)]}' { "log": [ { "commit": "df2908090cda368b01ff43709f51890076c56157", "tree": "349ca7246325dc415a944a4576fe4146968ef775", "parents": [ "b1e00ffaf91c41eb752a1c200295c9ab7abfae1d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 15:07:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 15:07:20 2026 -0700" }, "message": "Linux 7.3-rc2\n" }, { "commit": "b1e00ffaf91c41eb752a1c200295c9ab7abfae1d", "tree": "ce32db75f453e3079fc070e065f325e679dcb0eb", "parents": [ "2beb1b31a12b57e19cd5c82ea6d54e56520605e8", "d80e12156f1fd490adf29a8d28489725a3ac817a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 14:21:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 14:21:24 2026 -0700" }, "message": "Merge tag \u0027trace-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix several tracefs files that did not take the trace_array reference\n\n A trace instance can be created and destroyed in the tracefs\n \"instances\" directory via mkdir and rmdir respectively. The instance\n is represented by a trace_array descriptor.\n\n Most tracefs files pass the trace_array as the private data of the\n inode to the open/read/write functions. Since there is no locking\n between the time a task opens a file and the deletion of the instance\n (and the freeing of the trace_array), each open needs to get a\n reference to the trace_array and each close must remove it.\n\n An instance can\u0027t be removed if there\u0027s any reference taken on its\n trace_array. The open function uses trace_array_get() that takes a\n lock (preventing removal of instances) and iterates the list of all\n existing trace_arrays and if it finds a match, it takes the reference\n and releases the lock. If it doesn\u0027t find a match, it causes the open\n to return -ENODEV.\n\n There were some added files that did not take the trace_array\n reference on open that needed to be fixed. Sashiko also correctly\n pointed out that there were some files that took an address of an\n field or element of the trace_array which had a pointer back to the\n trace_array to take its reference on open. But this leaves a slight\n race between referencing this element to get the trace_array as the\n element itself could be freed. To solve this, some helper functions\n were created to look for trace_arrays with this field or element in\n the search so that the element did not have to be dereferenced before\n the trace_array\u0027s reference was taken.\n\n - Add a lock around ftrace_ops initialization\n\n When a ftrace_ops is first used by ftrace, some internal\n initialization is performed on the ops. But if multiple tasks were\n calling functions that did this initialization, it could race and\n perform doing the initialization more than once, corrupting the\n internal data. Add a lock in the initialization code to prevent this\n from happening.\n\n - Fix splice reads on mmapped buffers\n\n The logic in the ring buffer splice code for mmapped buffers is\n supposed to do a copy of the memory as the mapped buffers can\u0027t be\n given to splice. But there was an if statement within the copy code\n that would return a -1 if a request for a full page was done and it\n wasn\u0027t a partial read. This is because this logic was written before\n mmapped buffers existed and this case didn\u0027t make sense at the time.\n For mmapped buffers it makes perfect sense and by returning early can\n drop a lot of pages unnecessarily.\n\n - Have the persistent ring buffer validation check nr_subbufs\n\n Sashiko reported that the validation code was relying on the saved\n nr_subbufs to match the calculated nr_pages + 1 and if they were off,\n that the code could cause corruption. Sashiko is correct, and the\n saved nr_subbufs should be validated before assuming it is correct.\n\n - Do not allow more than one instance with the same name on cmdline\n\n If an admin were to add more than one trace instances with the same\n name they all would be created, but only the first one would be\n accessible via tracefs. This used to not be allowed but some\n restructuring of code has since made it possible.\n\n - Fix the race between subbuf resize and trace_pipe_raw readers\n\n If a task was reading trace_pipe_raw while another task was changing\n the ring buffer subbuf size, it could crash the reader. The\n trace_pipe_raw readers do get their own copy of the page from the\n buffer, but the code needs some restructuring to not have the resize\n of the subbuffers cause issues.\n\n - Cap the size of the mapped (static) ring buffer nr_pages\n\n The meta data used for ring buffer mapped buffers is 32 bit in size.\n A normal ring buffer could (in theory) have more than 4 billion\n pages. But this is not allowed by mapped buffers, so enforce it.\n\n* tag \u0027trace-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Use a macro for static buffer bits\n tracing: Fix comment in tracing_buffers_splice_read()\n ring-buffer: Prevent truncation of nr_pages / nr_subbufs\n ring-buffer: Cap static ring buffer nr_pages\n tracing: Fix subbuf resize races with trace_pipe_raw readers\n tracing: Fix to avoid creating trace instances with duplicate names\n ring-buffer: Add checking nr_subbufs to persistent ring buffer validation\n ring-buffer: Allow splice reads on static buffers\n tracing: Take trace_array reference when opening options file\n ftrace: Synchronize the initialization of ftrace_ops\n ftrace: Take trace_array reference before accessing its ftrace_ops\n tracing: Have show_event_filters/triggers files take trace array ref\n" }, { "commit": "2beb1b31a12b57e19cd5c82ea6d54e56520605e8", "tree": "622b0fd0b7fd41bdf9240873cb6d7514c248330b", "parents": [ "88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8", "536b523b407397c8d3967c020ce7aad70a0ea030" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 13:49:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 13:49:44 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n \"This mainly contains verifier fixes that address bugs reported by\n Nicholas Carlini.\n\n - Fix incorrect non-NULL inference in pointer comparisons: pointer\n types that may be NULL at runtime, pointers with unbounded offsets,\n JMP32 comparisons with zero, and imprecise zero registers (Eduard\n Zingerman)\n\n - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind\n implicit subprog exit, bpf_loop() callbacks, linked scalar ids and\n NULL call arguments (Eduard Zingerman)\n\n - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero\n extension of arena 32-bit cmpxchg, don\u0027t rewrite bpf_fastcall\n patterns entered by a jump (Eduard Zingerman)\n\n - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs\n (Hui Su)\n\n - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,\n and reject key-less BTF for hash maps (Jiayuan Chen)\n\n - Various fixes (Kumar Kartikeya Dwivedi):\n - Fix out-of-bounds access in disassembler on invalid LDSX\n instruction\n - mark siginfo of signal tracepoints as scalar and\n sched_process_wait argument as nullable\n - mark faultable stack helpers as sleepable\n - reject tail calls and legacy packet loads from callbacks\n - enforce rbtree callback lock restrictions for resilient locks\n - require MEM_PERCPU for percpu kptr stores\n - clear NON_OWN_REF after RCU protection ends\n - mark NULL kptr stores precise\n - preserve inner map identity in callback frames\n - reject non-scalar bpf_loop() iteration counts\n\n - Fix trampoline allocation slowdown on x86 by using\n EXECMEM_MODULE_DATA (Mike Rapoport)\n\n - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and\n reject untrusted allocated-object pointers (Ning Ding)\n\n - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,\n Yuan Chen)\"\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)\n bpf, riscv: Make arena support depend on ZACAS\n selftests/bpf: Test pointer bpf_loop iteration count rejection\n bpf: Reject non-scalar bpf_loop iteration counts\n bpf: use mark_arg_precision() in check_mem_size_reg()\n bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()\n selftests/bpf: precision of a NULL global subprogram BTF_ID argument\n bpf: mark a NULL BTF_ID argument of a global subprogram precise\n selftests/bpf: precision of a NULL kfunc argument\n bpf: mark a NULL kfunc argument precise\n selftests/bpf: precision of a NULL global subprogram memory argument\n bpf: mark a NULL memory argument of a call precise\n selftests/bpf: precision of a NULL helper argument\n bpf: mark a NULL call argument precise\n selftests/bpf: Test inner map identities in callbacks\n bpf: Preserve inner map identity in callback frames\n selftests/bpf: Test imprecise scalar kptr stores\n bpf: Mark NULL kptr stores precise\n selftests/bpf: Test rhtab kptr cancellation semantics\n bpf: Cancel special fields when recycling rhtab elements\n selftests/bpf: Test timer field on recycled rhtab element\n ...\n" }, { "commit": "88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8", "tree": "86a45b22f99f3918caeaa1a66a3da621e6597ce0", "parents": [ "c4a3928e7d0c08f2946ec3cf2814ba7738a08347", "f0d243a96f2684ad771d678767d17972cf840bd7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 11:08:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 11:08:44 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix a timestamping bug in pick_task_fair() and yield_task_fair()\n (Zhan Xusheng)\n\n - Skip migrate-disabled tasks when picking a push candidate in the\n RT and DL schedulers (Seiji Nishikawa)\n\n - Skip rq-\u003eavg_idle update without a valid idle_stamp (Shubhang\n Kaushik)\n\n - Fix throttling bug in throttle_cfs_rq(), caused by the recent\n single-runqueue conversion (Wanwu Li)\n\n - Fix bandwidth calculation bug in distribute_cfs_runtime(),\n caused by the single-runqueue conversion (Wanwu Li)\n\n - Don\u0027t make x86 ITMT enablement depend on debugfs (Mario Limonciello)\n\n - Avoid creating misfits during cache-aware load-balancing on hybrid\n systems (Tim Chen)\n\n* tag \u0027sched-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Avoid creating misfits during cache-aware balancing\n x86/itmt: Don\u0027t make ITMT enablement depend on debugfs\n sched/fair: Use cfs_rq-\u003eh_curr in distribute_cfs_runtime()\n sched/fair: Use cfs_rq-\u003eh_curr in throttle_cfs_rq()\n sched/core: Skip rq-\u003eavg_idle update without a valid idle_stamp\n sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate\n sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers\n" }, { "commit": "c4a3928e7d0c08f2946ec3cf2814ba7738a08347", "tree": "2b7d23238cdf8cb183cf6d8e86032acf181b44da", "parents": [ "c8990f3179e5636832fc22e6a262de5d50c797e3", "58a8108bc73de0740d5b88150465d6690ea5f85f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 11:06:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 11:06:09 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Skip empty AUX records with only format flags (Leo Yan)\n\n - Fix use-after-free when perf mmap() revival races with the\n last munmap() (Yilin Zhang, Weiming Shi)\n\n* tag \u0027perf-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf: Fix use-after-free when perf mmap() revival races with the last munmap()\n perf/core: Skip empty AUX records with only format flags\n" }, { "commit": "c8990f3179e5636832fc22e6a262de5d50c797e3", "tree": "495236dd54136175c981a5adb1589c22728a1cd5", "parents": [ "b485131995544741ba6dcc313d7eb573bca7bebc", "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 10:45:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 10:45:46 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix a softirq processing delay bug in local_interrupt_disable(),\n which should mostly only affect the Rust runtime (Boqun Feng)\n\n - Remove the hardirq_disable_count() function which caused the\n previous bug and is now unused \u0026 unnecessary (Boqun Feng)\n\n - lockdep: Invalidate stale class_cache entries for zapped classes\n (Eric Dumazet)\n\n - Fix rt_mutex specific futex scheduling helpers\n (Sebastian Andrzej Siewior)\n\n - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)\n\n* tag \u0027locking-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n futex: Prevent rcuwait use-after-free during requeue PI\n futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling\n locking/lockdep: Invalidate stale class_cache entries for zapped classes\n preempt: Remove hardirq_disable_count()\n interrupt: Disable interrupt before modifying hardirq_disable counter\n" }, { "commit": "b485131995544741ba6dcc313d7eb573bca7bebc", "tree": "67dc7c3c162b45905d52d52bfd8a5fb80c4c0add", "parents": [ "d3cbb9af7242873aae6fc2b7e8a991101a322201", "d31fbbade43f880b7e59e2b3a72722fe2725d93f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 10:35:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 10:35:24 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull IRQ subsystem fixes from Ingo Molnar:\n\n - Revert a commit to the mbigen irqchip driver that caused\n a regression on two-port Hi1616 chips (Caina)\n\n - Fix a too-long-preemption-off bug in the stm32mp-exti\n irqchip driver, caused by a time unit ambiguity \u0026 mismatch\n (Ju Nan)\n\n - Remove the now completely unused irq_domain_add_linear()\n inline function (Jiri Slaby)\n\n* tag \u0027irq-urgent-2026-09-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout\n Revert \"irqchip/mbigen: Fix mbigen node address layout\"\n irqdomain: Delete irq_domain_add_linear()\n" }, { "commit": "d3cbb9af7242873aae6fc2b7e8a991101a322201", "tree": "947f33c9c3fd023b18262409bff4e832782a1f82", "parents": [ "bf979ab8f24657ebc6193183cfef1669029e84a5", "b144dc5a24149ba9a0cb2197001973a74b8c93b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 09:55:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 09:55:20 2026 -0700" }, "message": "Merge tag \u0027tty-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull virtio console fix from Greg KH:\n \"Here is a single virtio console fix for 7.3-rc2 to fix a much reported\n regression in 7.3-rc1, sorry about that. It\u0027s not been in linux-next,\n but it has been sent by many different developers to resolve the issue\n and is \u0027obviously\u0027 correct\"\n\n* tag \u0027tty-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n virtio_console: allocate the port_buffer with the caller\u0027s gfp\n" }, { "commit": "bf979ab8f24657ebc6193183cfef1669029e84a5", "tree": "35353cc8b52639854c9ec2ab04b5318191025ee5", "parents": [ "65538a8f02fe6e4f07228a816529b039b544f051", "cc7cd2a9228175c975f62ad56ed7c767701cb4fa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 09:49:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 09:49:06 2026 -0700" }, "message": "Merge tag \u0027staging-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are some small staging driver fixes to resolve some reported bugs\n that have been found, and tested, in a few staging drivers in 7.3-rc1.\n Included in here are:\n\n - OOB read problem fixes in the rtl8723bs driver\n\n - fbtft driver fix\n\n - sm750fb driver fix\n\n All of these have been in linux-next this week with no reported\n problems\"\n\n* tag \u0027staging-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()\n staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()\n staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()\n staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()\n staging: fbtft: make dirty_lock IRQ-safe\n" }, { "commit": "65538a8f02fe6e4f07228a816529b039b544f051", "tree": "7fd3a311f909f9bb2dd3b0c55f7d99da5680980e", "parents": [ "1fc5a74b108fc90951890ec513ac81869f5eaff1", "c9273c83885835dbd1e8835d5665dfb8503d65e0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 08:50:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 06 08:50:20 2026 -0700" }, "message": "Merge tag \u0027usb-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some small USB driver fixes for reported problems and\n regressions. Include in here are:\n\n - xhci driver fixes\n\n - cdns3 driver fixes\n\n - usb gadget driver fixes for syzbot found problems\n\n - typec driver fixes for broken hardware and other bugs found\n\n - kernel data leaks in mdc800 driver\n\n - usb storage driver fixes\n\n - other small USB driver fixes\n\n All of these have been in linux-next this week with no reported\n issues\"\n\n* tag \u0027usb-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)\n usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails\n usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop\n usb: gadget: fix null pointer dereference in usb_put_function_instance()\n usb: typec: qcom-pmic: cancel reset_work on stop\n usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()\n usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()\n usb: storage: realtek_cr: fix use-after-free on disconnect\n usb: cdnsp: fix wakeup from S3 after controller context loss\n usb-storage: ene_ub6250: fix race between scan work and probe\n USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()\n usb: gadget: f_midi: initialize work in f_midi_alloc()\n usb: gadget: f_midi2: fix use-after-free in string attribute show path\n usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x\n usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs\n usb: typec: hd3ss3220: track VBUS enable state per consumer\n usb: dwc3: clear forceRM when issuing EndTransfer\n usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES\n usb: typec: mux: avoid duplicated mux switches\n usb: typec: mux: Fix typec_switch_match()\n usb: image: mdc800: change kmalloc() to kzalloc()\n ...\n" }, { "commit": "536b523b407397c8d3967c020ce7aad70a0ea030", "tree": "dc84117d2d8a2d5a6c5b5eda864530200a99432a", "parents": [ "fd5348b434c53c34de5a9b3c67a1516309b6a73c" ], "author": { "name": "Chen Pei", "email": "cp0613@linux.alibaba.com", "time": "Wed Sep 02 14:14:51 2026 +0800" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Sun Sep 06 16:23:12 2026 +0200" }, "message": "bpf, riscv: Make arena support depend on ZACAS\n\nThe arena range tree allocates its nodes with kmalloc_nolock() since\ncommit f8c67d8550ee (\"bpf: Use kmalloc_nolock() in range tree\").\nkmalloc_nolock() requires slab caches with cmpxchg128 support\n(__CMPXCHG_DOUBLE); on riscv cmpxchg128 is provided by the ZACAS\nextension. On systems without ZACAS every arena map creation fails\nwith a misleading -ENOMEM.\n\nReport the missing support instead: make bpf_jit_supports_arena()\nreturn system_has_cmpxchg128() where it is defined, so arena map\ncreation fails with -EOPNOTSUPP on systems without ZACAS. The macro\nis only defined when both CONFIG_RISCV_ISA_ZACAS and\nCONFIG_TOOLCHAIN_HAS_ZACAS are enabled, so guard it with #ifdef the\nsame way mm/slab.h consumes it, and reject arena otherwise. This\nmatches how arena BPF_CMPXCHG instructions are already gated on ZACAS\nin bpf_jit_supports_insn().\n\nFixes: f8c67d8550ee (\"bpf: Use kmalloc_nolock() in range tree\")\nSigned-off-by: Chen Pei \u003ccp0613@linux.alibaba.com\u003e\nAcked-by: Pu Lehui \u003cpulehui@huawei.com\u003e\nAcked-by: Björn Töpel \u003cbjorn@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/bpf/20260902061451.1416-1-cp0613@linux.alibaba.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "fd5348b434c53c34de5a9b3c67a1516309b6a73c", "tree": "63db6dc4e645e40c43ce5643b9dd586886f8facb", "parents": [ "b75a000f2ac15f4778ddd6d9298d60b24ad776fa", "bde8901ea14244e7195a2d6b6aa2023b28d4233c" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Sat Sep 05 20:50:13 2026 -0700" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Sat Sep 05 20:50:13 2026 -0700" }, "message": "Merge branch \u0027fix-bpf_loop-syzbot-report\u0027\n\nKumar Kartikeya Dwivedi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix bpf_loop syzbot report\n\nNeeds Eduard\u0027s ack. Fix for the report in\nhttps://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260905014735.1452988-1-memxor@gmail.com\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "bde8901ea14244e7195a2d6b6aa2023b28d4233c", "tree": "63db6dc4e645e40c43ce5643b9dd586886f8facb", "parents": [ "c3fd8e5fd100f122bad503bdc0e9277219533253" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Sat Sep 05 03:47:34 2026 +0200" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Sat Sep 05 20:50:13 2026 -0700" }, "message": "selftests/bpf: Test pointer bpf_loop iteration count rejection\n\nAdd a verifier test that leaves the raw tracepoint context pointer in R1\nwhen calling bpf_loop(). This is the smallest trigger for the incorrect\nprecision backtracking: it reuses an existing callback and needs no maps or\nuserspace setup.\n\nExpect an ordinary scalar-type rejection. Without the verifier fix, the\ntest instead reaches precision backtracking and reports an internal\n\"backtracking misuse\" error.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://patch.msgid.link/20260905014735.1452988-3-memxor@gmail.com\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "c3fd8e5fd100f122bad503bdc0e9277219533253", "tree": "20e5dd0f8f74add5b735327a5d4fa51dad47b6c0", "parents": [ "b75a000f2ac15f4778ddd6d9298d60b24ad776fa" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Sat Sep 05 03:47:33 2026 +0200" }, "committer": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Sat Sep 05 20:50:13 2026 -0700" }, "message": "bpf: Reject non-scalar bpf_loop iteration counts\n\nbpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged\nprograms may pass pointer values to such arguments, so check_func_arg()\nlets a pointer-valued R1 reach the helper-specific checks.\n\nSince commit bb124da69c47 (\"bpf: keep track of max number of bpf_loop\ncallback iterations\"), the verifier marks R1 precise and reads its upper\nbound to limit callback simulation. Precision backtracking only accepts\nscalar registers, so passing a pointer instead triggers the \"backtracking\nmisuse\" verifier warning. Kernels with panic_on_warn enabled subsequently\npanic.\n\nIntroduce ARG_SCALAR for helper arguments that only accept scalar values\nand use it for bpf_loop() nr_loops. Generic helper argument validation then\nrejects pointers before loop inlining and precision processing.\n\nFixes: bb124da69c47 (\"bpf: keep track of max number of bpf_loop callback iterations\")\nReported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://patch.msgid.link/20260905014735.1452988-2-memxor@gmail.com\nCloses: https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com/\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\n" }, { "commit": "1fc5a74b108fc90951890ec513ac81869f5eaff1", "tree": "ddd247abac0e8e148e4ded357db093bee4fe35ed", "parents": [ "9f0346dcbea363787186c94ef94dd01aaa215afa", "3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 20:45:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 20:45:18 2026 -0700" }, "message": "Merge tag \u0027kmalloc_obj-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull kmalloc_obj conversions from Kees Cook:\n \"Another run of the Coccinelle script for converting kmalloc()\n family of allocations to kmalloc_obj() via the existing rules\n in scripts/coccinelle/api/kmalloc_objs.cocci\"\n\n* tag \u0027kmalloc_obj-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n treewide: refresh kmalloc_obj() conversions\n drm/amd/display: Fix harmless type mismatch in allocation\n" }, { "commit": "9f0346dcbea363787186c94ef94dd01aaa215afa", "tree": "b81c168f4d0dbe4c7f4750f4598d48a6deb72094", "parents": [ "214f4aeb2255f2f9b5f5de1a15f650a429c43490", "f6d752278c13839888425294c110174fb6c87e3d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 11:59:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 11:59:05 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Fix kernfs listxattr() not returning security xattr names (e.g.\n SELinux labels) when the kernfs node has no allocated kernfs_iattrs\n\n - Fix silent truncation of IRQ vector indices in the Rust PCI\n abstractions\n\n - Don\u0027t select OF from DRIVER_PE_KUNIT_TEST; skip the test when OF is\n disabled instead of silently enabling extra kernel functionality\n\n - Russ Weight is retiring from kernel development; update the Firmware\n Loader sysfs contact to the driver-core mailing list, add a CREDITS\n entry for Firmware Upload, and update MAINTAINERS accordingly\n\n* tag \u0027driver-core-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n MAINTAINERS: Remove Russ Weight from Firmware Loader\n CREDITS: Add CREDITS entry for Firmware Upload\n firmware_loader: Change contact for sysfs nodes\n rust: pci: reject IRQ vector indices that do not fit in u32\n kernfs: preserve security xattrs without allocating iattrs\n drivers: base: test: DRIVER_PE_KUNIT_TEST should not select OF\n" }, { "commit": "214f4aeb2255f2f9b5f5de1a15f650a429c43490", "tree": "a4c81e24ad4c6bb14aeed52bb5b448b9186d455f", "parents": [ "d9d80a859bc45ca022abc13afdd11d1c812a1034", "a2628ce4ddb6873e35380a42396d17a66e704a1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 10:45:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 10:45:51 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n\n - Fix build errors when RUST and KASAN enabled\n\n - fix a typo in comment of vmlinux.lds.S\n\n - fix several bugs in Kprobes, BPF JIT and KVM support\n\n* tag \u0027loongarch-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n perf build: Add clang and rust target flags for LoongArch\n LoongArch: KVM: Fix TOCTOU race on pv_features\n LoongArch: KVM: Validate MSI data before routing it to EIOINTC\n LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()\n LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path\n LoongArch: KVM: Add unregister helpers for the KVM interrupt devices\n LoongArch: KVM: Free init resources if kvm_init() fails\n LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()\n LoongArch: Avoid preempt count underflow without probe\n LoongArch: Do not save/restore percpu base register in rethook trampoline\n LoongArch: Remove unused setup_profiling_timer() function\n LoongArch: Fix typo \"avaliable\" in comment of vmlinux.lds.S\n LoongArch: Do not select HAVE_RUST when KASAN is enabled\n" }, { "commit": "b144dc5a24149ba9a0cb2197001973a74b8c93b2", "tree": "237f843fcd162cc2c79d98564f360bec2899ffae", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Aug 10 09:40:00 2026 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 05 19:28:39 2026 +0200" }, "message": "virtio_console: allocate the port_buffer with the caller\u0027s gfp\n\nput_chars() runs from the hvc console write path with preemption\ndisabled, so it asks alloc_buf() for GFP_ATOMIC. Only the data buffer\ngets it: the struct port_buffer itself keeps the GFP_KERNEL default, so\nthe allocation can enter direct reclaim and sleep. A write to /dev/kmsg\non a CONFIG_DEBUG_ATOMIC_SLEEP kernel splats:\n\n BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:320\n in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: virtme-ng-init\n preempt_count: 1, expected: 0\n Preemption disabled at:\n [\u003cffffffff813fd90d\u003e] vprintk_emit+0x17d/0x510\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x69/0xa0\n __might_resched+0x37a/0x4d0\n __kmalloc_cache_noprof+0x94/0x5f0\n put_chars+0x209/0x3e0\n hvc_console_print+0x234/0x640\n console_flush_all+0x4fc/0x950\n console_unlock+0xbf/0x1b0\n vprintk_emit+0x312/0x510\n devkmsg_emit+0xba/0x110\n devkmsg_write+0x21b/0x2e0\n vfs_write+0x4dc/0x9d0\n ksys_write+0x108/0x1e0\n do_syscall_64+0xfa/0x460\n \u003c/TASK\u003e\n\nPass gfp on to that allocation too.\n\nFixes: fc220d6be3c7 (\"virtio_console: refactor __send_to_port() buffer ownership\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nAcked-by: Sungho Bae \u003cbaver.bae@lge.com\u003e\nTested-by: Florian Westphal \u003cfw@strlen.de\u003e\nLink: https://patch.msgid.link/20260810-serial-v1-1-abbe51602c13@debian.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d9d80a859bc45ca022abc13afdd11d1c812a1034", "tree": "7545f758473f40199ce1c061b9fe73d444b1eb6f", "parents": [ "0d9ff90a5422cc7509258aaaba1e7481df4d332a", "6a7a45b1d94799a5eb8e6d26e65cf31a3fcda9e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 10:18:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 10:18:21 2026 -0700" }, "message": "Merge tag \u0027for-7.3-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - preserve inode compression level when changing attributes\n\n - fix lost wakeup when waiting for a zstd workspace\n\n - fix bio context leaks after ordered extent processing errors\n\n - in send, handle unexpected extents for non-regular inodes\n\n - handle edge case in creation of reloc tree with enabled quotas\n\n - in scrub report the exact failing offset, not the stripe base\n\n - error handling fixes\n - error code propagation in send, zoned mode and raid-stripe-tree\n - restore active device pointer after seeding device addition error\n - transaction abort fixups\n\n - update Chris\u0027 email address\n\n* tag \u0027for-7.3-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n MAINTAINERS: update Chris Mason\u0027s email address\n btrfs: tests: do not touch page cache if root/inode allocation failed\n btrfs: zstd: fix lost wakeup when waiting for a workspace\n btrfs: do not force reloc root creation during qgroup_account_snapshot()\n btrfs: send: fix lost error return value in will_overwrite_ref()\n btrfs: abort transaction before releasing tree_log_mutex on commit failure\n btrfs: zoned: propagate do_zone_finish() error in btrfs_zone_finish_endio()\n btrfs: zoned: finish active block group cleanup if call_zone_finish() fails\n btrfs: send: reject extents for non-regular inodes\n btrfs: return proper negative error code for update_raid_extent_item()\n btrfs: fix the possible bioc_list memory leak during error\n btrfs: fix transaction use-after-free in raid stripe insertion\n btrfs: scrub: report the failing sector\u0027s address, not the stripe base\n btrfs: preserve the compression property when other inode flags change\n btrfs: restore active device pointers after failed sprout\n btrfs: detach failed sprout device from transaction update list\n btrfs: clean up target device if block group marking fails\n" }, { "commit": "0d9ff90a5422cc7509258aaaba1e7481df4d332a", "tree": "0d09caaa996b1d9863234fcf798d311d89553de7", "parents": [ "d0fc310b4dfd334023b90d2423818044190c0f68", "af8c27375733fb6a6df9fa484cda77cc3dd0cb80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 09:25:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 09:25:50 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Two enhancements to add support and MCQ for additional Intel 4.0\n controller types.\n\n The rest are all driver fixes, the largest of which is the mpi3mr\n target use after free fix, follwed by a similar TOCTOU fix for\n io_uring passthrough in bsg\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame\n scsi: bsg: Fix TOCTOU in io_uring passthrough command setup\n scsi: bsg: Cap io_uring sense copy to max_response_len\n scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()\n scsi: mpi3mr: Fix use-after-free on tgt_dev-\u003estarget during target device refresh/update\n scsi: target: iscsi: Reserve a terminator byte for the login payload\n scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands\n scsi: ufs: ufs-pci: Add MCQ support for Intel UFS 4.0 controllers\n scsi: ufs: ufs-pci: Add support for Intel UFS 4.0 HS-Gear5\n scsi: sg: Report request-table problems when any status is set\n scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\n scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()\n scsi: ufs: ufs-qcom: Fix sequential read variance\n scsi: ufs: ufs-qcom: Restore HS/LS link startup mode for Qualcomm UFS controller v6.2+\n scsi: ibmvfc: Document protocol parameter of ibmvfc_alloc_target()\n scsi: ibmvfc: Fix kernel-doc name for ibmvfc_scsi_relogin()\n scsi: pm8001: Use rollback index when freeing MSI-X vectors\n scsi: fnic: Initialize the NVMe local port info before registering\n" }, { "commit": "d0fc310b4dfd334023b90d2423818044190c0f68", "tree": "77be8fce6a8b0b707e5c1df0a36a9a23fdfbe24b", "parents": [ "4d7d9486c04d917265f64c55bd23b2cc4fe7749c", "00ef2248c5dae08548f7ceb6951b022f89905330" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 08:58:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 05 08:58:55 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20260905\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - nvme-tcp fixes for an out-of-bounds write on an over-long PDU\n - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering\n fixes\n - FDP placement id array racy access fix\n - nvme-fc double free of fabrics options on nvme_add_ctrl()\n failure, and a secret leak failure\n - Fault injection opcode filtering\n - stale namespace removal during scan\n - Various other smaller fixes and cleanups\n\n - Flag zoned disks with GENHD_FL_NO_PART\n\n - Save the page offset gaps in a cloned bio\n\n - Fix dma_alignment for large or unreported limits in loop and zloop\n\n - Clear VM_MAYWRITE on a read-only ublk char device mmap\n\n* tag \u0027block-7.3-20260905\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)\n nvme-tcp.h: drop kernel-doc comments, fix a few descriptions\n nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails\n nvmet: reject namespace enable without device path\n nvmet-auth: Synchronize timeout work during SQ teardown\n MAINTAINERS: update nvme entry\n nvmet-tcp: reject unsolicited H2CData PDUs\n nvme-tcp: defer TLS inline send to io_work\n nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU\n nvme-tcp: return -EPROTO for a C2HData on a write\n nvmet: print namespace IDs as unsigned 32bit value\n nvme: print namespace IDs as unsigned 32bit value\n nvme: remove stale namespaces by NSID range during scan\n nvme: add missing SRCU grace period in error path\n nvme-fabrics: fix DHCHAP secret leak on parse failure\n ublk: clear VM_MAYWRITE on read-only ublk char device mmap\n loop, zloop: fix dma_alignment for large or unreported limits\n block: save page offset gaps in cloned bio\n block: flag zoned disks with GENHD_FL_NO_PART\n nvmet-rdma: fix queue leak when connect backlog is exceeded\n nvme: add opcode filtering for fault injection\n ...\n" }, { "commit": "3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d", "tree": "c65086f9bdcd48c6360fb7cb4598bca084da1f32", "parents": [ "90feea391c64fc43bf44184fcf2b243ab991ce47" ], "author": { "name": "Kees Cook", "email": "kees+treewide@kernel.org", "time": "Wed Sep 02 15:31:14 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Fri Sep 04 21:37:00 2026 -0700" }, "message": "treewide: refresh kmalloc_obj() conversions\n\nThis is another run of the Coccinelle script for converting kmalloc()\nfamily of allocations to kmalloc_obj() via the existing rules in\nscripts/coccinelle/api/kmalloc_objs.cocci\n\nThis catches both the set of kmalloc() uses added since the first\nkmalloc_obj() conversions in v7.0 and adds a large group missed in the\nfirst pass due to Coccinelle not interacting well with the cleanup.h\nscoped_...() family of macros[1]. I worked around this with spatch\u0027s\n\"--macro-file\" argument to a file with all the scoped_...() macros mapped\nto Coccinelle\u0027s YACFE_ITERATOR[2] as that was the closest viable control\nflow indicator I could find.\n\nBuild tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,\nriscv, and s390 with no new warnings.\n\nLink: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]\nLink: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]\nSigned-off-by: Kees Cook \u003ckees+treewide@kernel.org\u003e\n" }, { "commit": "4d7d9486c04d917265f64c55bd23b2cc4fe7749c", "tree": "5284758ed1191cf5b42c42a0f55c2b2ba9b16b03", "parents": [ "654ae5d73c05bd2943d65636ce6cd0aa46e62f18", "6903878d4654bdef4e08e38cdf1ae306ce7de5f9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 19:36:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 19:36:11 2026 -0700" }, "message": "Merge tag \u0027integrity-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity\n\nPull IMA fixes from Mimi Zohar:\n\n - Instantiating the ima_file_truncate and ima_path_truncate LSM hooks\n resulted in configfs locking issues.\n\n configfs files should not be measured, appraised, or audited in the\n first place, so the builtin policies are updated to exclude them.\n\n - IMA audit messages include the filename, which could result in a page\n fault when the filename doesn\u0027t exist\n\n - Un-hide the IMA_MEASURE_PCR_IDX Kconfig prompt\n\n* tag \u0027integrity-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:\n ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX\n ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()\n ima: don\u0027t measure/appraise files on configfs\n configfs: move CONFIGFS_MAGIC definition to magic.h\n" }, { "commit": "b75a000f2ac15f4778ddd6d9298d60b24ad776fa", "tree": "816a0b2b050b0d983e9406afe751efd10f903582", "parents": [ "519f858317afc52e986817ad63fd68172dd38b6c", "cf2475616b11c0efefdd969d42913f56ca39f918" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:31 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:31 2026 -0700" }, "message": "Merge branch \u0027bpf-add-missing-precision-propagation-after-bpf_register_is_null-calls\u0027\n\nEduard Zingerman says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: add missing precision propagation after bpf_register_is_null calls\n\nFix [1] uncovered a host of locations where the call to\nbpf_register_is_null() is not followed by a call to\nbpf_mark_chain_precision().\n\ncheck_map_kptr_access() is omitted as it is handled [2]\nby another series.\n\n[1] https://lore.kernel.org/bpf/20260904083325.2083493-7-eddyz87@gmail.com/\n[2] https://lore.kernel.org/bpf/20260904104203.345917-6-memxor@gmail.com/\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260904-register-is-null-precise-fixes-v1-0-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "cf2475616b11c0efefdd969d42913f56ca39f918", "tree": "816a0b2b050b0d983e9406afe751efd10f903582", "parents": [ "1d7f8f191c06f967a85922c4652dc33c132b585d" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:06:01 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "bpf: use mark_arg_precision() in check_mem_size_reg()\n\nUse newly added mark_arg_precision() helper in check_mem_size_reg().\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-10-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "1d7f8f191c06f967a85922c4652dc33c132b585d", "tree": "f49797769778469a0070426cac00e815caddcdb2", "parents": [ "91957791663f49561848c40e982061799b8f86b0" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:06:00 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()\n\nStop verification if mark_chain_precision() fails when called from\nloop_flag_is_zero(). No functional change intended for the paths where\nbacktracking succeeds.\n\nFixes: 1ade23711971 (\"bpf: Inline calls to bpf_loop when callback is known\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-9-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "91957791663f49561848c40e982061799b8f86b0", "tree": "0d5e4a9fbfd286918348c5fa746fe95c110432c3", "parents": [ "e726fc6b9afe6b3a446a31d0f0767b7b9cb5085e" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:59 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "selftests/bpf: precision of a NULL global subprogram BTF_ID argument\n\nCheck that mark_chain_precision() is called for a NULL pointer passed\nas an __arg_trusted __arg_nullable argument of a global subprogram.\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-8-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "e726fc6b9afe6b3a446a31d0f0767b7b9cb5085e", "tree": "ceac082090b48f03a92e60174a9248af44ce043b", "parents": [ "562d266d3fae571617e72417753df648db261c56" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:58 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "bpf: mark a NULL BTF_ID argument of a global subprogram precise\n\nbtf_check_func_arg_match() accepts a NULL register for an\nARG_PTR_TO_BTF_ID argument tagged __arg_nullable and skips\ncheck_reg_type() and check_func_arg_reg_off() without marking the\nregister precise. Hence a checkpoint created on such a path would\nprune against arbitrary scalar value.\n\nFixes: e2b3c4ff5d18 (\"bpf: add __arg_trusted global func arg tag\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-7-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "562d266d3fae571617e72417753df648db261c56", "tree": "a3e139a8265fcf6f00482eb8321ff2924a6f334b", "parents": [ "506ada89629ec7059b96ecfb0dc7d33ece0103ca" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:57 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "selftests/bpf: precision of a NULL kfunc argument\n\nCheck that mark_chain_precision() is called for a NULL pointer passed\nas a __nullable kfunc memory argument.\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-6-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "506ada89629ec7059b96ecfb0dc7d33ece0103ca", "tree": "0b07297409b68d2333fb4f0eae7f3b072eb68d4c", "parents": [ "100f4cc0d59be88d2b4d6eb42e51910ea2548d04" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:56 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "bpf: mark a NULL kfunc argument precise\n\ncheck_kfunc_arg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\nFixes: 3bda08b63670 (\"bpf: Allow NULL buffers in bpf_dynptr_slice(_rw)\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-5-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "100f4cc0d59be88d2b4d6eb42e51910ea2548d04", "tree": "12429112aa15c4ca8a2b1b485eedfc1b860c18b3", "parents": [ "f1e418129f2ebb5376df2f1cd19720fa80f8adb4" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:55 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "selftests/bpf: precision of a NULL global subprogram memory argument\n\nCheck that mark_chain_precision() is called for a NULL pointer passed\nas a nullable pointer argument of a global subprogram.\n(Pointer arguments of the global subprograms are nullable by default).\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-4-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "f1e418129f2ebb5376df2f1cd19720fa80f8adb4", "tree": "1014f7b6324d46f07d016501547346a3727c78ed", "parents": [ "593c8eb0fb91a24c39244a7f9e7d04412d750544" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:54 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:30 2026 -0700" }, "message": "bpf: mark a NULL memory argument of a call precise\n\ncheck_mem_reg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\nThe argument may live on the stack rather than in a register when a\ncall has more than MAX_BPF_FUNC_REG_ARGS arguments, hence the new\nmark_arg_precision() helper.\n\nFixes: e5069b9c23b3 (\"bpf: Support pointers in global func args\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-3-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "593c8eb0fb91a24c39244a7f9e7d04412d750544", "tree": "af86b30ad1f0fc24cedf84ac7f475baf56d1a8f3", "parents": [ "1a3a10b030c96ea88868ccc060a16827c01eaa5a" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:53 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:29 2026 -0700" }, "message": "selftests/bpf: precision of a NULL helper argument\n\nCheck that mark_chain_precision() is called for a NULL nullable memory\nargument and for the zero flags argument of bpf_get_local_storage().\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-2-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "1a3a10b030c96ea88868ccc060a16827c01eaa5a", "tree": "d374663baaac75b1b59540f22cefc6632d92d114", "parents": [ "519f858317afc52e986817ad63fd68172dd38b6c" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 17:05:52 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 18:17:29 2026 -0700" }, "message": "bpf: mark a NULL call argument precise\n\ncheck_func_arg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\ncheck_helper_call() enforces second parameter of the\nbpf_get_local_storage() to be zero, w/o marking the underlying scalar\nregister precise. Hence a checkpoint created on such a path would\nprune against arbitrary scalar value.\n\nGrouping these two into one patch, as they share the same fixes tag.\n\nFixes: b5dc0163d8fd (\"bpf: precise scalar_value tracking\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "654ae5d73c05bd2943d65636ce6cd0aa46e62f18", "tree": "72e197264a554d392e8166508bf63575a1f100dc", "parents": [ "3f17a52d47ed39c89cc8429307cf246e781ec979", "c96294afbcb5737da18229e788ca45a5d534abc5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:42:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:42:16 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-09-05\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Lots of scattered fixes: nouveau has a bunch of display fixes for\n blackwell GPUs that should mean we light up monitors properly and fix\n some desktop rendering problems, amdgpu and intel display changes as\n usual.\n\n There also changes to the core pagemap, then the usual amouny of AI\n inspired validation fixes.\n\n core:\n - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used\n\n dma-buf:\n - Publish the dma-buf only after copy_to_user succeeds\n - fix some kernel-doc warnings\n\n atomic-state-helpers:\n - set pixel_blend_mode to prop default on reset\n\n sysfb:\n - Fix integer overflow\n - fix constant comparison bug\n\n pagemap:\n - Prevent double migration of device pages\n - Reset migration page count on eviction retry\n - dma-unmap pages before handling migration errors\n - use after free fixes\n\n prime:\n - fix prime exports tracing\n\n amdgpu:\n - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit\n userspace\n - plane blend mode fixes\n - SR-IOV fix\n - GFX8 fix\n - MES queue reset fix\n - GPUVM fixes\n - DCN 6 warning fix\n - DCN 3.5/3.6 fix\n - DML fix\n - Backlight fix\n - Colorop fix\n - DC get_estimated_bw() fix\n - devcoredump fix\n - Userq fixes\n - APU PSP fix\n - Cursor fix\n\n amdkfd:\n - MES queue eviction fix\n - MQD debugfs fix\n\n xe:\n - oa uapi error handling fix\n - drm info message to report FLAT_CSS base misalignment\n\n i915:\n - Drop an accidentally duplicated panel fitter call in DP MST\n - Fix DDI clock programming for Cx0 and LT PHY\n - Fix PTL CDCLK handling at probe, causing a glitch\n - Fix dg2_power_well_count() return type\n - Fix a NULL pointer deref at forced probe\n - Fix selective fetch disable\n\n amdxdna:\n - out-of-bounds access fix\n - reject commands chains with no commands\n - handle chained mapping BO failures\n - refuse to flush an imported BO\n\n ethosu:\n - handle mmio mapping failures\n - handle storage modes only on hardware that supports it\n - fix job completion fence cleanup\n\n fastrpc:\n - Publish the dma-buf only after copy_to_user succeeds\n\n gud:\n - Improve TV modes and rotation handling\n\n nouveau:\n - use-after-free fixes\n - add missing scanline position support\n - HDMI and DP fixes\n - null pointer dereference fix\n - dmem accounting fixes for large folios\n - use write-combined maps for coherent\n\n qaic:\n - out-of-bounds access fix\n\n tegra:\n - Add blend mode properties\n\n virtio:\n - exit path and error handling fixes\n\n* tag \u0027drm-fixes-2026-09-05\u0027 of https://gitlab.freedesktop.org/drm/kernel: (83 commits)\n drm/xe/vram: report FLAT_CCS base misalignment\n MAINTAINERS, mailmap: use Aditya Garg\u0027s linux.dev account\n drm/amd/display: use plane color_mgmt_changed to track colorop changes\n drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile\n drm/amd/display: Fix cursor disable with horizontally split planes\n drm/amdgpu/userq: dont overwrite the error of subsequent map call\n drm/amdgpu: Skip accessing psp rum time db for APUs\n drm/amdgpu: update the fw version for gfx12 userqueues\n drm/amdgpu: update the fw version for gfx11 userqueues\n drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump\n drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds\n drm/amd/display: fix division by zero in get_estimated_bw()\n drm/amd/display: use halving distribution for all encode-to-linear curves\n drm/amd/display: Fix backlight control for luminance-capable OLED\n drm/amd/display: Remove const Qualifier From Non-Pointer Fields\n drm/amd/display: Set gpuvm min page size to 4K on dcn35/36\n drm/amd/display: Fix DCN5/6 DML2 compilation warnings\n drm/amdgpu: fix Idle BOs list in VM debugfs status info\n drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT\n drm/amdgpu: Update queue reset support version\n ...\n" }, { "commit": "3f17a52d47ed39c89cc8429307cf246e781ec979", "tree": "33cc4eea950d24d910d6fecc225de28e6526a1c2", "parents": [ "408802f1e61dad400ed5d2504165579189cc183f", "5445d64199626974269fcdf347769ad44b0bb53b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:32:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:32:46 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"Nothing Earth-shattering, but worthwhile fixes nonetheless:\n\n - Disable interrupts during page-table walk in show_pte()\n\n - Fix kexec_file_load() with 52-bit capable kernels on machines\n without 52-bit addressing\n\n - Fix MIDR matching in CPU errata handling for KVM guests\n\n - Avoid reading MTE-specific ID registers when MTE support is\n disabled\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: Don\u0027t read GMID_EL1 when MTE is disabled\n arm64: errata: pass REVIDR when matching target implementation CPUs\n arm64: trans_pgd: clone only the linear map that exists at runtime\n arm64: mm: Fix the lockless page-table walk in show_pte()\n" }, { "commit": "408802f1e61dad400ed5d2504165579189cc183f", "tree": "3056b1c323e8992630eacdd791ac2fc35590e3da", "parents": [ "986c24e0fe44f844b44d365b71ce831947f50298", "dc173b37415e8f738fc4de477490056b479ddc9f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:27:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 13:27:58 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.3-rc2\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"A small fixup for the new nearfull_sync mount option, a potential\n use-after-free fix (marked for stable) and a patch that eliminates\n the last use of PageWriteback macro in the tree\"\n\n* tag \u0027ceph-for-7.3-rc2\u0027 of https://github.com/ceph/ceph-client:\n ceph: apply nearfull_sync option on remount\n libceph: remove pinning assertion in ceph_msg_data_iter_next()\n ceph: lock mutex in ceph_mds_check_access()\n" }, { "commit": "d80e12156f1fd490adf29a8d28489725a3ac817a", "tree": "74fad0df12c1e4e570b931cd42c7665df69bd044", "parents": [ "5cbea500775dd1944995f23320af030b9b24b24b" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 15:16:41 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 16:20:23 2026 -0400" }, "message": "ring-buffer: Use a macro for static buffer bits\n\nInstead of hard coding 30 for the number of bits used for the static\nbuffer ids in two places, create a macro. This way if it changes in the\nfuture, it will change in all the locations that use it.\n\nLink: https://patch.msgid.link/20260904151641.17eae0aa@gandalf.local.home\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "5cbea500775dd1944995f23320af030b9b24b24b", "tree": "1c685ebe6e28c9014238531cd3538881a51070ca", "parents": [ "c843fd3c73c94cb90b01c6bfe8d83796e652864d" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 14:49:02 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 16:19:29 2026 -0400" }, "message": "tracing: Fix comment in tracing_buffers_splice_read()\n\nThe comment about returning an error if the read fails on the first\niteration is slightly incorrect. It makes it sound like the only reason it\ncould fail on a later iteration is if the subbuf order changed. That is\nincorrect, it could also fail if the length passed in was not a multiple\nof the subbuf size. Fix the comment.\n\nLink: https://lore.kernel.org/all/20260904143527.40e73d36@gandalf.local.home/\nLink: https://patch.msgid.link/20260904144902.506862a1@gandalf.local.home\nFixes: dae8dda341d2 (\"tracing: Fix subbuf resize races with trace_pipe_raw readers\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "c843fd3c73c94cb90b01c6bfe8d83796e652864d", "tree": "d6e609c55f1445fad5c06c4b1eed0c5ef44c407e", "parents": [ "f2b2b645595c82b4e824880f6cb987e077a8da19" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 04 17:44:50 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 16:19:15 2026 -0400" }, "message": "ring-buffer: Prevent truncation of nr_pages / nr_subbufs\n\nAlthough ring_buffer_per_cpu::nr_pages is defined as unsigned long, it\nis capped to 32-bits in a few places, limiting the operations possible\non a very large buffer. Use `unsigned long` where appropriate and\nprevent truncation of values using nr_pages (or nr_subbufs).\n\nWhile at it, subbuf_size must be at least `unsigned int`.\n\nNote that persistent, remote and user-mapped ring buffers are capping\nthe number of pages to 30 bits already, making \"int\" safe in many\nplaces.\n\nLink: https://patch.msgid.link/20260904164450.1345852-5-vdonnefort@google.com\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "f2b2b645595c82b4e824880f6cb987e077a8da19", "tree": "49c3c94e632c658469ffc752adef41012237a105", "parents": [ "dae8dda341d2d9034a90d59e8a7d502e1263813f" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 04 17:44:49 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 16:19:14 2026 -0400" }, "message": "ring-buffer: Cap static ring buffer nr_pages\n\nStatic ring buffers (i.e. persistent, user-mapped and remote) rely on\nthe bpage::id field. The number of pages for those ring buffers must fit\ninto that variable. Enforce this limit on ring buffer creation or\nuser-mapping.\n\nWhile at it, prevent nr_pages underflow when allocating a persistent\nbuffer.\n\nLink: https://patch.msgid.link/20260904164450.1345852-4-vdonnefort@google.com\nFixes: be68d63a139b (\"ring-buffer: Add ring_buffer_alloc_range()\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "dae8dda341d2d9034a90d59e8a7d502e1263813f", "tree": "1a099a92002abc515ef931b9b88baa2239f9cfdf", "parents": [ "d7dbdd2ee01e12211046d4a535623ac732b749fb" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri Sep 04 17:44:48 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 16:19:07 2026 -0400" }, "message": "tracing: Fix subbuf resize races with trace_pipe_raw readers\n\nConcurrent subbuffer resizes may crash trace_pipe_raw readers or leak\nuninitialized memory to userspace due to stale size values.\n\nModify ring_buffer_alloc_read_page() to handle the resizing of an\nexisting buffer_data_read_page if necessary and add a new\nring_buffer_read_page_size(). This new function enables ring-buffer\nbuffer_data_read_page users to not call the racy\nring_buffer_subbuf_size_get(). This makes the spare_size member of\nftrace_buffer_info redundant.\n\nFinally, handle buffer_data_read_page/reader_page order discrepancy in\nring_buffer_read_page(). On a mismatch simply copy manually the data to\nthe buffer_data_read_page.\n\nLink: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.org/\nLink: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.com\nFixes: bce761d75745 (\"ring-buffer: Read and write to ring buffers with custom sub buffer size\")\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "519f858317afc52e986817ad63fd68172dd38b6c", "tree": "adb9ebd467f0b54cba1b7dcb9e2181156cf0ed8c", "parents": [ "5e8c349bc8d790fe031a4332e502f5d4f9878644", "e615b9fd4d9df602030d9b57a5eca206abbb0aff" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "Merge branch \u0027misc-bug-fixes-part-4\u0027\n\nKumar Kartikeya Dwivedi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMisc bug fixes - part 4\n\nA set of miscellaneous fixes for bugs reported by Nicholas, and GPT-5.6\nwhen analyzing those fixes, batched together again. See commit logs for\ndetails. Related rhtab fixes from Yuan Chen and Nuoqi Gui have been\nfolded into the series.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260904104203.345917-1-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "e615b9fd4d9df602030d9b57a5eca206abbb0aff", "tree": "adb9ebd467f0b54cba1b7dcb9e2181156cf0ed8c", "parents": [ "b90c5d770dad910fb89e6c1b15052a8a1e8db752" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:41:59 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "selftests/bpf: Test inner map identities in callbacks\n\nAdd load-only timer_mim coverage for inner map identities propagated\nthrough nested timer and bpf_for_each_map_elem() callbacks.\n\nThe negative case initializes a timer in the second inner map with the map\nsaved from the first inner map timer callback. The positive case pairs the\ntimer value with the map supplied to the same for-each callback.\n\nWithout the verifier fix, the mismatched-map program is accepted while the\nsame-map control is rejected. Preserving map_uid reverses both verdicts.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-9-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "b90c5d770dad910fb89e6c1b15052a8a1e8db752", "tree": "8853fc76ce74f373269cef5f80d931c6604ed027", "parents": [ "9dcddf30ac1a14f18c3221db9292bcaa0735ee2f" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:41:58 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "bpf: Preserve inner map identity in callback frames\n\nCallback frame constructors initialize map-typed argument registers with\n__mark_reg_known_zero() and then restore map_ptr. This clears map_uid,\nwhich is the only field distinguishing inner maps that share an\ninner_map_meta template.\n\nWhen a timer callback invokes bpf_for_each_map_elem() on a second inner\nmap, both the saved first map and the second map value can reach the nested\ncallback as the same template with map_uid zero. bpf_timer_init() then\naccepts pairing the timer from the second map with the first map.\n\nThe runtime records the first map in the timer without taking a reference.\nFreeing that map does not find the timer stored in the second map, so a\nlater timer callback dereferences the freed map.\n\nCopy map_uid from the same caller register as map_ptr when constructing\nfor-each, timer/workqueue, and task-work callback arguments. The existing\nidentity check can then reject mismatched inner maps while allowing a\ncallback value to be paired with its actual map.\n\nFixes: 3e8ce29850f1 (\"bpf: Prevent pointer mismatch in bpf_timer_init.\")\nFixes: 69c087ba6225 (\"bpf: Add bpf_for_each_map_elem() helper\")\nFixes: 5c8fd7e2b5b0 (\"bpf: bpf task work plumbing\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-8-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "9dcddf30ac1a14f18c3221db9292bcaa0735ee2f", "tree": "bf229db89be6e788262b4bddba69e42f264e201e", "parents": [ "ecdc5043794c9184aa8e6c814603899479c46b35" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:41:57 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "selftests/bpf: Test imprecise scalar kptr stores\n\nAdd a verifier regression where an imprecise zero scalar reaches a kptr\nstore first and a nonzero scalar reaches the same instruction on a second\npath.\n\nWithout the corresponding verifier fix, the second path is pruned and the\nprogram is unexpectedly accepted. With the fix, the scalar range is\ncompared and the invalid store is rejected.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-7-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "ecdc5043794c9184aa8e6c814603899479c46b35", "tree": "da2d125a692419990c1e0564e0f97f8a8c265c3b", "parents": [ "2b97956af60810cd382b86b9ce9aea421b889861" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:41:56 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "bpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value.\n\nFixes: 61df10c7799e (\"bpf: Allow storing unreferenced kptr in map\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "2b97956af60810cd382b86b9ce9aea421b889861", "tree": "7d9b0d8a91f77e63deff23976f68555a4895346a", "parents": [ "65cc95eba9e8b46312cac38c227473605a4b996a" ], "author": { "name": "Nuoqi Gui", "email": "gnq25@mails.tsinghua.edu.cn", "time": "Fri Sep 04 12:41:55 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:25 2026 -0700" }, "message": "selftests/bpf: Test rhtab kptr cancellation semantics\n\nResizable hash-map updates and deletions must not perform full special-field\ndestruction in their caller context. In particular, a referenced kptr must\nremain attached to the allocation until the memory allocator destructor can\nrelease it safely.\n\nAdd separate coverage for both affected paths. The update test stores a task\nkptr, replaces the ordinary value bytes with BPF_EXIST, and verifies that the\nkptr survived. The delete test removes an element and exchanges its kptr\nthrough the still-valid map-value pointer before the allocation is reclaimed.\n\nBoth cases observe a NULL kptr when rhtab uses bpf_obj_free_fields(). They\nrecover and release the reference after rhtab switches to cancellation\nsemantics.\n\nSigned-off-by: Nuoqi Gui \u003cgnq25@mails.tsinghua.edu.cn\u003e\n[ kkd: Split update and delete coverage and rewrote the commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-5-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "65cc95eba9e8b46312cac38c227473605a4b996a", "tree": "2c65f05450aecf22f75545509677cb94ec226500", "parents": [ "dbf6806dc81553edbab72fcec9a6d637dedff2f4" ], "author": { "name": "Nuoqi Gui", "email": "gnq25@mails.tsinghua.edu.cn", "time": "Fri Sep 04 12:41:54 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:24 2026 -0700" }, "message": "bpf: Cancel special fields when recycling rhtab elements\n\nrhtab_map_update_existing() and rhtab_delete_elem() call\nbpf_obj_free_fields() when replacing or deleting a value. These map\noperations can run from BPF programs in NMI context, where releasing a\nreferenced kptr or another complex field is not generally safe.\n\nArray and hash maps avoid that problem by cancelling only the asynchronous\nfields which can be stopped safely in the caller context. Other ownership\nstate remains attached to the allocation until its memory allocator\ndestructor performs the final cleanup.\n\nUse bpf_obj_cancel_fields() for the corresponding rhtab paths as well. This\ncancels timers, workqueues, and task work while allowing rhtab_mem_dtor() to\nrelease referenced kptrs when the allocation is eventually destroyed.\n\nFixes: 6905f8601298 (\"bpf: Allow special fields in resizable hashtab\")\nSigned-off-by: Nuoqi Gui \u003cgnq25@mails.tsinghua.edu.cn\u003e\nAcked-by: Mykyta Yatsenko \u003cyatsenko@meta.com\u003e\n[ kkd: Rebased, used direct helper calls, and rewrote the commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-4-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "dbf6806dc81553edbab72fcec9a6d637dedff2f4", "tree": "d7a697d4afd93b07d0b85168ac62792089556446", "parents": [ "5df46ddcb7b36878c1b691e9057a0509042a2567" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:41:53 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:24 2026 -0700" }, "message": "selftests/bpf: Test timer field on recycled rhtab element\n\nExercise the rhtab special-field lifecycle with the sequence from the\noriginal report. A bpf_for_each_map_elem() callback deletes the sole\nelement, then initializes and arms a timer through the callback value\npointer while it remains valid.\n\nUse a one-element map and pin userspace and BPF execution to one CPU.\nRepeated delete-and-replace cycles drain the per-CPU allocator cache, and\nperiodic RCU synchronization makes the deleted units available for\nrecycling.\n\nAfter each replacement, a second BPF program calls bpf_timer_cancel()\non its value. A successful cancellation proves both that a timer-bearing\nunit was recycled and that insertion preserved the timer field. Without\nthe fix, insertion clears that field and cancellation keeps returning\n-EINVAL. A long expiration keeps the timer callback out of the test, so\nthe regression is detected without accessing freed memory.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-3-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "5df46ddcb7b36878c1b691e9057a0509042a2567", "tree": "49f85affb400cdc5609902914c956db2bcf9dd14", "parents": [ "5e8c349bc8d790fe031a4332e502f5d4f9878644" ], "author": { "name": "Yuan Chen", "email": "chenyuan@kylinos.cn", "time": "Fri Sep 04 12:41:52 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 12:24:24 2026 -0700" }, "message": "bpf: Preserve special fields in recycled rhtab elements\n\nrhtab_map_update_elem() initializes special fields after obtaining an\nelement from bpf_mem_cache_alloc(). The allocator can return a fresh,\nzeroed unit, or recycle one from its RCU-pending lists before the\nregistered destructor has run.\n\nA BPF program can retain a map-value pointer after deleting its element\nand initialize and arm a timer through that pointer. If the deleted unit\nis recycled, check_and_init_map_value() clears the only pointer to the\ntimer. Neither a later deletion nor rhtab_mem_dtor() can then cancel it,\nand the callback can run with its key and value pointing into freed memory.\n\nDo not reinitialize special fields on insertion. Fresh allocator units are\nalready zeroed. For recycled units, the special fields are ownership state\nthat must remain visible to the eventual destructor. copy_map_value()\nalready skips those fields, matching the non-preallocated hash-map path and\nthe lifecycle established by commit 275c30bcee66 (\"bpf: Don\u0027t reinit map\nvalue in prealloc_lru_pop\").\n\nFixes: 6905f8601298 (\"bpf: Allow special fields in resizable hashtab\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Yuan Chen \u003cchenyuan@kylinos.cn\u003e\n[ kkd: Split out the fix and rewrote the commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904104203.345917-2-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "6903878d4654bdef4e08e38cdf1ae306ce7de5f9", "tree": "a10eead6fc92f47f7eccaade042f099e9bd4a8e1", "parents": [ "8861f6d5c0678a7c5089c7b272509fc5931b8437" ], "author": { "name": "Julian Braha", "email": "julianbraha@gmail.com", "time": "Fri Sep 04 12:09:11 2026 +0100" }, "committer": { "name": "Mimi Zohar", "email": "zohar@linux.ibm.com", "time": "Fri Sep 04 14:01:00 2026 -0400" }, "message": "ima: allow users to specify the pcr index with IMA_MEASURE_PCR_IDX\n\nThe IMA_MEASURE_PCR_IDX option is currently not visible in the kconfig\nfrontend, so it always uses its default, 10. This means that the\n\u0027range 8 14\u0027 is dead code, and users are unable to specify the pcr index\nvalue.\n\nIn a previous discussion, Mimi explained that users should be able to use\nthis config option to specify the pcr index. [1]\n\nLet\u0027s add a prompt for users to specify the pcr index, when EXPERT is\nenabled.\n\nThis dead range was found by kconfirm, a static analysis tool for Kconfig.\n\nLink: https://lore.kernel.org/all/1feff118-4afa-4b9c-86f1-271a7a88208f@gmail.com/T/#mc4efa2491b4937eb7c9e532c29ffba516a70e662 [1]\nSigned-off-by: Julian Braha \u003cjulianbraha@gmail.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.ibm.com\u003e\n" }, { "commit": "5e8c349bc8d790fe031a4332e502f5d4f9878644", "tree": "25b688e4b1d5b567c68bea8077b9924b1e068030", "parents": [ "41e6f03658adfa9df68642750b53a046f1abdea9" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Fri Sep 04 15:37:39 2026 +0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 09:57:34 2026 -0700" }, "message": "selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0\n\nThe bpf_nf test allocs a ct, sets snat and dnat with random addr and\nport via bpf_ct_set_nat_info(), then looks the ct up and checks the\nreply tuple against what was set.\n\nThe port comes from bpf_get_prandom_u32() and can be 0. For\nbpf_ct_set_nat_info(), port 0 means \"port not specified\", so only the\naddr is mapped and the kernel keeps the original port. The check then\ncompares that port with 0 and fails, which shows up as a flaky\n\"Test for source natting\" failure in CI [1][2].\n\nKeep the random port in 1..65535 so it is always specified.\n\n[1] https://github.com/kernel-patches/bpf/actions/runs/33830002889/job/100893868791\n[2] https://github.com/kernel-patches/bpf/actions/runs/33829976794/job/100893220999\n\nFixes: b06b45e82b59 (\"selftests/bpf: add tests for bpf_ct_set_nat_info kfunc\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://lore.kernel.org/r/20260904073745.363314-1-jiayuan.chen@linux.dev\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "90feea391c64fc43bf44184fcf2b243ab991ce47", "tree": "268ec40e07a74b0905d8c2f52aa387f477ac5db8", "parents": [ "986c24e0fe44f844b44d365b71ce831947f50298" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Sep 03 11:05:58 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Fri Sep 04 09:44:34 2026 -0700" }, "message": "drm/amd/display: Fix harmless type mismatch in allocation\n\nWhile converting to kmalloc_obj() API, a type assignment mismatch was\nfound between the desired struct dcn42_resource_pool and the allocated\nstruct dcn401_resource_pool. Fix the type (it is harmless: the objects\nhave the same contents and size).\n\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\n---\nCc: Harry Wentland \u003charry.wentland@amd.com\u003e\nCc: Leo Li \u003csunpeng.li@amd.com\u003e\nCc: Rodrigo Siqueira \u003csiqueira@igalia.com\u003e\nCc: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: \"Christian König\" \u003cchristian.koenig@amd.com\u003e\nCc: David Airlie \u003cairlied@gmail.com\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nCc: Roman Li \u003cRoman.Li@amd.com\u003e\nCc: Ovidiu Bunea \u003covidiu.bunea@amd.com\u003e\nCc: Charlene Liu \u003cCharlene.Liu@amd.com\u003e\nCc: Leo Chen \u003cleo.chen@amd.com\u003e\nCc: Ivan Lipski \u003civan.lipski@amd.com\u003e\nCc: Gaghik Khachatrian \u003cgaghik.khachatrian@amd.com\u003e\nCc: \u003camd-gfx@lists.freedesktop.org\u003e\nCc: \u003cdri-devel@lists.freedesktop.org\u003e\n" }, { "commit": "986c24e0fe44f844b44d365b71ce831947f50298", "tree": "15818d60b81c25a4fb3019bb9d132b53401508a1", "parents": [ "36ec09e2637c3430acb8ec8fc3c303d9f1a24837", "9cdc7e6dc7a99ad7311ad5e7c145f2b9ce4e24b0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:25:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:25:38 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026090401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Benjamin Tissoires:\n\n - hid-hyperv build fixes on certain configs (Jiri Kosina)\n\n - HID-BPF fix and selftests now that the bpf verifier is more\n restrictive (Benjamin Tissoires)\n\n - Some AI detected fixes for OOB, errors and validation (Ibrahim\n Hashimov, Shen Yongchao, Wei Jie Law)\n\n - various device fixes (Dave Carey and Vadim Klishko)\n\n* tag \u0027hid-for-linus-2026090401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n HID: bpf: serialize device reference release in struct_ops destroy path\n HID: rmi: fix OOB access with undersized RMI reports\n selftests/hid: prepare test_rdesc_fixup_get_data_overflow for the new verifier\n selftests/hid: Add a test to ensure we can write fields in hid_device\n HID: bpf: mark struct hid_device as safe BPF pointer\n HID: wacom: validate report length in wacom_intuos_pro2_bt_irq\n HID: multitouch: Fix stale MT slots when contact count drops to zero\n HID: i2c-hid: Add a quirk for a Cirque I2C device.\n HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE\n HID: hyperv: fix build breakage with certain configs\n" }, { "commit": "36ec09e2637c3430acb8ec8fc3c303d9f1a24837", "tree": "8e09212adf276fe6ce1ea53e0b3e29454649fbab", "parents": [ "3e66602704746dd59543b62820a3b86ec19218a5", "3b26ceef88c110f4d188387cffa0df78657be904" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:17:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:17:05 2026 -0700" }, "message": "Merge tag \u0027sound-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes since 7.3-rc1.\n\n Quite a few fixes are for ALSA core for issues that have been detected\n by the things you know well. Additionally a series of hardening for\n runtime PM, and usual quirk updates, and some other misc driver fixes\n are included.\n\n Core:\n - Fixes for PCM races\n - UMP parser NULL dereference fix\n - Fix error handling in rawmidi ioctl\n\n USB- and HD-audio:\n - Implement missing runtime PM guards across multiple interfaces\n - Fix for OOB access in US-122L MIDI driver\n - Double-free fix for CAIAQ driver\n - Quirks for HD-audio Realtek \u0026 Cirrus codecs, Conexant S3-resume,\n USB Audient devices\n\n Others:\n - Fix of logical mistakes in dummy driver mixer and selftest code\n - Lock init fix in the legacy harmony driver\"\n\n* tag \u0027sound-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits)\n ALSA: caiaq: Fix potential double-free at error path\n selftests/alsa: Fix the step check for INTEGER controls\n ALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57G\n ALSA: rawmidi: Return the error from snd_rawmidi_input_params()\n ALSA: ump: do not touch legacy_rmidi before it exists\n ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2\n ALSA: dummy: Report a change when one capture switch channel moves\n ALSA: usb-audio: Add mixer map quirk for Audient iD24\n ALSA: hda: restore MFG widget enumeration after core split\n ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n ALSA: harmony: initialize locks before requesting IRQ\n ALSA: hda/realtek: Add quirk for VAIO VJS131\n ALSA: pcm: Fix race between non-atomic ops and trigger-start\n ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72\n ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10\n ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up\n ALSA: usb-audio: Guard FCP protocol transfers\n ALSA: usb-audio: Add PM guards to RME Digiface controls\n ALSA: usb-audio: Guard Scarlett2 protocol transfers\n ...\n" }, { "commit": "3e66602704746dd59543b62820a3b86ec19218a5", "tree": "3848b8f472ac7ca1424b76589867ced0305fb820", "parents": [ "58f93a4b73a21d1c54457e4ff654d60029464c76", "6d81700ad7c4871f94fb72e469cb0f3f55843ef7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:00:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 09:00:03 2026 -0700" }, "message": "Merge tag \u0027ata-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Work around lost interrupts on Marvell 88SE61xx\n\n The Marvell AHCI controller requires you to clear interrupts in the\n opposite order from what is specified in the AHCI specification in\n order to not lose interrupts (Hajo)\n\n - Do not raise UNIT ATTENTION for depopulation commands\n\n The libata completion function unconditionally sets sense data with\n sense key UNIT ATTENTION (UA) for depopulation commands. The SCSI\n layer will fail a command when seeing this sense data. UA is only\n supposed to be raised if the capacity actually changed.\n\n Since these commands are currently only supported as passthrough\n commands, the user is expected to revalidate the device, which will\n detect a capacity change anyway. Thus drop the unconditional UA until\n a better solution has been implemented (Damien)\n\n* tag \u0027ata-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: do not raise UA for storage element depopulation and restoration\n ata: ahci: work around lost interrupts on Marvell 88SE61xx\n" }, { "commit": "d7dbdd2ee01e12211046d4a535623ac732b749fb", "tree": "cf22916b8da8b89416de8bdbfe93cb7127c37267", "parents": [ "6c001a62c34f13fe1c6a24304c289b387d9e697d" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 04 08:25:04 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Sep 04 11:44:40 2026 -0400" }, "message": "tracing: Fix to avoid creating trace instances with duplicate names\n\nSince commit e645535a954a (\"tracing: Add option to use memmapped\nmemory for trace boot instance\") changed trace_array_get_by_name() to\ntrace_array_create_systems(), enable_instances() does not reuse the\nsame name instance. Therefore, if an administrator mistakenly specifies\nmultiple `trace_instance\u003d` options with duplicate names, all are\ncreated but only the first is accessible via tracefs.\n\nCheck whether an instance with the same name already exists before\ncreating a new one, and reject duplicates with a warning.\n\nLink: https://patch.msgid.link/178847790399.283263.5313150997200138426.stgit@devnote2\nFixes: e645535a954a (\"tracing: Add option to use memmapped memory for trace boot instance\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "58f93a4b73a21d1c54457e4ff654d60029464c76", "tree": "5f09ece758566ddc80e3132ec0c94d1bf1ee198c", "parents": [ "421066905cbceca1f78cba5f7d92b4980317ab2b", "b5ec6c462aab1062cf5d1e667ba7c6442f737055" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:42:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:42:14 2026 -0700" }, "message": "Merge tag \u0027ksmbd-for-7.3-rc2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server fixes from Namjae Jeon:\n\n - Fix a tree connection use-after-free in smb2_tree_connect() by\n balancing references across concurrent connect, disconnect, and\n session logoff paths.\n\n - Validate source and target ranges in COPYCHUNK requests before range\n locking and copy operations.\n\n - Fix an oplock break notification UAF by acquiring a connection\n reference under ksmbd_inode lock and releasing it after the\n notification work completes.\n\n - Fix the sparc build by using an unsigned int for the atomic work\n state, ensuring xchg() uses a supported four-byte operation.\n\n* tag \u0027ksmbd-for-7.3-rc2-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: fix tree connection use-after-free in smb2_tree_connect()\n ksmbd: validate COPYCHUNK source and target ranges\n ksmbd: fix use-after-free in oplock break notification\n ksmbd: fix sparc build with atomic work state\n" }, { "commit": "421066905cbceca1f78cba5f7d92b4980317ab2b", "tree": "e9c0e9bf592904393fc588e38ec9ea305659010f", "parents": [ "65119e86fe463cdc96455539020fa75b02f2cf91", "0c4256196b3a105307e2235fbfd85e768bbcdd0f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:24:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:24:09 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probes fixes from Masami Hiramatsu:\n\n - Protect kprobe_blacklist with RCU\n\n RCU-protect kprobe_blacklist and use kfree_rcu() to prevent UAF races\n during module unloading and enable safe atomic lookups.\n\n - Fix multi-probe field use-after-free\n\n Duplicate field and type strings on trace_probe_event to prevent UAF\n when freeing primary probe\n\n - Fix probe BTF member lookup:\n\n Check the containing inner struct/union kflag when resolving\n anonymous members to ensure correct bitfield offset calculation\n\n Prevent unnamed bitfields from being pushed to anon_stack in\n btf_find_struct_member(), avoiding false lookup errors\n\n Fix code block indentation in get_bitoffset_of_field()\n\n - uprobes error pointer safety\n\n Guard free_trace_uprobe() with IS_ERR_OR_NULL() to avoid crashing\n during automatic cleanup when an error pointer is returned\n\n* tag \u0027probes-fixes-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n kprobes: Protect kprobe_blacklist with RCU\n tracing/probes: Fix use-after-free on field name/type of events with multiple probes\n tracing/probes: Fix code indent in get_bitoffset_of_field()\n tracing/probes: Fix BTF kflag check for anonymous struct member access\n tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member\n uprobes: guard trace cleanup against error pointers\n" }, { "commit": "65119e86fe463cdc96455539020fa75b02f2cf91", "tree": "8bf377c943b9f5bf389d0bbda6761e960d19f026", "parents": [ "bc35965f6940a9bf834d54187b6088b8eb09206d", "2b0ac85512b7f67479127b2713254490662eb13d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:17:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 04 08:17:41 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain and cpuidle fixes from Ulf Hansson:\n \"pmdomain providers:\n - mediatek: Fix Kconfig for Airoha power domains\n - qcom: Revert adding the missing power domains for Eliza\n\n cpuidle:\n - psci: Fix support for probe deferral by dropping the faux device\n - dt_idle_genpd: Free the original name allocation\"\n\n* tag \u0027pmdomain-v7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n cpuidle: dt_idle_genpd: kfree() the original name allocation\n pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig\n cpuidle: psci: Fix support for probe deferral by dropping the faux device\n Revert \"pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza\"\n" }, { "commit": "41e6f03658adfa9df68642750b53a046f1abdea9", "tree": "ec8406fa98b9cc67556f8bfd4f637a2612600ec9", "parents": [ "6b31560c6bc1a8a7a70792c7b3ca4c1ea322063b", "9492baf8532ca285c58b82a269acd7a57e205ae9" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:37 2026 -0700" }, "message": "Merge branch \u0027misc-bug-fixes-part-3\u0027\n\nKumar Kartikeya Dwivedi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMisc bug fixes - part 3\n\nA set of miscellaneous fixes for bugs reported by Nicholas, batched\ntogether again. See commit logs for details. Some of this was caught and\nposted by Ning before, but AI raised some concerns, so I\u0027m resolving\nthose issues and commandeering their patches now.\n\nChangelog:\n----------\nv1 -\u003e v2\nv1: https://lore.kernel.org/bpf/20260904063650.3877826-1-memxor@gmail.com\n\n * Fix GCC-BPF failure due to missed BTF emission for a type.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260904084325.52250-1-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "9492baf8532ca285c58b82a269acd7a57e205ae9", "tree": "ec8406fa98b9cc67556f8bfd4f637a2612600ec9", "parents": [ "7441ee8276641bddaf1cba7bb75ef9c1458ceb3b" ], "author": { "name": "Ning Ding", "email": "dingning04@gmail.com", "time": "Fri Sep 04 10:43:21 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "message": "selftests/bpf: Reject refcount acquisition after RCU unlock\n\nAdd a sleepable verifier test that loads a refcount-only local kptr in an\nexplicit RCU read-side critical section, ends the section, and passes the\npointer to bpf_refcount_acquire().\n\nThe loaded pointer never carries NON_OWN_REF. After RCU unlock it retains\nMEM_ALLOC while becoming PTR_UNTRUSTED, which previously made the kfunc\nargument check accept it as a live allocated object. Expect verification to\nreject the untrusted argument instead.\n\nSigned-off-by: Ning Ding \u003cdingning04@gmail.com\u003e\n[ kkd: Rewrote commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-9-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "7441ee8276641bddaf1cba7bb75ef9c1458ceb3b", "tree": "0233eb5bc4ec6318b8fadbdd8949bb61da45a300", "parents": [ "6668ed271eaefaa63e686bdfbedaeb7b8e492722" ], "author": { "name": "Ning Ding", "email": "dingning04@gmail.com", "time": "Fri Sep 04 10:43:20 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "message": "bpf: Reject untrusted allocated-object pointers\n\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\n\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\n\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n\nFixes: 1b12171533a9 (\"bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Ning Ding \u003cdingning04@gmail.com\u003e\n[ kkd: Rewrote commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-8-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "6668ed271eaefaa63e686bdfbedaeb7b8e492722", "tree": "58e8288fead484f6755ad0815fc74c3742663761", "parents": [ "cd6f72d7f38e10aa82fcbc745a6a9e58e0d8e366" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 10:43:19 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "message": "selftests/bpf: Reject graph kptr use after RCU unlock\n\nAdd a sleepable verifier test that loads a graph-node local kptr in an\nexplicit RCU read-side critical section, then passes its node to\nbpf_rbtree_remove() after the section ends.\n\nBefore the verifier fix, the stale NON_OWN_REF flag makes the node look like\na live borrowed reference and the program is accepted. After the fix, the\npointer is demoted without NON_OWN_REF and the graph kfunc argument is\nrejected.\n\nAlso exercise a graph kptr loaded while a spin lock provides implicit RCU\nprotection. The pointer must be invalidated when the lock is released, which\nguards the required ordering between non-owning-reference invalidation and\nRCU demotion.\n\nUpdate the existing fault-protected load test state description. The\npost-unlock pointer no longer carries NON_OWN_REF, but remains readable\nbecause the load is rewritten to use BPF_PROBE_MEM.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "cd6f72d7f38e10aa82fcbc745a6a9e58e0d8e366", "tree": "e730685bd5337cc2322da7cb0ed0649cd2145ad0", "parents": [ "2edd8339468e4bf0feecb3398aaad25fd7b84286" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 10:43:18 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "message": "bpf: Clear NON_OWN_REF after RCU protection ends\n\nA local kptr load of an object containing a graph node is marked MEM_RCU\nand NON_OWN_REF while protected by RCU. When the last RCU read-side critical\nsection ends, invalidate_rcu_protected_refs() removes MEM_RCU and marks the\npointer PTR_UNTRUSTED, but leaves NON_OWN_REF set.\n\nThe stale flag lets graph kfunc argument checks continue treating the\npointer as a live borrowed reference. In particular, bpf_rbtree_remove()\ncan accept a pointer after its protection ended and return it as a new\nowning reference, even though the object may already have been freed.\n\nClear NON_OWN_REF when an RCU-protected pointer is demoted. A spin lock also\nprovides implicit RCU protection, so invalidate non-owning references before\ndemoting RCU-protected pointers when releasing the lock. Otherwise the\ndemotion would clear the flag before invalidate_non_owning_refs() can find\nand invalidate those aliases.\n\nThe demoted pointer remains available for fault-protected reads. Exempt such\nreads from the allocated-object reference-state assertion; writes through a\nfault-prone pointer are already rejected, and bpf_may_fault_on_deref() makes\nthe surviving loads use BPF_PROBE_MEM.\n\nFixes: 1b12171533a9 (\"bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-6-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "2edd8339468e4bf0feecb3398aaad25fd7b84286", "tree": "e5c6fa56a5dcdcfea21adfffa038311f0639fe1f", "parents": [ "dc36739e5cc9f60485418a910b42bc95339218d2" ], "author": { "name": "Ning Ding", "email": "dingning04@gmail.com", "time": "Fri Sep 04 10:43:17 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:36 2026 -0700" }, "message": "selftests/bpf: Test borrowed refcount acquisition nullability\n\nAdd verifier coverage for the distinction between owning and borrowed\narguments to bpf_refcount_acquire().\n\nAn owning pointer returned by bpf_obj_new() must continue producing a\nnon-NULL result without an extra check. An RCU-loaded local kptr is only\nborrowed, so a checked result must load successfully while passing an\nunchecked result to bpf_obj_drop() must be rejected as possibly NULL.\n\nUse a sleepable syscall program for the borrowed cases so the explicit RCU\ncritical section is what permits the local kptr load. Without the verifier\nfix, the unchecked case is incorrectly accepted. With it, the verifier\nrejects the possibly NULL argument.\n\nSigned-off-by: Ning Ding \u003cdingning04@gmail.com\u003e\n[ kkd: Rewrote commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-5-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "dc36739e5cc9f60485418a910b42bc95339218d2", "tree": "745cf99cad138b74191a86dc0b74cbcec2ff8d1f", "parents": [ "17487b31f479c85eda3685e8e44242358bd68f23" ], "author": { "name": "Ning Ding", "email": "dingning04@gmail.com", "time": "Fri Sep 04 10:43:16 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:35 2026 -0700" }, "message": "bpf: Keep refcount_acquire nullable for borrowed RCU kptrs\n\nbpf_refcount_acquire() is fallible for a borrowed reference because the\nobject may have reached a zero refcount. The verifier therefore keeps\nKF_RET_NULL on the return value unless the argument is an owning reference.\n\nAn RCU-protected load of a local kptr is marked MEM_ALLOC, but it only\nreceives NON_OWN_REF when the pointee contains a graph node. A refcounted\nobject without a graph node consequently looks like an owning reference\neven though the loaded register has no acquired reference state. If the\nprogram drops the last real reference while remaining in the RCU critical\nsection, refcount_inc_not_zero() returns NULL while the verifier treats the\nresult as non-NULL.\n\nOnly classify the argument as owning when it is backed by a verifier-tracked\nreference. This retains the non-NULL return for pointers from bpf_obj_new(),\nbpf_kptr_xchg(), or an earlier successful acquisition, while requiring a\nNULL check for borrowed RCU kptrs.\n\nFixes: 1b12171533a9 (\"bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Ning Ding \u003cdingning04@gmail.com\u003e\n[ kkd: Rewrote commit log ]\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-4-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "17487b31f479c85eda3685e8e44242358bd68f23", "tree": "02b9ede8b091b38a37066570fb2e63a84adbb363", "parents": [ "048029ba1c793f8cabc4ad5eea765da01903f8f1" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 10:43:15 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:35 2026 -0700" }, "message": "selftests/bpf: Reject non-percpu values in percpu kptr fields\n\nAdd verifier coverage for the two ways a non-percpu pointer can be stored\nin a __percpu_kptr field: a program-BTF local allocation returned by\nbpf_obj_new(), and a referenced kernel-BTF task_struct pointer.\n\nWithout the verifier fix, both programs are unexpectedly accepted and the\nnegative tests fail. Requiring MEM_PERCPU makes both programs fail\nverification with the expected invalid-kptr diagnostic.\n\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-3-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "048029ba1c793f8cabc4ad5eea765da01903f8f1", "tree": "6b28cc2b0d5b96f2bd1c3d391150d98552c5872d", "parents": [ "6b31560c6bc1a8a7a70792c7b3ca4c1ea322063b" ], "author": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 10:43:14 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Sep 04 07:58:35 2026 -0700" }, "message": "bpf: Require MEM_PERCPU for percpu kptr stores\n\nmap_kptr_match_type() treats perm_flags as the set of register type flags\nthat a kptr field permits. Adding MEM_PERCPU to that set for\nBPF_KPTR_PERCPU does not require the source register to carry it, however.\nThe subset test consequently accepts both a plain bpf_obj_new() allocation\nand a referenced kernel pointer into a __percpu_kptr map field.\n\nLoads from the field are always marked MEM_PERCPU. Consumers then treat the\nstored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer\nhelpers relocate it, and map teardown selects the per-CPU free path. A plain\nallocation can therefore provide an arbitrary kernel read/write, while a\nkernel pointer can be relocated into an invalid address or sent through a\nmissing destructor.\n\nRequire the source MEM_PERCPU flag to match the destination field kind.\nThis preserves valid bpf_percpu_obj_new() stores and rejects both the\nprogram-BTF and kernel-BTF variants.\n\nFixes: 36d8bdf75a93 (\"bpf: Add alloc/xchg/direct_access support for local percpu kptr\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260904084325.52250-2-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "d31fbbade43f880b7e59e2b3a72722fe2725d93f", "tree": "b5c17fe512a37ec3c35bf07c10b0f005aad73f13", "parents": [ "e67091609cf85962f64391c1b0f93d4cbfcd4e22" ], "author": { "name": "Ju Nan", "email": "junan76@163.com", "time": "Fri Aug 21 10:47:57 2026 +0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 04 16:19:04 2026 +0200" }, "message": "irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout\n\nHWSPNLCK_TIMEOUT is passed to hwspin_lock_timeout_in_atomic(), whose\ntimeout argument is in milliseconds, not microseconds:\n\n atomic_delay +\u003d HWSPINLOCK_RETRY_DELAY_US;\n if (atomic_delay \u003e to * 1000)\n return -ETIMEDOUT;\n\nSo stm32mp_exti_set_type() asks for a 1 second timeout where the comment\nnext to the macro says it wants 1 millisecond. The semaphore is polled\nwith udelay() from a section that holds chip_data-\u003erlock, a\nraw_spinlock_t, so preemption stays disabled for the whole wait on every\nconfiguration, PREEMPT_RT included.\n\nThe hwspinlock core documents this explicitly:\n\n If the mode is HWLOCK_IN_ATOMIC (called from an atomic context) the\n timeout is handled with busy-waiting delays, hence shall not exceed\n few msecs.\n\nFixes: 5257169ade8c (\"irqchip/stm32-exti: Use the hwspin_lock_timeout_in_atomic() API\")\nSigned-off-by: Ju Nan \u003cjunan76@163.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Radu Rendec \u003cradu@rendec.net\u003e\nReviewed-by: Antonio Borneo \u003cantonio.borneo@foss.st.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260821024756.24927-2-junan76@163.com\n" }, { "commit": "e67091609cf85962f64391c1b0f93d4cbfcd4e22", "tree": "51820704b5211e9d27323f2d506af0fc179038dd", "parents": [ "797b13a7de957792c1b4773aa2cc3dab4621fd9c" ], "author": { "name": "caina", "email": "caina@uniontech.com", "time": "Fri Aug 21 17:17:20 2026 +0800" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 04 16:12:53 2026 +0200" }, "message": "Revert \"irqchip/mbigen: Fix mbigen node address layout\"\n\nThis reverts commit 6be6cba9c4371d27f78d900ccfe34bb880d9ee20.\n\nCommit 6be6cba9c437 (\"irqchip/mbigen: Fix mbigen node address layout\")\nappears to cause a regression on Hi1616.\n\nOn-board hns NIC has two ports, enahisic2i0 and enahisic2i1, both\nbehind mbigen-v2. Port 0 works; port 1 cannot pass any traffic.\n\nTheir interrupt pins fall on different mbigen nodes:\n\n enahisic2i0: pins 1152-1198 -\u003e all in node 9\n enahisic2i1: pins 1200-1246 -\u003e node 9 (1200-1215) + node 10 (1216-1246)\n\n (nid \u003d (hwirq - 64) / 128 + 1; pin 1215 \u003d node 9, pin 1216 \u003d node 10)\n\n/proc/interrupts shows the break happens exactly at the node boundary:\n\n enahisic2i1-rx0 pin 1200 count 102 \u003c- node 9\n enahisic2i1-rx5 pin 1215 count 1 \u003c- node 9, last pin\n enahisic2i1-tx5 pin 1216 count 0 \u003c- node 10, first pin\n enahisic2i1-rx6 pin 1218 count 0 \u003c- node 10\n ...all node 10 pins stay at zero.\n\nPort 0 (entirely node 9) is unaffected. Reverting the commit restores\nnormal operation.\n\nThe commit assumes CLEAR occupies a full 4 KB page at [0xa000, 0xb000)\nand collides with node 10, so node 10+ gets shifted by 0x1000.\n\nBut get_mbigen_clear_reg() uses flat, chip-wide addressing -- it never\nmultiplies by the node ID:\n\n *addr \u003d (hwirq / 32) * 4 + REG_MBIGEN_CLEAR_OFFSET; /* 0xa000 */\n\nOver the valid hwirq range [64, 1407], CLEAR only spans 0xa008-0xa0af\n(168 bytes). Node 10\u0027s registers are:\n\n TYPE: 0xa000-0xa00f (16 B) overlaps CLEAR by 8 B (0xa008-0xa00f)\n VEC: 0xa200-0xa3ff (512 B) no overlap with CLEAR\n\nShifting the whole page moves VEC from 0xa200 to 0xb200. The hardware\nreads the event ID from the fixed silicon address 0xa200 on interrupt\nfiring, but software wrote it to 0xb200 -- so the hardware gets an\nuninitialised value and the interrupt is lost.\n\nThe only real overlap is 8 bytes of TYPE. It can only trigger when a\nsingle mbigen instance has devices on both node 1 (CLEAR 0xa008) and\nnode 10 (TYPE 0xa008). On Hi1616 those nodes are on separate mbigen\ninstances, so it never triggers.\n\nFixes: 6be6cba9c4371d27f78d900ccfe34bb880d9ee20 (\"irqchip/mbigen: Fix mbigen node address layout\")\nSuggested-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nSigned-off-by: caina \u003ccaina@uniontech.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nAcked-by: Yipeng Zou \u003czouyipeng@huawei.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260821091720.16665-1-caina@uniontech.com\n" }, { "commit": "a2628ce4ddb6873e35380a42396d17a66e704a1a", "tree": "58d538e7031cbf6edbaff8dbab3d320c12878b1b", "parents": [ "9296375902579f9b0e456bbb76e5cf179e5a4e0b" ], "author": { "name": "Haiyong Sun", "email": "sunhaiyong@loongson.cn", "time": "Fri Sep 04 21:45:27 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:45:27 2026 +0800" }, "message": "perf build: Add clang and rust target flags for LoongArch\n\nAdd missing CLANG_TARGET_FLAGS_loongarch and RUST_TARGET_FLAGS_loongarch\nso that perf can be built with clang and enable rust cross compilation.\n\nCc: stable@vger.kernel.org\nAcked-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nAcked-by: Dmitrii Dolgov \u003c9erthalion6@gmail.com\u003e\nSigned-off-by: Haiyong Sun \u003csunhaiyong@loongson.cn\u003e\nSigned-off-by: WANG Rui \u003cwangrui@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "9296375902579f9b0e456bbb76e5cf179e5a4e0b", "tree": "c57a74e22cf5c10d0ba5644393dca550e7fdc1f5", "parents": [ "501514d6ebd2111c353a1296f25dbe22fbd64657" ], "author": { "name": "Tao Cui", "email": "cuitao@kylinos.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "message": "LoongArch: KVM: Fix TOCTOU race on pv_features\n\nIn kvm_loongarch_cpucfg_set_attr() the check-then-set on\nkvm-\u003earch.pv_features is lockless, so two vCPUs can race past the\nvalidation and set different values. Add a spinlock to protect it.\n\nCc: stable@vger.kernel.org\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "501514d6ebd2111c353a1296f25dbe22fbd64657", "tree": "e96b8ca91533442263aa16281a739141f26934f4", "parents": [ "27a9bfee3bbcb3cabb77797354f07e0e44e49831" ], "author": { "name": "Zeng Chi", "email": "zengchi@kylinos.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "message": "LoongArch: KVM: Validate MSI data before routing it to EIOINTC\n\npch_msi_set_irq() passes e-\u003emsi.data straight into eiointc_set_irq() as\nthe irq number. The MSI data comes from userspace, that either via a\nKVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd\nand KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked\nagainst EIOINTC_IRQS.\n\neiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the\n256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and\nthe per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value\n\u003e\u003d 256 reads and writes memory past the end of those arrays, i.e. any\nprocess holding a VM fd can corrupt kernel memory beyond the allocation\nof loongarch_eiointc.\n\nReject MSI data that doesn\u0027t fit in the EIOINTC irq space. The DMSINTC\npath is unaffected as it decodes the vector from the address and masks\nit.\n\nCc: stable@vger.kernel.org\nFixes: 1928254c5ccb (\"LoongArch: KVM: Add irqfd support\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260531140921.1B1181F00893@smtp.kernel.org/\nReviewed-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Zeng Chi \u003czengchi@kylinos.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "27a9bfee3bbcb3cabb77797354f07e0e44e49831", "tree": "2acdc8fafa2e40a18b3b05e0d6193b79508ffe56", "parents": [ "40bdbb4bfa730400e8b383d6f5931f90aebb5f54" ], "author": { "name": "Zeng Chi", "email": "zengchi@kylinos.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:45:13 2026 +0800" }, "message": "LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY\n\nkvm_arch_prepare_memory_region() computes new-\u003earch.flags, i.e. whether\na memslot is KVM_MEM_HUGEPAGE_CAPABLE or KVM_MEM_HUGEPAGE_INCAPABLE,\nonly for KVM_MR_CREATE and KVM_MR_MOVE, and returns early for every\nother change. But the generic code allocates a zeroed memslot for every\nchange and never copies old-\u003earch, so after a KVM_MR_FLAGS_ONLY update,\ne.g. toggling KVM_MEM_LOG_DIRTY_PAGES for live migration, the active\nmemslot has arch.flags \u003d\u003d 0.\n\nWith both flags clear, fault_supports_huge_mapping() falls through to\nthe alignment check on the HVA range alone, which no longer verifies\nthat the GPA and HVA have the same offset within a PMD. A memslot that\nwas marked KVM_MEM_HUGEPAGE_INCAPABLE because of a GPA/HVA offset\nmismatch can then be mapped with PMD entries on read faults, and since\nkvm_map_page() aligns the gfn and the pfn independently, the guest ends\nup accessing the wrong host pages, exactly the \"d -\u003e f, e -\u003e g\" case\ndescribed in the comment above the check.\n\nCarry the arch flags over from the old memslot for KVM_MR_FLAGS_ONLY,\nas the GPA, HVA and size are guaranteed to be unchanged for that case.\n\nCc: stable@vger.kernel.org\nFixes: 7ab6fb505b2a (\"LoongArch: KVM: Optimization for memslot hugepage checking\")\nTested-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nReviewed-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Zeng Chi \u003czengchi@kylinos.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "40bdbb4bfa730400e8b383d6f5931f90aebb5f54", "tree": "daa081ed74c33ee77fd28f042487b2363798de78", "parents": [ "910132bc7d72f26a8b288c2a38c32445a48d5be0" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Fri Sep 04 21:44:54 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:54 2026 +0800" }, "message": "LoongArch: KVM: Remove unused function kvm_arch_flush_remote_tlbs_memslot()\n\nFunction kvm_arch_flush_remote_tlbs_memslot() is not called any more, so\nremove this API.\n\nReviewed-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "910132bc7d72f26a8b288c2a38c32445a48d5be0", "tree": "2383eddfbd3ae80531734366f17ae393d11dae5d", "parents": [ "4af22177032ab2357bf551fbfcdebc8fd9f2502d" ], "author": { "name": "Chaithanya Lagisetty", "email": "nagachaithanya9911@gmail.com", "time": "Fri Sep 04 21:44:54 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:54 2026 +0800" }, "message": "LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path\n\nkvm_loongarch_env_init() allocates the per-CPU kvm_context (vmcs) and\nkvm_loongarch_ops, registers the perf callbacks, and then registers\nthe IPI/EIOINTC/PCH-PIC/DMSINTC KVM devices. If any of those device\nregistrations fails, the function returned the error directly, leaving\neverything acquired so far in place: vmcs and kvm_loongarch_ops are\nnever freed, the perf callbacks stay registered, and all previously\nregistered KVM device operations remain registered. kvm_loongarch_init()\npropagates the errors without calling kvm_loongarch_env_exit(), so\nnothing else cleans up either.\n\nUnwind the error path in reverse order of registration, so that each\nfailure only undoes what had actually been set up. Use the same helpers\nin kvm_loongarch_env_exit() to remove the device registrations during\nnormal teardown as well.\n\nCc: stable@vger.kernel.org\nFixes: c532de5a67a7 (\"LoongArch: KVM: Add IPI device support\")\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Chaithanya Lagisetty \u003cnagachaithanya9911@gmail.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "4af22177032ab2357bf551fbfcdebc8fd9f2502d", "tree": "7d90499c50972e5c3aaea2c1dfdc4cd15dff56d7", "parents": [ "f7a1064cce3b100b54780c68529176232d8eb01e" ], "author": { "name": "Chaithanya Lagisetty", "email": "nagachaithanya9911@gmail.com", "time": "Fri Sep 04 21:44:53 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:53 2026 +0800" }, "message": "LoongArch: KVM: Add unregister helpers for the KVM interrupt devices\n\nThe IPI/EIOINTC/PCH-PIC/DMSINTC KVM devices each have a helper that\nregisters their kvm_device_ops, but there is no counterpart to remove\nthem, so a caller that needs to undo a registration has to open-code\nkvm_unregister_device_ops() with the matching device type.\n\nAdd kvm_loongarch_unregister_{ipi,eiointc,pch_pic,dmsintc}_device()\nnext to the existing register helpers. kvm_unregister_device_ops() is a\nno-op when the corresponding device type is not currently registered.\n\nNo functional change, as there are no callers yet.\n\nCc: stable@vger.kernel.org\nSuggested-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Chaithanya Lagisetty \u003cnagachaithanya9911@gmail.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "f7a1064cce3b100b54780c68529176232d8eb01e", "tree": "dfc2882b0f16da4b90992a375b627461e2b6843f", "parents": [ "30419a0aa128135a81be917eaa3bd2f1a10c9ca3" ], "author": { "name": "Chaithanya Lagisetty", "email": "nagachaithanya9911@gmail.com", "time": "Fri Sep 04 21:44:53 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:53 2026 +0800" }, "message": "LoongArch: KVM: Free init resources if kvm_init() fails\n\nkvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the\nper-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the\nperf callbacks, and then calls kvm_init(). If kvm_init() fails its\nresult is returned directly, but since module_init() does not run the\nmodule_exit() stuff on failure, so kvm_loongarch_env_exit() is never\ncalled and those resources are leaked.\n\nSo call kvm_loongarch_env_exit() when kvm_init() fails, matching the\nteardown-on-failure pattern used by riscv_kvm_init().\n\nCc: stable@vger.kernel.org\nFixes: 2bd6ac687261 (\"LoongArch: KVM: Implement kvm module related interface\")\nReviewed-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Chaithanya Lagisetty \u003cnagachaithanya9911@gmail.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "30419a0aa128135a81be917eaa3bd2f1a10c9ca3", "tree": "6a1631e831a65d7d08e92b0903c89ea402815f16", "parents": [ "72ce4b24676e8b3b75376c4c559dd81c1ac52d5a" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "message": "LoongArch: BPF: Fix off-by-one error for insn_is_cast_user()\n\nIn the LoongArch BPF JIT code, the branch offset represents the number\nof instructions. An offset of 1 means the target of the \"beq\" is the\ncurrent PC plus 1 instruction (PC + 4 bytes). This matches the exact\nsame path as the sequential non-branch execution, the \"or\" instruction\nis always executed for the cast_user JIT arm in build_insn().\n\nIf the pointer is not NULL, there is no side effect. But if the pointer\nis NULL, it is incorrectly combined with the base address and turns into\na non-zero address, meaning a zero arena offset no longer casts to NULL.\n\nFix this by changing the branch offset from 1 to 2, which properly skips\nthe \"or\" instruction and jumps directly to the \"move_reg\" instruction if\nthe pointer is NULL, ensuring the destination register is safely cleared\nto 0.\n\nCc: stable@vger.kernel.org\nFixes: 4fdb5dd8aeba (\"LoongArch: BPF: Implement bpf_addr_space_cast instruction\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "72ce4b24676e8b3b75376c4c559dd81c1ac52d5a", "tree": "f08bbe12be13dd4468af5ad41686fdf6941c6800", "parents": [ "c3f2feace5e4f4b01b68b9f947b19adb4155c32e" ], "author": { "name": "Jérémy Jean", "email": "Jeremy.Jean@oss.cyber.gouv.fr", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "message": "LoongArch: Avoid preempt count underflow without probe\n\nLoongArch uses break 11 for the breakpoint placed after an instruction\nthat Kprobes executes out of line. Since userspace can issue the same\nbreak instruction, do_bp() can reach kprobe_singlestep_handler() when\nthere is no current probe.\n\nThe handler actually returns false in this case, but it first calls\npreempt_enable_no_resched(). The corresponding preempt_disable() is done\nby kprobe_breakpoint_handler() on a real Kprobe hit, so it has not run\nhere. As a result, an ordinary userspace breakpoint (code 11) underflows\nthe current task\u0027s preempt count.\n\nThis also makes in_interrupt() return true until the task schedules. One\nvisible consequence is the socket cgroup attribution: cgroup_sk_alloc()\ntreats the allocation as interrupt context and assigns the socket to the\nroot cgroup. A socket opened from the SIGTRAP handler can then avoid a\nBPF_CGROUP_INET_SOCK_CREATE policy attached to the task\u0027s own cgroup.\n\nReturn as soon as kprobe_running() reports no active probe.\n\nThe same check has appeared in [PATCH v10 2/4] of the original LoongArch\nKprobes series, but was dropped before the feature reached mainline.\n\nCc: stable@vger.kernel.org\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nLink: https://lore.kernel.org/loongarch/1670575981-14389-3-git-send-email-yangtiezhu@loongson.cn/\nAssisted-by: Codex:gpt-5\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "c3f2feace5e4f4b01b68b9f947b19adb4155c32e", "tree": "a823ab852ce8c6cf8666995658c492e0af1a2525", "parents": [ "3e1b64bd8cd2bc15c514d90b3dd0a55c53302f3a" ], "author": { "name": "Wentao Guan", "email": "guanwentao@uniontech.com", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "message": "LoongArch: Do not save/restore percpu base register in rethook trampoline\n\nThe rethook trampoline saves $r21 ($u0), the percpu base, into its frame\nat entry and restores it at exit. Inbetween rethook_trampoline_handler()\nmay schedule via preempt_enable_notrace().\n\nIf the task migrates to another CPU, the frame\u0027s $r21 holds the old\nCPU\u0027s percpu base, and restoring it poisons $r21 on the new CPU. Until\nthe next user-\u003ekernel transition heals $r21, all this_cpu_*() accesses\n(runqueues, RCU per-CPU data, timer tick programming, FPU ownership)\nhit the wrong CPU\u0027s percpu area.\n\nUnder kretprobe-heavy preemptible load this can corrupt scheduler and\ntimer state: scheduling-while-atomic splats, wrong-CPU RCU warnings,\nWARN_ON_ONCE(rq !\u003d this_rq()) in nohz_balance_exit_idle(), and CPUs\nparking in the idle loop with the constant timer never re-armed (hard\nlockup). Reproduces on a Loongson-3A6000 with kretprobes on VFS paths\nplus heavy file churn (OS install / unsquashfs).\n\nBy convention $r21 always holds the current CPU\u0027s percpu base in kernel\nmode: SAVE_SOME() at exception entry reloads it only when coming from\nuser mode, and RESTORE_SOME() restores it only when returning to user\nmode; the context-switch path never writes it. Therefore the live $r21\nat trampoline exit is already correct, and nothing inbetween can change\nit legitimately (kernel C code cannot write a global register variable).\nThe same flaw existed even in the pre-rethook kretprobe trampoline since\nv6.3; it was carried over when rethook replaced it. Drop both the save\nand the restore here. Drop the restore is enough to solve the issue, and\ndrop the save is to keep the code tidy and no need to clear it.\n\nCc: stable@vger.kernel.org # v6.3+\nFixes: 3f5536860086d (\"LoongArch: Add kretprobes support\")\nAssisted-by: Kimi:Kimi-K3 # debug and root-cause analysis\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "3e1b64bd8cd2bc15c514d90b3dd0a55c53302f3a", "tree": "6b1ef532c11fd860c76ffa6b977096fa3cdadc22", "parents": [ "20a9e97137caaa3fbb27f22f83a5ad80cbd03b01" ], "author": { "name": "Anthony Iliopoulos", "email": "ailiop@suse.com", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:43 2026 +0800" }, "message": "LoongArch: Remove unused setup_profiling_timer() function\n\nsetup_profiling_timer() is not used by any code at this point. Since a\ndefault weak implementation exists, there is no need to still keep this\narch-specific definition around. Remove it along with the now-redundant\nprofile header includes.\n\nSigned-off-by: Anthony Iliopoulos \u003cailiop@suse.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "20a9e97137caaa3fbb27f22f83a5ad80cbd03b01", "tree": "c2ea1d423e6fd3259c21c75d2cdc096904c749c4", "parents": [ "63b6a48c951d63bf39d44603ada48a987ccf66eb" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Fri Sep 04 21:44:24 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:24 2026 +0800" }, "message": "LoongArch: Fix typo \"avaliable\" in comment of vmlinux.lds.S\n\nCorrect \"avaliable\" to \"available\", reported by scripts/checkpatch.pl\nusing the misspelling list in scripts/spelling.txt. It only touches the\ncomments, no code changes.\n\nAssisted-by: Cursor:claude-opus-5\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "63b6a48c951d63bf39d44603ada48a987ccf66eb", "tree": "2b1c054de6dc2831d7b46b2942b74d6969ea4224", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Fri Sep 04 21:44:23 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri Sep 04 21:44:23 2026 +0800" }, "message": "LoongArch: Do not select HAVE_RUST when KASAN is enabled\n\nAfter commit 2625480a1bf7 (\"hardening: Default randstruct off with rust\nfor better allmodconfig support\"), which allows Rust to be enabled for\nallmodconfig, ARCH\u003dloongarch allmodconfig starts failing with:\n\n error: kernel-address sanitizer is not supported for this target\n\n error: aborting due to 1 previous error\n\n make[4]: *** [rust/Makefile:741: rust/core.o] Error 1\n\nFor the same reason as the commit 84a0f7caafc679f7 (\"ARM: Do not select\nHAVE_RUST when KASAN is enabled\"), do not select HAVE_RUST when KASAN\nis enabled until the loongarch64-unknown-none-softfloat target in rustc\nsupports KASAN.\n\nCc: stable@vger.kernel.org\nFixes: 90868ff9cade (\"LoongArch: Enable initial Rust support\")\nAcked-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "6b31560c6bc1a8a7a70792c7b3ca4c1ea322063b", "tree": "af5c5d378e2ad3bc187ab0556cbdd51985d43450", "parents": [ "6aed0134d3cda6382385a734ae0158eb7df6b142" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:25 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:05 2026 +0200" }, "message": "selftests/bpf: No non-NULL inference from an imprecise zero register\n\nCheck that a register-form NULL check does not lift PTR_MAYBE_NULL on\na path where the compared register is non-zero. W/o the previous patch\nthe program is accepted.\n\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-8-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "6aed0134d3cda6382385a734ae0158eb7df6b142", "tree": "e30dca447a0ea122d540d38e6742dabd6250942e", "parents": [ "836b2fe544a5e9b5ce116622cb36fba33838c6fd" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:24 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:04 2026 +0200" }, "message": "bpf: Mark the zero register precise for a register-form NULL check\n\ncheck_cond_jmp_op() accepts \"if rA \u003cop\u003e rB\" as a NULL check for a\nnullable pointer rA when rB is a scalar known to be zero,\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not\nmark rB precise. Consider the following program:\n\n r0 \u003d bpf_get_prandom_u32();\n r6 \u003d 1; /* the r6 \u003d\u003d 0 path is explored first */\n if (r0 \u003d\u003d 0) goto 1f;\n r6 \u003d 0;\n1:\n r0 \u003d bpf_map_lookup_elem(map, \u00260); /* absent, NULL at runtime */\n if (r0 \u003d\u003d r6) goto 2f; /* taken as a NULL check for r0 */\n *(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */\n2:\n return 0;\n\nThe r6 \u003d\u003d 0 path is explored first and the dereference is accepted.\nThe r6 \u003d\u003d 1 path is pruned at the checkpoint recorded for (1),\nso the comparison is never verified with a non-zero r6. At runtime a\nfailed lookup returns NULL, NULL !\u003d 1 takes the non-NULL edge and the\nprogram dereferences a pointer that is zero.\n\nFixes: 2f4cb53eed44 (\"bpf: detect non null pointer with register operand in JEQ/JNE.\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-7-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "836b2fe544a5e9b5ce116622cb36fba33838c6fd", "tree": "95e38e4aaa0a6a78e373148b3d0af4aa2ab3d371", "parents": [ "e51179a4e09846f8fd0f26a05068520de2b301bf" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:23 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:04 2026 +0200" }, "message": "selftests/bpf: Check that JMP32 pointer vs zero jumps are not predicted\n\nAdd jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which\nthe verifier used to skip, contains an out of bounds map value access,\nhence w/o the previous patch the program is accepted. See previous patch\nfor detailed description.\n\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "e51179a4e09846f8fd0f26a05068520de2b301bf", "tree": "68928c7a5d99a861d1ebc9e38708fba0600488e5", "parents": [ "bc412b3fb185540112fcc99ac91a14e57418d28e" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:22 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:04 2026 +0200" }, "message": "bpf: Don\u0027t predict JMP32 pointer vs zero comparisons\n\nConsider the following program:\n\n r1 \u003d map_value; /* low 32 bits are zero at runtime */\n r6 \u003d 0xdead000000000000;\n if w1 !\u003d 0 goto l1;\n l0: r1 +\u003d r6;\n r2 \u003d *(u64 *)(r1 + 0);\n exit;\n l1: r6 \u003d 0;\n goto l0;\n\nAt the moment is_branch_taken() reports the jump as always taken,\nbecause it does not distinguish between BPF_JMP and BPF_JMP32\ncomparisons when processing \u0027if w1 !\u003d 0 ...\u0027.\n\nFixes: cac616db39c2 (\"bpf: Verifier track null pointer branch_taken with JNE and JEQ\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "bc412b3fb185540112fcc99ac91a14e57418d28e", "tree": "4d1b54773557d65a059157a025b70dcd2cab9597", "parents": [ "73a98f96811e2cb0f4210b1caa8cb322f92f2a2b" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:21 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:03 2026 +0200" }, "message": "selftests/bpf: Check the linked regs cap for the compared register\n\nlinked_regs_too_many_regs checks that collect_linked_regs() ties at most\nLINKED_REGS_MAX registers for a single jump. Compare r5 instead of r0,\nso that the register the jump compares is itself the member that does\nnot fit, and check that it comes out of the jump unlinked.\n\nW/o the previous patch env-\u003e{false,true}_reg{1,2} bring r5\u0027s id back and\ninsn 7 is logged as \"R5\u003dscalar(id\u003d1,...)\".\n\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-4-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "73a98f96811e2cb0f4210b1caa8cb322f92f2a2b", "tree": "e9508662e72a041bf48995a47ee68f3141356408", "parents": [ "6752b90ccfb378e311e428932facf37c8625abae" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:20 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:03 2026 +0200" }, "message": "bpf: Don\u0027t resurrect a scalar id dropped by collect_linked_regs()\n\ncheck_cond_jmp_op() copies the compared registers into\nenv-\u003e{false,true}_reg{1,2} before collect_linked_regs() runs and copies\nthose snapshots back into both branch states afterwards.\n\ncollect_linked_regs() records at most LINKED_REGS_MAX members of a\nlinked registers group in the jump history and calls clear_scalar_id()\nfor every member that does not fit. The compared register is not exempt\nfrom that.\n\nAs a consequence, sync_linked_regs() might adjust ranges for more\nregisters than bpf_bt_sync_linked_regs() can propagate precision to.\n\nCollect the linked registers before the snapshots are taken instead.\nThis might lead to some unnecessary clear_scalar_id\u0027s, but from\nprevious testing situations with many linked registers are\nextremely rare.\n\nFixes: ec1d77cb0ee9 (\"bpf: Use bpf_verifier_env buffers for reg_set_min_max\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-3-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "6752b90ccfb378e311e428932facf37c8625abae", "tree": "3a0bee174e08b3b2f5bc3e46bd85d278b8c5a160", "parents": [ "67b529f521a6676cdfc78b91b0217d7eaa84216b" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:19 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:02 2026 +0200" }, "message": "selftests/bpf: No non-NULL inference from unbounded offset pointers\n\nCheck that a comparison against a pointer whose offset is not bounded\nfrom above does not make the verifier infer that a nullable pointer is\nnot NULL, and that a bounded offset still does. W/o the previous patch\nthe first test is accepted.\n\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSuggested-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-2-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "67b529f521a6676cdfc78b91b0217d7eaa84216b", "tree": "1ac38c6bcdf7b8bddba21875da18975522bc028e", "parents": [ "254c881fe0554c5efb16d355c273702a27a32a20" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Sep 04 01:33:18 2026 -0700" }, "committer": { "name": "Kumar Kartikeya Dwivedi", "email": "memxor@gmail.com", "time": "Fri Sep 04 12:58:02 2026 +0200" }, "message": "bpf: Don\u0027t infer non-NULL from a pointer with an unbounded offset\n\nreg_not_null() decides that a register holds a non-NULL value by\nlooking at its type alone. For pointer types that allow arithmetic the\ntype only guarantees a non-NULL base, in case of an unbound offset\nthe runtime offset value might still add up to NULL.\nConsider the followng program:\n\n r6 \u003d bpf_map_lookup_elem(map, \u00260); /* present */\n if (r6 \u003d\u003d 0) return 0;\n r7 \u003d bpf_map_lookup_elem(map, \u00261); /* absent, NULL at runtime */\n r8 \u003d r7;\n r8 -\u003d r6; /* pointer - pointer: unknown scalar, -r6 */\n r8 \u003c\u003c\u003d 1;\n r8 \u003e\u003e\u003d 1; /* any non-negative offset is accepted by */\n /* check_reg_sane_offset_ptr() */\n r6 +\u003d r8; /* verifier: map value; runtime: zero */\n if (r7 !\u003d r6) return 0;\n *(u8 *)(r7 + 0); /* r7 is inferred non-NULL, both are zero */\n\nAt runtime both registers are zero, the comparison is true and the\nload faults with NULL pointer dereference.\n\nRequire the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null().\n\nFixes: cac616db39c2 (\"bpf: Verifier track null pointer branch_taken with JNE and JEQ\")\nReported-by: Nicholas Carlini \u003cnpc@anthropic.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/bpf/20260904083325.2083493-1-eddyz87@gmail.com\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\n" }, { "commit": "c96294afbcb5737da18229e788ca45a5d534abc5", "tree": "04a82656d04026adac295094c804323276253f4b", "parents": [ "7f78fe856eb64723c436c636a1479c27608aaced", "0e68c74e44da81a4599c52437ee1f63a2c234470" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 20:36:09 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 20:36:14 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-09-03\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nA small fix on the error handling of an OA uapi and the\naddition of a drm_info message to report FLAT_CSS base misalignment.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/apnVOtDv4WAIoj_X@intel.com\n" }, { "commit": "7f78fe856eb64723c436c636a1479c27608aaced", "tree": "687ce74dc2baf1c7817611f168da6b27b751f0a4", "parents": [ "5ff6e2f8a779f72306bd93bde40c1b10436dbf58", "13af55f71399f5e562f6cb59ad413476e513c4d4" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 17:04:53 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 20:34:31 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-03\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-09-03:\n\namdgpu:\n- SR-IOV fix\n- GFX8 fix\n- MES queue reset fix\n- GPUVM fixes\n- DCN 6 warning fix\n- DCN 3.5/3.6 fix\n- DML fix\n- Backlight fix\n- Colorop fix\n- DC get_estimated_bw() fix\n- devcoredump fix\n- Userq fixes\n- APU PSP fix\n- Cursor fix\n\namdkfd:\n- MES queue eviction fix\n- MQD debugfs fix\n\nUAPI:\n- Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260903174712.584320-1-alexander.deucher@amd.com\n" }, { "commit": "797b13a7de957792c1b4773aa2cc3dab4621fd9c", "tree": "e16c1fdf25ee2bf3500650b8ccb972733061a4de", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Jiri Slaby (SUSE)", "email": "jirislaby@kernel.org", "time": "Tue Sep 01 09:04:48 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 04 08:40:07 2026 +0200" }, "message": "irqdomain: Delete irq_domain_add_linear()\n\n7.3-rc1 is free of calls to irq_domain_add_linear(), so it can be finally\ndeleted.\n\nAccording to Dongliang Mu, the related paragraph in the Chinese docs is now\nobsolete. So drop it completely.\n\nSigned-off-by: Jiri Slaby (SUSE) \u003cjirislaby@kernel.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Dongliang Mu \u003cdzm91@hust.edu.cn\u003e\nReviewed-by: Yanteng Si \u003csi.yanteng@linux.dev\u003e\nLink: https://patch.msgid.link/20260901070450.255507-1-jirislaby@kernel.org\n" }, { "commit": "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e", "tree": "3e04c255271e9d134b1e97a0fb34a01cb4c728cf", "parents": [ "912edebe8501a36c6bedcef03bd238ab90a7e060" ], "author": { "name": "Yao Kai", "email": "yaokai34@huawei.com", "time": "Tue Sep 01 15:54:52 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 04 08:14:15 2026 +0200" }, "message": "futex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter\u0027s\nstack. An early wakeup can race with a PI requeue as follows:\n\n waiter requeue task\n ------ ------------\nfutex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_NONE -\u003e Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n futex_requeue_pi_wakeup_sync()\n Q_REQUEUE_PI_IN_PROGRESS -\u003e Q_REQUEUE_PI_WAIT\n requeue_pi_wake_futex\n futex_requeue_pi_complete()\n cmpxchg Q_REQUEUE_PI_WAIT -\u003e Q_REQUEUE_PI_LOCKED\n rcuwait_wait_event()\n if (atomic_read(\u0026q-\u003erequeue_state) !\u003d Q_REQUEUE_PI_WAIT)\n break /* no schedule() */\n\n /* q.pi_state-\u003eowner \u003d\u003d current */\n futex_private_hash_put()\n /* return from syscall */\n rcuwait_wake_up(\u0026q-\u003erequeue_wait)\n /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq-\u003etask before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]\n\nFixes: 07d91ef510fb1 (\"futex: Prevent requeue_pi() lock nesting issue on RT\")\nSigned-off-by: Yao Kai \u003cyaokai34@huawei.com\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260901135453.3121948-3-bigeasy@linutronix.de\n" }, { "commit": "912edebe8501a36c6bedcef03bd238ab90a7e060", "tree": "3b57858b31e3370beea78cca03372dd1a179a1a6", "parents": [ "02c6be7d675b21d81f0ba3a524346850a8c0e3bf" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Sep 01 15:54:51 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Fri Sep 04 08:14:15 2026 +0200" }, "message": "futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling\n\nThere is rt_mutex_{pre|post}_schedule() around\nrt_mutex_wait_proxy_lock() to ensure that sched_submit_work()/\nsched_update_worker() is invoked before we schedule out and block on\nrt_mutex while waiting for it become available.\n\nThe reason is that blocking on rt_mutex assigns a pi_waiter for the PI\nchain and sched_submit_work() will also assign a pi_waiter if it blocks\non lock but a this point we already have a waiter assigned.\nWe can\u0027t skip sched_submit_work() entirely because I/O relies on the\nfact that I/O queue is flushed while it blocks on a sleeping lock.\nTherefore sched_submit_work() is moved before we block on the lock.\n\nSleeping lock in this context means mutex or rw_semaphore not spinlock_t\non PREEMPT_RT. Because the mutex abstraction on PREEMPT_RT uses the same\nabstraction as the futex proxy lock, the futex code ended up using\nrt_mutex_{pre|post}_schedule(), too.\nUsing it is/ was just to keep the task_struct::sched_rt_mutex assertion\nhappy. Futex proxy lock is used only in the syscall context of a task.\nAt this point it never got any I/O that needs to be flushed and it can\u0027t\nbe a workqueue that needs to notify that it will be scheduled out.\nTherefore sched_submit_work() does nothing here.\n\nBy mistake futex_wait_requeue_pi() -\u003e rt_mutex_wait_proxy_lock() did not\nget the rt_mutex_{pre|post}_schedule() annotation. This was not noticed\nbecause in this callchain the lock is (usually) not contended and so\nrt_mutex_slowlock_block() does not schedule, triggering the assert.\n\nAdding rt_mutex_pre_schedule() here looks wrong (as noted by PeterZ)\nbecause at this point there is a pi_waiter recorded and invoking\nsched_submit_work() with a possible lock contention would be wrong.\n\nAdd rt_mutex_futex_{pre|post}_schedule() which toggles the\nsched_rt_mutex assert and does not involve sched_submit_work(). Add\nasserts here to ensure that sched_submit_work() would do nothing. Use it\nonly in futex proxy lock case which is rt_mutex_wait_proxy_lock().\nRemove it from futex_lock_pi().\n\nFixes: d14f9e930b90 (\"locking/rtmutex: Use rt_mutex specific scheduler helpers\")\nReported-by: Yao Kai \u003cyaokai34@huawei.com\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260901135453.3121948-2-bigeasy@linutronix.de\nCloses: https://lore.kernel.org/all/20260717084922.4153317-2-yaokai34@huawei.com\n" }, { "commit": "5ff6e2f8a779f72306bd93bde40c1b10436dbf58", "tree": "41daf4db7981de7e5178e8017a0b8592a917e845", "parents": [ "42bc1b92c9b98674ab4f368e1bd6fa9be479e969", "3785d40831ba5601296283e0197e10e089392757" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 15:58:06 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 04 15:58:07 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-09-03\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc2:\n- Drop an accidentally duplicated panel fitter call in DP MST\n- Fix DDI clock programming for Cx0 and LT PHY\n- Fix PTL CDCLK handling at probe, causing a glitch\n- Fix dg2_power_well_count() return type\n- Fix a NULL pointer deref at forced probe\n- Fix selective fetch disable\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/affe11af9d5eb9dc6f906441495cb843f9d4817c@intel.com\n" } ], "next": "254c881fe0554c5efb16d355c273702a27a32a20" }