911eb8eef2501485d819b4eabebadc25c3497", "tree": "014eaa518592b4d9a903ad9cec11146bd51be1c6", "parents": [ "c369299895a591d96745d6492d4888259b004a9e" ], "author": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Mon Mar 23 17:43:47 2026 -0600" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Sat Apr 04 18:36:52 2026 -0600" }, "message": "riscv: kgdb: fix several debug register assignment bugs\n\nFix several bugs in the RISC-V kgdb implementation:\n\n- The element of dbg_reg_def[] that is supposed to pertain to the S1\n register embeds instead the struct pt_regs offset of the A1\n register. Fix this to use the S1 register offset in struct pt_regs.\n\n- The sleeping_thread_to_gdb_regs() function copies the value of the\n S10 register into the gdb_regs[] array element meant for the S9\n register, and copies the value of the S11 register into the array\n element meant for the S10 register. It also neglects to copy the\n value of the S11 register. Fix all of these issues.\n\nFixes: fe89bd2be8667 (\"riscv: Add KGDB support\")\nCc: Vincent Chen \u003cvincent.chen@sifive.com\u003e\nLink: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e\n" }, { "commit": "3aae9383f42f687221c011d7ee87529398e826b3", "tree": "8a51a77273c2f101c43f55da9f6e7abba010f04c", "parents": [ "7ca6d1cfec80ebe46cc063f3284c5896c344d9a1", "0d9363a764d9d601a05591f9695cea8b429e9be3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 04 08:24:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 04 08:24:32 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - new IDs for BETOP BTP-KP50B/C and Razer Wolverine V3 Pro added to\n xpad controller driver\n\n - another quirk for new TUXEDO InfinityBook added to i8042\n\n - a small fixup for Synaptics RMI4 driver to properly unlock mutex when\n encountering an error in F54\n\n - an update to bcm5974 touch controller driver to reliably switch into\n wellspring mode\n\n* tag \u0027input-for-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: xpad - add support for BETOP BTP-KP50B/C controller\u0027s wireless mode\n Input: xpad - add support for Razer Wolverine V3 Pro\n Input: synaptics-rmi4 - fix a locking bug in an error path\n Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table\n Input: bcm5974 - recover from failed mode switch\n" }, { "commit": "f387e2e2b9d302688dbdceebe9aade221c90f09e", "tree": "1fa32940c13d76ae4bed13eb67cf6f2ff2a0ca51", "parents": [ "496fa1befba1e8ff149af5120cd9c9616bb05120" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Sat Apr 04 10:20:33 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Apr 04 10:38:43 2026 +0200" }, "message": "Documentation: fix two typos in latest update to the security report howto\n\nIn previous patch \"Documentation: clarify the mandatory and desirable\ninfo for security reports\" I left two typos that I didn\u0027t detect in local\nchecks. One is \"get_maintainers.pl\" (no \u0027s\u0027 in the script name), and the\nother one is a missing closing quote after \"Reported-by\", which didn\u0027t\nhave effect here but I don\u0027t know if it can break rendering elsewhere\n(e.g. on the public HTML page). Better fix it before it gets merged.\n\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nLink: https://patch.msgid.link/20260404082033.5160-1-w@1wt.eu\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0d9363a764d9d601a05591f9695cea8b429e9be3", "tree": "d112cdf7dc96a17e97d40fa9c17aaf99c174476d", "parents": [ "e2b0ae529db4766584e77647cefe3ec15c3d842e" ], "author": { "name": "Shengyu Qu", "email": "wiagn233@outlook.com", "time": "Fri Apr 03 22:07:28 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Apr 03 22:37:30 2026 -0700" }, "message": "Input: xpad - add support for BETOP BTP-KP50B/C controller\u0027s wireless mode\n\nBETOP\u0027s BTP-KP50B and BTP-KP50C controller\u0027s wireless dongles are both\nworking as standard Xbox 360 controllers. Add USB device IDs for them to\nxpad driver.\n\nSigned-off-by: Shengyu Qu \u003cwiagn233@outlook.com\u003e\nLink: https://patch.msgid.link/TY4PR01MB14432B4B298EA186E5F86C46B9855A@TY4PR01MB14432.jpnprd01.prod.outlook.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "e2b0ae529db4766584e77647cefe3ec15c3d842e", "tree": "1c3a44d15478accd0da8e0863a6d775c3adf5b2a", "parents": [ "7adaaee5edd35a423ae199c41b86bd1ed60ed483" ], "author": { "name": "Zoltan Illes", "email": "zoliviragh@gmail.com", "time": "Fri Apr 03 22:03:42 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Apr 03 22:37:29 2026 -0700" }, "message": "Input: xpad - add support for Razer Wolverine V3 Pro\n\nAdd device IDs for the Razer Wolverine V3 Pro controller in both\nwired (0x0a57) and wireless 2.4 GHz dongle (0x0a59) modes.\n\nThe controller uses the Xbox 360 protocol (vendor-specific class,\nsubclass 93, protocol 1) on interface 0 with an identical 20-byte\ninput report layout, so no additional processing is needed.\n\nSigned-off-by: Zoltan Illes \u003czoliviragh@gmail.com\u003e\nLink: https://patch.msgid.link/20260329220031.1325509-1-137647604+ZlordHUN@users.noreply.github.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "7ca6d1cfec80ebe46cc063f3284c5896c344d9a1", "tree": "546747636281792bda7de2647638933c1fb877df", "parents": [ "3719114091cea0d3a896581e4fe5bed4eba4604b", "328335a79487ec38d6b0e1aa807785b0f75e594d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 20:08:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 20:08:25 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fix from Madhavan Srinivasan:\n\n - fix iommu incorrectly bypassing DMA APIs\n\nThanks to Dan Horak, Gaurav Batra, and Ritesh Harjani (IBM).\n\n* tag \u0027powerpc-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs\n" }, { "commit": "3719114091cea0d3a896581e4fe5bed4eba4604b", "tree": "5cc0790456484e81b25891fc9c2304371fb3cd8f", "parents": [ "1523e4d567f119ad859783b314b5d1312ebf8281", "c8d46f17c2fc7d25c18e60c008928aecab26184d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 17:50:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 17:50:24 2026 -0700" }, "message": "Merge tag \u0027s390-7.0-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix a memory leak in the zcrypt driver where the AP message buffer\n for clear key RSA requests was allocated twice, once by the caller\n and again locally, causing the first allocation to never be freed\n\n - Fix the cpum_sf perf sampling rate overflow adjustment to clamp the\n recalculated rate to the hardware maximum, preventing exceptions on\n heavily loaded systems running with HZ\u003d1000\n\n* tag \u0027s390-7.0-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/zcrypt: Fix memory leak with CCA cards used as accelerator\n s390/cpum_sf: Cap sampling rate to prevent lsctl exception\n" }, { "commit": "1523e4d567f119ad859783b314b5d1312ebf8281", "tree": "36708c81c4f4bf37a106953393223b0790f1a841", "parents": [ "631919fb12fe7b1f0453fe1035e62ce704bc3923", "cffff6df669a438ecac506dadd49a53d4475a796" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 17:13:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 17:13:59 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - Fix temperature sensor for PRIME X670E-PRO WIFI\n\n - occ: Add missing newline, and fix potential division by zero\n\n - pmbus:\n - Fix device ID comparison and printing in tps53676_identify()\n - Add missing MODULE_IMPORT_NS(\"PMBUS\") for ltc4286\n - Check return value of page-select write in pxe1610 probe\n - Fix array access with zero-length block tps53679 read\n\n* tag \u0027hwmon-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI\n hwmon: (occ) Fix missing newline in occ_show_extended()\n hwmon: (occ) Fix division by zero in occ_show_power_1()\n hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()\n hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\")\n hwmon: (pxe1610) Check return value of page-select write in probe\n hwmon: (tps53679) Fix array access with zero-length block read\n" }, { "commit": "631919fb12fe7b1f0453fe1035e62ce704bc3923", "tree": "77e9b79bc365f83b980b26bf5e915ef2f3a25666", "parents": [ "e41255ce7acc4a3412ecdaa74b32deee980d27f7", "7e0ffb72de8aa3b25989c2d980e81b829c577010" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 12:05:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 12:05:06 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.0-rc6-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n \"These are late but both fix subtle yet critical problems and the blast\n radius is limited strictly to sched_ext.\n\n - Fix stale direct dispatch state in ddsp_dsq_id which can cause\n spurious warnings in mark_direct_dispatch() on task wakeup\n\n - Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU\n configs which can lead to incorrectly dispatching migration-\n disabled tasks to remote CPUs\"\n\n* tag \u0027sched_ext-for-7.0-rc6-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU\n" }, { "commit": "e41255ce7acc4a3412ecdaa74b32deee980d27f7", "tree": "ec79fac775fd8b36025e942932445229b8eb7d38", "parents": [ "c514f73377d6e3c2d4bab6db89b5a0e4b8807fa1", "aa35dd6bdd033dea8aa3e20cbbbe10e06b2d044f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 11:58:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 11:58:04 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.0-20260403\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - A previous fix in this release covered the case of the rings being\n RCU protected during resize, but it missed a few spots. This covers\n the rest\n\n - Fix the cBPF filters when COW\u0027ed, introduced in this merge window\n\n - Fix for an attempt to import a zero sized buffer\n\n - Fix for a missing clamp in importing bundle buffers\n\n* tag \u0027io_uring-7.0-20260403\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/bpf_filters: retain COW\u0027ed settings on parse failures\n io_uring: protect remaining lockless ctx-\u003erings accesses with RCU\n io_uring/rsrc: reject zero-length fixed buffer import\n io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n" }, { "commit": "c514f73377d6e3c2d4bab6db89b5a0e4b8807fa1", "tree": "273f343175dcdbed18b9b582d0c192f3da5cf308", "parents": [ "1270605fd2d8c3d2f0a050f5078e56cbc9b755e5", "59e1be1278f064d7172b00473b7e0c453cb1ec52" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 10:19:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 10:19:52 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A small collection of fixes, mostly probe/remove issues that are the\n result of Felix Gu going and auditing those areas, plus one error\n handling fix for the Cadence QSPI driver\"\n\n* tag \u0027spi-fix-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: cadence-qspi: Fix exec_mem_op error handling\n spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback\n spi: stm32-ospi: Fix DMA channel leak on stm32_ospi_dma_setup() failure\n spi: stm32-ospi: Fix reset control leak on probe error\n spi: stm32-ospi: Fix resource leak in remove() callback\n" }, { "commit": "7e0ffb72de8aa3b25989c2d980e81b829c577010", "tree": "2ee7e8dedd4b6792b8abd1282b3030352a3d9203", "parents": [ "0c4a59df370bea245695c00aaae6ae75747139bd" ], "author": { "name": "Andrea Righi", "email": "arighi@nvidia.com", "time": "Fri Apr 03 08:57:20 2026 +0200" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 03 07:14:49 2026 -1000" }, "message": "sched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p-\u003escx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup\u0027s\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n and clear it before dispatch_enqueue() on the synchronous path. For\n the deferred path, the direct dispatch state must remain set until\n process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n variables and clear it before calling dispatch_to_local_dsq(), which\n may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n (local/global/bypass fallbacks), where the direct dispatch verdict is\n ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n to handle both the deferred dispatch cancellation and the holding_cpu\n race, covering all cases where a pending direct dispatch is\n cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n transitioning a task out of the current scheduler. Waking tasks may\n have had the direct dispatch state set by the outgoing scheduler\u0027s\n ops.select_cpu() and then been queued on a wake_list via\n ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n tasks are not on the runqueue and are not iterated by scx_bypass(),\n so their direct dispatch state won\u0027t be cleared. Without this clear,\n any subsequent SCX scheduler that tries to direct dispatch the task\n will trigger the WARN_ON_ONCE() in mark_direct_dispatch().\n\nFixes: 5b26f7b920f7 (\"sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches\")\nCc: stable@vger.kernel.org # v6.12+\nCc: Daniel Hodges \u003chodgesd@meta.com\u003e\nCc: Patrick Somaru \u003cpatsomaru@meta.com\u003e\nSigned-off-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "1270605fd2d8c3d2f0a050f5078e56cbc9b755e5", "tree": "ac90c9a9155631961e490008ac705dd9ab8c73ab", "parents": [ "576db0f37549a05d7b1d9b5d6ad9fcce9ad7bfd6", "744d5721d2d7abc84e5131c16002039c53465c89" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:56:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:56:32 2026 -0700" }, "message": "Merge tag \u0027pm-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix a potential NULL pointer dereference in the energy model\n netlink interface and a potential double free in an error path in\n the common cpufreq governor management code:\n\n - Fix a NULL pointer dereference in the energy model netlink\n interface that may occur if a given perf domain ID is not\n recognized (Changwoo Min)\n\n - Avoid double free in the cpufreq_dbs_governor_init() error\n path when kobject_init_and_add() fails (Guangshuo Li)\"\n\n* tag \u0027pm-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path\n PM: EM: Fix NULL pointer dereference when perf domain ID is not found\n" }, { "commit": "576db0f37549a05d7b1d9b5d6ad9fcce9ad7bfd6", "tree": "17107f5a9079d6b14dadf2dc023a0a1470f89565", "parents": [ "116a3308e1eb0ea59aa248e22ac29d65eb7cd250", "9e07e3b81807edd356e1f794cffa00a428eff443" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:49:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:49:06 2026 -0700" }, "message": "Merge tag \u0027thermal-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fixes from Rafael Wysocki:\n \"Address potential races between thermal zone removal and system\n resume that may lead to a use-after-free (in two different ways)\n and a potential use-after-free in the thermal zone unregistration\n path (Rafael Wysocki)\"\n\n* tag \u0027thermal-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: core: Fix thermal zone device registration error path\n thermal: core: Address thermal zone removal races with resume\n" }, { "commit": "116a3308e1eb0ea59aa248e22ac29d65eb7cd250", "tree": "589aba70e5fa8d13479c007d08585dd29b9a1154", "parents": [ "441c63ff42c4e666304cdd32d23b5fc6bc1ea3cc", "6b5ef8c88854b343b733b574ea8754c9dab61f41" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:33:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 09:33:38 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix kerneldocs for gpio-timberdale and gpio-nomadik\n\n - clear the \"requested\" flag in error path in gpiod_request_commit()\n\n - call of_xlate() if provided when setting up shared GPIOs\n\n - handle pins shared by child firmware nodes of consumer devices\n\n - fix return value check in gpio-qixis-fpga\n\n - fix suspend on gpio-mxc\n\n - fix gpio-microchip DT bindings\n\n* tag \u0027gpio-fixes-for-v7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n dt-bindings: gpio: fix microchip #interrupt-cells\n gpio: shared: shorten the critical section in gpiochip_setup_shared()\n gpio: mxc: map Both Edge pad wakeup to Rising Edge\n gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()\n gpio: shared: handle pins shared by child nodes of devices\n gpio: shared: call gpio_chip::of_xlate() if set\n gpiolib: clear requested flag if line is invalid\n gpio: nomadik: repair some kernel-doc comments\n gpio: timberdale: repair kernel-doc comments\n gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n" }, { "commit": "441c63ff42c4e666304cdd32d23b5fc6bc1ea3cc", "tree": "bb9dcc517afa7b8f90b35e0be53e2ddd6faa7f4f", "parents": [ "60d9212c6932376a337507b20fc45b2c2785b5ac", "54ac9ff8f1196afc49d644a1625e0af1c9fcf7f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 08:47:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 08:47:13 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fix from Will Deacon:\n\n - Implement a basic static call trampoline to fix CFI failures with the\n generic implementation\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: Use static call trampolines when kCFI is enabled\n" }, { "commit": "60d9212c6932376a337507b20fc45b2c2785b5ac", "tree": "ca6f8e8f4a61ff226394a1388b70155bfef5802e", "parents": [ "d8a9a4b11a137909e306e50346148fc5c3b63f9d", "75f53c4b2dbca831bf91e9befe06c9ad58f29352" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 08:23:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 03 08:23:51 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-04-03\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Hopefully no Easter eggs in this bunch of fixes. Usual stuff across\n the amd/intel with some misc bits. Thanks to Thorsten and Alex for\n making sure a regression fix that was hanging around in process land\n finally made it in, that is probably the biggest change in here.\n\n core:\n - revert unplug/framebuffer fix as it caused problems\n - compat ioctl speculation fix\n\n bridge:\n - refcounting fix\n\n sysfb:\n - error handling fix\n\n amdgpu:\n - fix renoir audio regression\n - UserQ fixes\n - PASID handling fix\n - S4 fix for smu11 chips\n - Misc small fixes\n\n amdkfd:\n - Non-4K page fixes\n\n i915:\n - Fix for #12045: Huawei Matebook E (DRR-WXX): Persistent Black\n Screen on Boot with i915 and Gen11: Modesetting and Backlight\n Control Malfunction\n - Fix for #15826: i915: Raptor Lake-P [UHD Graphics] display\n flicker/corruption on eDP panel\n - Use crtc_state-\u003eenhanced_framing properly on ivb/hsw CPU eDP\n\n xe:\n - uapi: Accept canonical GPU addresses in xe_vm_madvise_ioctl\n - Disallow writes to read-only VMAs\n - PXP fixes\n - Disable garbage collector work item on SVM close\n - void memory allocations in xe_device_declare_wedged\n\n qaic:\n - hang fix\n\n ast:\n - initialisation fix\"\n\n* tag \u0027drm-fixes-2026-04-03\u0027 of https://gitlab.freedesktop.org/drm/kernel: (28 commits)\n drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations\n drm/ioc32: stop speculation on the drm_compat_ioctl path\n drm/sysfb: Fix efidrm error handling and memory type mismatch\n drm/i915/dp: Use crtc_state-\u003eenhanced_framing properly on ivb/hsw CPU eDP\n drm/i915/cdclk: Do the full CDCLK dance for min_voltage_level changes\n drm/amdkfd: Fix queue preemption/eviction failures by aligning control stack size to GPU page size\n drm/amdgpu: Fix wait after reset sequence in S4\n drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()\n drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n drm/amdgpu/userq: fix memory leak in MQD creation error paths\n drm/amd: Fix MQD and control stack alignment for non-4K\n drm/amdkfd: Align expected_queue_size to PAGE_SIZE\n drm/amdgpu: fix the idr allocation flags\n drm/amdgpu: validate doorbell_offset in user queue creation\n drm/amdgpu/pm: drop SMU driver if version not matched messages\n drm/xe: Avoid memory allocations in xe_device_declare_wedged()\n drm/xe: Disable garbage collector work item on SVM close\n drm/xe/pxp: Don\u0027t allow PXP on older PTL GSC FWs\n drm/xe/pxp: Clear restart flag in pxp_start after jumping back\n drm/xe/pxp: Remove incorrect handling of impossible state during suspend\n ...\n" }, { "commit": "744d5721d2d7abc84e5131c16002039c53465c89", "tree": "cecd1cad41fefb8ac1843ada0f665a46bdf4adfe", "parents": [ "6dcf9d0064ce2f3e3dfe5755f98b93abe6a98e1e", "9badc2a84e688be1275bb740942d5f6f51746908" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Apr 03 14:15:06 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Apr 03 14:15:06 2026 +0200" }, "message": "Merge branch \u0027pm-em\u0027\n\nFix a NULL pointer dereference in the energy model netlink interface\nthat may occur if a given perf domain ID is not recognized (Changwoo Min).\n\n* pm-em:\n PM: EM: Fix NULL pointer dereference when perf domain ID is not found\n" }, { "commit": "496fa1befba1e8ff149af5120cd9c9616bb05120", "tree": "c97a19f6bce9d09d7212b0d9e3edf706375a4b96", "parents": [ "a72b832a482372001a158c8014d116b053089b5d" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Fri Apr 03 08:20:18 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 03 13:11:23 2026 +0200" }, "message": "Documentation: clarify the mandatory and desirable info for security reports\n\nA significant part of the effort of the security team consists in begging\nreporters for patch proposals, or asking them to provide them in regular\nformat, and most of the time they\u0027re willing to provide this, they just\ndidn\u0027t know that it would help. So let\u0027s add a section detailing the\nrequired and desirable contents in a security report to help reporters\nwrite more actionable reports which do not require round trips.\n\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Greg KH \u003cgreg@kroah.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nLink: https://patch.msgid.link/20260403062018.31080-4-w@1wt.eu\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a72b832a482372001a158c8014d116b053089b5d", "tree": "176995bef63a3c8d8c7aca891c1e396736d3a216", "parents": [ "f2b1cbef153636fa498324b47e822e8b4d1774aa" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Fri Apr 03 08:20:17 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 03 13:11:23 2026 +0200" }, "message": "Documentation: explain how to find maintainers addresses for security reports\n\nThese days, 80% of the work done by the security team consists in\nlocating the affected subsystem in a report, running get_maintainers on\nit, forwarding the report to these persons and responding to the reporter\nwith them in Cc. This is a huge and unneeded overhead that we must try to\nlower for a better overall efficiency. This patch adds a complete section\nexplaining how to figure the list of recipients to send the report to.\n\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Greg KH \u003cgreg@kroah.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nLink: https://patch.msgid.link/20260403062018.31080-3-w@1wt.eu\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f2b1cbef153636fa498324b47e822e8b4d1774aa", "tree": "0c6da55e3fb02bca9cceada3d6ba8f37264a7000", "parents": [ "d78ceee1e6205ffcd84ff581ccb40a008d39136f" ], "author": { "name": "Willy Tarreau", "email": "w@1wt.eu", "time": "Fri Apr 03 08:20:16 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 03 13:11:23 2026 +0200" }, "message": "Documentation: minor updates to the security contacts\n\nThis clarifies the fact that the bug reporters must use a valid\ne-mail address to send their report, and that the security team\nassists developers working on a fix but doesn\u0027t always produce\nfixes on its own.\n\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Greg KH \u003cgreg@kroah.com\u003e\nSigned-off-by: Willy Tarreau \u003cw@1wt.eu\u003e\nLink: https://patch.msgid.link/20260403062018.31080-2-w@1wt.eu\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "75f53c4b2dbca831bf91e9befe06c9ad58f29352", "tree": "ee1963aeb053bbf79121903a72a8a134f9600e99", "parents": [ "293fa6ebd46fffc2722b6c960f40f1eb74b08dba", "f8995c2df519f382525ca4bc90553ad2ec611067" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 19:05:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 19:07:43 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-04-02\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA refcounting fix for bridges, revert a previous framebuffer\nuse-after-free fix that turned out to be causing more problems, a hang\nfix for qaic, an initialization fix for ast, a error handling fix for\nsysfb, and a speculation fix for drm_compat_ioctl.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260402-vivid-perfect-caiman-ca055e@houat\n" }, { "commit": "293fa6ebd46fffc2722b6c960f40f1eb74b08dba", "tree": "85510765cc91e9c6b721bd2f593792f4d75007b6", "parents": [ "82f5e5b443ae32fe28a068f58abf53b89feea5f2", "a4983968fa5b3179ab090407d325a71cdc96874e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:41:48 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:43:09 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.0-2026-04-02\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.0-2026-04-02:\n\namdgpu:\n- Fix audio regression on renoir\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260402194409.914769-1-alexander.deucher@amd.com\n" }, { "commit": "82f5e5b443ae32fe28a068f58abf53b89feea5f2", "tree": "8fa14e7059107a97251da864255d1dd6c9e15919", "parents": [ "9b454a3412764b2a64b1a00d1f4c4da1e6b1cf2b", "56b7432b7e8e6ae1b289cb405d16db4150ef193b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:36:51 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:37:03 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-04-02\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nuAPI Fix:\n - Accept canonical GPU addresses in xe_vm_madvise_ioctl (Arvind)\n\nDriver Fixes:\n - Disallow writes to read-only VMAs (Jonathan)\n - PXP fixes (Daniele)\n - Disable garbage collector work item on SVM clos (Brost)\n - void memory allocations in xe_device_declare_wedged (Brost)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ac5mDHs-McR5cJSV@intel.com\n" }, { "commit": "9b454a3412764b2a64b1a00d1f4c4da1e6b1cf2b", "tree": "c5b98e3ba24c0810611aaa5f65cc406c381277d1", "parents": [ "2aa5a6d933f4e458db1825c7b25a7ec268a167ee", "9c9a57e4e337f94e23ddf69263fd0685c91155fb" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:31:22 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 03 18:31:24 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-04-02\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix for #12045: Huawei Matebook E (DRR-WXX): Persistent Black Screen on Boot with i915 and Gen11: Modesetting and Backlight Control Malfunction\n- Fix for #15826: i915: Raptor Lake-P [UHD Graphics] display flicker/corruption on eDP panel\n- Use crtc_state-\u003eenhanced_framing properly on ivb/hsw CPU eDP\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/ac5DM1IpBkuaT58e@jlahtine-mobl\n" }, { "commit": "d8a9a4b11a137909e306e50346148fc5c3b63f9d", "tree": "5b02536cdfb8743d8642e43710f3de99a4bff213", "parents": [ "7b9e74c5a49e1331e03c8ae5f981067da4f33328", "78ec5bf2f589ec7fd8f169394bfeca541b077317" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 21:04:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 21:04:28 2026 -0700" }, "message": "Merge tag \u0027v7.0-rc6-smb3-client-fix\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fix from Steve French:\n\n - Fix potential out of bounds read in mount\n\n* tag \u0027v7.0-rc6-smb3-client-fix\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n" }, { "commit": "7b9e74c5a49e1331e03c8ae5f981067da4f33328", "tree": "8628e0e4cded0b478adbf9ab1908c559b12f8184", "parents": [ "5a9617dde77d0777b53f0af7dee58109650bda41", "e1b5687a862a43429f1d9f69065b3bbc7780a97a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 18:59:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 18:59:56 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix register equivalence for pointers to packet (Alexei Starovoitov)\n\n - Fix incorrect pruning due to atomic fetch precision tracking (Daniel\n Borkmann)\n\n - Fix grace period wait for bpf_link-ed tracepoints (Kumar Kartikeya\n Dwivedi)\n\n - Fix use-after-free of sockmap\u0027s sk-\u003esk_socket (Kuniyuki Iwashima)\n\n - Reject direct access to nullable PTR_TO_BUF pointers (Qi Tang)\n\n - Reject sleepable kprobe_multi programs at attach time (Varun R\n Mallya)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n selftests/bpf: Add more precision tracking tests for atomics\n bpf: Fix incorrect pruning due to atomic fetch precision tracking\n bpf: Reject sleepable kprobe_multi programs at attach time\n bpf: reject direct access to nullable PTR_TO_BUF pointers\n bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready().\n bpf: Fix grace period wait for tracepoint bpf_link\n bpf: Fix regsafe() for pointers to packet\n" }, { "commit": "5a9617dde77d0777b53f0af7dee58109650bda41", "tree": "bcc15ea657e4506e7c7365ef9dd43983b60497be", "parents": [ "19abf08d5e66713e7e02a3e160f51647512c1302", "e02494114ebf7c8b42777c6cd6982f113bfdbec7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 17:29:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 17:29:48 2026 -0700" }, "message": "Merge tag \u0027v7.0-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Add missing async markers to tegra\n\n - Fix long hmac key DMA handling in caam\n\n - Fix spurious ENOSPC errors in deflate\n\n - Fix SG chaining in af_alg\n\n - Do not use in-place process in algif_aead\n\n - Fix out-of-place destination overflow in authencesn\n\n* tag \u0027v7.0-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption\n crypto: algif_aead - Revert to operating out-of-place\n crypto: af-alg - fix NULL pointer dereference in scatterwalk\n crypto: deflate - fix spurious -ENOSPC\n crypto: caam - fix overflow on long hmac keys\n crypto: caam - fix DMA corruption on long hmac keys\n crypto: tegra - Add missing CRYPTO_ALG_ASYNC\n" }, { "commit": "0c4a59df370bea245695c00aaae6ae75747139bd", "tree": "e5f13d7fb425103fea11b0b8b790c804ad8e7d77", "parents": [ "090d34f0f0285124452373225bcc520a31e305e4" ], "author": { "name": "Changwoo Min", "email": "changwoo@igalia.com", "time": "Thu Apr 02 11:31:50 2026 +0900" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Apr 02 09:26:55 2026 -1000" }, "message": "sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU\n\nSince commit 8e4f0b1ebcf2 (\"bpf: use rcu_read_lock_dont_migrate() for\ntrampoline.c\"), the BPF prolog (__bpf_prog_enter) calls migrate_disable()\nonly when CONFIG_PREEMPT_RCU is enabled, via rcu_read_lock_dont_migrate().\nWithout CONFIG_PREEMPT_RCU, the prolog never touches migration_disabled,\nso migration_disabled \u003d\u003d 1 always means the task is truly\nmigration-disabled regardless of whether it is the current task.\n\nThe old unconditional p \u003d\u003d current check was a false negative in this\ncase, potentially allowing a migration-disabled task to be dispatched to\na remote CPU and triggering scx_error in task_can_run_on_remote_rq().\n\nOnly apply the p \u003d\u003d current disambiguation when CONFIG_PREEMPT_RCU is\nenabled, where the ambiguity with the BPF prolog still exists.\n\nFixes: 8e4f0b1ebcf2 (\"bpf: use rcu_read_lock_dont_migrate() for trampoline.c\")\nCc: stable@vger.kernel.org # v6.18+\nLink: https://lore.kernel.org/lkml/20250821090609.42508-8-dongml2@chinatelecom.cn/\nSigned-off-by: Changwoo Min \u003cchangwoo@igalia.com\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "a4983968fa5b3179ab090407d325a71cdc96874e", "tree": "c41b37b6198cf7684d0d5f28185f40687dd833e8", "parents": [ "78746a474e92fc7aaed12219bec7c78ae1bd6156" ], "author": { "name": "Ionut Nechita", "email": "ionut_n2001@yahoo.com", "time": "Mon Mar 23 23:13:43 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Apr 02 15:24:13 2026 -0400" }, "message": "drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generations\n\nDescription:\n - Commit b82f0759346617b2 (\"drm/amd/display: Migrate DIO registers access\n from hwseq to dio component\") moved DIO_MEM_PWR_CTRL register access\n behind the new dio abstraction layer but only created the dio object for\n DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/\n 31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the\n register write to be silently skipped.\n\n This results in AFMT HDMI memory not being powered on during init_hw,\n which can cause HDMI audio failures and display issues on affected\n hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw.\n\n Call dcn10_dio_construct() in each older DCN generation\u0027s resource.c\n to create the dio object, following the same pattern as DCN 4.01. This\n ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works\n through the dio abstraction for all DCN generations.\n\nFixes: b82f07593466 (\"drm/amd/display: Migrate DIO registers access from hwseq to dio component.\")\nReviewed-by: Ivan Lipski \u003civan.lipski@amd.com\u003e\nSigned-off-by: Ionut Nechita \u003cionut_n2001@yahoo.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n" }, { "commit": "19abf08d5e66713e7e02a3e160f51647512c1302", "tree": "163df8b11f8a6f30826d22cdf4e36bbfa152153a", "parents": [ "5619b098e2fbf3a23bf13d91897056a1fe238c6d", "fda9522ed6afaec45cabc198d8492270c394c7bc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 12:03:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 12:03:15 2026 -0700" }, "message": "Merge tag \u0027v7.0-rc6-ksmbd-server-fix\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fix from Steve French:\n\n - Fix out of bound write\n\n* tag \u0027v7.0-rc6-ksmbd-server-fix\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix OOB write in QUERY_INFO for compound requests\n" }, { "commit": "5619b098e2fbf3a23bf13d91897056a1fe238c6d", "tree": "1f807b9a0be31d90e9cb8eb082ead3424d3b05b4", "parents": [ "f8f5627a8aeab15183eef8930bf75ba88a51622f", "316fb1b3169efb081d2db910cbbfef445afa03b9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 10:31:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 10:31:30 2026 -0700" }, "message": "Merge tag \u0027for-7.0-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fix from David Sterba:\n \"One more fix for a potential extent tree corruption due to an\n unexpected error value.\n\n When the search for an extent item failed, it under some circumstances\n was reported as a success to the caller\"\n\n* tag \u0027for-7.0-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()\n" }, { "commit": "e1b5687a862a43429f1d9f69065b3bbc7780a97a", "tree": "f9ebfdb178927bdb46f0d26ac07285861e917bde", "parents": [ "179ee84a89114b854ac2dd1d293633a7f6c8dac1" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Apr 01 00:20:20 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 02 09:57:59 2026 -0700" }, "message": "selftests/bpf: Add more precision tracking tests for atomics\n\nAdd verifier precision tracking tests for BPF atomic fetch operations.\nValidate that backtrack_insn correctly propagates precision from the\nfetch dst_reg to the stack slot for {fetch_add,xchg,cmpxchg} atomics.\nFor the first two src_reg gets the old memory value, and for the last\none r0. The fetched register is used for pointer arithmetic to trigger\nbacktracking. Also add coverage for fetch_{or,and,xor} flavors which\nexercises the bitwise atomic fetch variants going through the same\ninsn-\u003eimm \u0026 BPF_FETCH check but with different imm values.\n\nAdd dual-precision regression tests for fetch_add and cmpxchg where\nboth the fetched value and a reread of the same stack slot are tracked\nfor precision. After the atomic operation, the stack slot is STACK_MISC,\nso the ldx does not set INSN_F_STACK_ACCESS. These tests verify that\nstack precision propagates solely through the atomic fetch\u0027s load side.\n\nAdd map-based tests for fetch_add and cmpxchg which validate that non-\nstack atomic fetch completes precision tracking without falling back\nto mark_all_scalars_precise. Lastly, add 32-bit variants for {fetch_add,\ncmpxchg} on map values to cover the second valid atomic operand size.\n\n # LDLIBS\u003d-static PKG_CONFIG\u003d\u0027pkg-config --static\u0027 ./vmtest.sh -- ./test_progs -t verifier_precision\n [...]\n + /etc/rcS.d/S50-startup\n ./test_progs -t verifier_precision\n [ 1.697105] bpf_testmod: loading out-of-tree module taints kernel.\n [ 1.700220] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel\n [ 1.777043] tsc: Refined TSC clocksource calibration: 3407.986 MHz\n [ 1.777619] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fc6d7268, max_idle_ns: 440795260133 ns\n [ 1.778658] clocksource: Switched to clocksource tsc\n #633/1 verifier_precision/bpf_neg:OK\n #633/2 verifier_precision/bpf_end_to_le:OK\n #633/3 verifier_precision/bpf_end_to_be:OK\n #633/4 verifier_precision/bpf_end_bswap:OK\n #633/5 verifier_precision/bpf_load_acquire:OK\n #633/6 verifier_precision/bpf_store_release:OK\n #633/7 verifier_precision/state_loop_first_last_equal:OK\n #633/8 verifier_precision/bpf_cond_op_r10:OK\n #633/9 verifier_precision/bpf_cond_op_not_r10:OK\n #633/10 verifier_precision/bpf_atomic_fetch_add_precision:OK\n #633/11 verifier_precision/bpf_atomic_xchg_precision:OK\n #633/12 verifier_precision/bpf_atomic_fetch_or_precision:OK\n #633/13 verifier_precision/bpf_atomic_fetch_and_precision:OK\n #633/14 verifier_precision/bpf_atomic_fetch_xor_precision:OK\n #633/15 verifier_precision/bpf_atomic_cmpxchg_precision:OK\n #633/16 verifier_precision/bpf_atomic_fetch_add_dual_precision:OK\n #633/17 verifier_precision/bpf_atomic_cmpxchg_dual_precision:OK\n #633/18 verifier_precision/bpf_atomic_fetch_add_map_precision:OK\n #633/19 verifier_precision/bpf_atomic_cmpxchg_map_precision:OK\n #633/20 verifier_precision/bpf_atomic_fetch_add_32bit_precision:OK\n #633/21 verifier_precision/bpf_atomic_cmpxchg_32bit_precision:OK\n #633/22 verifier_precision/bpf_neg_2:OK\n #633/23 verifier_precision/bpf_neg_3:OK\n #633/24 verifier_precision/bpf_neg_4:OK\n #633/25 verifier_precision/bpf_neg_5:OK\n #633 verifier_precision:OK\n Summary: 1/25 PASSED, 0 SKIPPED, 0 FAILED\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://lore.kernel.org/r/20260331222020.401848-2-daniel@iogearbox.net\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "179ee84a89114b854ac2dd1d293633a7f6c8dac1", "tree": "cdbe31c98668c7f5220adc8539ff2fa310580276", "parents": [ "eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Apr 01 00:20:19 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 02 09:57:59 2026 -0700" }, "message": "bpf: Fix incorrect pruning due to atomic fetch precision tracking\n\nWhen backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC\nand BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as\na destination, thus receiving the old value from the memory location.\n\nThe current backtracking logic does not account for this. It treats\natomic fetch operations the same as regular stores where the src\nregister is only an input. This leads the backtrack_insn to fail to\npropagate precision to the stack location, which is then not marked\nas precise!\n\nLater, the verifier\u0027s path pruning can incorrectly consider two states\nequivalent when they differ in terms of stack state. Meaning, two\nbranches can be treated as equivalent and thus get pruned when they\nshould not be seen as such.\n\nFix it as follows: Extend the BPF_LDX handling in backtrack_insn to\nalso cover atomic fetch operations via is_atomic_fetch_insn() helper.\nWhen the fetch dst register is being tracked for precision, clear it,\nand propagate precision over to the stack slot. For non-stack memory,\nthe precision walk stops at the atomic instruction, same as regular\nBPF_LDX. This covers all fetch variants.\n\nBefore:\n\n 0: (b7) r1 \u003d 8 ; R1\u003d8\n 1: (7b) *(u64 *)(r10 -8) \u003d r1 ; R1\u003d8 R10\u003dfp0 fp-8\u003d8\n 2: (b7) r2 \u003d 0 ; R2\u003d0\n 3: (db) r2 \u003d atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2\u003d8 R10\u003dfp0 fp-8\u003dmmmmmmmm\n 4: (bf) r3 \u003d r10 ; R3\u003dfp0 R10\u003dfp0\n 5: (0f) r3 +\u003d r2\n mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n mark_precise: frame0: regs\u003dr2 stack\u003d before 4: (bf) r3 \u003d r10\n mark_precise: frame0: regs\u003dr2 stack\u003d before 3: (db) r2 \u003d atomic64_fetch_add((u64 *)(r10 -8), r2)\n mark_precise: frame0: regs\u003dr2 stack\u003d before 2: (b7) r2 \u003d 0\n 6: R2\u003d8 R3\u003dfp8\n 6: (b7) r0 \u003d 0 ; R0\u003d0\n 7: (95) exit\n\nAfter:\n\n 0: (b7) r1 \u003d 8 ; R1\u003d8\n 1: (7b) *(u64 *)(r10 -8) \u003d r1 ; R1\u003d8 R10\u003dfp0 fp-8\u003d8\n 2: (b7) r2 \u003d 0 ; R2\u003d0\n 3: (db) r2 \u003d atomic64_fetch_add((u64 *)(r10 -8), r2) ; R2\u003d8 R10\u003dfp0 fp-8\u003dmmmmmmmm\n 4: (bf) r3 \u003d r10 ; R3\u003dfp0 R10\u003dfp0\n 5: (0f) r3 +\u003d r2\n mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n mark_precise: frame0: regs\u003dr2 stack\u003d before 4: (bf) r3 \u003d r10\n mark_precise: frame0: regs\u003dr2 stack\u003d before 3: (db) r2 \u003d atomic64_fetch_add((u64 *)(r10 -8), r2)\n mark_precise: frame0: regs\u003d stack\u003d-8 before 2: (b7) r2 \u003d 0\n mark_precise: frame0: regs\u003d stack\u003d-8 before 1: (7b) *(u64 *)(r10 -8) \u003d r1\n mark_precise: frame0: regs\u003dr1 stack\u003d before 0: (b7) r1 \u003d 8\n 6: R2\u003d8 R3\u003dfp8\n 6: (b7) r0 \u003d 0 ; R0\u003d0\n 7: (95) exit\n\nFixes: 5ffa25502b5a (\"bpf: Add instructions for atomic_[cmp]xchg\")\nFixes: 5ca419f2864a (\"bpf: Add BPF_FETCH field / create atomic_fetch_add instruction\")\nReported-by: STAR Labs SG \u003cinfo@starlabs.sg\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://lore.kernel.org/r/20260331222020.401848-1-daniel@iogearbox.net\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "f8f5627a8aeab15183eef8930bf75ba88a51622f", "tree": "95709f6f636ef73476b65de4d5b9d29e06235c80", "parents": [ "4c2c526b5adfb580bd95316bf179327d5ee26da8", "ec7067e661193403a7a00980bda8612db5954142" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:57:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:57:06 2026 -0700" }, "message": "Merge tag \u0027net-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"With fixes from wireless, bluetooth and netfilter included we\u0027re back\n to each PR carrying 30%+ more fixes than in previous era.\n\n The good news is that so far none of the \"extra\" fixes are themselves\n causing real regressions. Not sure how much comfort that is.\n\n Current release - fix to a fix:\n\n - netdevsim: fix build if SKB_EXTENSIONS\u003dn\n\n - eth: stmmac: skip VLAN restore when VLAN hash ops are missing\n\n Previous releases - regressions:\n\n - wifi: iwlwifi: mvm: don\u0027t send a 6E related command when\n not supported\n\n Previous releases - always broken:\n\n - some info leak fixes\n\n - add missing clearing of skb-\u003ecb[] on ICMP paths from tunnels\n\n - ipv6:\n - flowlabel: defer exclusive option free until RCU teardown\n - avoid overflows in ip6_datagram_send_ctl()\n\n - mpls: add seqcount to protect platform_labels from OOB access\n\n - bridge: improve safety of parsing ND options\n\n - bluetooth: fix leaks, overflows and races in hci_sync\n\n - netfilter: add more input validation, some to address bugs directly\n some to prevent exploits from cooking up broken configurations\n\n - wifi:\n - ath: avoid poor performance due to stopping the wrong\n aggregation session\n - virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\n - eth:\n - fec: fix the PTP periodic output sysfs interface\n - enetc: safely reinitialize TX BD ring when it has unsent frames\"\n\n* tag \u0027net-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (95 commits)\n eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64\n ipv6: avoid overflows in ip6_datagram_send_ctl()\n net: hsr: fix VLAN add unwind on slave errors\n net: hsr: serialize seq_blocks merge across nodes\n vsock: initialize child_ns_mode_locked in vsock_net_init()\n selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks\n net/sched: cls_flow: fix NULL pointer dereference on shared blocks\n net/sched: cls_fw: fix NULL pointer dereference on shared blocks\n net/x25: Fix overflow when accumulating packets\n net/x25: Fix potential double free of skb\n bnxt_en: Restore default stat ctxs for ULP when resource is available\n bnxt_en: Don\u0027t assume XDP is never enabled in bnxt_init_dflt_ring_mode()\n bnxt_en: Refactor some basic ring setup and adjustment logic\n net/mlx5: Fix switchdev mode rollback in case of failure\n net/mlx5: Avoid \"No data available\" when FW version queries fail\n net/mlx5: lag: Check for LAG device before creating debugfs\n net: macb: properly unregister fixed rate clocks\n net: macb: fix clk handling on PCI glue driver removal\n virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN\n net/sched: sch_netem: fix out-of-bounds access in packet corruption\n ...\n" }, { "commit": "4c2c526b5adfb580bd95316bf179327d5ee26da8", "tree": "73476feb7a63fdc7b8c9fa9065762ebcc559df03", "parents": [ "2ec9074b28a09a2cc4871371675bafc575a114c5", "8b72aa5704c77380742346d4ac755b074b7f9eaa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:53:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:53:16 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n\n - IOMMU-PT related compile breakage in for AMD driver\n\n - IOTLB flushing behavior when unmapped region is larger than requested\n due to page-sizes\n\n - Fix IOTLB flush behavior with empty gathers\n\n* tag \u0027iommu-fixes-v7.0-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommupt/amdv1: mark amdv1pt_install_leaf_entry as __always_inline\n iommupt: Fix short gather if the unmap goes into a large mapping\n iommu: Do not call drivers for empty gathers\n" }, { "commit": "eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8", "tree": "7c0c123c6454fcba49a6dca26dbb8f9cb03b61cd", "parents": [ "b0db1accbc7395657c2b79db59fa9fae0d6656f3" ], "author": { "name": "Varun R Mallya", "email": "varunrmallya@gmail.com", "time": "Thu Apr 02 00:41:25 2026 +0530" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 02 09:48:46 2026 -0700" }, "message": "bpf: Reject sleepable kprobe_multi programs at attach time\n\nkprobe.multi programs run in atomic/RCU context and cannot sleep.\nHowever, bpf_kprobe_multi_link_attach() did not validate whether the\nprogram being attached had the sleepable flag set, allowing sleepable\nhelpers such as bpf_copy_from_user() to be invoked from a non-sleepable\ncontext.\n\nThis causes a \"sleeping function called from invalid context\" splat:\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo\n preempt_count: 1, expected: 0\n RCU nest depth: 2, expected: 0\n\nFix this by rejecting sleepable programs early in\nbpf_kprobe_multi_link_attach(), before any further processing.\n\nFixes: 0dcac2725406 (\"bpf: Add multi kprobe link\")\nSigned-off-by: Varun R Mallya \u003cvarunrmallya@gmail.com\u003e\nAcked-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nAcked-by: Leon Hwang \u003cleon.hwang@linux.dev\u003e\nAcked-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260401191126.440683-1-varunrmallya@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "b0db1accbc7395657c2b79db59fa9fae0d6656f3", "tree": "f123854cf8f49c5311bfaf1888d270f8386e7280", "parents": [ "ad8391d37f334ee73ba91926f8b4e4cf6d31ea04" ], "author": { "name": "Qi Tang", "email": "tpluszz77@gmail.com", "time": "Thu Apr 02 17:29:22 2026 +0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Apr 02 09:47:13 2026 -0700" }, "message": "bpf: reject direct access to nullable PTR_TO_BUF pointers\n\ncheck_mem_access() matches PTR_TO_BUF via base_type() which strips\nPTR_MAYBE_NULL, allowing direct dereference without a null check.\n\nMap iterator ctx-\u003ekey and ctx-\u003evalue are PTR_TO_BUF | PTR_MAYBE_NULL.\nOn stop callbacks these are NULL, causing a kernel NULL dereference.\n\nAdd a type_may_be_null() guard to the PTR_TO_BUF branch, matching the\nexisting PTR_TO_BTF_ID pattern.\n\nFixes: 20b2aff4bc15 (\"bpf: Introduce MEM_RDONLY flag\")\nSigned-off-by: Qi Tang \u003ctpluszz77@gmail.com\u003e\nAcked-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260402092923.38357-2-tpluszz77@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "2ec9074b28a09a2cc4871371675bafc575a114c5", "tree": "9a647b302e5bfad821b5ccacf52316b24bcfcfba", "parents": [ "2064d7784e79258094c7dbf2695cb536b3c55010", "b477ab8893c3e6b4be3074358db830687de7bfff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:41:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:41:21 2026 -0700" }, "message": "Merge tag \u0027sound-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"People have been so busy for hunting and we\u0027re still getting more\n changes than wished for, but it doesn\u0027t look too scary; almost all\n changes are device-specific small fixes.\n\n I guess it\u0027s rather a casual bump, and no more Easter eggs are left\n for 7.0 (hopefully)...\n\n - Fixes for the recent regression on ctxfi driver\n\n - Fix missing INIT_LIST_HEAD() for ASoC card_aux_list\n\n - Usual HD- and USB-audio, and ASoC AMD quirk updates\n\n - ASoC fixes for AMD and Intel\"\n\n* tag \u0027sound-7.0-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)\n ASoC: amd: ps: Fix missing leading zeros in subsystem_device SSID log\n ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP\n ALSA: hda/realtek: add quirk for Acer Swift SFG14-73\n ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9\n ASoC: Intel: boards: fix unmet dependency on PINCTRL\n ASoC: Intel: ehl_rt5660: Use the correct rtd-\u003edev device in hw_params\n ALSA: ctxfi: Don\u0027t enumerate SPDIF1 at DAIO initialization\n ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 7 14AKP10\n ALSA: hda/realtek: add quirk for HP Laptop 15-fc0xxx\n ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure\n ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list\n ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED)\n ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx\n ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 16X OLED M7601RM\n ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15\n ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP\n ALSA: caiaq: fix stack out-of-bounds read in init_card\n ALSA: ctxfi: Check the error for index mapping\n ALSA: ctxfi: Fix missing SPDIFI1 index handling\n ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx\n ...\n" }, { "commit": "2064d7784e79258094c7dbf2695cb536b3c55010", "tree": "1ebb06e56a8350f059d61b270189f46ff8527fb9", "parents": [ "9147566d801602c9e7fc7f85e989735735bf38ba", "7f138de156b20d9f9da6f72f90b63c01941d97d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:34:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 02 09:34:22 2026 -0700" }, "message": "Merge tag \u0027auxdisplay-v7.0-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay\n\nPull auxdisplay fixes from Andy Shevchenko:\n\n - Fix NULL dereference in linedisp_release()\n\n - Fix ht16k33 DT bindings to avoid warnings\n\n - Handle errors in I²C transfers in lcd2s driver\n\n* tag \u0027auxdisplay-v7.0-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay:\n auxdisplay: line-display: fix NULL dereference in linedisp_release\n auxdisplay: lcd2s: add error handling for i2c transfers\n dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning\n" }, { "commit": "ec7067e661193403a7a00980bda8612db5954142", "tree": "dd9907c8aa0af7c81076a30c3692c32bf22720a3", "parents": [ "4e453375561fc60820e6b9d8ebeb6b3ee177d42e" ], "author": { "name": "Dimitri Daskalakis", "email": "daskald@meta.com", "time": "Wed Apr 01 09:28:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:38:34 2026 -0700" }, "message": "eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64\n\nOn systems with 64K pages, RX queues will be wedged if users set the\ndescriptor count to the current minimum (16). Fbnic fragments large\npages into 4K chunks, and scales down the ring size accordingly. With\n64K pages and 16 descriptors, the ring size mask is 0 and will never\nbe filled.\n\n32 descriptors is another special case that wedges the RX rings.\nInternally, the rings track pages for the head/tail pointers, not page\nfragments. So with 32 descriptors, there\u0027s only 1 usable page as one\nring slot is kept empty to disambiguate between an empty/full ring.\nAs a result, the head pointer never advances and the HW stalls after\nconsuming 16 page fragments.\n\nFixes: 0cb4c0a13723 (\"eth: fbnic: Implement Rx queue alloc/start/stop/free\")\nSigned-off-by: Dimitri Daskalakis \u003cdaskald@meta.com\u003e\nLink: https://patch.msgid.link/20260401162848.2335350-1-dimitri.daskalakis1@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4e453375561fc60820e6b9d8ebeb6b3ee177d42e", "tree": "dad207460665ef7a9418f6f0464c093df14cf214", "parents": [ "be193568bef72c21dc7608ef7bf6232bcf091439" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Apr 01 15:47:21 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:25:22 2026 -0700" }, "message": "ipv6: avoid overflows in ip6_datagram_send_ctl()\n\nYiming Qian reported :\n\u003cquote\u003e\n I believe I found a locally triggerable kernel bug in the IPv6 sendmsg\n ancillary-data path that can panic the kernel via `skb_under_panic()`\n (local DoS).\n\n The core issue is a mismatch between:\n\n - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type\n `__u16`) and\n - a pointer to the *last* provided destination-options header (`opt-\u003edst1opt`)\n\n when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.\n\n - `include/net/ipv6.h`:\n - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).\n (lines 291-307, especially 298)\n - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:\n - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`\n without rejecting duplicates. (lines 909-933)\n - `net/ipv6/ip6_output.c:__ip6_append_data()`:\n - Uses `opt-\u003eopt_flen + opt-\u003eopt_nflen` to compute header\n sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)\n - `net/ipv6/ip6_output.c:__ip6_make_skb()`:\n - Calls `ipv6_push_frag_opts()` if `opt-\u003eopt_flen` is non-zero.\n (lines 1930-1934)\n - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:\n - Push size comes from `ipv6_optlen(opt-\u003edst1opt)` (based on the\n pointed-to header). (lines 1179-1185 and 1206-1211)\n\n 1. `opt_flen` is a 16-bit accumulator:\n\n - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.\n\n 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs\n and increments `opt_flen` each time:\n\n - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:\n - It computes `len \u003d ((hdr-\u003ehdrlen + 1) \u003c\u003c 3);`\n - It checks `CAP_NET_RAW` using `ns_capable(net-\u003euser_ns,\n CAP_NET_RAW)`. (line 922)\n - Then it does:\n - `opt-\u003eopt_flen +\u003d len;` (line 927)\n - `opt-\u003edst1opt \u003d hdr;` (line 928)\n\n There is no duplicate rejection here (unlike the legacy\n `IPV6_2292DSTOPTS` path which rejects duplicates at\n `net/ipv6/datagram.c:901-904`).\n\n If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps\n while `dst1opt` still points to a large (2048-byte)\n destination-options header.\n\n In the attached PoC (`poc.c`):\n\n - 32 cmsgs with `hdrlen\u003d255` \u003d\u003e `len \u003d (255+1)*8 \u003d 2048`\n - 1 cmsg with `hdrlen\u003d0` \u003d\u003e `len \u003d 8`\n - Total increment: `32*2048 + 8 \u003d 65544`, so `(__u16)opt_flen \u003d\u003d 8`\n - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.\n\n 3. The transmit path sizes headers using the wrapped `opt_flen`:\n\n- In `net/ipv6/ip6_output.c:1463-1465`:\n - `headersize \u003d sizeof(struct ipv6hdr) + (opt ? opt-\u003eopt_flen +\n opt-\u003eopt_nflen : 0) + ...;`\n\n With wrapped `opt_flen`, `headersize`/headroom decisions underestimate\n what will be pushed later.\n\n 4. When building the final skb, the actual push length comes from\n `dst1opt` and is not limited by wrapped `opt_flen`:\n\n - In `net/ipv6/ip6_output.c:1930-1934`:\n - `if (opt-\u003eopt_flen) proto \u003d ipv6_push_frag_opts(skb, opt, proto);`\n - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes\n `dst1opt` via `ipv6_push_exthdr()`.\n - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:\n - `skb_push(skb, ipv6_optlen(opt));`\n - `memcpy(h, opt, ipv6_optlen(opt));`\n\n With insufficient headroom, `skb_push()` underflows and triggers\n `skb_under_panic()` -\u003e `BUG()`:\n\n - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)\n - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)\n\n - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target\n netns user namespace (`ns_capable(net-\u003euser_ns, CAP_NET_RAW)`).\n - Root (or any task with `CAP_NET_RAW`) can trigger this without user\n namespaces.\n - An unprivileged `uid\u003d1000` user can trigger this if unprivileged\n user namespaces are enabled and it can create a userns+netns to obtain\n namespaced `CAP_NET_RAW` (the attached PoC does this).\n\n - Local denial of service: kernel BUG/panic (system crash).\n - Reproducible with a small userspace PoC.\n\u003c/quote\u003e\n\nThis patch does not reject duplicated options, as this might break\nsome user applications.\n\nInstead, it makes sure to adjust opt_flen and opt_nflen to correctly\nreflect the size of the current option headers, preventing the overflows\nand the potential for panics.\n\nThis applies to IPV6_DSTOPTS, IPV6_HOPOPTS, and IPV6_RTHDR.\n\nSpecifically:\n\nWhen a new IPV6_DSTOPTS is processed, the length of the old opt-\u003edst1opt\nis subtracted from opt-\u003eopt_flen before adding the new length.\n\nWhen a new IPV6_HOPOPTS is processed, the length of the old opt-\u003edst0opt\nis subtracted from opt-\u003eopt_nflen.\n\nWhen a new Routing Header (IPV6_RTHDR or IPV6_2292RTHDR) is processed,\nthe length of the old opt-\u003esrcrt is subtracted from opt-\u003eopt_nflen.\n\nIn the special case within IPV6_2292RTHDR handling where dst1opt is moved\nto dst0opt, the length of the old opt-\u003edst0opt is subtracted from\nopt-\u003eopt_nflen before the new one is added.\n\nFixes: 333fad5364d6 (\"[IPV6]: Support several new sockopt / ancillary data in Advanced API (RFC3542).\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAL_bE8JNzawgr5OX5m+3jnQDHry2XxhQT5\u003djThW1zDPtUikRYA@mail.gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260401154721.3740056-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be193568bef72c21dc7608ef7bf6232bcf091439", "tree": "dda28de72cca746390af06d431e91dd9b2c99239", "parents": [ "b18c833888742ca9de80c250f9d40d0e97caa9f6", "2e3514e63bfb0e972b1f19668547a455d0129e88" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:23:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:23:55 2026 -0700" }, "message": "Merge branch \u0027net-hsr-fixes-for-prp-duplication-and-vlan-unwind\u0027\n\nLuka Gejak says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: hsr: fixes for PRP duplication and VLAN unwind\n\nThis series addresses two logic bugs in the HSR/PRP implementation\nidentified during a protocol audit. These are targeted for the \u0027net\u0027\ntree as they fix potential memory corruption and state inconsistency.\n\nThe primary change resolves a race condition in the node merging path by\nimplementing address-based lock ordering. This ensures that concurrent\nmutations of sequence blocks do not lead to state corruption or\ndeadlocks.\n\nAn additional fix corrects asymmetric VLAN error unwinding by\nimplementing a centralized unwind path on slave errors.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260401092243.52121-1-luka.gejak@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2e3514e63bfb0e972b1f19668547a455d0129e88", "tree": "dda28de72cca746390af06d431e91dd9b2c99239", "parents": [ "f5df2990c364d1ac596d24b3118dbc56503f7cd4" ], "author": { "name": "Luka Gejak", "email": "luka.gejak@linux.dev", "time": "Wed Apr 01 11:22:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:23:49 2026 -0700" }, "message": "net: hsr: fix VLAN add unwind on slave errors\n\nWhen vlan_vid_add() fails for a secondary slave, the error path calls\nvlan_vid_del() on the failing port instead of the peer slave that had\nalready succeeded. This results in asymmetric VLAN state across the HSR\npair.\n\nFix this by switching to a centralized unwind path that removes the VID\nfrom any slave device that was already programmed.\n\nFixes: 1a8a63a5305e (\"net: hsr: Add VLAN CTAG filter support\")\nSigned-off-by: Luka Gejak \u003cluka.gejak@linux.dev\u003e\nLink: https://patch.msgid.link/20260401092243.52121-3-luka.gejak@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f5df2990c364d1ac596d24b3118dbc56503f7cd4", "tree": "6880b505f23185d5a0cf2a4e18cb057ead890203", "parents": [ "b18c833888742ca9de80c250f9d40d0e97caa9f6" ], "author": { "name": "Luka Gejak", "email": "luka.gejak@linux.dev", "time": "Wed Apr 01 11:22:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:23:49 2026 -0700" }, "message": "net: hsr: serialize seq_blocks merge across nodes\n\nDuring node merging, hsr_handle_sup_frame() walks node_curr-\u003eseq_blocks\nto update node_real without holding node_curr-\u003eseq_out_lock. This\nallows concurrent mutations from duplicate registration paths, risking\ninconsistent state or XArray/bitmap corruption.\n\nFix this by locking both nodes\u0027 seq_out_lock during the merge.\nTo prevent ABBA deadlocks, locks are acquired in order of memory\naddress.\n\nReviewed-by: Felix Maurer \u003cfmaurer@redhat.com\u003e\nFixes: 415e6367512b (\"hsr: Implement more robust duplicate discard for PRP\")\nSigned-off-by: Luka Gejak \u003cluka.gejak@linux.dev\u003e\nLink: https://patch.msgid.link/20260401092243.52121-2-luka.gejak@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b18c833888742ca9de80c250f9d40d0e97caa9f6", "tree": "3afad919650cab1e04a4fd7435302daabba4e481", "parents": [ "70f73562d278d9f88e7095e327f2a50082a82c65" ], "author": { "name": "Stefano Garzarella", "email": "sgarzare@redhat.com", "time": "Wed Apr 01 11:21:53 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 02 08:18:56 2026 -0700" }, "message": "vsock: initialize child_ns_mode_locked in vsock_net_init()\n\nThe `child_ns_mode_locked` field lives in `struct net`, which persists\nacross vsock module reloads. When the module is unloaded and reloaded,\n`vsock_net_init()` resets `mode` and `child_ns_mode` back to their\ndefault values, but does not reset `child_ns_mode_locked`.\n\nThe stale lock from the previous module load causes subsequent writes\nto `child_ns_mode` to silently fail: `vsock_net_set_child_mode()` sees\nthe old lock, skips updating the actual value, and returns success\nwhen the requested mode matches the stale lock. The sysctl handler\nreports no error, but `child_ns_mode` remains unchanged.\n\nSteps to reproduce:\n $ modprobe vsock\n $ echo local \u003e /proc/sys/net/vsock/child_ns_mode\n $ cat /proc/sys/net/vsock/child_ns_mode\n local\n $ modprobe -r vsock\n $ modprobe vsock\n $ echo local \u003e /proc/sys/net/vsock/child_ns_mode\n $ cat /proc/sys/net/vsock/child_ns_mode\n global \u003c--- expected \"local\"\n\nFix this by initializing `child_ns_mode_locked` to 0 (unlocked) in\n`vsock_net_init()`, so the write-once mechanism works correctly after\nmodule reload.\n\nFixes: 102eab95f025 (\"vsock: lock down child_ns_mode as write-once\")\nReported-by: Jin Liu \u003cjinl@redhat.com\u003e\nSigned-off-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260401092153.28462-1-sgarzare@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d78ceee1e6205ffcd84ff581ccb40a008d39136f", "tree": "a377d845b6059bd47f9a973f3eb1da2f25d232bf", "parents": [ "f9b88613ff402aa6fe8fd020573cb95867ae947e" ], "author": { "name": "Askar Safin", "email": "safinaskar@gmail.com", "time": "Tue Mar 24 08:29:28 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 16:48:25 2026 +0200" }, "message": ".get_maintainer.ignore: add myself\n\nI don\u0027t want get_maintainer.pl to automatically print my email.\n\nSigned-off-by: Askar Safin \u003csafinaskar@gmail.com\u003e\nLink: https://patch.msgid.link/20260324082928.3473789-1-safinaskar@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f9b88613ff402aa6fe8fd020573cb95867ae947e", "tree": "22f913f9c2f2e62fb5823ec8af65c50d44780048", "parents": [ "48b5163c957548f5854f14c90bfdedc33afbea3c" ], "author": { "name": "Ivan Vera", "email": "ivanverasantos@gmail.com", "time": "Fri Mar 27 13:16:45 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 16:44:40 2026 +0200" }, "message": "nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy\n\nBuffer size used in dma allocation and memcpy is wrong.\nIt can lead to undersized DMA buffer access and possible\nmemory corruption. use correct buffer size in dma_alloc_coherent\nand memcpy.\n\nFixes: 737c0c8d07b5 (\"nvmem: zynqmp_nvmem: Add support to access efuse\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ivan Vera \u003civanverasantos@gmail.com\u003e\nSigned-off-by: Harish Ediga \u003charish.ediga@amd.com\u003e\nSigned-off-by: Harsh Jain \u003ch.jain@amd.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrini@kernel.org\u003e\nLink: https://patch.msgid.link/20260327131645.3025781-3-srini@kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "48b5163c957548f5854f14c90bfdedc33afbea3c", "tree": "2aac4609d0e416685166ecc0a5e4a175f724e56f", "parents": [ "6a502776f4a4f80fb839b22f12aeaf0267fca344" ], "author": { "name": "Christian Eggers", "email": "ceggers@arri.de", "time": "Fri Mar 27 13:16:44 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 16:44:40 2026 +0200" }, "message": "nvmem: imx: assign nvmem_cell_info::raw_len\n\nAvoid getting error messages at startup like the following on i.MX6ULL:\n\nnvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4\nnvmem imx-ocotp0: cell mac-addr raw len 6 unaligned to nvmem word size 4\n\nThis shouldn\u0027t cause any functional change as this alignment would\notherwise be done in nvmem_cell_info_to_nvmem_cell_entry_nodup().\n\nCc: stable@vger.kernel.org\nFixes: 13bcd440f2ff (\"nvmem: core: verify cell\u0027s raw_len\")\nSigned-off-by: Christian Eggers \u003cceggers@arri.de\u003e\nSigned-off-by: Fabio Estevam \u003cfestevam@gmail.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrini@kernel.org\u003e\nLink: https://patch.msgid.link/20260327131645.3025781-2-srini@kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "70f73562d278d9f88e7095e327f2a50082a82c65", "tree": "9a353c239e5110c3a1aec257efdbca7b6db2b262", "parents": [ "1a280dd4bd1d616a01d6ffe0de284c907b555504" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Mar 30 22:02:17 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 15:08:42 2026 +0200" }, "message": "selftests/tc-testing: add tests for cls_fw and cls_flow on shared blocks\n\nRegression tests for the shared-block NULL derefs fixed in the previous\ntwo patches:\n\n - fw: attempt to attach an empty fw filter to a shared block and\n verify the configuration is rejected with EINVAL.\n - flow: create a flow filter on a shared block without a baseclass\n and verify the configuration is rejected with EINVAL.\n\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260331050217.504278-3-xmei5@asu.edu\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a280dd4bd1d616a01d6ffe0de284c907b555504", "tree": "3e27987fc15cfccf2d26babeffae6d63c21bdd62", "parents": [ "faeea8bbf6e958bf3c00cb08263109661975987c" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Mar 30 22:02:16 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 15:08:42 2026 +0200" }, "message": "net/sched: cls_flow: fix NULL pointer dereference on shared blocks\n\nflow_change() calls tcf_block_q() and dereferences q-\u003ehandle to derive\na default baseclass. Shared blocks leave block-\u003eq NULL, causing a NULL\nderef when a flow filter without a fully qualified baseclass is created\non a shared block.\n\nCheck tcf_block_shared() before accessing block-\u003eq and return -EINVAL\nfor shared blocks. This avoids the null-deref shown below:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nKASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\nRIP: 0010:flow_change (net/sched/cls_flow.c:508)\nCall Trace:\n tc_new_tfilter (net/sched/cls_api.c:2432)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)\n [...]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: 1abf272022cf (\"net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "faeea8bbf6e958bf3c00cb08263109661975987c", "tree": "e21bdc1e46f158dd9081d8f896de48f6ae494377", "parents": [ "a80a014f83bded5a2f498c22b4a06a7a31256f98" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Mon Mar 30 22:02:15 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 15:08:41 2026 +0200" }, "message": "net/sched: cls_fw: fix NULL pointer dereference on shared blocks\n\nThe old-method path in fw_classify() calls tcf_block_q() and\ndereferences q-\u003ehandle. Shared blocks leave block-\u003eq NULL, causing a\nNULL deref when an empty cls_fw filter is attached to a shared block\nand a packet with a nonzero major skb mark is classified.\n\nReject the configuration in fw_change() when the old method (no\nTCA_OPTIONS) is used on a shared block, since fw_classify()\u0027s\nold-method path needs block-\u003eq which is NULL for shared blocks.\n\nThe fixed null-ptr-deref calling stack:\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:fw_classify (net/sched/cls_fw.c:81)\n Call Trace:\n tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)\n tc_run (net/core/dev.c:4401)\n __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)\n\nFixes: 1abf272022cf (\"net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260331050217.504278-1-xmei5@asu.edu\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6a502776f4a4f80fb839b22f12aeaf0267fca344", "tree": "7b3a2f19781a0344698a0efe870c6f7bbfc8f873", "parents": [ "ba2c83167b215da30fa2aae56b140198cf8d8408" ], "author": { "name": "Xingjing Deng", "email": "micro6947@gmail.com", "time": "Sat Jan 31 14:55:39 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:42:19 2026 +0200" }, "message": "misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe\n\nIn the SDSP probe path, qcom_scm_assign_mem() is used to assign the\nreserved memory to the configured VMIDs, but its return value was not checked.\n\nFail the probe if the SCM call fails to avoid continuing with an\nunexpected/incorrect memory permission configuration.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed.\n\nFixes: c3c0363bc72d4 (\"misc: fastrpc: support complete DMA pool access to the DSP\")\nCc: stable@vger.kernel.org # 6.11-rc1\nSigned-off-by: Xingjing Deng \u003cxjdeng@buaa.edu.cn\u003e\nReviewed-by: Dmitry Baryshkov \u003cdmitry.baryshkov@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260131065539.2124047-1-xjdeng@buaa.edu.cn\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ba2c83167b215da30fa2aae56b140198cf8d8408", "tree": "179c522118a09398d83e48522ca4452420028a80", "parents": [ "93853512f565e625df2397f0d8050d6aafd7c3ad" ], "author": { "name": "Xingjing Deng", "email": "micro6947@gmail.com", "time": "Fri Jan 30 07:41:40 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:42:03 2026 +0200" }, "message": "misc: fastrpc: possible double-free of cctx-\u003eremote_heap\n\nfastrpc_init_create_static_process() may free cctx-\u003eremote_heap on the\nerr_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()\nfrees cctx-\u003eremote_heap again if it is non-NULL, which can lead to a\ndouble-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg\ndevice is subsequently removed/unbound.\nClear cctx-\u003eremote_heap after freeing it in the error path to prevent the\nlater cleanup from freeing it again.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed.\n\nFixes: 0871561055e66 (\"misc: fastrpc: Add support for audiopd\")\nCc: stable@vger.kernel.org # 6.2+\nSigned-off-by: Xingjing Deng \u003cxjdeng@buaa.edu.cn\u003e\nReviewed-by: Dmitry Baryshkov \u003cdmitry.baryshkov@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260129234140.410983-1-xjdeng@buaa.edu.cn\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "93853512f565e625df2397f0d8050d6aafd7c3ad", "tree": "61ea1e7e2561077a780d127587506ecb4c50f8c2", "parents": [ "29f644f14b89e6c4965e3c89251929e451190a66" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Mon Mar 09 16:18:59 2026 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:40:27 2026 +0200" }, "message": "comedi: dt2815: add hardware detection to prevent crash\n\nThe dt2815 driver crashes when attached to I/O ports without actual\nhardware present. This occurs because syzkaller or users can attach\nthe driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.\n\nWhen no hardware exists at the specified port, inb() operations return\n0xff (floating bus), but outb() operations can trigger page faults due\nto undefined behavior, especially under race conditions:\n\n BUG: unable to handle page fault for address: 000000007fffff90\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n RIP: 0010:dt2815_attach+0x6e0/0x1110\n\nAdd hardware detection by reading the status register before attempting\nany write operations. If the read returns 0xff, assume no hardware is\npresent and fail the attach with -ENODEV. This prevents crashes from\noutb() operations on non-existent hardware.\n\nReported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com\nCc: stable \u003cstable@kernel.org\u003e\nCloses: https://syzkaller.appspot.com/bug?extid\u003d72f94b474d6e50b71ffc\nTested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com\nReviewed-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nSigned-off-by: Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e\nLink: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/]\nLink: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/\nLink: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "29f644f14b89e6c4965e3c89251929e451190a66", "tree": "4c045e16b166aaed71312bb5b5fa776c71ce8810", "parents": [ "4b9a9a6d71e3e252032f959fb3895a33acb5865c" ], "author": { "name": "Edward Adam Davis", "email": "eadavis@qq.com", "time": "Tue Mar 10 11:11:04 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:39:58 2026 +0200" }, "message": "comedi: runflags cannot determine whether to reclaim chanlist\n\nsyzbot reported a memory leak [1], because commit 4e1da516debb (\"comedi:\nAdd reference counting for Comedi command handling\") did not consider\nthe exceptional exit case in do_cmd_ioctl() where runflags is not set.\nThis caused chanlist not to be properly freed by do_become_nonbusy(),\nas it only frees chanlist when runflags is correctly set.\n\nAdded a check in do_become_nonbusy() for the case where runflags is not\nset, to properly free the chanlist memory.\n\n[1]\nBUG: memory leak\n backtrace (crc 844a0efa):\n __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\n do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\n do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]\n\nFixes: 4e1da516debb (\"comedi: Add reference counting for Comedi command handling\")\nReported-by: syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003df238baf6ded841b5a82e\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nReviewed-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nCc: stable \u003cstable@kernel.org\u003e # 6.19\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nLink: https://patch.msgid.link/20260310111104.70959-1-abbotti@mev.co.uk\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4b9a9a6d71e3e252032f959fb3895a33acb5865c", "tree": "3178d34b232da997a6e52c48f2bdac85c4239bec", "parents": [ "cc797d4821c754c701d9714b58bea947e31dbbe0" ], "author": { "name": "Ian Abbott", "email": "abbotti@mev.co.uk", "time": "Wed Feb 25 13:24:27 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:39:39 2026 +0200" }, "message": "comedi: Reinit dev-\u003espinlock between attachments to low-level drivers\n\n`struct comedi_device` is the main controlling structure for a COMEDI\ndevice created by the COMEDI subsystem. It contains a member `spinlock`\ncontaining a spin-lock that is initialized by the COMEDI subsystem, but\nis reserved for use by a low-level driver attached to the COMEDI device\n(at least since commit 25436dc9d84f (\"Staging: comedi: remove RT\ncode\")).\n\nSome COMEDI devices (those created on initialization of the COMEDI\nsubsystem when the \"comedi.comedi_num_legacy_minors\" parameter is\nnon-zero) can be attached to different low-level drivers over their\nlifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in\ninconsistent lock states being reported when there is a mismatch in the\nspin-lock locking levels used by each low-level driver to which the\nCOMEDI device has been attached. Fix it by reinitializing\n`dev-\u003espinlock` before calling the low-level driver\u0027s `attach` function\npointer if `CONFIG_LOCKDEP` is enabled.\n\nReported-by: syzbot+cc9f7f4a7df09f53c4a4@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dcc9f7f4a7df09f53c4a4\nFixes: ed9eccbe8970 (\"Staging: add comedi core\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nLink: https://patch.msgid.link/20260225132427.86578-1-abbotti@mev.co.uk\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cc797d4821c754c701d9714b58bea947e31dbbe0", "tree": "66a69a734af1b3fdce0cc81a9f935b440f629f21", "parents": [ "3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7" ], "author": { "name": "Ian Abbott", "email": "abbotti@mev.co.uk", "time": "Thu Feb 05 14:01:30 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:39:29 2026 +0200" }, "message": "comedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards. Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nFixes: 85acac61096f9 (\"Staging: comedi: add me_daq driver\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nLink: https://patch.msgid.link/20260205140130.76697-1-abbotti@mev.co.uk\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7", "tree": "db1255f645437d0e0109de3ea84e9fdb4f5195f4", "parents": [ "101ab946b79ad83b36d5cfd47de587492a80acf0" ], "author": { "name": "Ian Abbott", "email": "abbotti@mev.co.uk", "time": "Thu Feb 05 13:39:49 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:39:21 2026 +0200" }, "message": "comedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix.\n\nFixes: ac584af59945 (\"staging: comedi: me4000: fix firmware downloading\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nLink: https://patch.msgid.link/20260205133949.71722-1-abbotti@mev.co.uk\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "101ab946b79ad83b36d5cfd47de587492a80acf0", "tree": "36a7d0f235b540cc76132b78428507af5f305994", "parents": [ "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6" ], "author": { "name": "Ian Abbott", "email": "abbotti@mev.co.uk", "time": "Wed Jan 28 15:00:10 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:38:28 2026 +0200" }, "message": "comedi: ni_atmio16d: Fix invalid clean-up after failed attach\n\nIf the driver\u0027s COMEDI \"attach\" handler function (`atmio16d_attach()`)\nreturns an error, the COMEDI core will call the driver\u0027s \"detach\"\nhandler function (`atmio16d_detach()`) to clean up. This calls\n`reset_atmio16d()` unconditionally, but depending on where the error\noccurred in the attach handler, the device may not have been\nsufficiently initialized to call `reset_atmio16d()`. It uses\n`dev-\u003eiobase` as the I/O port base address and `dev-\u003eprivate` as the\npointer to the COMEDI device\u0027s private data structure. `dev-\u003eiobase`\nmay still be set to its initial value of 0, which would result in\nundesired writes to low I/O port addresses. `dev-\u003eprivate` may still be\n`NULL`, which would result in null pointer dereferences.\n\nFix `atmio16d_detach()` by checking that `dev-\u003eprivate` is valid\n(non-null) before calling `reset_atmio16d()`. This implies that\n`dev-\u003eiobase` was set correctly since that is set up before\n`dev-\u003eprivate`.\n\nFixes: 2323b276308a (\"Staging: comedi: add ni_at_atmio16d driver\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Ian Abbott \u003cabbotti@mev.co.uk\u003e\nLink: https://patch.msgid.link/20260128150011.5006-1-abbotti@mev.co.uk\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d1857f8296dceb75d00ab857fc3c61bc00c7f5c6", "tree": "57715fb2657c72c66cd99657c20bfc18c05a1b66", "parents": [ "5cefb52c1af6f69ea719e42788f6ec6a087eb74c" ], "author": { "name": "Adam Crosser", "email": "adam.crosser@praetorian.com", "time": "Tue Mar 17 19:25:28 2026 +0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:30:40 2026 +0200" }, "message": "gpib: fix use-after-free in IO ioctl handlers\n\nThe IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor\npointer after board-\u003ebig_gpib_mutex has been released. A concurrent\nIBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during\nthis window, causing a use-after-free.\n\nThe IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly\nrelease big_gpib_mutex before calling their handler. wait_ioctl() is\ncalled with big_gpib_mutex held, but ibwait() releases it internally\nwhen wait_mask is non-zero. In all four cases, the descriptor pointer\nobtained from handle_to_descriptor() becomes unprotected.\n\nFix this by introducing a kernel-only descriptor_busy reference count\nin struct gpib_descriptor. Each handler atomically increments\ndescriptor_busy under file_priv-\u003edescriptors_mutex before releasing the\nlock, and decrements it when done. close_dev_ioctl() checks\ndescriptor_busy under the same lock and rejects the close with -EBUSY\nif the count is non-zero.\n\nA reference count rather than a simple flag is necessary because\nmultiple handlers can operate on the same descriptor concurrently\n(e.g. IBRD and IBWAIT on the same handle from different threads).\n\nA separate counter is needed because io_in_progress can be cleared from\nunprivileged userspace via the IBWAIT ioctl (through general_ibstatus()\nwith set_mask containing CMPL), which would allow an attacker to bypass\na check based solely on io_in_progress. The new descriptor_busy\ncounter is only modified by the kernel IO paths.\n\nThe lock ordering is consistent (big_gpib_mutex -\u003e descriptors_mutex)\nand the handlers only hold descriptors_mutex briefly during the lookup,\nso there is no deadlock risk and no impact on IO throughput.\n\nSigned-off-by: Adam Crosser \u003cadam.crosser@praetorian.com\u003e\nCc: stable \u003cstable@kernel.org\u003e\nReviewed-by: Dave Penkler \u003cdpenkler@gmail.com\u003e\nTested-by: Dave Penkler \u003cdpenkler@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5cefb52c1af6f69ea719e42788f6ec6a087eb74c", "tree": "8ed6afc0bbc5453739a34781748a00f5f91a4b89", "parents": [ "579af7204d762587f9cce0d6236a710a771f1f6f" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Tue Mar 10 11:51:27 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:30:30 2026 +0200" }, "message": "gpib: lpvo_usb: fix memory leak on disconnect\n\nThe driver iterates over the registered USB interfaces during GPIB\nattach and takes a reference to their USB devices until a match is\nfound. These references are never released which leads to a memory leak\nwhen devices are disconnected.\n\nFix the leak by dropping the unnecessary references.\n\nFixes: fce79512a96a (\"staging: gpib: Add LPVO DIY USB GPIB driver\")\nCc: stable \u003cstable@kernel.org\u003e # 6.13\nCc: Dave Penkler \u003cdpenkler@gmail.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20260310105127.17538-1-johan@kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "579af7204d762587f9cce0d6236a710a771f1f6f", "tree": "7a62826fb7d3e1a5996a8f741674443ce79b9842", "parents": [ "3e68690a2ac51fc3448a907aef5deda98c770f15" ], "author": { "name": "Dave Penkler", "email": "dpenkler@gmail.com", "time": "Mon Feb 02 10:47:55 2026 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 14:30:25 2026 +0200" }, "message": "gpib: Fix fluke driver s390 compile issue\n\nThe following errors were reported for a s390 randconfig build\nof the fluke gpib driver:\n\n\u003e\u003e drivers/gpib/eastwood/fluke_gpib.c:1002:23: error: call to undeclared function \u0027ioremap\u0027; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]\n 1002 | nec_priv-\u003emmiobase \u003d ioremap(e_priv-\u003egpib_iomem_res-\u003estart,\n | ^\n\u003e\u003e drivers/gpib/eastwood/fluke_gpib.c:1002:21: error: incompatible integer to pointer conversion assigning to \u0027void *\u0027 from \u0027int\u0027 [-Wint-conversion]\n 1002 | nec_priv-\u003emmiobase \u003d ioremap(e_priv-\u003egpib_iomem_res-\u003estart,\n | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n 1003 | resource_size(e_priv-\u003egpib_iomem_res));\n | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n drivers/gpib/eastwood/fluke_gpib.c:1036:33: error: incompatible integer to pointer conversion assigning to \u0027void *\u0027 from \u0027int\u0027 [-Wint-conversion]\n 1036 | e_priv-\u003ewrite_transfer_counter \u003d ioremap(e_priv-\u003ewrite_transfer_counter_res-\u003estart,\n | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n 1037 | resource_size(e_priv-\u003ewrite_transfer_counter_res));\n | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nAdd HAS_IOMEM dependency to Kconfig for fluke driver option\n\nSuggested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202601221748.AFAqHieJ-lkp@intel.com/\nFixes: baf8855c9160 (\"staging: gpib: fix address space mixup\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Dave Penkler \u003cdpenkler@gmail.com\u003e\nLink: https://patch.msgid.link/20260202094755.4259-1-dpenkler@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "dbde07f06226438cd2cf1179745fa1bec5d8914a", "tree": "172e925be1d6d80e3f2abddf2ff420cc164bb63f", "parents": [ "7aaa8047eafd0bd628065b15757d9b48c5f9c07d" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Thu Mar 12 12:43:05 2026 -0700" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Apr 02 13:49:16 2026 +0200" }, "message": "perf/x86: Fix potential bad container_of in intel_pmu_hw_config\n\nAuto counter reload may have a group of events with software events\npresent within it. The software event PMU isn\u0027t the x86_hybrid_pmu and\na container_of operation in intel_pmu_set_acr_caused_constr (via the\nhybrid helper) could cause out of bound memory reads. Avoid this by\nguarding the call to intel_pmu_set_acr_caused_constr with an\nis_x86_event check.\n\nFixes: ec980e4facef (\"perf/x86/intel: Support auto counter reload\")\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Thomas Falcon \u003cthomas.falcon@intel.com\u003e\nLink: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com\n" }, { "commit": "e08d007f9d813616ce7093600bc4fdb9c9d81d89", "tree": "9a8cd50efc0639603f837ac662a2fd64ec081a2a", "parents": [ "1319ea57529e131822bab56bf417c8edc2db9ae8" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Apr 01 15:20:21 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Apr 02 13:42:43 2026 +0200" }, "message": "sched/debug: Fix avg_vruntime() usage\n\nJohn reported that stress-ng-yield could make his machine unhappy and\nmanaged to bisect it to commit b3d99f43c72b (\"sched/fair: Fix\nzero_vruntime tracking\").\n\nThe commit in question changes avg_vruntime() from a function that is\na pure reader, to a function that updates variables. This turns an\nunlocked sched/debug usage of this function from a minor mistake into\na data corruptor.\n\nFixes: af4cf40470c2 (\"sched/fair: Add cfs_rq::avg_vruntime\")\nFixes: b3d99f43c72b (\"sched/fair: Fix zero_vruntime tracking\")\nReported-by: John Stultz \u003cjstultz@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nTested-by: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nTested-by: John Stultz \u003cjstultz@google.com\u003e\nLink: https://patch.msgid.link/20260401132355.196370805@infradead.org\n" }, { "commit": "1319ea57529e131822bab56bf417c8edc2db9ae8", "tree": "1cf991cebae1a25420350f0f93de8224c5a4480d", "parents": [ "7aaa8047eafd0bd628065b15757d9b48c5f9c07d" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Apr 01 15:20:20 2026 +0200" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Thu Apr 02 13:42:43 2026 +0200" }, "message": "sched/fair: Fix zero_vruntime tracking fix\n\nJohn reported that stress-ng-yield could make his machine unhappy and\nmanaged to bisect it to commit b3d99f43c72b (\"sched/fair: Fix\nzero_vruntime tracking\").\n\nThe combination of yield and that commit was specific enough to\nhypothesize the following scenario:\n\nSuppose we have 2 runnable tasks, both doing yield. Then one will be\neligible and one will not be, because the average position must be in\nbetween these two entities.\n\nTherefore, the runnable task will be eligible, and be promoted a full\nslice (all the tasks do is yield after all). This causes it to jump over\nthe other task and now the other task is eligible and current is no\nlonger. So we schedule.\n\nSince we are runnable, there is no {de,en}queue. All we have is the\n__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the\nfingered commit, those two no longer move zero_vruntime.\n\nAll that moves zero_vruntime are tick and full {de,en}queue.\n\nThis means, that if the two tasks playing leapfrog can reach the\ncritical speed to reach the overflow point inside one tick\u0027s worth of\ntime, we\u0027re up a creek.\n\nAdditionally, when multiple cgroups are involved, there is no guarantee\nthe tick will in fact hit every cgroup in a timely manner. Statistically\nspeaking it will, but that same statistics does not rule out the\npossibility of one cgroup not getting a tick for a significant amount of\ntime -- however unlikely.\n\nTherefore, just like with the yield() case, force an update at the end\nof every slice. This ensures the update is never more than a single\nslice behind and the whole thing is within 2 lag bounds as per the\ncomment on entity_key().\n\nFixes: b3d99f43c72b (\"sched/fair: Fix zero_vruntime tracking\")\nReported-by: John Stultz \u003cjstultz@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nTested-by: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nTested-by: John Stultz \u003cjstultz@google.com\u003e\nLink: https://patch.msgid.link/20260401132355.081530332@infradead.org\n" }, { "commit": "a80a014f83bded5a2f498c22b4a06a7a31256f98", "tree": "2848b3b99fd5a54942cadc15c619b73e0f16f358", "parents": [ "9351edf65cb6ba10564f9c81e3c52cf97f4b2a81", "a1822cb524e89b4cd2cf0b82e484a2335496a6d9" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 13:36:10 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 13:36:10 2026 +0200" }, "message": "Merge branch \u0027net-x25-fix-overflow-and-double-free\u0027\n\nMartin Schiller says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/x25: Fix overflow and double free\n\nThis patch set includes 2 fixes:\n\nThe first removes a potential double free of received skb\nThe second fixes an overflow when accumulating packets with the more-bit\nset.\n\nSigned-off-by: Martin Schiller \u003cms@dev.tdt.de\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260331-x25_fraglen-v4-0-3e69f18464b4@dev.tdt.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a1822cb524e89b4cd2cf0b82e484a2335496a6d9", "tree": "2848b3b99fd5a54942cadc15c619b73e0f16f358", "parents": [ "d10a26aa4d072320530e6968ef945c8c575edf61" ], "author": { "name": "Martin Schiller", "email": "ms@dev.tdt.de", "time": "Tue Mar 31 09:43:18 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 13:36:08 2026 +0200" }, "message": "net/x25: Fix overflow when accumulating packets\n\nAdd a check to ensure that `x25_sock.fraglen` does not overflow.\n\nThe `fraglen` also needs to be resetted when purging `fragment_queue` in\n`x25_clear_queues()`.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSuggested-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Martin Schiller \u003cms@dev.tdt.de\u003e\nLink: https://patch.msgid.link/20260331-x25_fraglen-v4-2-3e69f18464b4@dev.tdt.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d10a26aa4d072320530e6968ef945c8c575edf61", "tree": "4731dbbf43336358a6da3c70a702954471960122", "parents": [ "9351edf65cb6ba10564f9c81e3c52cf97f4b2a81" ], "author": { "name": "Martin Schiller", "email": "ms@dev.tdt.de", "time": "Tue Mar 31 09:43:17 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 02 13:36:08 2026 +0200" }, "message": "net/x25: Fix potential double free of skb\n\nWhen alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at\nline 48 and returns 1 (error).\nThis error propagates back through the call chain:\n\nx25_queue_rx_frame returns 1\n |\n v\nx25_state3_machine receives the return value 1 and takes the else\nbranch at line 278, setting queued\u003d0 and returning 0\n |\n v\nx25_process_rx_frame returns queued\u003d0\n |\n v\nx25_backlog_rcv at line 452 sees queued\u003d0 and calls kfree_skb(skb)\nagain\n\nThis would free the same skb twice. Looking at x25_backlog_rcv:\n\nnet/x25/x25_in.c:x25_backlog_rcv() {\n ...\n queued \u003d x25_process_rx_frame(sk, skb);\n ...\n if (!queued)\n kfree_skb(skb);\n}\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Martin Schiller \u003cms@dev.tdt.de\u003e\nLink: https://patch.msgid.link/20260331-x25_fraglen-v4-1-3e69f18464b4@dev.tdt.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bf3781a35c27978341c31f59f1460dcaabf2e726", "tree": "4d425d8787ba05d4830ef801dd544b9cfcae0050", "parents": [ "4e0a88254ad59f6c53a34bf5fa241884ec09e8b2", "e8d0ed37bd51da52da6225d278e330c2f18a6198" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 13:28:22 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 13:28:22 2026 +0200" }, "message": "Merge tag \u0027usb-serial-7.0-rc7\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial device ids for 7.0-rc7\n\nHere are some new modem and io_edgeport device ids.\n\nAll have been in linux-next with no reported issues.\n\n* tag \u0027usb-serial-7.0-rc7\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n USB: serial: option: add MeiG Smart SRM825WN\n USB: serial: io_edgeport: add support for Blackbox IC135A\n USB: serial: option: add support for Rolling Wireless RW135R-GL\n" }, { "commit": "9e07e3b81807edd356e1f794cffa00a428eff443", "tree": "5a701bc18adde708aa9b811dde10b8ce8e6326f5", "parents": [ "45b859b0728267a6199ee5002d62e6c6f3e8c89d" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Wed Apr 01 16:33:53 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Apr 02 11:37:35 2026 +0200" }, "message": "thermal: core: Fix thermal zone device registration error path\n\nIf thermal_zone_device_register_with_trips() fails after registering\na thermal zone device, it needs to wait for the tz-\u003eremoval completion\nlike thermal_zone_device_unregister(), in case user space has managed\nto take a reference to the thermal zone device\u0027s kobject, in which case\nthermal_release() may not be called by the error path itself and tz may\nbe freed prematurely.\n\nAdd the missing wait_for_completion() call to the thermal zone device\nregistration error path.\n\nFixes: 04e6ccfc93c5 (\"thermal: core: Fix NULL pointer dereference in zone registration error path\")\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nCc: All applicable \u003cstable@vger.kernel.org\u003e\nReviewed-by: Lukasz Luba \u003clukasz.luba@arm.com\u003e\nTested-by: Lukasz Luba \u003clukasz.luba@arm.com\u003e\nLink: https://patch.msgid.link/2849815.mvXUDI8C0e@rafael.j.wysocki\n" }, { "commit": "4e0a88254ad59f6c53a34bf5fa241884ec09e8b2", "tree": "8f4fabcf4397dab910180a95b3308a3b442dc93f", "parents": [ "5abbe6ecc6203355c770bf232ade88e29c960049" ], "author": { "name": "Michael Zimmermann", "email": "sigmaepsilon92@gmail.com", "time": "Tue Mar 31 20:48:44 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:55:28 2026 +0200" }, "message": "usb: gadget: f_hid: move list and spinlock inits from bind to alloc\n\nThere was an issue when you did the following:\n- setup and bind an hid gadget\n- open /dev/hidg0\n- use the resulting fd in EPOLL_CTL_ADD\n- unbind the UDC\n- bind the UDC\n- use the fd in EPOLL_CTL_DEL\n\nWhen CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported\nwithin remove_wait_queue (via ep_remove_wait_queue). After some\ndebugging I found out that the queues, which f_hid registers via\npoll_wait were the problem. These were initialized using\ninit_waitqueue_head inside hidg_bind. So effectively, the bind function\nre-initialized the queues while there were still items in them.\n\nThe solution is to move the initialization from hidg_bind to hidg_alloc\nto extend their lifetimes to the lifetime of the function instance.\n\nAdditionally, I found many other possibly problematic init calls in the\nbind function, which I moved as well.\n\nSigned-off-by: Michael Zimmermann \u003csigmaepsilon92@gmail.com\u003e\nCc: stable \u003cstable@kernel.org\u003e\nLink: https://patch.msgid.link/20260331184844.2388761-1-sigmaepsilon92@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5abbe6ecc6203355c770bf232ade88e29c960049", "tree": "540bf17470cff42dd337a468ac7e1e47f0e5a220", "parents": [ "bd3d245b0fef571f93504904df62b8865b1c0d34" ], "author": { "name": "Guan-Yu Lin", "email": "guanyulin@google.com", "time": "Wed Apr 01 12:32:18 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:43:30 2026 +0200" }, "message": "usb: host: xhci-sideband: delegate offload_usage tracking to class drivers\n\nRemove usb_offload_get() and usb_offload_put() from the xHCI sideband\ninterrupter creation and removal paths.\n\nThe responsibility of manipulating offload_usage now lies entirely with\nthe USB class drivers. They have the precise context of when an offload\ndata stream actually starts and stops, ensuring a much more accurate\nrepresentation of offload activity for power management.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: ef82a4803aab (\"xhci: sideband: add api to trace sideband usage\")\nSigned-off-by: Guan-Yu Lin \u003cguanyulin@google.com\u003e\nTested-by: Hailong Liu \u003chailong.liu@oppo.com\u003e\nTested-by: hailong.liu@oppo.com\nAcked-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260401123238.3790062-3-guanyulin@google.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bd3d245b0fef571f93504904df62b8865b1c0d34", "tree": "1d37ac524cf4db558d5b86a11a4e545bbea5e8e9", "parents": [ "c32f8748d70c8fc77676ad92ed76cede17bf2c48" ], "author": { "name": "Guan-Yu Lin", "email": "guanyulin@google.com", "time": "Wed Apr 01 12:32:17 2026 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:43:26 2026 +0200" }, "message": "usb: core: use dedicated spinlock for offload state\n\nReplace the coarse USB device lock with a dedicated offload_lock\nspinlock to reduce contention during offload operations. Use\noffload_pm_locked to synchronize with PM transitions and replace\nthe legacy offload_at_suspend flag.\n\nOptimize usb_offload_get/put by switching from auto-resume/suspend\nto pm_runtime_get_if_active(). This ensures offload state is only\nmodified when the device is already active, avoiding unnecessary\npower transitions.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: ef82a4803aab (\"xhci: sideband: add api to trace sideband usage\")\nSigned-off-by: Guan-Yu Lin \u003cguanyulin@google.com\u003e\nTested-by: Hailong Liu \u003chailong.liu@oppo.com\u003e\nAcked-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260401123238.3790062-2-guanyulin@google.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c32f8748d70c8fc77676ad92ed76cede17bf2c48", "tree": "fadfe0cfe96009b5e1d0d9d0a5fd143f05a3321b", "parents": [ "541288339b8cb8bb62be5ec0eab6c65e9dfc6055" ], "author": { "name": "Yongchao Wu", "email": "yongchao.wu@autochips.com", "time": "Wed Apr 01 08:10:00 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:38:00 2026 +0200" }, "message": "usb: cdns3: gadget: fix state inconsistency on gadget init failure\n\nWhen cdns3_gadget_start() fails, the DRD hardware is left in gadget mode\nwhile software state remains INACTIVE, creating hardware/software state\ninconsistency.\n\nWhen switching to host mode via sysfs:\n echo host \u003e /sys/class/usb_role/13180000.usb-role-switch/role\n\nThe role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,\nso cdns_role_stop() skips cleanup because state is still INACTIVE.\nThis violates the DRD controller design specification (Figure22),\nwhich requires returning to idle state before switching roles.\n\nThis leads to a synchronous external abort in xhci_gen_setup() when\nsetting up the host controller:\n\n[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19\n[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget\n[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed\n...\n[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller\n[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP\n[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408\n[ 1301.393391] backtrace:\n ...\n xhci_gen_setup+0xa4/0x408 \u003c-- CRASH\n xhci_plat_setup+0x44/0x58\n usb_add_hcd+0x284/0x678\n ...\n cdns_role_set+0x9c/0xbc \u003c-- Role switch\n\nFix by calling cdns_drd_gadget_off() in the error path to properly\nclean up the DRD gadget state.\n\nFixes: 7733f6c32e36 (\"usb: cdns3: Add Cadence USB3 DRD Driver\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Yongchao Wu \u003cyongchao.wu@autochips.com\u003e\nAcked-by: Peter Chen \u003cpeter.chen@kernel.org\u003e\nLink: https://patch.msgid.link/20260401001000.5761-1-yongchao.wu@autochips.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "541288339b8cb8bb62be5ec0eab6c65e9dfc6055", "tree": "d70d67e911e043e57bd77f11a1de36e2b58c4093", "parents": [ "6e0e34d85cd46ceb37d16054e97a373a32770f6c" ], "author": { "name": "Xiaolei Wang", "email": "xiaolei.wang@windriver.com", "time": "Wed Apr 01 21:49:38 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:37:45 2026 +0200" }, "message": "usb: dwc3: imx8mp: fix memory leak on probe failure path\n\nWhen platform_get_drvdata() returns NULL and probe defers, the error\npath jumps to the \u0027depopulate\u0027 label, skipping put_device() for the\nreference acquired by of_find_device_by_node(). This extra reference\nprevents the child platform device from being freed when\nof_platform_depopulate() is called, resulting in memory leaks reported\nby kmemleak:\n\n unreferenced object 0xffff0000c92c1480 (size 64):\n comm \"kworker/u16:2\", pid 50, jiffies 4294895789\n backtrace (crc 49d507d0):\n kmemleak_alloc+0x34/0x40\n __kmalloc_noprof+0x430/0x670\n of_device_alloc+0xec/0x26c\n of_platform_device_create_pdata+0x60/0x1f0\n of_platform_bus_create+0x290/0x610\n of_platform_populate+0x74/0x118\n dwc3_imx8mp_probe+0x228/0x734\n\nFixes: 86767625f525 (\"usb: dwc3: imx8mp: disable auto suspend for host role\")\nSigned-off-by: Xiaolei Wang \u003cxiaolei.wang@windriver.com\u003e\nAcked-by: Thinh Nguyen \u003cThinh.Nguyen@synopsys.com\u003e\nLink: https://patch.msgid.link/20260401134938.686748-1-xiaolei.wang@windriver.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "6e0e34d85cd46ceb37d16054e97a373a32770f6c", "tree": "fb4ad322c9e8172147256da111cb9bb1c9029e14", "parents": [ "01af542392b5d41fd659d487015a71f627accce3" ], "author": { "name": "Taegu Ha", "email": "hataegu0826@gmail.com", "time": "Thu Apr 02 04:13:11 2026 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:37:17 2026 +0200" }, "message": "usb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req-\u003elength bytes into a 4-byte stack\nvariable:\n\n u32 data \u003d 0;\n memcpy(\u0026data, req-\u003ebuf, req-\u003elength);\n\nreq-\u003elength is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req-\u003eactual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object.\n\nSigned-off-by: Taegu Ha \u003chataegu0826@gmail.com\u003e\nCc: stable \u003cstable@kernel.org\u003e\nLink: https://patch.msgid.link/20260401191311.3604898-1-hataegu0826@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "01af542392b5d41fd659d487015a71f627accce3", "tree": "48dc4cb838051114c724459a8504329b61cca900", "parents": [ "33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Wed Apr 01 10:51:42 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:36:56 2026 +0200" }, "message": "usb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u003edev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().\n\nFixes: 289fcff4bcdb1 (\"usb: add bus type for USB ULPI\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nReviewed-by: Heikki Krogerus \u003cheikki.krogerus@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21", "tree": "3465d935bdbbd00c6221c64c60d6390354c9af75", "parents": [ "8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c" ], "author": { "name": "Felix Gu", "email": "ustc.gu@gmail.com", "time": "Tue Mar 31 20:05:08 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:36:36 2026 +0200" }, "message": "usb: misc: usbio: Fix URB memory leak on submit failure\n\nWhen usb_submit_urb() fails in usbio_probe(), the previously allocated\nURB is never freed, causing a memory leak.\n\nFix this by jumping to err_free_urb label to properly release the URB\non the error path.\n\nFixes: 121a0f839dbb (\"usb: misc: Add Intel USBIO bridge driver\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Oliver Neukum \u003coneukum@suse.com\u003e\nReviewed-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260331-usbio-v2-1-d8c48dad9463@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8b7a42ecdcdeb55580d9345412f7f8fc5aca3f6c", "tree": "ad30fcafd62017576f74cfa30dc7088e9ab1832e", "parents": [ "7f6f127b9bc34bed35f56faf7ecb1561d6b39000" ], "author": { "name": "JP Hein", "email": "jp@jphein.com", "time": "Mon Mar 30 17:38:04 2026 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:30:44 2026 +0200" }, "message": "USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam\n\nThe Razer Kiyo Pro (1532:0e05) is a USB 3.0 UVC webcam whose firmware\ndoes not handle USB Link Power Management transitions reliably. When LPM\nis active, the device can enter a state where it fails to respond to\ncontrol transfers, producing EPIPE (-32) errors on UVC probe control\nSET_CUR requests. In the worst case, the stalled endpoint triggers an\nxHCI stop-endpoint command that times out, causing the host controller\nto be declared dead and every USB device on the bus to be disconnected.\n\nThis has been reported as Ubuntu Launchpad Bug #2061177. The failure\nmode is:\n\n 1. UVC probe control SET_CUR returns -32 (EPIPE)\n 2. xHCI host not responding to stop endpoint command\n 3. xHCI host controller not responding, assume dead\n 4. All USB devices on the affected xHCI controller disconnect\n\nDisabling LPM prevents the firmware from entering the problematic low-\npower states that precede the stall. This is the same approach used for\nother webcams with similar firmware issues (e.g., Logitech HD Webcam C270).\n\nCc: stable \u003cstable@kernel.org\u003e\nLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2061177\nSigned-off-by: JP Hein \u003cjp@jphein.com\u003e\nLink: https://patch.msgid.link/20260331003806.212565-2-jp@jphein.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7f6f127b9bc34bed35f56faf7ecb1561d6b39000", "tree": "e40bf7cea2fb71b76b8e887c61c6d85840d8ab01", "parents": [ "0179c6da0793ae03607002c284b53b6d584172d0" ], "author": { "name": "Yongchao Wu", "email": "yongchao.wu@autochips.com", "time": "Tue Mar 31 08:04:07 2026 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:30:25 2026 +0200" }, "message": "usb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep-\u003edesc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep-\u003edesc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready.\n\nFixes: 7733f6c32e36 (\"usb: cdns3: Add Cadence USB3 DRD Driver\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Yongchao Wu \u003cyongchao.wu@autochips.com\u003e\nAcked-by: Peter Chen \u003cpeter.chen@kernel.org\u003e\nLink: https://patch.msgid.link/20260331000407.613298-1-yongchao.wu@autochips.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0179c6da0793ae03607002c284b53b6d584172d0", "tree": "1b288dbb6c022431837784f9e1076376b7fcfc42", "parents": [ "e367599529dc42578545a7f85fde517b35b3cda7" ], "author": { "name": "Gabor Juhos", "email": "j4g8y7@gmail.com", "time": "Mon Mar 30 17:02:42 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 02 09:19:31 2026 +0200" }, "message": "usb: core: phy: avoid double use of \u0027usb3-phy\u0027\n\nCommit 53a2d95df836 (\"usb: core: add phy notify connect and disconnect\")\ncauses double use of the \u0027usb3-phy\u0027 in certain cases.\n\nSince that commit, if a generic PHY named \u0027usb3-phy\u0027 is specified in\nthe device tree, that is getting added to the \u0027phy_roothub\u0027 list of the\nsecondary HCD by the usb_phy_roothub_alloc_usb3_phy() function. However,\nthat PHY is getting added also to the primary HCD\u0027s \u0027phy_roothub\u0027 list\nby usb_phy_roothub_alloc() if there is no generic PHY specified with\n\u0027usb2-phy\u0027 name.\n\nThis causes that the usb_add_hcd() function executes each phy operations\ntwice on the \u0027usb3-phy\u0027. Once when the primary HCD is added, then once\nagain when the secondary HCD is added.\n\nThe issue affects the Marvell Armada 3700 platform at least, where a\ncustom name is used for the USB2 PHY:\n\n $ git grep \u0027phy-names.*usb3\u0027 arch/arm64/boot/dts/marvell/armada-37xx.dtsi | tr \u0027\\t\u0027 \u0027 \u0027\n arch/arm64/boot/dts/marvell/armada-37xx.dtsi: phy-names \u003d \"usb3-phy\", \"usb2-utmi-otg-phy\";\n\nExtend the usb_phy_roothub_alloc_usb3_phy() function to skip adding the\n\u0027usb3-phy\u0027 to the \u0027phy_roothub\u0027 list of the secondary HCD when \u0027usb2-phy\u0027\nis not specified in the device tree to avoid the double use.\n\nFixes: 53a2d95df836 (\"usb: core: add phy notify connect and disconnect\")\nCc: stable \u003cstable@kernel.org\u003e\nSigned-off-by: Gabor Juhos \u003cj4g8y7@gmail.com\u003e\nLink: https://patch.msgid.link/20260330-usb-avoid-usb3-phy-double-use-v1-1-d2113aecb535@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b477ab8893c3e6b4be3074358db830687de7bfff", "tree": "44d132561eb33087ec533affa648ac0cfaffe326", "parents": [ "a0dafdbd1049a8ea661a1a471be1b840bd8aed13", "e74c38ef6f170179c0029b5744d6a14dfd543108" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Apr 02 09:08:03 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Apr 02 09:08:03 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.0-rc6\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.0\n\nAnother smallish batch of fixes and quirks, these days it\u0027s AMD that is\ngetting all the DMI entries added. We\u0027ve got one core fix for a missing\nlist initialisation with auxiliary devices, otherwise it\u0027s all fairly\nsmall things.\n" } ], "next": "f8995c2df519f382525ca4bc90553ad2ec611067" }