)]}' { "log": [ { "commit": "743a94f58872c26fe63019bbc4cd3ed6be218903", "tree": "5100c82302b8712d748ee8d249f61c745f4e20dd", "parents": [ "7475ea8b58616b33c04afb976cf0fbaad9dd63fb" ], "author": { "name": "xujiahao", "email": "xujiahao@cmss.chinamobile.com", "time": "Mon Nov 09 09:39:52 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Nov 09 14:39:39 2026 +0100" }, "message": "udf: reject extents past EOF when extending a file\n\nudf_extend_file() warns when inode_bmap() reports the last extent as\nlonger than the block the file is being extended in:\n\n\tWARN_ON_ONCE(within_last_ext \u0026\u0026\n\t\t elen \u003e ((loff_t)offset + 1) \u003c\u003c inode-\u003ei_blkbits);\n\nA corrupted image can trigger this, as syzbot reports for\nudf_setsize():\n\n WARNING: CPU: 1 PID: 6098 at fs/udf/inode.c:684 udf_extend_file fs/udf/inode.c:683 [inline]\n WARNING: CPU: 1 PID: 6098 at fs/udf/inode.c:684 udf_setsize+0xd5a/0x1010 fs/udf/inode.c:1300\n\nThe extent really is invalid, so there is nothing to warn about: report\nit with udf_err() and fail the truncate with -EFSCORRUPTED instead of\ntainting the kernel.\n\nReported-by: syzbot+db6df8c0f578bc11e50e@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003ddb6df8c0f578bc11e50e\nFixes: 16d055656814 (\"udf: Discard preallocation before extending file with a hole\")\nSigned-off-by: xujiahao \u003cxujiahao@cmss.chinamobile.com\u003e\nLink: https://patch.msgid.link/20261109013952.449019-1-xujiahao@cmss.chinamobile.com\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "7475ea8b58616b33c04afb976cf0fbaad9dd63fb", "tree": "cccce5fea5fe43ed1a45832ff28f5d74468369dc", "parents": [ "e0d8e8de8bcb1ef7b749033b5af5518ba8df7bec" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 16:22:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 16:22:20 2026 -0800" }, "message": "Linux 7.4-rc2\n" }, { "commit": "e0d8e8de8bcb1ef7b749033b5af5518ba8df7bec", "tree": "28b34217252fea6ee2d86bbbc3b7b6002d69ed76", "parents": [ "8a65162514fbad21a2c58ffed65f42b27e92b163", "4dd10fbbeb9c33709edc89916e19c03c780a0751" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 14:55:54 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 14:55:54 2026 -0800" }, "message": "Merge tag \u0027devm_kmalloc_obj-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull devm_kmalloc_obj conversion from Kees Cook:\n\n - treewide refresh of kmalloc_obj() conversions\n\n - devm_kmalloc_obj conversion rules added to Coccinelle scripting\n\n - treewide conversion of devm_kmalloc() family to devm_kmalloc_obj()\n\n* tag \u0027devm_kmalloc_obj-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family\n coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules\n treewide: refresh kmalloc_obj() conversions\n" }, { "commit": "8a65162514fbad21a2c58ffed65f42b27e92b163", "tree": "fa9166d182d4082ba801d3e4a80b68240fa313d4", "parents": [ "e6f836ef7865fb454641febe080cf88a3c677186", "a42ae51fe3c36cef82dc687ea594ca232a785fd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 12:14:14 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 12:14:14 2026 -0800" }, "message": "Merge tag \u0027driver-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Fix an unused-function warning in the Rust I/O code that breaks\n builds with CONFIG_PCI disabled and CONFIG_WERROR enabled\n\n - Fix kernfs sparse warnings on SMP Alpha when inheriting a parent\n node\u0027s group ID\n\n - Add Johan Hovold as an auxiliary bus maintainer\n\n* tag \u0027driver-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n MAINTAINERS: update auxiliary bus entry\n kernfs: avoid READ_ONCE() on a kgid_t in kernfs_new_node()\n rust: io: fix unused Flags::from_raw warning without CONFIG_PCI\n" }, { "commit": "e6f836ef7865fb454641febe080cf88a3c677186", "tree": "3cf764e0f059fff6c509534478df4935725b8329", "parents": [ "25fccf436e6e978954bb2774170d1094889c3fc7", "a4845f077415ef32fe672c841e2fc58ae9e28273" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:59:25 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:59:25 2026 -0800" }, "message": "Merge tag \u0027ata-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Allow re-enabling NCQ, after EH disabled it, by writing the current\n queue depth to the queue_depth sysfs attribute (Igor)\n\n - Retry failed non-NCQ commands when their sense data asks for a\n retry, as is already done for NCQ commands. Previously, such\n non-NCQ commands were never retried (me)\n\n - Only check the power mode of ATA and ZAC devices before putting\n them in standby mode (on suspend, shutdown or device removal).\n libata never puts other devices, such as ATAPI devices, in standby\n mode, and some ATAPI devices reject the CHECK POWER MODE command\n (Giuseppe)\n\n - Fix several bugs in the MODE SELECT translation.\n\n Reject parameter lists with data after the mode page before the\n mode page is handled. Previously, a rejected command could leave\n the CDL enabled state tracked by libata out of sync with the\n device, and data after the control mode page was silently ignored.\n\n Reject mode pages with SUBPAGE CODE FFh, and mode pages with the\n SPF bit set but SUBPAGE CODE 00h, which were incorrectly accepted.\n\n The commit that passes the whole mode page to the MODE SELECT\n handlers might look like a cleanup, but it is a fix, and thus has\n a Fixes tag: the FIELD POINTER pointed 2 bytes (page_0 format) or\n 4 bytes (sub_page format) before the invalid byte in the mode page\n (me, Shao)\n\n - Disable the enclosure management (SEMB) port of the Marvell\n 88SM9705 port multiplier. The port never answers SRST, and the\n resulting EH retries delayed disk discovery by minutes (Marco)\n\n - Reject data-in commands, e.g. INQUIRY, submitted via SG_IO with a\n data-out buffer, whose pages may be pinned without write access.\n Writing a reply to such a buffer could oops the kernel (Zhao)\n\n* tag \u0027ata-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: reject data-in commands with a data-out buffer\n ata: libata-pmp: disable the SEMB port on Marvell 88SM9705\n ata: libata-scsi: set the field pointer when rejecting CDL\n ata: libata-scsi: pass the whole mode page to the MODE SELECT handlers\n ata: libata-scsi: fix MODE SELECT field pointer for block descriptor length\n ata: libata-scsi: fix MODE SELECT field pointer for unsupported subpages\n ata: libata-scsi: reject MODE SELECT mode pages with a wrong SPF bit\n ata: libata-scsi: do not accept subpage code FFh in MODE SELECT\n ata: libata-scsi: fix MODE SELECT handling of data after the mode page\n ata: libata-core: Check device support before querying power state\n ata: libata-eh: Retry non-NCQ commands when their sense data asks for it\n ata: libata-sata: allow re-enabling NCQ with the same queue_depth\n" }, { "commit": "25fccf436e6e978954bb2774170d1094889c3fc7", "tree": "5812f716ff395b99a7de2a7de803a1e61f2a4248", "parents": [ "2651f6deb3326129a052897df193052dc28ea94f", "4acd5f806bf5569bfa3a45ea6a525936197df10c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:54:44 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:54:44 2026 -0800" }, "message": "Merge tag \u0027firewire-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a race in the 1394 OHCI driver, introduced in v7.4-rc1\n\n Queueing an AT local request in interrupt context can race with\n dequeueing requests in a workqueue without disabling interrupts,\n potentially leading to a deadlock\"\n\n* tag \u0027firewire-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: ohci: avoid potential deadlock when queueing AT local requests\n" }, { "commit": "2651f6deb3326129a052897df193052dc28ea94f", "tree": "151cf554fd60fb513c3cc9de634bca9fdb2dbbb7", "parents": [ "11b6438b9e9f30e2eead2f232a58ef3f71a206be", "456c965ca46c59a4a241c755e6565fd883a522f4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:36:45 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 11:36:45 2026 -0800" }, "message": "Merge tag \u0027mips-fixes_7.4_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux\n\nPull MIPS fixes from Thomas Bogendoerfer:\n \"Alchemy:\n - Fix /proc/interrups\n - Preserve ethernet address from PROM\n\n SGI:\n - IP27: Fix NMI dump\n - IP30: make defconfig more useful\n - IP32: added workarounds for crime revision 1.1\n\n Others:\n - Fix compressed kernel linked with ld.lld\n - Fix IDE ports on Cobalt devices\n - Reject wrong affinity settings on SB1250 platforms\"\n\n* tag \u0027mips-fixes_7.4_1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:\n MIPS: SB1250: Validate and update IRQ affinity\n MIPS: Cobalt: Include legacy IDE ports in the PCI I/O window\n MIPS: sgi-ip32: Report the real CRIME revision\n MIPS: sgi-ip32: Leave MACE PCI control alone in config accesses\n MIPS: sgi-ip32: Mask MACE PCI interrupts in CRIME only\n MIPS: mm: Fix the cache error vector jump for XKPHYS kernels\n MIPS: Alchemy: Save the Ethernet address before reusing PROM memory\n MIPS: Alchemy: Register interrupt chips with the IRQ core\n MIPS: SGI-IP30: fix the defconfig defaults for the Bridge PROM and RTC\n MIPS: boot: compressed: fix the vmlinuz link with ld.lld\n MIPS: boot: compressed: place .rodata.* and discard .MIPS.abiflags\n MIPS: Avoid dead code/data elimination when using recordmcount\n MIPS: SGI-IP27: print the NMI dump on an nbcon console\n" }, { "commit": "11b6438b9e9f30e2eead2f232a58ef3f71a206be", "tree": "1b02298ca39941ae69468b300e884fe10637a598", "parents": [ "2ebb9de23bbd942b1a2431384e4a62908c31bb2a", "5cdc3746fa163fb4e8d05fa3cabf46bc6aa7df75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 10:29:22 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 10:29:22 2026 -0800" }, "message": "Merge tag \u0027x86-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Select the BHI mitigation based on the attack vector properly\n (Breno Leitao)\n\n - Fix i386-gcov build bug in csum_ipv6_magic() due to overly\n strict asm constraints that cannot be met in that build mode\n (Rosen Penev)\n\n - Fix Vmware-guest i386 high-bandwidth hypercall arguments\n under UNWINDER_GUESS \u0026 disabled frame-pointers (Zack Rusin)\n\n - Fix resctrl AMD ABMC counter ID field width (Babu Moger)\n\n - Fix restctrl pqos tool ABI breakage by reverting the\n mbm_assign_mode to default mode at boot (Babu Moger)\n\n - Initialize wall clock in get_rtc_noop() (Naman Jain)\n\n - Fix ptrace historic ABI quirk regression (Thomas Gleixner)\n\n - Add Drew Fustini as resctrl reviewer and Ben Horgan\n as fs/resctrl reviewer\n\n - Clear SEV RMPOPT when segmented RMP is disabled by firmware but\n is advertised as available (Ashish Kalra)\n\n - Set up SEV RMPOPT only on an active SNP host (Ashish Kalra)\n\n - Don\u0027t emit KCFI_REFERENCE() in modules (Ridge Lomont)\n\n - Ignore negative NMI handler durations (Breno Leitao)\n\n - Fix off-by-one error in boot-time sme_clear_pgd() (Thorsten Blum)\n\n - Fix ASID allocation bug (Chris Mason)\n\n* tag \u0027x86-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mm: Fix global ASID handed out to two processes\n x86/boot: Fix off-by-one error in sme_clear_pgd()\n MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer\n x86/nmi: Ignore negative NMI handler durations\n x86/kcfi: Don\u0027t emit KCFI_REFERENCE() in modules\n x86/sev: Set up RMPOPT only on an active SNP host\n x86/sev: Clear RMPOPT when segmented RMP is disabled by firmware\n MAINTAINERS: resctrl: Add myself as reviewer\n x86/entry: Fix ptrace regression\n x86/init: Initialize wall clock in get_rtc_noop()\n x86,fs/resctrl: Keep mbm_assign_mode in default mode at boot\n x86/resctrl: Correct ABMC counter ID field width\n x86/vmware: Fix i386 high-bandwidth hypercall arguments\n x86/csum: Relax the len and proto constraints in 32-bit csum_ipv6_magic()\n x86/bugs: Select the BHI mitigation based on the attack vector properly\n" }, { "commit": "2ebb9de23bbd942b1a2431384e4a62908c31bb2a", "tree": "800945c1c5fe53e94828ccfa72af1c9bbfb15b8e", "parents": [ "40f3717a64edff0b91686e22208312114f7e2061", "006991aa89974378ee579416dba87adc22cd60fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 09:01:08 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 09:01:08 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix this_bw on class change of a dying SCHED_DEADLINE task\n (Nickolai Zeldovich)\n\n - Account I/O waits independently of delayed dequeue\n (Christian Loehle)\n\n - Clear throttle state when leaving the fair class (Daehyeon Ko)\n\n - Fix u32 truncation of the PELT period count (Hui Su)\n\n - Fix imbalanced cluster static-key updates that can mistakenly\n disable cluster-aware scheduling (Hui Su)\n\n - Fix active load balancing logic to ignore non-fair current\n in alb_break_llc() (Kayra Cizmeci)\n\n* tag \u0027sched-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/cache: Ignore non-fair current in alb_break_llc()\n sched/topology: Balance cluster static-key updates\n sched/pelt: Fix u32 truncation of the PELT period count\n sched/fair: Clear throttle state when leaving the fair class\n sched/core: Account I/O waits independently of delayed dequeue\n sched/deadline: Fix this_bw on class change of a dying task\n" }, { "commit": "40f3717a64edff0b91686e22208312114f7e2061", "tree": "481335b0b41a185ee1b7ede583e9d09d4f090662", "parents": [ "d1829ebf4ad888f1b73afee0f1d6e41734ca328a", "6f083fbccd5f06889bc08e1182bd02c0383b9121" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:54:01 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:54:01 2026 -0800" }, "message": "Merge tag \u0027perf-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix sideband event output when only requesting attr.defer_output\n (Ian Rogers)\n\n - Clamp deferred callchain entry count to fit u16 header.size\n (Ian Rogers)\n\n - Various AMD IBS fixes (Ravi Bangoria):\n - Reset CPU0 IBS state on syscore resume\n - Fix kernel address leak via REGS_USER and REGS_INTR\n - Simplify/fix event state handling with IBS_CAPS_DIS\n\n - Revert AUX page allocation order default to be continuous (Leo Yan)\n\n - Don\u0027t send SIGTRAP after exec removed the event (Danish Khateeb)\n\n* tag \u0027perf-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Don\u0027t send SIGTRAP after exec removed the event\n Revert \"perf/aux: Allocate non-contiguous AUX pages by default\"\n perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS\n perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR\n perf/amd/ibs: Reset CPU0 IBS state on syscore resume\n perf/core: Clamp deferred callchain entry count to fit u16 header.size\n perf/core: Include perf_event_attr::defer_output in is_sb_event() check\n" }, { "commit": "d1829ebf4ad888f1b73afee0f1d6e41734ca328a", "tree": "dd009a1b110f5caf7df0b7c6aff0ade7191bafa5", "parents": [ "bef911b8064db38d32ccfed7f05ac639978180d6", "408b129aac48b574c0c9d11137a89eefba825d5d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:52:09 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:52:09 2026 -0800" }, "message": "Merge tag \u0027locking-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix lockdep message output (Zhuangzhuang Wang)\n\n - Fix OSQ memory ordering bugs, one of which can cause\n unlink queue corruption (Peter Zijlstra)\n\n* tag \u0027locking-urgent-2026-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/osq: Fix unlink queue corruption\n locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering\n locking/lockdep: Fix inverted \"on\"/\"last\" CPU label in lockdep_print_held_locks()\n" }, { "commit": "bef911b8064db38d32ccfed7f05ac639978180d6", "tree": "43a83efed692a1e9f8d2763950bd1b995b1c17ec", "parents": [ "fa4ad798f6f681031775266044ba1b0cf3c670bd", "57d916a3eb765ee0577d269bb2ac1bdf3a7a7f40" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:49:58 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 08 08:49:58 2026 -0800" }, "message": "Merge tag \u0027rust-fixes-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix build error with bindgen 0.73 in certain configs such as\n allmodconfig by deriving \u0027Zeroable\u0027 for opaque array wrappers.\n\n \u0027kernel\u0027 crate:\n\n - \u0027cpufreq\u0027 module: clean \u0027undocumented_unsafe_blocks\u0027 Clippy warning\n for Rust \u003c\u003d 1.86\"\n\n* tag \u0027rust-fixes-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: bindings: derive Zeroable for bindgen\u0027s opaque array wrappers\n rust: cpufreq: fix `undocumented_unsafe_blocks` in `PolicyCpu::from_cpu()`\n" }, { "commit": "fa4ad798f6f681031775266044ba1b0cf3c670bd", "tree": "5f20e6a3e5fbc24910a4a46ac7ba846a151fce9f", "parents": [ "7f75cd8ccd9588e969158c5dc92a8cc217663f5b", "8c66a6aa59a5df1d672d72b7cd379d897ff73200" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:52:02 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:52:02 2026 -0800" }, "message": "Merge tag \u0027for-7.4-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A btrfs fixes. The ones that could have some user noticeable impact\n are enumerated, the rest is one-liners.\n\n - fix chattr failing on files with nodatasum and compress flags\n\n - fix inode defrag status with concurrent truncation so it\u0027s not\n skipped in defrag in the future\n\n - fix merging compressed extent in fiemap output\n\n - fix deleting wrong subvolume by id if it gets renamed during the\n ioctl\n\n - error handling fixes: sysfs, quotas, fs-verity, scrub, zoned mode\"\n\n* tag \u0027for-7.4-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: zoned: fix double free of bitmaps on clone failure\n btrfs: prevent deleting the wrong subvolume by ID\n btrfs: scrub: fix race between scrub and scrub progress ioctl\n btrfs: scrub: fix race leading to use-after-free in the scrub progress ioctl\n btrfs: scrub: fix lost wakeup and hang when cancelling a scrub that is finishing\n btrfs: scrub: fix lost error return value when scrubbing raid56 parity stripe\n btrfs: fix fiemap merging compressed extents\n btrfs: fix the fsverity callback where unexpected range is verified\n btrfs: verity: propagate orphan insertion errors when enabling verity\n btrfs: sysfs: restore NOFS context on early return in btrfs_sysfs_add_block_group_type()\n btrfs: defrag: prevent inode truncated to zero from not being defragged again\n btrfs: cleanup dirty_cowonly_roots during btrfs_free_fs_roots()\n btrfs: cleanup qgroup swapped blocks at root release\n btrfs: always remove quota_root from dirty_cowonly_roots\n btrfs: unwind device add when sysfs registration fails\n btrfs: fix chattr failing on nodatasum files that have the compress flag\n" }, { "commit": "7f75cd8ccd9588e969158c5dc92a8cc217663f5b", "tree": "b0fb74033001a90c1980776cfb802de8796855a6", "parents": [ "12419f306c3ca34a38064d2b502966fa01650b49", "e49296d51ccbf2ad0ed0484db1382f1d7217bd6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:44:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:44:05 2026 -0800" }, "message": "Merge tag \u0027ksmbd-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server updates from Namjae Jeon:\n\n - Validate EA-name NUL termination to prevent out-of-bounds reads in\n debug logging. Return STATUS_EA_LIST_INCONSISTENT for malformed EA\n names in CREATE and SET_INFO requests.\n\n - Grant the owner\u0027s implicit READ_CONTROL and WRITE_DAC rights when no\n ACE names it, including MAXIMUM_ALLOWED handling, while respecting\n applicable OWNER RIGHTS ACEs.\n\n - Check group membership before granting permissions from a POSIX ACL\n group entry, preventing unintended access when a caller\u0027s UID matches\n the group\u0027s numeric GID.\n\n - Avoid reading past the DACL when logging an access denial by printing\n the requested and allowed access masks instead.\n\n - Handle unauthenticated sessions in procfs reporting without\n dereferencing a NULL session-\u003euser.\n\n - Fix credential cleanup on attribute lookup failures during durable\n handle reconnect or request replay, preventing subsequent requests\n from running with another user\u0027s credentials.\n\n - Fix read-only share handling for named stream creation, including\n AFP_AfpInfo synthesis on Time Machine shares.\n\n - Validate DELETE access for FILE_DELETE_ON_CLOSE opens, including\n MAXIMUM_ALLOWED handling, to prevent unauthorized deletion or\n delete-pending states.\n\n* tag \u0027ksmbd-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: require NUL-terminated EA names\n ksmbd: let the owner read and change the DACL when no ACE names it\n ksmbd: grant a POSIX ACL group entry only to the group\u0027s members\n ksmbd: do not read past the DACL in the access denied debug message\n ksmbd: fix NULL pointer dereference in session_user_name() and session_account_type()\n ksmbd: revert fsids on durable reconnect and replay failure\n ksmbd: enforce the read-only share flag when creating a stream\n ksmbd: require DELETE access for delete-on-close opens\n" }, { "commit": "12419f306c3ca34a38064d2b502966fa01650b49", "tree": "29a1daca56423eeb77be5a8682e7a4664c39b274", "parents": [ "a41e364995bbcfa627418a70fe913c35b7510728", "c77ab4eeeb3ed471bcc99a94673f0e0142c4b84a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:35:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 13:35:13 2026 -0800" }, "message": "Merge tag \u0027ntfs-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Don\u0027t allow compression to be enabled through system.ntfs_attrib on\n volumes with clusters larger than 4 KiB, preventing out-of-bounds\n accesses in the compressed read path.\n\n - Don\u0027t allow resident attribute values to overlap the attribute\n header, preventing malformed records from causing writes outside the\n MFT record buffer.\n\n - Fix recursive acquisition of the mapping invalidate lock when writing\n to non-resident named streams through NTFS_IOC_STREAM_WRITE.\n\n - Keep the file size unchanged when extending the initialized size\n fails, avoiding unintended truncation and page-cache removal.\n\n - Avoid integer overflow when limiting attribute reads to the attribute\n size.\n\n - Initialize the promoted index entry\u0027s child VCN before inserting it\n into the parent during an index split.\n\n - Validate index entry VCNs and return an error for negative attribute\n read positions before they reach pointer arithmetic.\n\n - Fix cleanup after ACL initialization fails in __ntfs_create(),\n avoiding an erroneous free of $MFT, unmapping an unmapped record, and\n unlocking mutexes that were never held.\n\n* tag \u0027ntfs-for-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: don\u0027t allow compression on volumes with clusters larger than 4K\n ntfs: don\u0027t allow resident values to overlap the attribute header\n ntfs: fix a self-deadlock on writes to non-resident named streams\n ntfs: keep the file size on a failed initialized-size extension\n ntfs: avoid overflow when limiting attribute read length\n ntfs: initialize VCN when inserting index entries\n ntfs: reject negative attribute read positions\n ntfs: Fix error handling in __ntfs_create()\n" }, { "commit": "a41e364995bbcfa627418a70fe913c35b7510728", "tree": "ad641ad6f60e12195aa56c58067e581839f07509", "parents": [ "c1c70a8431be6df4ada55ed4930ea9bac9baab48", "ca14cc05808f9c0115c38bec53573bf93e030435" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 12:21:33 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 12:21:33 2026 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Mostly fixes in drivers.\n\n The three core changes are moving the target reap into the main exit\n path of pseudo device allocation to fix a leak and a couple of minor\n error propagation updates in bsg.\n\n The largest driver fix is the rethreading of Buslogic to enable\n context locking that was held back from the merge window pull due to\n problems spotted by the maintainer\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store\n scsi: target: Verify the iSCSI ISID is null-terminated\n scsi: bsg: Report io_uring data copyback failures\n scsi: bsg: Report synchronous data copyback failures\n scsi: target: Validate REGISTER AND MOVE TransportID length\n scsi: mpt3sas: Register devices during SANITIZE\n scsi: libsas: Add __printf attribute to sas_ata_printk()\n scsi: target: Fix demo-mode dynamic ACL dev-entry UAF vs LUN teardown\n scsi: aha1542: Remove unneeded scsi_dma_unmap() call\n scsi: BusLogic: Prepare for enabling lock context analysis\n scsi: BusLogic: Pass the host pointer directly to several functions\n scsi: ufs: core: Change the error check sequence for auto hibern8\n scsi: core: Balance the pseudo target reap reference\n scsi: scsi_debug: Drain target cleanup before module exit\n scsi: aic79xx: Fix NULL pointer dereference in device reset\n scsi: aic7xxx: Use default settings on the SGI O2 onboard controllers\n scsi: aic7xxx: Fix REQUEST SENSE allocation length on big-endian hosts\n" }, { "commit": "c1c70a8431be6df4ada55ed4930ea9bac9baab48", "tree": "db08272b29a1ea6047adda1361fbc14a45e7a045", "parents": [ "91fd3a15265f095a9632d8f9d9732b37363ed121", "059518f775baecc9803fc97787bd0b17558f8047" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:53:43 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:53:43 2026 -0800" }, "message": "Merge tag \u0027spi-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"As well as a few driver specific fixes we have a couple of core fixes\n here.\n\n One avoids requesting interrupts until we have validated that we have\n a SPI device, avoiding triggering warnings on boot.\n\n The other avoids a request for a zero length scatterlist triggering a\n BUG_ON() in swiotlb on 64k page systems, this was due to using both\n DIV_ROUND_UP() and min() to compute lengths\"\n\n* tag \u0027spi-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: cadence-quadspi: Fix race between DMA completion and transfer start\n spi: ljca: Don\u0027t require data in write replies\n spi: acpi: only look up the IRQ of confirmed SPI devices\n spi: pic32-sqi: fail transfer when the BD ring is exhausted\n spi: fix zero-length scatterlist entries for vmalloc buffers\n spi: rtk-nor: Limit exec_op writes to one byte per operation\n spi: amd: validate FIFO usage before executing message\n" }, { "commit": "91fd3a15265f095a9632d8f9d9732b37363ed121", "tree": "a642d7f9f0b93bd5c97472229c1906a6594bda01", "parents": [ "d164c7d754f0e1f020298366ea92430e62476089", "7904338c38426d72c5f7cd9402cb9a20232a7af5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:51:34 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:51:34 2026 -0800" }, "message": "Merge tag \u0027regulator-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A small collection of mostly fairly standard driver specific fixes.\n\n The mt6363 changes are a little large but are the result of two\n independent users running into the same issues and testing each\n other\u0027s changes so given that it\u0027s only -rc1 it seemed sensible to\n take the changes as fixes\"\n\n* tag \u0027regulator-fix-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: mt6363: Fix VEMC voltage selection\n regulator: mt6363: Use 8-bit register values\n regulator: mt6363: Fix the registers of the VSRAM CPU and APU LDOs\n regulator: qcom_spmi: don\u0027t take a sleeping lock in the SAW IPI\n" }, { "commit": "d164c7d754f0e1f020298366ea92430e62476089", "tree": "7da4976758631907e4aca13b97dfb4ed89755b4b", "parents": [ "fd7e9dc9997a3e792e93f8b6795cba1de0f52726", "9c1075791172d936935ca20d7f0c1da601c4f408" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:28:55 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:28:55 2026 -0800" }, "message": "Merge tag \u0027devicetree-fixes-for-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree fixes from Rob Herring:\n \"All of these are patches that didn\u0027t get picked up for the merge\n window. They all fix new warnings because the corresponding .dts\n changes did get applied\n\n - Add Altera Agilex5 DWC3 controller and Raspberry Pi RP1 PWM\n controller bindings\n\n - Make \"peer-hub\" property optional on cypress,hx3 USB hubs\"\n\n* tag \u0027devicetree-fixes-for-7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:\n dt-bindings: usb: add Altera Agilex5 DWC3 controller\n dt-bindings: pwm: Add Raspberry Pi RP1 PWM controller\n dt-bindings: usb: cypress,hx3: make peer-hub property optional\n" }, { "commit": "fd7e9dc9997a3e792e93f8b6795cba1de0f52726", "tree": "475ac49d64aa250287fb7824adcc9d7e5c2a691f", "parents": [ "543b7d2ca09b4b08d518d668ac2fdc361f231785", "22733b6e2e1ebf75228a1e15b9fb9760a86137cc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:26:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 11:26:06 2026 -0800" }, "message": "Merge tag \u0027sound-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of (unsurprisingly high amount of) small fixes since the\n previous PR. Majority of changes are device-specific quirks and driver\n fixes, along with a few ALSA core fixes and USB-audio driver\n hardening.\n\n ALSA Core:\n - Fix page leak on WC DMA buffer allocation failure\n - Prevent O_APPEND on OSS streams to avoid UAF\n - A PCM regression fix for PulseAudio to allow hw_refine with mmap\n - Serialize DSP image loading requests in hwdep\n - Clear user-provided numid before adding a control\n - Fix dropped data bytes in UMP to MIDI 1.0 System message conversion\n\n HD-audio:\n - Fix double-free on stream page allocation failure in core\n - Stop capability walk cleanly on empty capability header\n - Fix silent output on Nvidia codecs due to shared converters\n - Restore audio registers after AE-5 LED strip transmission\n - Calibration data validation and custom address fixes for TAS2781\n - Shared boot wait and reset helpers for CS35L41\n - Cleanups and fixes for CS35L56 and AW88399\n - Add Tegra268 HDMI/DP codec ID\n - Device quirks for Acer, Alienware, ASUS, HP, Huawei, Lenovo, MSI\n\n USB-audio:\n - Hardening and bug fixes for usx2y and us122l drivers\n - Delay MIDI URB retry on -EPIPE to allow disconnect handling\n - Fix use-after-free of MIDI URBs on close in bcd2000\n - Reject undersized capture buffers in line6 driver\n - Fix URB leak on input setup failure in caiaq driver\n - Check return value of qmi_handle_init() in Qualcomm offload driver\n - Quirks for Yamaha ZG02, HIK camera, and CVT Touch Device\n\n ASoC:\n - AMD: Support more ACP7.0 projects, quirks for HP and Lenovo models\n - Intel: Dummy topology for SN624x codec, SOF BPT DMA stream fix\n - Qualcomm: Guard q6apm callbacks, fix runtime PM refcount leak\n - Rockchip: Add missing REGMAP_MMIO Kconfig dependencies\n - Meson: Request IRQ with clock enabled in axg-fifo\n - Codec fixes for cs35l41, cs_dsp, wm_adsp, wm8904, ES8389, tas2770,\n sn624x, and aw88399\n\n Misc:\n - FireWire: Fix inverted streaming speed in firewire-tascam\n - PCI: Check SCB creation failures in legacy cs46xx driver\"\n\n* tag \u0027sound-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (72 commits)\n ALSA: hda/realtek: Add quirk for Acer Predator PHN16-71\n ALSA: hda/realtek: Use inverted mute LED quirk for HP ZBook 8 G2a\n ALSA: hda: cs35l41: Add support for HP OmniBook 7 Laptop 16-ay0xxx\n ALSA: usx2y: Guard the playback copy\n ALSA: usx2y: Require a buffer of two URBs\n ALSA: hda: cs35l56: Stop cs_dsp before calling cs_dsp_power_down()\n ALSA: doc: cs35l56: Update calibration write failure message info\n ALSA: hda: cs35l56: Fix mixed cleanup and goto in cs35l56_hda_fw_load()\n ALSA: hda/tegra: Add Tegra268 HDMI/DP codec ID\n ALSA: hda/realtek: Fix pop noise on ASUS PRIME B650M-K\n ALSA: hda/realtek: Fix DAC binding for Legion Pro 7 16ARX8H variant\n ALSA: hda/realtek: Fix DAC binding for Lenovo Legion Pro 7 16ARX8H\n ALSA: caiaq: free the EP4 URB when input setup fails\n ALSA: line6: Reject capture buffers smaller than two packets\n ALSA: pcm: Allow HW_REFINE queries with mapped buffers\n ALSA: hda/ca0132: Restore AE-5 audio registers after LED strip send\n ALSA: hda/tas2781: Only accept CRC-less V1 data if all entries are valid\n ALSA: hda/realtek: Enable mute and mic-mute LEDs on HP ENVY 17-cr0xxx\n ALSA: usb-audio: Add quirk for Yamaha ZG02\n ALSA: pcm: Prevent O_APPEND open on OSS streams\n ...\n" }, { "commit": "5cdc3746fa163fb4e8d05fa3cabf46bc6aa7df75", "tree": "778707265bb10722f237267d1e6410f8f2323bae", "parents": [ "cb319926808b1cca522d2087a13205e840beb45b" ], "author": { "name": "Chris Mason", "email": "mason@kernel.org", "time": "Fri Nov 06 18:47:17 2026 -0500" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Sat Nov 07 10:35:02 2026 -0800" }, "message": "x86/mm: Fix global ASID handed out to two processes\n\nOn AMD CPUs with INVLPGB, two live processes can get the same MAX_ASID_AVAILABLE\nglobal ASID value. The two then hit each other\u0027s TLB entries, so each can read\nor corrupt the other\u0027s memory.\n\nThe global ASID space is managed lazily. When a global ASID is freed, its bit is\nset in the global_asid_freed bitmap. Once the free ASID search reaches the end\nof the global_asid_used bitmap, a global flush is done to really reclaim the\nlazily freed global ASIDs.\n\nHowever, the current code can assign the same global ASID to two different\nprocesses, if one process is assigned MAX_ASID_AVAILABLE - 1, another process\nMAX_ASID_AVAILABLE, and both stick around (keeping their global ASID numbers in\nuse) until the search wraps around again. At that point a third process could\nalso get assigned MAX_ASID_AVAILABLE.\n\n the highest ASID stays in use, so it is not handed out again\n last_global_asid stays below it, so no reset\n the clear bits run out\n find_next_zero_bit() returns MAX_ASID_AVAILABLE\n global_asid_available \u003e 0, so the failure is not caught\n MAX_ASID_AVAILABLE is handed out as an ASID\n\nA search only looks at the bits below MAX_ASID_AVAILABLE, so it cannot see that\nthis value is in use. The next failed search hands it out again, even if the\nfirst process still holds it.\n\nThe fix used here is to reset the global ASID space after a failed search, and\nto search again. If that search fails too, no global ASID is handed out.\n\nThe test for !global_asid_available is removed, because use_global_asid() only\ncalls allocate_global_asid() if global_asid_available \u003e 0. The remaining test is\nfor a condition that should be impossible.\n\n [ riel: simplify code, massage changelog and comment ]\n\nFixes: d504d1247e36 (\"x86/mm: Add global ASID allocation helper functions\")\nSigned-off-by: Chris Mason \u003cmason@kernel.org\u003e\nSigned-off-by: Rik van Riel \u003criel@surriel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nReviewed-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: \u003cstable@kernel.org\u003e\n" }, { "commit": "543b7d2ca09b4b08d518d668ac2fdc361f231785", "tree": "cb725d1b6a2b9f60045e14d28e0de09569d5631a", "parents": [ "d48723711bae9b8cdc56719c448ba42fef28cbee", "19e67d977d3d4d0c54f03906ef578578190db9e1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 10:20:51 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 07 10:20:51 2026 -0800" }, "message": "Merge tag \u0027drm-fixes-2026-11-07\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"This is the weekly drm fixes, amdgpu leading the way with some i915,\n nouveau and other fixes.\n\n There should be a bunch of xe fixes, but their tree got screwed up so\n I guess I\u0027ll send those next week once they cleanup whatever happened.\n\n atomic:\n - Fix CRTC dma-fence handling\n\n drm:\n - Add parsing for additional HDMI 2.2 FRL rates\n\n bridge:\n - nwl-dsi: Fix LCDIF handling\n\n dma-buf:\n - Fix IOVA offset\n - Restore the scatter-list entry count before freeing\n\n dp:\n - Keep MOT set between messages when no_zero_sized is set\n\n panel:\n - visionox-r66451: Set brightness MSB first; Increase reset waiting time\n\n panic:\n - Fix display loop\n - Fix line parsing\n\n sched:\n - Fix out of bounds entity priority check\n - Adjust run-queue when changing priority at runtime\n\n amdgpu:\n - UALink fixes\n - RAS fixes\n - GEM_OP fix\n - Parse IB fixes\n - CS user fence fix\n - GPU reset fixes\n - Multi-media idle work handler cleanup fixes\n - UserQ fixes\n - CRC fix\n - SR-IOV fixes\n - IP discovery fix\n - HDMI 2.2 FRL fixes\n - DDC pin fix\n - HUBP fix\n - SPM fix\n - DCN 3.2 fixes\n - VRR/freesync fix\n - Seamless boot fix\n - SMU 13.0.7 fix\n - Backlight fix\n - dma-buf fixes\n - GPUVM fixes\n - Move DMCUB back to VRAM\n - Non-DC audio fix\n - BACO fix\n\n amdkfd:\n - Fix WPTR BO eviction fence handling\n - GPUVM locking fix\n\n i915:\n - Fix GitLab #8991 where tiled displays (LG UltraFine 5K) broken on PTL\n - Limit NVL TRANS_VTOTAL.Vtotal skip display workaround to A-step\n - Single scaler per pipe number to 1 and disable pipe joiner on WCL\n - Add quirk to force backlight type on some TUXEDO devices\n - Fix \"CMTG: A disable timeout\" splat\n - Fix intel_vrr_dcb_vmin_vblank_start\n - Bunch of PSR fixes\n - Static checker fixes\n\n etnaviv:\n - Fix NULL dereference in etnaviv_unbind()\n - Flush the tile status cache through both the PE and BLT\n\n imagination:\n - Align rogue_fwif_hwrtdata to 64 bytes\n\n loongson:\n - Fix BO handling in several places\n\n nouveau:\n - Map Kepler video engine contexts non-privileged\n - Clear use.enabled when subdev init fails\n - Avoid running VBIOS twice\n - Fix CE channel creation on pre-Kepler GPUs\n\n v3d:\n - Initialize job timedout_batches\n - Fix cache_clean_lock\n\n vc4:\n - Move output fence and BO unreserve out of job_lock\n - Power down PYH when output is disabled\n - hdmi: Fix scrambling\"\n\n* tag \u0027drm-fixes-2026-11-07\u0027 of https://gitlab.freedesktop.org/drm/kernel: (91 commits)\n drm/sched: Adjust run-queue when changing priority at runtime\n drm/sched: Fix out of bounds entity priority check\n drm/etnaviv: Flush the tile status cache through both the PE and BLT\n drm/etnaviv: Fix NULL dereference on unbind without PPU flop reset\n drm/nouveau: Fix CE channel creation on pre-Kepler GPUs\n drm/nouveau/devinit/gf100-: try to avoid double-running vbios scripts\n drm/dp: keep MOT set between messages when no_zero_sized is set\n drm/nouveau/nvkm: clear use.enabled when subdev init fails\n drm/nouveau/fifo: map Kepler video engine contexts non-privileged\n drm/amdgpu: don\u0027t drop the gang dependency fence twice\n drm/amdgpu: stop GPU recovery wait for the JPEG/VCN idle work\n drm/amd/pm: track BACO state in the SMU v11 ArmD3 sequence\n drm/amdgpu: Only enable HDMI audio if display supports it\n Revert \"drm/amd/display: Allocate DCN32/1 dmub memory to GTT\"\n drm/amdgpu: don\u0027t walk the CS chunks when allocating them failed\n drm/amdgpu/vce: don\u0027t allocate a scheduler fence in the direct IB test\n drm/amdgpu: rewrite all PTEs of the BOs after a VM reset\n drm/amdgpu: unlock the VM and BO when attaching a KFD BO fails\n drm/amdgpu: drop the dma-buf reference when a KFD import fails\n drm/amdgpu: Clamp the ATIF backlight curve to its 99 points\n ...\n" }, { "commit": "a4845f077415ef32fe672c841e2fc58ae9e28273", "tree": "cf55bae5f04fd79bf752bf22cd6b5059fb743a2e", "parents": [ "6b67cdb463b006e57f15e3fe4ea03b00f0ac9ee5" ], "author": { "name": "Zhao Gongyi", "email": "zhaogongyi@bytedance.com", "time": "Wed Nov 04 21:06:38 2026 +0800" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 14:35:25 2026 +0100" }, "message": "ata: libata-scsi: reject data-in commands with a data-out buffer\n\nSG_IO can submit a data-in SCSI command with DMA_TO_DEVICE. The\nscatterlist can then contain pages pinned without write access.\nata_scsi_rbuf_fill() writes simulated replies to that scatterlist;\nin the reported case, the copy tried to write the shared zero page\nand faulted in the kernel.\n\nThe same mismatch can affect SG_IO commands translated by libata.\nZBC IN and GET PHYSICAL ELEMENT STATUS completion handlers can modify\nthe receive buffer even if the drive aborts the command. For ATAPI,\nthe successful INQUIRY completion also rewrites the buffer in\natapi_fixup_inquiry().\n\nReject these mismatched commands before the buffer is written or the\ncommand is issued. Report ABORTED COMMAND / DATA IN BUFFER ERROR because\nthe CDB itself can be valid; the supplied transfer direction is wrong.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nLink: https://lore.kernel.org/r/20261027090809.94126-1-zhaogongyi@bytedance.com\nSuggested-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSuggested-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Zhao Gongyi \u003czhaogongyi@bytedance.com\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261104130638.37882-1-zhaogongyi@bytedance.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "6b67cdb463b006e57f15e3fe4ea03b00f0ac9ee5", "tree": "77b72bc8942cd41940f785da9864e8d056396153", "parents": [ "7c972e73641cbe5f77f63c336de15c7a30268d49" ], "author": { "name": "Marco Ziliani", "email": "rylos78@gmail.com", "time": "Sat Nov 07 14:13:30 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 14:15:58 2026 +0100" }, "message": "ata: libata-pmp: disable the SEMB port on Marvell 88SM9705\n\nThe Marvell 88SM9705 is a 1-to-5 SATA port multiplier with one\nadditional SEMB (SATA Enclosure Management Bridge) port [1]. Ports\n0-4 are device ports and port 5 is the SEMB. The number of fan-out\nports in GSCR[2] is 6 when the SEMB is enabled and 5 when it is not,\nso on boards without the SEMB there is no link 5 and this quirk does\nnothing. That includes the common 8-port PCIe cards that pair an\n88SE9215 with an 88SM9705, which report 5 ports.\n\nThe SEMB port never answers SRST. libata probes it like a device\nport, and every EH round on the PMP ends in a retry loop that lasts\nabout a minute before EH gives up, then starts over:\n\n ata19.15: Port Multiplier 1.2, 0x1b4b:0x9705 r160, 6 ports, feat 0x1/0x1f\n ata19.05: hard resetting link\n ata19.05: failed to resume link (SControl 0)\n ata19.05: softreset failed (1st FIS failed)\n ata19.05: hard resetting link\n ...\n ata20.05: reset failed, giving up\n\nDisk discovery waits for this, including disks on other controllers.\n\nlibata.force only partly works around it. The \"disable\" horkage\nonly takes effect after IDENTIFY, which the SEMB link never reaches.\n\"norst\" on port 5 stops the retry loop, but the disks still come up\nabout a minute later than with this change (see below).\n\nTreat port 5 the same way as port 4 of the Marvell 88SM4140 and mark\nthe link ATA_LFLAG_DISABLED.\n\nTested on a Synology DX1222 expansion unit (four 88SM9705 r160 behind\na Marvell 88SE9235, passed through to a KVM guest, 6 disks), 7.4-rc1\nwith and without this change, one boot each:\n\n softreset reset failed, last disk\n failed giving up attached\n 7.4-rc1, no libata.force 60 12 197 s\n 7.4-rc1, libata.force\u003dN.05:norst 0 0 70 s\n 7.4-rc1 + this patch, no force 0 0 11 s\n\nThe problem was first found on a Synology DX1215 with the same chain,\nwhere this change brought the disks up after about 20 s instead of\nabout 200 s, including a disk on a separate AHCI controller.\n\nEach PMP still logs one \"failed to resume link (SControl 0)\" for port 5\nat probe time.\n\nLink: https://www.marvell.com/content/dam/marvell/en/public-collateral/storage/marvell-storage-88sm9705-functional-specifications-2015-06.pdf [1]\nCc: stable@vger.kernel.org\nTested-by: Kyrylo Biryuk \u003cillofspeed@gmail.com\u003e\nSigned-off-by: Marco Ziliani \u003crylos78@gmail.com\u003e\nLink: https://lore.kernel.org/r/20261107-pmp-88sm9705-v2-1-18eed983d3db@gmail.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "7c972e73641cbe5f77f63c336de15c7a30268d49", "tree": "9edc59338113bc6b986343134352ab4cb08943cf", "parents": [ "0fdb8eef88a886751e33600d446a66c529384f11" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Tue Nov 03 21:54:56 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: set the field pointer when rejecting CDL\n\nata_mselect_control_ata_feature() rejects enabling CDL while NCQ\npriority is enabled, but unlike its other error branches it returns\nwithout setting *fp.\n\nata_scsi_mode_select_xlat() initializes fp to 0xffff and, when the\nhandler fails, adds the offset of the mode page in the parameter list\nto it, i.e. the length of the mode parameter header and of the block\ndescriptors. As fp is a u16, this wraps around, so the resulting sense\ndata reports the byte before the mode page, i.e. the last byte of the\nmode parameter header or of the block descriptors, as the FIELD\nPOINTER, instead of the byte containing the CDL_CTRL field that\nrequests enabling CDL.\n\nSet *fp to 4, i.e. to the byte containing the CDL_CTRL field, like the\nbranch rejecting an invalid CDL_CTRL value does.\n\nFixes: df60f9c64576 (\"scsi: ata: libata: Add ATA feature control sub-page translation\")\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\n[cassel: set *fp to 4, the offset of CDL_CTRL in the mode page]\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-17-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "0fdb8eef88a886751e33600d446a66c529384f11", "tree": "975173f76e61e793ffe069fb876ed30472ae7ed0", "parents": [ "a3e52dcf0fbaa1a103accef3e8861cdc250ee5d6" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:55 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: pass the whole mode page to the MODE SELECT handlers\n\nata_scsi_mode_select_xlat() strips the mode page header before calling\nthe mode page handlers, which report the position of an invalid field\nas an offset relative to the mode page data. It then converts this\noffset into an offset in the parameter list by adding the length of the\nmode parameter header and of the block descriptors, but not the length\nof the mode page header. As a result, the FIELD POINTER of the INVALID\nFIELD IN PARAMETER LIST sense data points 2 bytes (page_0 format) or 4\nbytes (sub_page format) before the byte that is actually invalid. For\nexample, changing byte 3 of the caching mode page in a MODE SELECT(10)\nparameter list without block descriptors reports byte 9 instead of\nbyte 11.\n\nPass the whole mode page, starting with its mode page header, to the\nhandlers instead, like the ata_msense_*() functions, which generate the\nwhole mode page. Offsets in buf are then the byte numbers of the mode\npage, as used in the mode page definitions of SPC, SBC and SAT, the\nhandlers can compare buf with the mode page generated by the matching\nata_msense_*() function without adjusting offsets, and the conversion\ndone by ata_scsi_mode_select_xlat() becomes correct. This also allows\nreporting an invalid PAGE LENGTH at the PAGE LENGTH field, which was not\npart of buf before. As ata_scsi_mode_select_xlat() rejects SUBPAGE CODE\nFFh and mode pages with a wrong SPF bit, each handler only gets its mode\npage in a single format, so the mode page header length is known.\n\nDocument what buf, len and fp are, and the return values, in kernel-doc\ncomments for all the handlers.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-16-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "a3e52dcf0fbaa1a103accef3e8861cdc250ee5d6", "tree": "eadeddac5201ec51eba0c317600e116409021e50", "parents": [ "2a4c61cf94d48ec8560473d4fd5383583ce8809c" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:54 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT field pointer for block descriptor length\n\nata_scsi_mode_select_xlat() only accepts MODE SELECT parameter lists\nwithout block descriptors or with a single 8 byte block descriptor. For\nany other BLOCK DESCRIPTOR LENGTH, it terminates the command with\nINVALID FIELD IN PARAMETER LIST, and the FIELD POINTER should point at\nthe BLOCK DESCRIPTOR LENGTH field, i.e. at byte 3 of the mode parameter\nheader(6) or at byte 6 of the mode parameter header(10), as SPC requires\nthe FIELD POINTER of a multiple-byte field to point at its first byte.\n\nHowever, the mode parameter header length and the BLOCK DESCRIPTOR\nLENGTH are added to the offset of the field, so the FIELD POINTER points\n3 or 6 bytes after the end of the block descriptors instead. For\nexample, a MODE SELECT(10) with a BLOCK DESCRIPTOR LENGTH of 16 reports\nbyte 30 instead of byte 6.\n\nDo not add the mode parameter header length and the BLOCK DESCRIPTOR\nLENGTH to the offset of the BLOCK DESCRIPTOR LENGTH field.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-15-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "2a4c61cf94d48ec8560473d4fd5383583ce8809c", "tree": "e62095243025586c98204895c5123ac8542e5c03", "parents": [ "a1eb72c477ec1320c540f27ce1e2f717d4518e62" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:53 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT field pointer for unsupported subpages\n\nWhen the mode page of a MODE SELECT parameter list has an unsupported\nSUBPAGE CODE, ata_scsi_mode_select_xlat() sets the FIELD POINTER of the\nINVALID FIELD IN PARAMETER LIST sense data to the SUBPAGE CODE byte of\nthe mode page header (byte 1 of the page) if the SPF bit is set, and to\nthe PAGE CODE byte (byte 0 of the page) otherwise.\n\nHowever, the SPF bit is tested on p[0] after p has already been advanced\npast the mode page header, so the test reads bit 6 of the first byte of\nthe mode page data instead. If the parameter list ends with the mode\npage header, it even reads the byte that follows the parameter list in\nbuffer, which is not initialized when no data beyond the parameter list\nwas transferred.\n\nThe test is not needed anyway: spg can only be non-zero for a mode page\nin sub_page format, i.e. with the SPF bit set, and the field in error is\nthe SUBPAGE CODE. Always set the FIELD POINTER to the SUBPAGE CODE byte,\nwhich follows the mode parameter header, the block descriptors and the\nPAGE CODE byte.\n\nFixes: 7780081c1f04 (\"libata-scsi: Set information sense field for invalid parameter\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-14-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "a1eb72c477ec1320c540f27ce1e2f717d4518e62", "tree": "de4b7b90c2e8fae3d9f39a2856a8c92c7d418198", "parents": [ "b29c40dc150b0b4218c4d6844770892eb6b2f6b5" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:52 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:34:39 2026 +0100" }, "message": "ata: libata-scsi: reject MODE SELECT mode pages with a wrong SPF bit\n\nata_scsi_mode_select_xlat() accepts the caching and control mode pages\nboth in page_0 format and in sub_page format with SUBPAGE CODE 00h.\n\nHowever, SAT-2 and later versions of SAT define the SPF bit of the\nCaching mode page and of the Control mode page as not changeable and\nset to zero (see SAT-6, 10.4.9 and 10.4.6), and SPC-7 (6.12, MODE\nSELECT(10) command) requires the device server to terminate a MODE\nSELECT command with INVALID FIELD IN PARAMETER LIST if the application\nclient sets any field that is reported as not changeable to a value\nother than its current value.\n\nReject a mode page with the SPF bit set to one and SUBPAGE CODE 00h,\nwith the FIELD POINTER set to the byte containing the SPF bit. The only\nmode page with the SPF bit set to one that remains accepted is the ATA\nFeature Control mode page (control mode page, sub-page f2h), for which\nSAT-6 (12.3.4) requires the SPF bit to be set to one. The opposite case\ndoes not need a check: a mode page in page_0 format always has subpage\ncode 00h, so it can never be the ATA Feature Control mode page.\n\nThis also allows the mode page handlers to rely on the format of their\nmode page, which a later patch will make use of.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nLink: https://lore.kernel.org/r/20261103205448.931471-13-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "b29c40dc150b0b4218c4d6844770892eb6b2f6b5", "tree": "66a71340b0e15fbe3ae20710e71ae61c29db0219", "parents": [ "6fde0444d07ec954f3d885375e0402ff2f2e5064" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:51 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:20:41 2026 +0100" }, "message": "ata: libata-scsi: do not accept subpage code FFh in MODE SELECT\n\nWhen the SUBPAGE CODE of the mode page in a MODE SELECT parameter list\nis FFh, ata_scsi_mode_select_xlat() rejects it for the control mode\npage, but accepts it for all other mode pages, i.e. for the caching\nmode page, the only other mode page that it supports.\n\nHowever, FFh is not the subpage code of an actual mode page: SPC-7\n(7.5.2) only defines it as the MODE SENSE request code for all\nsubpages. SUBPAGE CODE FFh only means \"all subpages\" in requests, i.e.\nin the MODE SENSE CDB for mode pages and in the LOG SELECT CDB for log\npages (see SPC-5, 6.8), while the SUBPAGE CODE of a mode page in a MODE\nSELECT parameter list identifies a specific mode page. Also, SAT-2 and\nlater versions of SAT define the Caching mode page with the SPF bit set\nto zero (see SAT-6, 10.4.9), i.e. without a SUBPAGE CODE field.\n\nRemove the ALL_SUB_MPAGES case, so that SUBPAGE CODE FFh is rejected\nlike any other unsupported subpage.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-12-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "6fde0444d07ec954f3d885375e0402ff2f2e5064", "tree": "7ac931795eed5b322d0543444ab394ed6f14e633", "parents": [ "ec585ac78742527f80495dd8f451dcda7e9e7f59" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Tue Nov 03 21:54:50 2026 +0100" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Sat Nov 07 13:20:41 2026 +0100" }, "message": "ata: libata-scsi: fix MODE SELECT handling of data after the mode page\n\nata_scsi_mode_select_xlat() only supports one mode page per MODE SELECT\ncommand, and rejects a parameter list with data after the mode page with\nINVALID FIELD IN PARAMETER LIST. However:\n\n- It does not set the field pointer, so the sense data reports 0xffff as\n the FIELD POINTER.\n\n- It only checks for data after the mode page after the mode page\n handler has been called. ata_mselect_control_ata_feature() has then\n already updated the CDL enabled flag of the device, even though the\n command is rejected and the CDL setting of the device is not changed.\n\n- For the control mode page, ata_mselect_control_spg0() does not need an\n ATA command, so the check is skipped, and the data after the mode page\n is silently ignored.\n\nCheck for data after the mode page before calling the mode page\nhandlers, and set the FIELD POINTER to the first byte after the mode\npage, i.e. to the first byte of the next mode page.\n\nThe reason why only one mode page per command is supported is that a\nMODE SELECT command is translated into at most one ATA command, so\nupdate the comment accordingly.\n\nFixes: 1b26d29ccd59 (\"[libata] scsi: implement MODE SELECT command\")\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nLink: https://lore.kernel.org/r/20261103205448.931471-11-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "d48723711bae9b8cdc56719c448ba42fef28cbee", "tree": "01dee483dfd26ba340ee4d3653f6c848b24fe823", "parents": [ "bdeb84ed24e543930487f03f5243bbf83aebaf31", "58c1eb84e97701c583605ba2fd553b69afba2245" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:18:19 2026 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n \"Fix SDEI (software delegated exception interface) handlers taking\n nested exceptions (looping on the KPTI trampoline vectors and\n clobbering the interrupted context\u0027s exception registers), TPIDR2_EL0\n preservation across CPU suspend, a kexec_file_load() memory leak and\n an overflow in the /dev/mem valid_mmap_phys_addr_range() check:\n\n - Fix nested exceptions taken by SDEI event handlers.\n\n With KPTI, an event interrupting user space left the trampoline\n vectors installed and any exception in the handler looped forever.\n Also save and restore ELR/SPSR/ESR/FAR around the handler since an\n event can interrupt exception entry or return where these registers\n are live\n\n - Save and restore TPIDR2_EL0 across CPU suspend.\n\n Its value is UNKNOWN after a warm reset and the task initiating\n suspend could return to user space with a corrupted value\n\n - Fix an overflow in valid_mmap_phys_addr_range() allowing /dev/mem\n to map out-of-range PFNs\n\n - Fix an elf_headers memory leak in the kexec_file segment placement\n retry loop\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: sdei: Preserve the interrupted context\u0027s exception registers\n arm64: sdei: Run the event handler on the kernel vectors\n arm64: kexec_file: Fix elf_headers memory leak in retry loop\n arm64: mm: validate /dev/mem mmap ranges without overflow\n arm64: suspend: Save and restore TPIDR2_EL0 across CPU suspend\n" }, { "commit": "bdeb84ed24e543930487f03f5243bbf83aebaf31", "tree": "701efcdca2b8f7b74e930f0435756092602cd49b", "parents": [ "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "8a7f26aa072a4e63bc3b1adfe649546709db722e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:13:41 2026 -0800" }, "message": "Merge tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux\n\nPull printk fixes from Petr Mladek:\n\n - Prevent possible use-after-free when printk kthreads\n could not be created\n\n - Fix computation of the free space when allocating a\n bigger ring buffer\n\n - Add info about the new printk mailing list for\n printk-related subsystems\n\n* tag \u0027printk-for-7.4-fixups\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:\n printk: Avoid multiple unregistration in unregister_console_locked()\n MAINTAINERS: Add new \"printk\" mailing list for PRINTK, PRINTK INDEXING, and VSPRINTF\n printk_ringbuffer: Fix space_used() when blk_lpos-\u003enext overflows\n" }, { "commit": "a7963b12ca3e764e6ad3b15d1373430eb02492ee", "tree": "b44ef3f445e404a9c72c7fd4f2cb307a84701204", "parents": [ "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "2cf4be57b301ed2d7af82e70cff5dfd96894d8de" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 13:02:02 2026 -0800" }, "message": "Merge tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"AMD IOMMU:\n\n - Move PerfOpt management into the IOMMU domain attachment paths,\n enabling it automatically for supported integrated GPUs in identity\n mode and clearing it before switching to translated or blocked\n domains\n\n - Fix a boot panic in the GPU identity-mapping quirk when a GPU has\n no upstream PCI bridge\n\n - Clear the IOMMU SNP enable flag when RMP table initialization\n fails, preventing subsequent initialization from assuming SNP setup\n succeeded\n\n - Check IVRS subtable types before parsing memory definitions,\n avoiding bogus PCI segments caused by misinterpreting IVHD entries\n under QEMU\n\n - Remove an obsolete warning on device release that incorrectly fires\n for devices required to remain attached to an identity domain\"\n\n* tag \u0027iommu-fixes-v7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n iommu/amd: remove obsolete domain pointer warning on release\n iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n iommu/amd: Enable PerfOpt automatically for integrated GPUs\n" }, { "commit": "c53d8fc9a7571b63482548a7e5284ef9f025fd3f", "tree": "5365b3daafb2c0256dee4d434d8edb412878008d", "parents": [ "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "28f7d31c2aeb350df9a0116093fade0a840fb4ce" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:36:20 2026 -0800" }, "message": "Merge tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe fixes via Keith:\n - nvme-tcp use-after-free in nvme_tcp_free_ctrl() on a failed\n connect, and the nvme-rdma counterpart of the NULL queue-\u003ectrl on\n reconnect\n - nvmet-rdma iWARP disconnect and device removal fixes\n - nvmet-tcp: ask for the TLS record type on every receive, and bound\n the connections accepted per work run so a connect flood can\u0027t\n hold up port removal; nvmet-auth keep the old keys if the new ones\n fail to decode; nvme-loop delete the controller if a reset fails\n - nvmet-auth reject incomplete DHCHAP messages, and a keep-alive\n timeout overflow\n - nvmet locking and bounds fixes for tbkas reconnects and the\n traddr/trsvcid configfs writes, don\u0027t leak stale memory in the ANA\n log page, and cache the passthru reference across queue_response\n - Wait for SRCU readers before splicing the namespace list, with a\n new list_splice_init_srcu() helper, and drop an extra grace period\n in nvmet_ns_disable()\n - Unregister when pr_register() is given a zero new key, and don\u0027t\n drop the cdev reference twice on cdev_device_add() failure\n - Quirks for the ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d\n - Various smaller fixes and cleanups\n\n - blk-mq: end the request if getting a keyslot fails, which left the\n in-flight count and zone write plug stuck, reset the queue state on\n scheduler teardown so requests don\u0027t stall in software queues, and\n fix an out-of-bounds read in blk_mq_free_rqs() after a failed\n nr_hw_queues update\n\n - Only serialize elevator switches of the same queue\n\n - dma-buf bio fixes: don\u0027t use the bvec fast path for them, and only\n fail the ones that need block layer PI\n\n - Reject GPT entries with starting_lba \u003e ending_lba\n\n - Return the soft block size for compat BLKBSZGET, report the correct\n discard alignment in sysfs, and account the flush sequence latency\n only once in iocost\n\n - virtio_blk fixes: synchronous quiesce in freeze, freeze the virtqueue\n layout at probe time, clamp max_segments to the ring size, and fix\n zone append sector reporting in batched completion\n\n - null_blk zone fixes and a cache state reset\n\n - zloop fixes\n\n - ublk DEL_DEV_ASYNC permission check, and 32-bit selftest build\n\n* tag \u0027block-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (52 commits)\n nvmet: cache passthru reference in __nvmet_req_complete()\n nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n nvmet: bound the traddr and trsvcid configfs writes\n nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n nvme: wait for SRCU readers before splicing the namespace list\n srcu: Add list_splice_init_srcu()\n nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n ublk: add missing DEL_DEV_ASYNC to unprivileged permission check\n selftests: ublk: fix the build and file offsets on 32-bit\n nvmet-rdma: disconnect a queue on device removal\n nvmet-rdma: queue the release work under the mutex\n nvmet-rdma: take a device off the list last\n nvmet-tcp: limit the connections accepted per work run\n nvmet-rdma: disconnect only established queues\n nvmet-auth: keep the old keys if the new ones fail\n nvmet-tcp: ask for the TLS record type on every receive\n ...\n" }, { "commit": "90d9e367d4dc3e4bec20c2919c1beab69a4d7431", "tree": "fa9342a4a7c5c526d740e897188f87c245712532", "parents": [ "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "cf6542493e35ab9e72ac07da10a178ac78db5a16" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 12:30:19 2026 -0800" }, "message": "Merge tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Only wait for in-flight requests on ring release if the closing task\n actually uses the ring.\n\n - SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,\n as memory.high reclaim and blkcg throttling otherwise only ran at\n thread exit, and don\u0027t set the stop bit on thread exit, which tripped\n a WARN_ON_ONCE() in the ring teardown.\n\n - Don\u0027t poll a writer for a read side hangup or for urgent data, as a\n half-closed peer or unread OOB data kept the async poll of a send\n ready on every re-arm.\n\n - Cancel all matching poll requests in one pass for CANCEL_ALL rather\n than restarting the hash walk per request.\n\n - Hold uring_lock across the put_user() for the index-alloc file\n install.\n\n - Don\u0027t arm an hrtimer and schedule for a wait whose timeout has\n already expired.\n\n - Add a feature flag for the dma-buf registered buffer support.\n\n - selftests 32-bit cast fix\n\n* tag \u0027io_uring-7.4-20261106\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: only wait for in-flight requests if the closing task uses the ring\n io_uring: add feature flag for dma-buf support\n io_uring/wait: don\u0027t sleep on an already expired timeout\n io_uring/rsrc: hold uring_lock across index-alloc put_user\n selftests/io_uring: cast optval through uintptr_t in mini_liburing.h\n io_uring/poll: don\u0027t poll a writer for urgent data\n io_uring/poll: don\u0027t poll a writer for a read side hangup\n io_uring/poll: cancel all matching requests in one pass\n io_uring/cancel: count all requests that a CANCEL_ALL cancels\n io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread\n io_uring/sqpoll: don\u0027t set IO_SQ_THREAD_SHOULD_STOP on thread exit\n" }, { "commit": "58c1eb84e97701c583605ba2fd553b69afba2245", "tree": "0a10c684cb1127d414c669333fac05129a101eaf", "parents": [ "9bf6ee7952c7ee151c30e0fffcfc61b58127c899" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:34 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:20 2026 +0000" }, "message": "arm64: sdei: Preserve the interrupted context\u0027s exception registers\n\nAn SDEI event is dispatched by firmware regardless of PSTATE.DAIF, so it\ncan interrupt the kernel where the exception registers are live:\n\n - exception entry, before kernel_entry has saved ELR_EL1/SPSR_EL1 and\n before the C handler has read ESR_EL1/FAR_EL1;\n - exception return, after kernel_exit has loaded ELR_EL1/SPSR_EL1 and\n before the ERET.\n\nAn IRQ or pseudo-NMI cannot arrive there with PSTATE.I set. Firmware\nsaves only x0-x17, PC and PSTATE around an SDEI event, so a synchronous\nexception taken by the handler overwrites the interrupted context\u0027s\nELR, SPSR, ESR and FAR. do_sdei_event() only notices that ELR changed,\nand warns.\n\nThe interrupted context then carries on with the handler\u0027s state. A\ntask interrupted on its way into the kernel can be sent SIGILL for the\nhandler\u0027s kernel data abort. A task interrupted on its way back to user\nspace ERETs to EL1, at the handler\u0027s fixup address, with user registers\nloaded.\n\nWith SDEI delivering NMI backtraces, this happens in normal operation.\nThe handler runs show_regs(), which reads through possibly-NULL pointers\nwith the _nofault() accessors. print_worker_info() faults this way for a\nkworker that is not running a work item, and a single sysrq-l warned\nonce per such kworker.\n\nSave ELR, SPSR, ESR and FAR in __sdei_handler() before\nirqentry_nmi_enter(), which can take an exception too, and restore them\nafter irqentry_nmi_exit().\n\nOnce they are restored, a nested exception is harmless if its handler is\nsafe in NMI context. That holds for EL1 data aborts on translation,\npermission and access-flag faults, which never take the mmap lock in NMI\ncontext, and for BRK. Warn once, with the syndrome, about any other\nexception class.\n\nFixes: f5df26961853 (\"arm64: kernel: Add arch-specific SDEI entry code and CPU masking\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "9bf6ee7952c7ee151c30e0fffcfc61b58127c899", "tree": "93f56b4959bb18af21fffabe91e44be8f32c2c63", "parents": [ "ac302aea3d824ccc99f29b8e499c365cb9a684a9" ], "author": { "name": "Kiryl Shutsemau (Meta)", "email": "kas@kernel.org", "time": "Thu Nov 05 12:08:33 2026 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 17:43:12 2026 +0000" }, "message": "arm64: sdei: Run the event handler on the kernel vectors\n\nWith KPTI, VBAR_EL1 holds the trampoline vectors from the return to EL0\nuntil the next exception from EL0 maps the kernel and installs the\nkernel vectors. The trampoline vectors only handle exceptions from EL0;\ntheir current-EL half is zero-filled.\n\nAn SDEI event is dispatched regardless of PSTATE.DAIF, so it lands there\nwhenever the CPU is in user space. The SDEI entry trampoline maps the\nkernel but leaves VBAR_EL1 alone. An exception taken by the handler then\nexecutes the zeros, takes an undefined instruction exception to the same\nvector, and loops there forever. The event never completes and the CPU\nis lost; RCU stall reports are the first sign of it.\n\nRAS notifications land in user space whenever a task consumes the\nerror, and NMI backtraces land wherever the CPU happens to be. The GHES\nhandler takes no exception on its own, but any exception in the handler\npath does it: a WARN, a kprobe hit, or a fault fixed up by a _nofault()\naccessor.\n\nInstall the kernel vectors in __sdei_handler() when VBAR_EL1 holds the\ntrampoline vectors, and restore it before returning to firmware. The\nswitch covers irqentry_nmi_enter() and irqentry_nmi_exit() too, as Usama\nArif pointed out: their tracepoints and context tracking WARNs can take\nan exception as well.\n\nThe IRQ-like resume into user space must still go through the\ntrampoline to map the kernel. do_sdei_event() takes the interrupted\nVBAR_EL1 and keeps basing the resume address on it.\n\nFixes: 79e9aa59dc29 (\"arm64: sdei: Add trampoline code for remapping the kernel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\n[catalin.marinas@arm.com: use raw_cpu_read() for this_cpu_vector]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "a91337fb5e8e0127c8b5be87be9f3027f95b48bc", "tree": "29a4aab100d12968f421c2373b5d6f21a6962ad1", "parents": [ "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "57d94d26ed42773d6378da45eed9de03b116e7f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:38:11 2026 -0800" }, "message": "Merge tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux\n\nPull configfs fix from Breno Leitao:\n\n - Fix the build of the configfs selftest on 32-bit architectures,\n broken since the test was added in the v7.4 merge window.\n\n The harness casts the ASSERT_NE() operands to intmax_t, so handing it\n the pointer returned by mkdtemp() triggers gcc\u0027s pointer-to-int-cast\n warning on 32-bit, and the test builds with -Werror.\n\n KernelCI\u0027s 32-bit arm kselftest builds hit this.\n\n* tag \u0027configfs-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux:\n selftests/configfs: fix the build on 32-bit architectures\n" }, { "commit": "cb319926808b1cca522d2087a13205e840beb45b", "tree": "85b520c0f06418218284b2917088f7b06f9f1738", "parents": [ "b73fdd0f49e175dd733650669193c1504d283955" ], "author": { "name": "Thorsten Blum", "email": "blum@kernel.org", "time": "Fri Sep 18 16:27:13 2026 +0200" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Nov 06 09:05:23 2026 -0800" }, "message": "x86/boot: Fix off-by-one error in sme_clear_pgd()\n\nThe mapping helpers __sme_map_range_pmd() and __sme_map_range_pte(), and\ntherefore sme_encrypt_kernel(), use exclusive end addresses and stop\nbefore vaddr reaches vaddr_end.\n\nHowever, sme_clear_pgd() treats vaddr_end as inclusive when calculating\nthe last PGD entry to clear. If vaddr_end is PGD-aligned, the first PGD\nentry outside the range is cleared too.\n\nUse vaddr_end - 1 to calculate the last PGD entry within the range.\n\nFixes: 6ebcb060713f (\"x86/mm: Add support to encrypt the kernel in-place\")\nSigned-off-by: Thorsten Blum \u003cblum@kernel.org\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nCc: \u003cstable@kernel.org\u003e\nLink: https://patch.msgid.link/20260918142714.242711-2-blum@kernel.org\n" }, { "commit": "b556f1c4dc9fa538bb3b27c0b9710e62baca692f", "tree": "92fe3a7e319d79105df14e1bc41e2cca4d3287cf", "parents": [ "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "e5801273f93eb7513850b1c38ea14d69f2de1592" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 09:00:12 2026 -0800" }, "message": "Merge tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull udf, ext2, isofs and quota fixes from Jan Kara:\n - Some disk format validation improvements for udf\n - Fix isofs handling of dates before 1900\n - Fix ext2 inadvertedly syncing buffer on every directory modification\n - Fix ext2 O_DSYNC handling for direct IO\n - A couple of smaller ext2 fixes\n - Fix tmpfs quotas for root filesystem\n - Unify my email addresses in MAINTAINERS file\n\n* tag \u0027fs_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n udf: Fix incorrect error code in udf_current_aext()\n udf: Simplify udf_table_prealloc_blocks()\n udf: don\u0027t use eloc after the end of the unallocated space table\n udf: fix preallocation discarding before an empty allocation extent\n udf: check the unallocated space table when it is loaded\n udf: don\u0027t let the extent type hide an exhausted free-space table extent\n ext2: preserve IOMAP_F_DIRTY for extending direct writes\n udf, ext2, quota, jbd2: Unify email addresses in MAINTAINERS\n isofs: handle Rock Ridge long-form dates before 1900\n ext2: only flush DIRSYNC directories on every change\n ext2: preserve completed DIO bytes when buffered fallback fails\n ext2: take invalidate_lock in ext2_write_failed()\n ext2: Make sbi an proper alias for EXT2_SB(sb) in ext2_fill_super()\n udf: Validate extended attribute space is large enough\n quota: initialize dquot cache before mounting rootfs\n udf: validate vat20-\u003elengthHeader and VAT inode size in udf_load_vat()\n" }, { "commit": "fb382e8efdd4b89b0dcd0169abd31d90b7ddd570", "tree": "600300070cc8fdfca73cba8f8d4c085b8b58b381", "parents": [ "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "581230d2ec3c0380917d1255792508851e7c4627" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:55:48 2026 -0800" }, "message": "Merge tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fixes from Jan Kara:\n \"Two small fixes for fsnotify\"\n\n* tag \u0027fsnotify_for_v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n inotify: do not coalesce rename events\n fsnotify: preserve 64-bit pre-content ranges\n" }, { "commit": "b73fdd0f49e175dd733650669193c1504d283955", "tree": "09ea669d7adfde36769379572e79dfd31dd79174", "parents": [ "ade63af6cfb7b3ca19ced28730fd6461e8d1d410" ], "author": { "name": "Reinette Chatre", "email": "reinette.chatre@intel.com", "time": "Wed Nov 04 16:37:47 2026 -0800" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Nov 06 08:53:29 2026 -0800" }, "message": "MAINTAINERS: Add Ben Horgan as fs/resctrl reviewer\n\nThe resctrl filesystem provides the user interface to the resource control\nfeatures of multiple architectures, among them Arm\u0027s MPAM. Ben Horgan,\nMPAM maintainer, has consistently helped keep MPAM\u0027s requirements in view,\nboth in discussions about new resctrl features and in review of resctrl\nchanges.\n\nAdd Ben Horgan as a reviewer so that he is copied on resctrl submissions.\n\nSigned-off-by: Reinette Chatre \u003creinette.chatre@intel.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nAcked-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nLink: https://patch.msgid.link/c68cbba4455d3f5e65c38b76b3daadc04217abca.1793838993.git.reinette.chatre@intel.com\n" }, { "commit": "0ccc72d4b3fcf8c79178b7024541e1aa694e08a7", "tree": "59a031210383c8e677ccadb2d3b402886cdec645", "parents": [ "ce8f7280865e90c02878419733b7bed420eba94b", "7ba9663607b31108b4350b604a3c85ae86c67c19" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:50:27 2026 -0800" }, "message": "Merge tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"The most notable fix here IMO is for xfs\u0027s pNFS support (mostly\n related to LAYOUTCOMMIT) and for that it contains several patches.\n\n Besides that, this contains bug fixes for different subsystems in xfs.\n The last patch is mostly a refactor than a bug fix, but the refactor\n is done to prevent a nasty journal transaction state corruption to\n happen\"\n\n* tag \u0027xfs-fixes-7.4-rc2\u0027 of git://git.kernel.org:/pub/scm/fs/xfs/xfs-linux:\n xfs: kill xfs_trans_set/clear_context() helpers\n xfs: fix recovery of partial attr removals\n xfs: make pNFS LAYOUTCOMMIT stable the way fdatasync does\n xfs: add datasync and log_flushed arguments to xfs_log_force_inode()\n xfs: take the invalidate lock while mapping a pNFS layout\n xfs: clamp the pNFS layout range to the maximum file size\n xfs: cap the block count of xfs_iomap_write_direct() at one extent\n xfs: clamp a pNFS LAYOUTCOMMIT extent before computing its end\n xfs: refuse a pNFS LAYOUTCOMMIT of a range without blocks\n xfs: add a flag to convert unwritten extents without allocating blocks\n xfs: mark the inode preallocated for pNFS write layouts past EOF\n xfs: fix wrong compat fields in xfs_ioctl32_bstat_copyin()\n xfs: fix temporary cursor leak in btree shift corruption paths\n xfs: skip iunlock with empty iolock flags in xfs_file_dio_write_aligned\n xfs: don\u0027t skip free extents of the longest length in a whole-AG FITRIM\n xfs: don\u0027t skip free extents in later batches of a whole-AG FITRIM\n xfs: fix unwind handling during xfs_mount_sysfs_init()\n xfs: mark i_mode\u003d0 and shut down on attr fork inactivation failure\n xfs: set healthmon mount cookie before publishing it\n" }, { "commit": "ce8f7280865e90c02878419733b7bed420eba94b", "tree": "24bc88d3f33422d7360389a242a210c2f1bf4bbd", "parents": [ "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "db1c5da238dc80a61ab429a7b71b0e2835766c45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:28:14 2026 -0800" }, "message": "Merge tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs\n\nPull overlayfs fixes from Amir Goldstein:\n\n - Fix a self deadlock of a fanotify permission event listener that also\n watches the layers, when it reads an overlay directory\n\n - Three casefold fixes, found by Chris Mason\u0027s AI review\n\n - Fix a decode of a modified file handle with nfs_export\u003don, which\n could read the stale lower data of a copied up file, also found by\n Chris Mason\u0027s AI review\n\n - Fix an overlay selftest after an errno change\n\n* tag \u0027ovl-fixes-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:\n selftests/fscontext_ns: expect EINVAL for overlay descendant userns create\n ovl: look up the index by the decoded origin\n ovl: inherit FMODE_NONOTIFY when reading directory layers\n ovl: inherit FMODE_NONOTIFY when opening directory realfiles\n ovl: fix whiteout creation in casefolded directories\n ovl: do not let chattr change the casefold flag\n ovl: fail the mount if the casefold flag has changed\n" }, { "commit": "ac302aea3d824ccc99f29b8e499c365cb9a684a9", "tree": "d83c1190893e2223afd4ff37f6694cc7c24b4df5", "parents": [ "b0958b1397fb5ffdb995c0ccc74349841929c08d" ], "author": { "name": "Jinjie Ruan", "email": "ruanjinjie@huawei.com", "time": "Thu Nov 05 20:57:24 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 06 16:25:34 2026 +0000" }, "message": "arm64: kexec_file: Fix elf_headers memory leak in retry loop\n\nA retry allocates new elf headers and overwrites image-\u003eelf_headers,\nleaking the previous buffer.\n\nFree it before assigning.\n\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Thomas Huth \u003cthuth@redhat.com\u003e\nCc: Breno Leitao \u003cleitao@debian.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nCc: Baoquan He \u003cbhe@redhat.com\u003e\nCc: stable@vger.kernel.org\nFixes: 108aa503657e (\"arm64: kexec_file: try more regions if loading segments fails\")\nAcked-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Jinjie Ruan \u003cruanjinjie@huawei.com\u003e\n[catalin.marinas@arm.com: drop the redundant NULL check before vfree()]\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "41b77d5dccc7809f5f56f0822e00ea55b42691a8", "tree": "4e8145baa0871f805bf3bab96f53c2f170fdf98e", "parents": [ "f66469d9905b39d2c260a15d7d6db450f4db67c1", "a02926f7c89bfc798ee9514e09694ff4279928a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 06 08:16:23 2026 -0800" }, "message": "Merge tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n \"Fix three UAF issues that can be hit in the Xen netback and blkback\n drivers when a guest is forcing a teardown of a PV device\"\n\n* tag \u0027xsa526-xsa528-7.4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen-blkback: Avoid UAF when reading I/O statistics\n xen-netback: defer xenvif_mcast_addr_list_free()\n xen-netback: Fix UAF when reading statistics data\n" }, { "commit": "a02926f7c89bfc798ee9514e09694ff4279928a1", "tree": "9e7e8cad8dc7b350aea8a69d385a7130dc8cb92d", "parents": [ "bfddc420afe827d9f06458cdf8087cd602f8c9cb" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu Nov 05 08:27:38 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-blkback: Avoid UAF when reading I/O statistics\n\nReading I/O statistics via sysfs concurrently with tearing down a\nfrontend device might result in UAF or a NULL dereference, as the\nreading of the statistics data is not synchronized with freeing the\ndata.\n\nUse a rwlock for synchronizing.\n\nThis is XSA-528 / CVE-2026-100082\n\nFixes: db6fbc106786 (\"xen/blkback: make st_ statistics per ring\")\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nAcked-by: Roger Pau Monné \u003croger@xenproject.org\u003e\n" }, { "commit": "bfddc420afe827d9f06458cdf8087cd602f8c9cb", "tree": "2e68b6d1562e5807055a26eb1a4653ec2df0648b", "parents": [ "5fb756f1bbec7a3862dda5d79028bf656271804c" ], "author": { "name": "Jan Beulich", "email": "jbeulich@suse.com", "time": "Fri Nov 06 17:07:01 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:09:08 2026 +0100" }, "message": "xen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()\u0027s error path doesn\u0027t require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081.\n\nFixes: b17075d5c198 (\"xen-netback: fix race condition on XenBus disconnect\")\nReported-by: kerhunt \u003ckerhunt@proton.me\u003e\nSigned-off-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "5fb756f1bbec7a3862dda5d79028bf656271804c", "tree": "15aedb616568e17d286e04d1a2cb8f71f5e00166", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 13:07:52 2026 +0100" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri Nov 06 17:08:55 2026 +0100" }, "message": "xen-netback: Fix UAF when reading statistics data\n\nThe network statistic data in the driver is protected by RCU.\nUnfortunately when tearing down the queues after an error during\nconnecting to the frontend (e.g. due to illegal Xenstore data filled\nin by the guest), the statistic data is being freed without\nsynchronizing the RCU state. In case the data is being read via sysfs\nin this phase, access to already freed memory or memory being in new\nuse is possible.\n\nFix that by calling synchronize_net() before freeing the queue data.\n\nThis is XSA-526 / CVE-2026-100080\n\nReported-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\n" }, { "commit": "2cf4be57b301ed2d7af82e70cff5dfd96894d8de", "tree": "840554440aef942334f2800bf8a5ebe2347e7364", "parents": [ "fa77b023eb80cdb297ff32f6b13786e483a81ca8" ], "author": { "name": "Jean-Christophe Guillain", "email": "jean-christophe@guillain.net", "time": "Thu Nov 05 16:32:19 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: Fix NULL pointer dereference for GPUs without upstream bridge\n\npci_upstream_bridge() can return NULL for devices without an upstream\nbridge. The AMD GPU identity mapping quirk dereferences the returned\npointer unconditionally, causing a kernel panic during boot.\n\nCheck the pointer before accessing the bridge vendor ID.\n\nThis fixes a boot regression on a Lenovo system with an AMD PRO\nA10-9700E APU. The system now boots with AMD IOMMU enabled.\n\nFixes: bf5bdfd1f8d4 (\"iommu/amd: Force identity mode for selected GPUs only\")\n\nSigned-off-by: Jean-Christophe Guillain \u003cjean-christophe@guillain.net\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "fa77b023eb80cdb297ff32f6b13786e483a81ca8", "tree": "b07d2c97d7d863f5faadcb7433c9e115448d286b", "parents": [ "e62df37e0eff4d670e78bbd415be2c1675883c15" ], "author": { "name": "Kevin Mitchell", "email": "kevmitch@arista.com", "time": "Thu Nov 05 16:32:18 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:44 2026 +0100" }, "message": "iommu/amd: remove obsolete domain pointer warning on release\n\nA warning is triggered in amd_iommu_release_device() on removal of a\ndevice with an IOMMU_RESV_DIRECT region. The warning is based on the\nfalse assumption that correct attachment to the release_domain will\nalways result in a NULL dev_data-\u003edomain pointer. For devices with\nIOMMU_RESV_DIRECT (and consequently dev-\u003eiommu-\u003erequire_direct), the\nrelease domain is the permanent identity_domain which sets\nitself to dev_data-\u003edomain on attach.\n\nThis behaviour was added in commit e94160488e65 (\"iommu: Generic support\nfor RMRs during device release\"). Commit c21b34762e2f (\"iommu/amd: Set\nrelease_domain to blocked_domain\") caused it to take effect for AMD\nIOMMU.\n\nRemove the warning as it is no longer strictly an error to have a non-NULL\ndomain pointer. As this leaves amd_iommu_release_device() empty, remove it.\n\nThe warning was observed for a device with direct mapped region:\n\n/sys/bus/pci/devices/0000:04:00.0/iommu_group/reserved_regions:\n\n 0x00000000fee00000 0x00000000feefffff msi\n 0x000000fd00000000 0x000000ffffffffff reserved\n 0x0000fffd00000000 0x0000ffffffffffff direct\n\nUpon hotunplug:\n\n[ 28.715475] pcieport 0000:00:03.1: pciehp: Slot(0-3): Link Down\n[ 28.715482] pcieport 0000:00:03.1: pciehp: Slot(0-3): Card not present\n[ 28.715601] ------------[ cut here ]------------\n[ 28.715603] WARNING: drivers/iommu/amd/iommu.c:2521 at amd_iommu_release_device+0x5d/0x70, CPU#4: irq/29-pciehp/99\n[ 28.715657] RIP: 0010:amd_iommu_release_device+0x5d/0x70\n[ 28.715687] Call Trace:\n[ 28.715689] \u003cTASK\u003e\n[ 28.715694] iommu_deinit_device+0x84/0x110\n[ 28.715699] __iommu_group_remove_device+0xa8/0xd0\n[ 28.715703] iommu_bus_notifier+0x48/0x70\n[ 28.715707] notifier_call_chain+0x48/0xe0\n[ 28.715712] blocking_notifier_call_chain+0x45/0x60\n[ 28.715716] bus_notify+0x3b/0x60\n[ 28.715720] device_del+0x259/0x3b0\n[ 28.715730] pci_remove_bus_device+0x85/0x100\n[ 28.715735] pciehp_unconfigure_device+0x9d/0x180\n[ 28.715743] __pciehp_disable_slot+0x47/0xe0\n[ 28.715747] pciehp_handle_presence_or_link_change+0x80/0x5e0\n[ 28.715753] pciehp_ist+0x162/0x290\n\nFixes: c21b34762e2f (\"iommu/amd: Set release_domain to blocked_domain\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kevin Mitchell \u003ckevmitch@arista.com\u003e\nReviewed-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "e62df37e0eff4d670e78bbd415be2c1675883c15", "tree": "11ced107ed00d943dd364ea60d5fe2f0dd6e772d", "parents": [ "ec91bb159dc24eefe144ef8867937f4a055dd0e2" ], "author": { "name": "Akshay Jindal", "email": "Akshay.Jindal@amd.com", "time": "Thu Nov 05 16:32:17 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions\n\ninit_memory_definitions() walks every top-level subtable including the\nIVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets\neach one as a \u0027struct ivmd_header\u0027, solely on m-\u003eflags, without first\nchecking that the subtable\u0027s type actually is one of the IVMD types\n(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).\n\n if (m-\u003eflags \u0026 (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))\n init_unity_map_range(m, table);\n\nIVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD\nflags field\u0027s HtTunEn bit. Unlike real hardware, QEMU\u0027s AMD IOMMU\nemulation sets HtTunEn unconditionally (flags\u003d0xD1 for type 0x10,\n0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified\nas a unity-map/exclusion-range IVMD entry, which subsequently results\nin the creation of a bogus pci segment. Eg:\n\n AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000\n\nFix by checking the subtable\u0027s type before treating it as IVMD.\n\nFixes: be2a022c0dd0 (\"x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices\")\nCc: stable@vger.kernel.org\nSigned-off-by: Akshay Jindal \u003cAkshay.Jindal@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "ec91bb159dc24eefe144ef8867937f4a055dd0e2", "tree": "00787bab9a3345387259654cdbf6fa0645cc3dfb", "parents": [ "b32ecac779bba6e7ac7caeae8c40db4280941634" ], "author": { "name": "Dheeraj Kumar Srivastava", "email": "dheerajkumar.srivastava@amd.com", "time": "Thu Nov 05 16:32:16 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:43 2026 +0100" }, "message": "iommu/amd: Clear amd_iommu_snp_en if snp_rmptable_init() fails\n\niommu_snp_enable() checks that the IOMMU can support SNP and sets\namd_iommu_snp_en, then calls snp_rmptable_init() to map the RMP table.\nIf that call fails, CC_ATTR_HOST_SEV_SNP is cleared but amd_iommu_snp_en\nis left set. Later IOMMU initialization uses amd_iommu_snp_en to\nconfigure the IOMMU for SNP, on the assumption that RMP setup succeeded.\n\nClear amd_iommu_snp_en along with CC_ATTR_HOST_SEV_SNP.\n\nFixes: 409f45387c93 (\"x86/sev: Fix broken SNP support with KVM module built-in\")\nSigned-off-by: Dheeraj Kumar Srivastava \u003cdheerajkumar.srivastava@amd.com\u003e\nReviewed-by: Ankit Soni \u003cAnkit.Soni@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b32ecac779bba6e7ac7caeae8c40db4280941634", "tree": "9bc62b6b19e7267d39ead4ab721ebc1d7995d5ee", "parents": [ "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4" ], "author": { "name": "Mario Limonciello (AMD)", "email": "superm1@kernel.org", "time": "Thu Nov 05 16:32:15 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Nov 06 13:22:42 2026 +0100" }, "message": "iommu/amd: Enable PerfOpt automatically for integrated GPUs\n\nPerfOpt is usable by integrated GPUs in identity mode. Enable it from\nthe IOMMU driver\u0027s domain attachment paths instead of requiring an\namdgpu policy knob and exported enable/disable interfaces.\n\nMark supported integrated GPUs as PerfOpt-eligible when selecting their\ndefault identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for\nthese identity attachments, then enable PerfOpt after installing the DTE.\nClear PerfOpt before attaching an eligible GPU to a translated or blocked\ndomain, including unmanaged domains used by VFIO. Propagate failures to\nclear bypass, but keep a completed identity attachment successful if the\noptional PerfOpt enable fails.\n\nClear inherited PerfOpt state during initialization, including when a crash\nkernel reuses device tables. Read feature support directly from hardware\nbecause cached features may not be available yet, and stop initialization\nif the initial clear fails.\n\nEach IOMMU has at most one PerfOpt-eligible GPU, so track activation with a\nboolean under the IOMMU lock. Preserve this state while clearing hardware\nat suspend and shutdown, and restore the bit on resume only where it was\nactive. Do not enable PerfOpt unconditionally during early IOMMU\ninitialization.\n\nRemove the amdgpu parameter, driver callbacks, and exported interfaces.\nTranslated attachments retain their normal device capability setup.\n\nSuggested-by: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nSigned-off-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "408b129aac48b574c0c9d11137a89eefba825d5d", "tree": "2762b3f85eaac9bc8d5391b460141b0486def8de", "parents": [ "1b9e01fcc47aff00d2fd64693c5dcd620eff5865" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Sep 15 13:51:12 2026 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:14 2026 +0100" }, "message": "locking/osq: Fix unlink queue corruption\n\nVery similar to commit 50972fe78f24 (\"locking/osq_lock: Fix osq_lock\nqueue corruption\"), make sure to order the prev-\u003enext store against\nthe next-\u003eprev store.\n\nFixes: 50972fe78f24 (\"locking/osq_lock: Fix osq_lock queue corruption\")\nSuggested-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Waiman Long \u003clongman@redhat.com\u003e\nCc: linux-kernel@vger.kernel.org\n" }, { "commit": "1b9e01fcc47aff00d2fd64693c5dcd620eff5865", "tree": "999018e40020b468e914cb7002505a6cd4c287cd", "parents": [ "aa63c0df79920f6abe1b66e1f8b6443ad2d62d0e" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Sep 15 13:09:33 2026 +0200" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:14 2026 +0100" }, "message": "locking/osq: Switch osq_wait_next()/atomic_cmpxchg() ordering\n\nThe atomic_cmpxchg() in osq_wait_next() removes the current CPU\u0027s node\nfrom the tail of the queue and puts @old_cpu back.\n\nThis is very much like an \u0027unlock\u0027, which is RELEASE, rather than\nACQUIRE.\n\nAdditionally, on success (the only case where the ordering is\neffective), this returns NULL which means both callsites will do nothing\nmore, there are no subsequent operations to order against.\n\nFurthermore, the osq_lock() caller will then return false, indicating\nfailure to acquire -- the mutex must go block. Again, not making a case\nfor ACQUIRE. Neither atomics nor locks provide ordering on failure.\n\nSince ACQUIRE makes no sense, while RELEASE makes it more symmetric with\nosq_unlock(), switch the ordering. This then makes osq_unlock()\nconsistently RELEASE.\n\nFixes: c55a6ffa6285 (\"locking/osq: Relax atomic semantics\")\nSuggested-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Waiman Long \u003clongman@redhat.com\u003e\nCc: linux-kernel@vger.kernel.org\n" }, { "commit": "aa63c0df79920f6abe1b66e1f8b6443ad2d62d0e", "tree": "59390b59c04c8368dc5cb06c0ff7f4c9100a45cc", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Zhuangzhuang Wang", "email": "3050681779@qq.com", "time": "Fri Oct 30 07:07:27 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 11:16:04 2026 +0100" }, "message": "locking/lockdep: Fix inverted \"on\"/\"last\" CPU label in lockdep_print_held_locks()\n\nCommit 051f5d223dfc (\"lockdep: Enable the printing of held locks of\nremote running tasks and print task CPU\") added the task\u0027s CPU to the\n\"locks held by\" line. As the comment above the printk() describes, a\nrunning task should be reported as \"on CPU#N\" and a task that is not\nrunning as \"last CPU#N\". The ternary has the two strings swapped, so\nthe labels are inverted.\n\nSwap the strings so the output matches the comment.\n\nFixes: 051f5d223dfc (\"lockdep: Enable the printing of held locks of remote running tasks and print task CPU\")\nSigned-off-by: Zhuangzhuang Wang \u003c3050681779@qq.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261030-lockdep-fix-cpu-label-v1-1-96875c74b15b@qq.com\n" }, { "commit": "ade63af6cfb7b3ca19ced28730fd6461e8d1d410", "tree": "f166fb5186b24359faa9e122943dd472095fb4ce", "parents": [ "fb685de78e6bf79e49854e7d149f69b125583de5" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Oct 27 03:43:51 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:48:59 2026 +0100" }, "message": "x86/nmi: Ignore negative NMI handler durations\n\nI am seeing NMI handlers in the Meta fleet reported as running for\nabout 584 years. Over 30 days, 11 AMD and Intel machines logged 637\nsuch lines, for example:\n\n AMD EPYC 9D25 (family 0x1a, model 0x11, stepping 0x0):\n [ 1650.616627] INFO: NMI handler (nmi_cpu_backtrace_handler.llvm.9643156322683129580) took too long to run: 18446744073709.551 msecs\n\n Intel Xeon Platinum 8321HC (family 0x6, model 0x55, stepping 0xb):\n [360448.230129] INFO: NMI handler (perf_event_nmi_handler) took too long to run: 18446744071018.936 msecs\n\n Intel Xeon D-2191A (family 0x6, model 0x55, stepping 0x4):\n [81787.188959] INFO: NMI handler (ghes_notify_nmi) took too long to run: 18446744073709.545 msecs\n\nnmi_handle() times each handler with two sched_clock() reads. When the\nsecond read is lower than the first, the u64 subtraction wraps, and\nnmi_check_duration() treats the result as a duration. In the three\nexamples, the clock went back by less than 1 us, by 2.7 s and by about\n6 us.\n\nThe wrapped value is also stored in action-\u003emax_duration. Every later\nreal duration is smaller, so the handler is never reported again until\nthe next boot.\n\nWhatever makes the clock read lower, a negative difference is not a\nduration, so return before it is stored or reported. A clock that steps\nforward is not covered, since that cannot be told from a real stall.\n\nA backwards clock is still worth knowing about, so print the size of\nthe step once per boot. This uses pr_warn_once() rather than WARN, as a\nstack trace says nothing about the clock and panic_on_warn machines\nshould not go down for it.\n\nFixes: 2ab00456ea8a (\"x86: Warn when NMI handlers take large amounts of time\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261027-nmi_negative-v1-1-b436a005eb8a@debian.org\n" }, { "commit": "fb685de78e6bf79e49854e7d149f69b125583de5", "tree": "9b8f01329c1893dc498eef59d3b7a56091185eb6", "parents": [ "dc2334c1752b3c5f58af74f1e7ad6769b38e1f33" ], "author": { "name": "Ridge Lomont", "email": "cyridge@proton.me", "time": "Tue Oct 27 15:29:21 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:47:57 2026 +0100" }, "message": "x86/kcfi: Don\u0027t emit KCFI_REFERENCE() in modules\n\nKCFI_REFERENCE() takes the address of a symbol so that the compiler\nemits its __kcfi_typeid_ symbol, which the SYM_TYPED_FUNC_START()\nassembly implementing it needs. It is used from arch/x86 headers for\n__clear_pages_unrolled(), copy_page(), __memset() and __memmove(), and\nall of that assembly is built into vmlinux.\n\nModules include the same headers, so with CONFIG_CFI\u003dy every module\nalso gets an __ADDRESSABLE() reference to each of these symbols in\n.discard.addressable. This serves no purpose there, and since\n__clear_pages_unrolled() is EXPORT_SYMBOL_GPL, modpost now rejects any\nGPL-incompatible module that includes \u003clinux/mm.h\u003e:\n\n ERROR: modpost: GPL-incompatible module repro.ko uses GPL-only\n symbol \u0027__clear_pages_unrolled\u0027\n\neven though the module never uses the symbol. This makes OpenZFS\nimpossible to build against CFI kernels; its configure checks fail\nin the same way and are misreported as CONFIG_DEBUG_LOCK_ALLOC.\n\nscripts/module.lds.S does not help here: modpost checks \u003cmodule\u003e.o\nbefore the final link, and even after it the discarded section only\nloses its relocations, the undefined symbols stay in .symtab, where\nthe module loader resolves them with the same license check.\n\nOnly emit the reference when building vmlinux.\n\nTested on x86_64 with clang 23.1.3 and CONFIG_CFI\u003dy, with both\nCONFIG_LTO_CLANG_FULL\u003dy (the configuration from the Fixes: commit) and\nCONFIG_LTO_CLANG_THIN\u003dy: vmlinux links without warnings and still contains\n__kcfi_typeid___clear_pages_unrolled, __kcfi_typeid_copy_page,\n__kcfi_typeid___memset and __kcfi_typeid___memmove. It boots in QEMU\nwith no CFI failures. A minimal module with MODULE_LICENSE(\"Proprietary\")\nincluding \u003clinux/mm.h\u003e fails modpost before this change and builds and\nloads after it. OpenZFS builds against a CFI kernel with this change,\nand its pool, encryption, checksum and send/recv operations run\nwithout CFI failures, in QEMU and on a desktop with CFI enforcing.\n\nFixes: 9b041a4b66b3 (\"x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols\")\nAssisted-by: LLM\nSigned-off-by: Ridge Lomont \u003ccyridge@proton.me\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://github.com/openzfs/zfs/issues/18092\nLink: https://patch.msgid.link/20261027-kcfi-reference-modules-v2-1-3a3247f15806@proton.me\n" }, { "commit": "006991aa89974378ee579416dba87adc22cd60fd", "tree": "be01ff0666a019fcdcb24724e662aaf7bdbc4b6f", "parents": [ "5ebdfe12ab96368d0339593129d4ce0bc2bd06f5" ], "author": { "name": "Kayra Cizmeci", "email": "kayracizmeci@gmail.com", "time": "Tue Oct 20 21:54:01 2026 +0300" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:10:52 2026 +0100" }, "message": "sched/cache: Ignore non-fair current in alb_break_llc()\n\nCommit d6b9afab44e23 (\"sched/cache: Fix\nchecking active load balance by only considering the CFS task\")\nstopped using task_util() for non-fair cur.\n\n__active_load_balance_cpu_stop() calls detach_one_task(), that only looks\nto cfs_tasks list. So if the rq-\u003ecurr is not fair, doing a decision\naccording to it is wrong, since we only migrate tasks that is fair.\n\nCommit f0d243a96f26 (\"sched/fair: Avoid creating misfits during\ncache-aware balancing\") passes cur to task_misfits_asym_cpu()\nwithout checking if the cur is in fair class or not. Fix this.\n\nFixes: f0d243a96f26 (\"sched/fair: Avoid creating misfits during cache-aware balancing\")\nSigned-off-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Tim Chen \u003ctim.c.chen@linux.intel.com\u003e\nLink: https://patch.msgid.link/20261020185402.57017-1-kayracizmeci@gmail.com\n" }, { "commit": "5ebdfe12ab96368d0339593129d4ce0bc2bd06f5", "tree": "8dd4d8df49917d611663ebcf99a8186dd5cd0bac", "parents": [ "a0c755e574e37fddb59edf175f27dc3877e7fe23" ], "author": { "name": "Hui Su", "email": "sh_def@163.com", "time": "Wed Oct 21 13:38:34 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:57 2026 +0100" }, "message": "sched/topology: Balance cluster static-key updates\n\nbuild_sched_domains() increments sched_cluster_active once per newly\nbuilt partition that contains an SD_CLUSTER domain.\ndetach_destroy_domains() instead tested the global static key before\ndecrementing it, so destroying a cluster-less partition could drop a\nreference owned by another partition and disable cluster-aware\nscheduling while SD_CLUSTER domains remained installed.\n\nCheck the installed domains before detaching them, only while the key is\nenabled, and decrement only when the removed partition contains an\nSD_CLUSTER domain.\n\nWith two cluster-bearing partitions installed, removing a singleton\npartition left the baseline count at 1 where 2 partitions still\ncarried SD_CLUSTER; the fixed kernel correctly reports 2. On an\nasymmetric cluster topology where the parent partition gains no\ncluster domain, the baseline count drops to 0 while a cluster\npartition remains installed; the fixed kernel keeps it at 1.\n\nFixes: 8881e1639f1f (\"sched/fair: Scan cluster before scanning LLC in wake-up path\")\nSigned-off-by: Hui Su \u003csh_def@163.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/20261021043834.1140951-1-sh_def@163.com\n" }, { "commit": "a0c755e574e37fddb59edf175f27dc3877e7fe23", "tree": "cf4ca14b75052a64ca789ba5a4c206f81b0a2e24", "parents": [ "c282051fc2cae2ea54770ebe435dbea090272c25" ], "author": { "name": "Hui Su", "email": "sh_def@163.com", "time": "Fri Oct 23 11:52:07 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:11 2026 +0100" }, "message": "sched/pelt: Fix u32 truncation of the PELT period count\n\naccumulate_sum() computes the number of elapsed PELT periods in a\nu64 but returns u32. When the count is a multiple of 2^32, it is\ntruncated to zero even though the PELT sums have been updated.\n\nThe caller interprets zero as no period boundary crossed and skips\nrecomputing the averages, leaving *_avg stale relative to *_sum.\n\nReturn the period count as u64 so the caller can test it without\ntruncation.\n\nFixes: a481db34b9be (\"sched/fair: Optimize ___update_sched_avg()\")\nSigned-off-by: Hui Su \u003csh_def@163.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/20261023025207.2967903-1-sh_def@163.com\n" }, { "commit": "c282051fc2cae2ea54770ebe435dbea090272c25", "tree": "445875f359c848d13d22dcfbfd3422f53f6b27ce", "parents": [ "0965587d00b84f0a3b0fc94930d4a5f8ff011eda" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 23 08:52:33 2026 +0900" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:04:04 2026 +0100" }, "message": "sched/fair: Clear throttle state when leaving the fair class\n\nTask-based CFS bandwidth throttling removes a task\u0027s fair sched_entity\nwhile the scheduler core still considers the task queued. p-\u003ethrottled\ncarries the fair-specific state across dequeue/enqueue operations.\n\nDEQUEUE_CLASS removes the task from cfs_rq-\u003ethrottled_limbo_list\nbut retains the bit. If the last finite CFS quota is disabled while\nthe task runs in another class, it is absent from the unthrottle walk and\nthe bit survives.\nReturning to fair while cfs_bandwidth_used() is false then performs a real\nfair enqueue with p-\u003ethrottled still set.\n\nAfter bandwidth is re-enabled, a class-change dequeue treats the\nstale bit as limbo state and skips __dequeue_task(). p-\u003ese.on_rq therefore\nremains set, and put_prev_task_fair() places the entity in the EEVDF tree\nwhile the task moves to RT. On exit, the fair picker can select the\nTASK_DEAD task. __schedule() then returns to do_task_dead(),\nwhich hits BUG().\n\nKeep p-\u003ethrottled across migrations and group moves, but clear it on\nDEQUEUE_CLASS because fair-specific state must not outlive fair-class\nmembership. A later return to fair uses the normal enqueue path. That path\nstill respects a throttled cfs_rq.\n\nA KASAN, LOCKDEP and DEBUG_LIST v7.3 kernel reproduced the do_task_dead()\nBUG in 3/3 root and 3/3 delegated uid-1000 runs with CapPrm\u003dCapEff\u003d0 and\nRLIMIT_RTPRIO\u003d1. The fix passed both matrices plus a 3/3 class-switch\ncontrol with bandwidth continuously enabled, without a scheduler warning,\nKASAN report, lockdep splat or crash.\n\nAn AI coding assistant analyzed the state mismatch and drafted the initial\nreproducer, fix candidate and this changelog. The source paths, trigger,\ncontrols and results were rechecked against the cited revisions.\n\nFixes: e1fad12dcb66 (\"sched/fair: Switch to task based throttle model\")\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Aaron Lu \u003cziqianlu@bytedance.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261022235234.150957-1-4ncienth@gmail.com\n" }, { "commit": "0965587d00b84f0a3b0fc94930d4a5f8ff011eda", "tree": "c767901fd3e5fc7adebb3987957d78b0c299cede", "parents": [ "0c93e25ef11a9dee43f6076bd1f09771dc2b167e" ], "author": { "name": "Christian Loehle", "email": "christian.loehle@arm.com", "time": "Thu Oct 15 12:37:54 2026 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:01:52 2026 +0100" }, "message": "sched/core: Account I/O waits independently of delayed dequeue\n\nStarting blkio delay accounting and incrementing rq-\u003enr_iowait in\n__block_task() ties both to removal from the runqueue. With EEVDF delayed\ndequeue, this misses the initial part of an I/O sleep, or the entire\nsleep if the task wakes before it is dequeued. Such tasks are also\nmissing from procs_blocked while their dequeue is delayed. Final dequeue\ncan run in another task\u0027s context, causing delayacct_blkio_start() to\ntimestamp the wrong task.\n\nStart both forms of accounting in try_to_block_task(), when the current\ntask commits to blocking, before delayed dequeue or proxy execution can\nretain it on the runqueue. End both when clearing is_blocked, including\nqueued wakeups and the proxy execution paths that let the current task\ncontinue. Checking is_blocked excludes wakeups that precede blocking.\n\nSave the CPU charged at the start of the wait. Delayed tasks can migrate\nwhile still queued, and proxy execution can also move blocked tasks.\nDecrement the saved CPU\u0027s counter on unblock, regardless of the task\u0027s\ncurrent placement, and remove the old dequeue-based accounting.\n\nCPU iowait continues to classify idle time using the counter on the\ncharged CPU; it does not accumulate the full per-task blocked duration.\n\nCloses: https://lore.kernel.org/r/20261014081731.1068794-1-zhanxusheng@xiaomi.com\nFixes: 152e11f6df29 (\"sched/fair: Implement delayed dequeue\")\nReported-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Christian Loehle \u003cchristian.loehle@arm.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nReviewed-by: Kayra Cizmeci \u003ckayracizmeci@gmail.com\u003e\nLink: https://patch.msgid.link/fd8578a1-e60b-4993-ab51-2b5d63abcf77@arm.com\n" }, { "commit": "0c93e25ef11a9dee43f6076bd1f09771dc2b167e", "tree": "7eff74007a78d83052bb5c6d0b9b19d815adb288", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Nickolai Zeldovich", "email": "nickolai@csail.mit.edu", "time": "Sun Oct 25 08:46:57 2026 -0400" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 10:00:50 2026 +0100" }, "message": "sched/deadline: Fix this_bw on class change of a dying task\n\nMoving a SCHED_DEADLINE task out of the class with sched_setscheduler(2)\nafter it stored TASK_DEAD in do_task_dead(), but before __schedule()\ndequeued it, subtracts its bandwidth from the runqueue\u0027s this_bw twice.\nthis_bw then stays short until reboot: __sub_rq_bw() warns about the\nunderflow or about running_bw \u003e this_bw, and GRUB reclaim for\nSCHED_FLAG_RECLAIM tasks on that CPU is miscomputed.\n\nThe class change dequeues the still queued task with DEQUEUE_SAVE, which\nremoves its bandwidth from running_bw and this_bw. switched_from_dl()\nthen calls task_non_contending(), which, if the 0-lag time has passed,\nremoves it from this_bw again because the task is TASK_DEAD. That\nremoval is meant for the dying task\u0027s own DEQUEUE_SLEEP dequeue, which\nhas removed nothing before it.\n\nDo the TASK_DEAD removal only on that dequeue path.\n\nReproduced under QEMU on x86_64 and riscv64 by moving exiting deadline\ntasks to SCHED_OTHER in a loop; with this patch there is no warning.\n\nFixes: 8fd27231c330 (\"sched/deadline: Track the \"total rq utilization\" too\")\nSigned-off-by: Nickolai Zeldovich \u003cnickolai@csail.mit.edu\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nTested-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nLink: https://patch.msgid.link/20261025124657.836229-1-nickolai@csail.mit.edu\n" }, { "commit": "6f083fbccd5f06889bc08e1182bd02c0383b9121", "tree": "04b1666020bcd4f2bc4153c0a07b457c8d1136eb", "parents": [ "526d945ad9c09d42f2482f058e1f41376681627e" ], "author": { "name": "Danish Khateeb", "email": "danishkhateeb03@gmail.com", "time": "Thu Oct 15 10:20:13 2026 -0500" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:52:11 2026 +0100" }, "message": "perf/core: Don\u0027t send SIGTRAP after exec removed the event\n\nA sigtrap event must also set remove_on_exec, so that its SIGTRAP never\nreaches a program after exec. But the signal is sent from task work,\nwhich only runs on the way back to user space. If the event overflows\nshortly before execve(), the task work can still be pending when the\ntask enters execve(), and then runs when execve() returns. By then\nperf_event_exec() has removed the event and the new program has default\nsignal handlers, so the SIGTRAP kills it.\n\nThe exec_stress test in the remove_on_exec selftest catches this and\nfails about half the time in a VM. A process that opens a sigtrap event\non itself and then calls execve() is killed by SIGTRAP in 15% to 50% of\nruns, both on an AMD machine running v7.2 and in a VM, with or without\nclose-on-exec on the event fd.\n\nCommit ffb684f2aa14 (\"perf: Fix race between perf_event_exit_task() and\nperf_pending_task()\") made perf_sigtrap() return once\nperf_event_exit_task() has set ctx-\u003etask to TASK_TOMBSTONE. Exec only\ncalls perf_event_exit_task() when the new program is not dumpable, such\nas a setuid one. An ordinary exec keeps the context and only removes the\nremove_on_exec events, so the SIGTRAP is still sent.\n\nperf_event_exit_event() sets PERF_EVENT_STATE_EXIT when exec removes the\nevent. If the event fd is close-on-exec and was the last reference to\nthe file, exec also queues the file release as task work. Task work runs\nnewest first, so perf_release() runs before the SIGTRAP work and moves\nthe event on to PERF_EVENT_STATE_DEAD. So don\u0027t send the signal when the\nevent state is PERF_EVENT_STATE_EXIT or lower, which means the event has\nbeen removed. That also covers PERF_EVENT_STATE_REVOKED, where the PMU\nis gone.\n\nFixes: 97ba62b27867 (\"perf: Add support for SIGTRAP on perf events\")\nAssisted-by: LLM\nSigned-off-by: Danish Khateeb \u003cdanishkhateeb03@gmail.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20261015152013.106040-1-danishkhateeb03@gmail.com\n" }, { "commit": "526d945ad9c09d42f2482f058e1f41376681627e", "tree": "c3909ca243e868a9445ab2986d332c1a491c3c90", "parents": [ "927f9c5cdadbc4ac6973bcd1690107fcb392612c" ], "author": { "name": "Leo Yan", "email": "leo.yan@arm.com", "time": "Sun Oct 25 16:24:06 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:50:37 2026 +0100" }, "message": "Revert \"perf/aux: Allocate non-contiguous AUX pages by default\"\n\nThis reverts commit 18049c8cff9cc89daadc4df6975f7d9069638926.\n\nThe original commit claimed that contiguous AUX pages unnecessarily\nexacerbate fragmentation for SPE, TRBE and ETR. This is not generally\nvalid: larger allocations can keep pages with the same lifetime\ntogether, while order-0 allocations can scatter them across large\nblocks and prevent free pages from coalescing [1]. The follow-up\ndiscussion [2] has not established how forcing order-0 allocations\naddresses the reported problem.\n\nTRBE and SPE write to virtually addressed buffers. The TRBE L1 TLB\nhas one entry on Neoverse V2 [3] and two on Neoverse V3 [4]. Small\nmappings increase translation pressure, and TTW stalls can contribute\nto FIFO overflow and trace loss on TRBE.\n\nLarger allocations provide contiguous, aligned chunks for PMD or\ncontiguous-PTE mappings with the proposed vmap() support [5].\nWith the proposed vmap() support already applied, the tests in [2]\nshowed that preferring larger AUX allocations reduced L2 data TLB\nrefills by 99.68% in the TRBE test and 34.74% in the SPE test.\n\nRestore the previous policy of trying higher-order allocations first.\nThe allocator already uses __GFP_NORETRY and falls back to smaller\norders, including order 0, when larger allocations fail.\n\nRemove PERF_PMU_CAP_AUX_PREFER_LARGE, since the restored default\nprovides that preference. Intel PT retains its existing allocation\nbehaviour, with no functional change.\n\n[1] https://lore.kernel.org/all/aPjrRkjiIt6HmXmT@casper.infradead.org/\n[2] https://lore.kernel.org/linux-arm-kernel/20260810-perf_aux_trace_large_granule-v1-0-03306c9339e3@arm.com/\n[3] https://documentation-service.arm.com/static/633fe1ec4c59b30b517730b8#page\u003d52\n[4] https://documentation-service.arm.com/static/67361bd2c7fc0d1f211da382#page\u003d54\n[5] https://lore.kernel.org/linux-mm/20260715120813.3609949-1-jiangwen6@xiaomi.com/\n\nSigned-off-by: Leo Yan \u003cleo.yan@arm.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: James Clark \u003cjames.clark@linaro.org\u003e\nReviewed-by: Dev Jain \u003cdev.jain@arm.com\u003e\nLink: https://patch.msgid.link/20261025-perf_revert_prefer_large_alloc-v1-1-5fb431bbd624@arm.com\n" }, { "commit": "927f9c5cdadbc4ac6973bcd1690107fcb392612c", "tree": "82dbae4480c2a45fc016de5b200c3c816440eb43", "parents": [ "b61c12527223423ab66891b2e8131da0d66537c4" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:37 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:50:21 2026 +0100" }, "message": "perf/amd/ibs: Simplify event state handling with IBS_CAPS_DIS\n\nThe IBS_{FETCH|OP}_CTL2[Dis] bit allows IBS sampling to be stopped without\na RMW of IBS_{FETCH,OP}_CTL. Systems providing this bit therefore do not\nrequire the IBS_STARTED and IBS_STOPPED states used to coordinate control\nMSR updates with late NMIs.\n\nAdd a separate stop path for these systems. Preserve the Val bit while\ndisabling the event so that a delayed NMI can be identified and consumed,\nand wait briefly for such an NMI before restarting the event.\n\nLeave the existing handling unchanged on systems without IBS_CAPS_DIS.\n\nCloses: https://lore.kernel.org/r/20261007234815.4026028-1-jmattson@google.com\nFixes: efa5700ec0da (\"perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race\")\nReported-by: Jim Mattson \u003cjmattson@google.com\u003e\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nLink: https://lore.kernel.org/r/20261007234815.4026028-1-jmattson@google.com\nLink: https://patch.msgid.link/20261026041838.941-4-ravi.bangoria@amd.com\n" }, { "commit": "b61c12527223423ab66891b2e8131da0d66537c4", "tree": "ecbc4e1cfd663ac002a9d9154e9d723d0bf0a15f", "parents": [ "2c1d35bd95b13b50b43a0cb2167305dabfb54c07" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:36 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:45:25 2026 +0100" }, "message": "perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR\n\nIBS hardware captures a sample and raises an NMI. Since the NMI can be\ndelivered with a delay, a privilege change may occur between sample\ncapture and NMI delivery. Because IBS only provides the sample RIP, the\nkernel records GPRs from the NMI pt_regs, which may reflect kernel mode\nif a privilege switch occurred in the interim. This can leak kernel\naddresses to unprivileged users through PERF_SAMPLE_REGS_USER and/or\nPERF_SAMPLE_REGS_INTR.\n\nFix this by using interrupt regs while preparing PERF_SAMPLE_REGS_USER\nand PERF_SAMPLE_REGS_INTR. With the change, when IBS samples a user mode\ninstruction but the NMI is delivered in kernel mode, PERF_SAMPLE_REGS_USER\nwill source its register state from task_pt_regs(current) and\nPERF_SAMPLE_REGS_INTR will be omitted from the data sent to userspace.\n\nIn addition to fixing the kernel address leak, this change also ensures\nGPR snapshot consistency, which resolves the DWARF unwinding issue with\nIBS.\n\nCloses: https://lore.kernel.org/r/CAPu-DQqF0aF6\u003dGS8Z6KKWeeX_V5LiXeKU_rJQZC+uGg8zuTPNw@mail.gmail.com\nFixes: d29e744c7167 (\"perf/x86: Relax privilege filter restriction on AMD IBS\")\nReported-by: Gennady Kupava \u003cgennady.kupava@gmail.com\u003e\nReported-by: Jayapal Ashwin Nair \u003cjanair@amd.com\u003e\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261026041838.941-3-ravi.bangoria@amd.com\n" }, { "commit": "2c1d35bd95b13b50b43a0cb2167305dabfb54c07", "tree": "04beb70a49f2492d9a6902e46b5584ec6b30879c", "parents": [ "5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87" ], "author": { "name": "Ravi Bangoria", "email": "ravi.bangoria@amd.com", "time": "Mon Oct 26 04:18:35 2026 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:40:55 2026 +0100" }, "message": "perf/amd/ibs: Reset CPU0 IBS state on syscore resume\n\nDuring a suspend/resume cycle, all CPUs except CPU0 go through hotplug\ncallbacks, which sets up IBS state. CPU0 bypasses this path, leaving its\nIBS state stale after resume.\n\nFix this bug by explicitly setting CPU0\u0027s IBS state in the\nsyscore -\u003eresume() callback.\n\nFixes: efa5700ec0da (\"perf/amd/ibs: Support IBS_{FETCH|OP}_CTL2[Dis] to eliminate RMW race\")\nSigned-off-by: Ravi Bangoria \u003cravi.bangoria@amd.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nLink: https://patch.msgid.link/20261026041838.941-2-ravi.bangoria@amd.com\n" }, { "commit": "5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87", "tree": "bf949e0a6e7d1d6c8fb8ba92286b14844bb9145f", "parents": [ "772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Sun Oct 25 14:55:08 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:39:43 2026 +0100" }, "message": "perf/core: Clamp deferred callchain entry count to fit u16 header.size\n\nIn perf_callchain_deferred_output(), if trace-\u003enr is large enough that\nsizeof(deferred_event-\u003eevent) + trace-\u003enr * sizeof(u64) + id_header_size\nexceeds U16_MAX, header.size wraps while the output loop still writes\nall trace-\u003enr entries into the ring buffer.\n\nClamp nr per event (accounting for event-\u003eid_header_size when\nsample_id_all is enabled) so the record never overflows u16 header.size.\n\nFixes: c69993ecdd4d (\"perf: Support deferred user unwind\")\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261025215508.1237480-2-irogers@google.com\n" }, { "commit": "772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8", "tree": "a1502666857734d93b1d1849cfc11d826b10ba70", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Ian Rogers", "email": "irogers@google.com", "time": "Sun Oct 25 14:55:07 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Nov 06 09:38:16 2026 +0100" }, "message": "perf/core: Include perf_event_attr::defer_output in is_sb_event() check\n\nEvents configured with attr.defer_output \u003d 1 receive deferred callchain\nsideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().\n\nInclude attr-\u003edefer_output in is_sb_event() so that such events are\nattached to the sideband event list even when no other sideband flags\n(such as mmap or comm) are enabled on the event.\n\nFixes: c69993ecdd4d (\"perf: Support deferred user unwind\")\nSigned-off-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://patch.msgid.link/20261025215508.1237480-1-irogers@google.com\n" }, { "commit": "4dd10fbbeb9c33709edc89916e19c03c780a0751", "tree": "9871d2e04bda459c4982438d837e3255d0857cac", "parents": [ "bcd347f31e84ecfb1e45be488b1c7c835b8feb4c" ], "author": { "name": "Kees Cook", "email": "kees+treewide@kernel.org", "time": "Wed Oct 28 23:16:33 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:50 2026 -0800" }, "message": "treewide: Convert devm_kmalloc() family to the devm_kmalloc_obj() family\n\nMirroring the earlier kmalloc_obj() conversion, convert the\ndevice-managed allocators over to the type-based API using the now\nupdated scripts/coccinelle/api/kmalloc_objs.cocci. The size is derived\nfrom the type rather than written out as a sizeof(), and the result is\na pointer to that type rather than void *, so a mismatch between the\nsize requested and the variable assigned becomes a build error instead\nof being silently accepted.\n\nThe conversions break down as:\n\n\t6713\tdevm_kzalloc_obj()\n\t1749\tdevm_kzalloc_objs()\n\t 307\tdevm_kzalloc_flex()\n\t 91\tdevm_kmalloc_objs()\n\t 82\tdevm_kmalloc_obj()\n\t 2\tdevm_kmalloc_flex()\n\nThe rules deliberately leave alone allocations sized by a string or a\nbyte-sized type, or assigned to a pointer to a byte-sized type, since\nthose are byte buffers rather than objects. Allocations sized by a\nmulti-byte integer type are only converted when they are assigned to a\npointer to that same type, and allocations of pointers to integers or of\nvoid pointers are left alone too. After this change, 528 files still\ncall devm_kmalloc(), devm_kzalloc(), devm_kcalloc(), or\ndevm_kmalloc_array().\n\nBuild tested with allmodconfig on x86_64, arm64, i386, arm, riscv, s390,\nm68k, mips, parisc, sparc, loongarch, arc, xtensa, and openrisc with GCC\n16.2.0 with no new warnings.\n\nSigned-off-by: Kees Cook \u003ckees+treewide@kernel.org\u003e\n" }, { "commit": "bcd347f31e84ecfb1e45be488b1c7c835b8feb4c", "tree": "b8cb15bc70805420800f17c8df03ebcddf87a35d", "parents": [ "0af298e62e5cff4ebf9bec47b8711177a7e2f115" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Sun Aug 09 12:41:08 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:49 2026 -0800" }, "message": "coccinelle: kmalloc_obj: Include devm_kmalloc_obj conversion rules\n\nMirroring the kmalloc -\u003e kmalloc_obj conversion rules, do the same for\ndevm_kmalloc. The device-managed allocators differ only by taking the\nmanaging \"struct device *\" as a leading argument, so capture the leading\narguments in an \"expression list\" metavariable rather than repeating\nevery pattern.\n\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\nCc: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\nCc: Nicolas Palix \u003cnicolas.palix@imag.fr\u003e\nCc: \u003ccocci@inria.fr\u003e\n" }, { "commit": "0af298e62e5cff4ebf9bec47b8711177a7e2f115", "tree": "e0582f1712814a4a71743467f2ad2ca6566165ce", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5" ], "author": { "name": "Kees Cook", "email": "kees+treewide@kernel.org", "time": "Wed Oct 28 23:08:12 2026 -0700" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Nov 05 21:55:37 2026 -0800" }, "message": "treewide: refresh kmalloc_obj() conversions\n\nRefresh the tree with run of the existing Coccinelle rules in\nscripts/coccinelle/api/kmalloc_objs.cocci, now that they also convert\narrays of multi-byte integers.\n\nThe conversions break down as:\n\n\t435\tkzalloc_objs()\n\t169\tkmalloc_objs()\n\t 52\tkvzalloc_objs()\n\t 47\tkzalloc_obj()\n\t 42\tkvmalloc_objs()\n\t 8\tkmalloc_obj()\n\t 2\tkzalloc_flex()\n\t 2\tkvmalloc_flex()\n\nand 37 existing kmalloc_obj() family calls drop a redundant GFP_KERNEL.\n\nBuild tested with allmodconfig on x86_64 with GCC 16.2.0, and, together\nwith the devm_kmalloc_obj() conversion that follows, on x86_64, arm64,\ni386, arm, riscv, s390, m68k, mips, parisc, sparc, loongarch, arc,\nxtensa, and openrisc with GCC 16.2.0 with no new warnings.\n\nSigned-off-by: Kees Cook \u003ckees+treewide@kernel.org\u003e\n" }, { "commit": "f66469d9905b39d2c260a15d7d6db450f4db67c1", "tree": "ce6e028e57b075aabbc4e0e5cf6e039455fa12a9", "parents": [ "2d2200551ccc3b9e444aecb59c4b53287e169266", "fafbc4051123d5459ea6950899cec08ed946e278" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 18:00:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 18:00:16 2026 -0800" }, "message": "Merge tag \u0027net-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Bluetooth, IPsec, WiFi and CAN.\n\n Current release - regressions:\n\n - eth: wwan: mhi_wwan_ctrl: send a DTR drop before it can be coalesced\n\n Previous releases - regressions:\n\n - core:\n - use a dedicated flag to track disabled napi instances\n - frags: limit the truesize of a reassembly queue\n - reject a negative TCP header offset in qdisc_pkt_len_segs_init()y\n\n - tcp:\n - reject unhashed sockets during established lookups\n - free ireq-\u003eipv6_opt after an RCU grace period\n\n - ipv6:\n - fix fib6 walker UAF on NLM_F_REPLACE\n - raw: fix use-after-free in rawv6_send_hdrinc()\n\n - wifi:\n - mac80211: reinstate IEEE80211_TX_CTL_AMPDU, fix ath9k stall\n - brcmfmac: map msgbuf RX packet IDs bidirectional, fix firmware\n crash loop\n\n - vsock: size receive SKBs from declared payload\n\n - xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()\n\n - bluetooth: hci_sync: copy the LE accept list under hdev-\u003elock\n\n - ptp: fix use-after-free in extts_fifo_show() reading tsevqs unlocked\n\n - can: protect the receive lists with a per-device lock\n\n - eth:\n - bnxt: don\u0027t keep MSI-X vectors added before FW reserves them\n - vxlan: stop rejecting dynamic FDB entries with a nexthop ID\n\n Previous releases - always broken:\n\n - sched: sch_qfq: prevent aggregate self-replacement\n\n - bridge: disable MRP ports before the FDB flush in del_nbp()\n\n - mptcp: do not use fast open on MP_JOIN subflows\n\n - ipv6: serialize multicast router socket ownership\n\n - bluetooth: hci_core: keep link-key filtering inside RCU\n\n - eth:\n - atl1c: drop oversized RX frames instead of panicking\n - stmmac: a bunch of XDP path fixes\n - b53: enable IGMP and MLD control packet CPU copies\"\n\n* tag \u0027net-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (170 commits)\n tcp: ipv6: free ireq-\u003eipv6_opt after an RCU grace period\n mptcp: pm: kernel: use RCU to free endpoint listeners\n tcp: initialize send sequence numbers before deferring TFO\n net: bridge: disable MRP ports before the FDB flush in del_nbp()\n net: stmmac: set XDP metadata length on the page_pool RX path\n bonding: fix missing down path on speed/duplex failure after FAIL-\u003eUP\n ip6mr: Serialize multicast router socket ownership\n bonding: 3ad: don\u0027t set BOND_LINK_FAIL on a slave that is not up\n net: ethernet: ti: am65-cpsw-nuss: Enable timestamping of unicast PTP packets\n net: count last skb of each sk_backlog pass in __release_sock()\n net: 8139cp: keep Rx masked while NAPI is scheduled\n net/smc: don\u0027t spin in smc_rx_recvmsg() while a pipe holds spliced data\n net: dsa: b53: restore the NSP IMP port 2 Gbps mode\n net: ethernet: bgmac: preserve forced 2.5 Gbps link speed\n l2tp: only return sessions of the given tunnel in l2tp_session_get()\n tipc: raise the minimum bearer MTU to fit tunnel and crypto overhead\n mptcp: do not use Fast Open on MP_JOIN subflows\n tcp: ipv6: do not read ireq-\u003epktopts from tcp_v6_send_synack()\n ipv4: Call rt_add_uncached_list() if !do_cache in ip_route_input_slow().\n ipv6: Flush rt-\u003efrom in rt6_uncached_list_flush_dev().\n ...\n" }, { "commit": "2d2200551ccc3b9e444aecb59c4b53287e169266", "tree": "ba0fdc02abf88b45affba21916f7fadbed222632", "parents": [ "eedaa7d61f1ec8ae053a9ece0d553785350ac486", "086aeca907789bd2604f16f07bfc073b19015015" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 17:32:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 17:32:20 2026 -0800" }, "message": "Merge tag \u0027platform-drivers-x86-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull platform driver fixes from Ilpo Järvinen:\n\n - arm64: asus-glymur-ec: Resolve config loop due to THERMAL symbol\n\n - uniwill-laptop: Add .hw_offloaded() to avoid leds subsystem warning\n about missing callback\n\n* tag \u0027platform-drivers-x86-v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: uniwill-laptop: Implement .hw_offloaded trigger callback\n platform: arm64: drop the vacuous THERMAL dependency from EC_ASUS_GLYMUR\n" }, { "commit": "eedaa7d61f1ec8ae053a9ece0d553785350ac486", "tree": "0dc683e608627133cbbf3910d485ee86e71058ea", "parents": [ "3e516eae690b3f24c19168cc0fe605e1c610eb21", "2433db2af8e1482a3a50b8cefaf25cf7e4a9374d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:51:29 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:51:29 2026 -0800" }, "message": "Merge tag \u0027chrome-platform-firmware-fixes-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux\n\nPull chrome platform firmware fixes from Tzung-Bi Shih:\n\n - Don\u0027t skip CBMEM entries outside of known memory resources\n\n - Fix a Coccinelle warning for error-pointer handling in coreboot-cfr\n\n* tag \u0027chrome-platform-firmware-fixes-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:\n firmware: coreboot: Fix CFR error-pointer handling warning\n firmware: coreboot: Don\u0027t skip CBMEM entries outside of known memory\n" }, { "commit": "19e67d977d3d4d0c54f03906ef578578190db9e1", "tree": "6c3084e05150479eacfd6baa155017da0a0c45e5", "parents": [ "1c3b1398f1cf7ebb00ba95b4b76ad18f3501ca7a", "6d1f901a83603a7d314e4a756b416b11d8dc7e35" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 10:38:38 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 10:43:59 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.4-2026-11-05\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.4-2026-11-05:\n\namdgpu:\n- UALink fixes\n- RAS fixes\n- GEM_OP fix\n- Parse IB fixes\n- CS user fence fix\n- GPU reset fixes\n- Multi-media idle work handler cleanup fixes\n- UserQ fixes\n- CRC fix\n- SR-IOV fixes\n- IP discovery fix\n- HDMI 2.2 FRL fixes\n- DDC pin fix\n- HUBP fix\n- SPM fix\n- DCN 3.2 fixes\n- VRR/freesync fix\n- Seamless boot fix\n- SMU 13.0.7 fix\n- Backlight fix\n- dma-buf fixes\n- GPUVM fixes\n- Move DMCUB back to VRAM\n- Non-DC audio fix\n- BACO fix\n\namdkfd:\n- Fix WPTR BO eviction fence handling\n- GPUVM locking fix\n\ndrm:\n- Add parsing for additional HDMI 2.2 FRL rates\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20261105212000.2846044-1-alexander.deucher@amd.com\n" }, { "commit": "3e516eae690b3f24c19168cc0fe605e1c610eb21", "tree": "0e43cabe52b1df9cc2abae2610c049f3875dc7c2", "parents": [ "69e2b55fc3b4fa3639b8c320374c255f046ddda5", "e395bbf3ddf1b3175fd3bddaead63a2909b33694" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:37:21 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 16:37:21 2026 -0800" }, "message": "Merge tag \u0027hwmon-for-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - acpi_power_meter: Check for 32-bit and 64-bit unknown ACPI values,\n Fix missing locking in sysfs show callbacks and resume, and Prevent\n spurious power alarm when power is unknown\n\n - aquacomputer_d5next: Avoid truncating scaled sensor readings, Check\n maxcollection when probing AQUAERO devices, and reject short status\n reports\n\n - asus_rog_ryujin: Fix pump control source on the Ryujin III, and Fix\n timeout when reading 0% duty cycle\n\n - asus_wmi_sensors: Avoid global struct mutation\n\n - chipcap2: Series of fixes addressing various bugs in the driver\n\n - coretemp: Check for NULL platform device in hotplug callbacks, Fix\n 32-bit jiffies wraparound in show_temp() hnd Set nr_cores only after\n core_data allocation succeeds\n\n - corsair-cpro: Cache fan target only after a successful command\n\n - gpd-fan: Reset both fans to automatic on duo boards, and Update the\n speed cache before dropping the PM reference\n\n - hp-wmi-sensors: Avoid global struct mutation, Fix unbounded loops in\n scale_numeric_sensor(), and Serialize alarm flag read-and-clear with\n state-\u003elock\n\n - lm75: Fix setting polarity mask for chips with 16-bit config register\n\n - lm87: Fix drvdata type confusion in vrm_show() and vrm_store()\n\n - nct6683: Fix incorrect struct cast in show_pwm() and store_pwm()\n\n - peci/dimmtemp: Fix devres leak and UAF on concurrent unbind\n\n - pmbus core: Check return value from pmbus_thermal_add_sensor(),\n Register the thermal sensors with a 0-based index, and Fix return\n value check from thermal zone registration, and release devres\n allocated memory after devm_thermal_of_zone_register error\n\n - pmbus/q54sj108a2: Add missing NULL pointer check\n\n - sht15: Stop deferred work before releasing its resources\n\n - sht4x: Convert update_interval to jiffies in pending data check\n\n - tmp108: Fix initial conversion delay and wait until ready\n\n* tag \u0027hwmon-for-v7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (41 commits)\n hwmon: (asus_rog_ryujin) Fix timeout when reading 0% duty cycle\n hwmon: (hp-wmi-sensors) Serialize alarm flag read-and-clear with state-\u003elock\n hwmon: (acpi_power_meter) Check for 32-bit and 64-bit unknown ACPI values\n hwmon: (acpi_power_meter) Prevent spurious power alarm when power is unknown\n hwmon: (acpi_power_meter) Fix missing locking in sysfs show callbacks and resume\n hwmon: (aquacomputer_d5next) Avoid truncating scaled sensor readings\n hwmon: (sht4x) Convert update_interval to jiffies in pending data check\n hwmon: (coretemp) Fix 32-bit jiffies wraparound in show_temp()\n hwmon: (coretemp) Set nr_cores only after core_data allocation succeeds\n hwmon: (coretemp) Check for NULL platform device in hotplug callbacks\n hwmon: (gpio-fan) Update the speed cache before dropping the PM reference\n hwmon: (tmp108) Fix initial conversion delay and wait until ready\n hwmon: (lm75) Fix setting polarity mask for chips with 16-bit config register\n hwmon: (pmbus) Fix return value check from thermal zone registration\n hwmon: (pmbus) Release devres allocated memory after devm_thermal_of_zone_register error\n hwmon: (pmbus) Check return value from pmbus_thermal_add_sensor()\n hwmon: (pmbus/q54sj108a2) Add missing NULL pointer check\n hwmon: (peci/dimmtemp) Fix devres leak and UAF on concurrent unbind\n hwmon: (nct6683) Fix incorrect struct cast in show_pwm() and store_pwm()\n hwmon: (lm87) Fix drvdata type confusion in vrm_show() and vrm_store()\n ...\n" }, { "commit": "1c3b1398f1cf7ebb00ba95b4b76ad18f3501ca7a", "tree": "9a69b0f550598f69c97db690f1d3643463e6f221", "parents": [ "f9c898ececdbcf9532038a6de4797fcc83a145a4", "75709a35da45bc67f94c9ceb91bf8871fdfe4d9e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 09:19:09 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 09:19:38 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-11-05\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\natomic:\n- Fix CRTC dma-fence handling\n\nbridge:\n- nwl-dsi: Fix LCDIF handling\n\ndma-buf:\n- Fix IOVA offset\n- Restore the scatter-list entry count before freeing\n\ndp:\n- Keep MOT set between messages when no_zero_sized is set\n\netnaviv:\n- Fix NULL dereference in etnaviv_unbind()\n- Flush the tile status cache through both the PE and BLT\n\nimagination:\n- Align rogue_fwif_hwrtdata to 64 bytes\n\nloongson:\n- Fix BO handling in several places\n\nnouveau:\n- Map Kepler video engine contexts non-privileged\n- Clear use.enabled when subdev init fails\n- Avoid running VBIOS twice\n- Fix CE channel creation on pre-Kepler GPUs\n\npanel:\n- visionox-r66451: Set brightness MSB first; Increase reset waiting time\n\npanic:\n- Fix display loop\n- Fix line parsing\n\nsched:\n- Fix out of bounds entity priority check\n- Adjust run-queue when changing priority at runtime\n\nv3d:\n- Initialize job timedout_batches\n- Fix cache_clean_lock\n\nvc4:\n- Move output fence and BO unreserve out of job_lock\n- Power down PYH when output is disabled\n- hdmi: Fix scrambling\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20261105143915.GA896462@linux.fritz.box\n" }, { "commit": "f9c898ececdbcf9532038a6de4797fcc83a145a4", "tree": "6919491eeea39145c5f9b1e5b5ed6cecfd9dfc9a", "parents": [ "6628e7d4c6b25c8d18f1345e3a20d21829aae7e4", "01aa63eade529680cb28fce40f2357bf392a249f" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 09:11:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 06 09:11:57 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-11-05\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix GitLab #8991 where tiled displays (LG UltraFine 5K) broken on PTL\n- Limit NVL TRANS_VTOTAL.Vtotal skip display workaround to A-step\n- Single scaler per pipe number to 1 and disable pipe joiner on WCL\n- Add quirk to force backlight type on some TUXEDO devices\n\n- Fix \"CMTG: A disable timeout\" splat\n- Fix intel_vrr_dcb_vmin_vblank_start\n- Bunch of PSR fixes\n- Static checker fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/auyLLyt1cpOQYL4n@jlahtine-mobl\n" }, { "commit": "69e2b55fc3b4fa3639b8c320374c255f046ddda5", "tree": "be00cb69e1108adf375e24fb307aab5b689d1a60", "parents": [ "d68ce4e71248e1ff5af9654b407541d9260b3ba5", "1a577f9402c1780cc1e663f48d5dd54c02051b09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 15:10:52 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 15:10:52 2026 -0800" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"vhost, virtio, and vdpa bugfixes.\n\n Just a bunch of fixes all over the place\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (38 commits)\n virtio_pci: don\u0027t take the MSI mutex under cpu_hotplug_lock\n virtio_ring: Initialize id field in packed indirect descriptors\n vhost-scsi: fix page reference leak in misaligned I/O fallback\n vduse: fix VA/PA confusion in the coherent page fault path\n hwrng: virtio - prevent use-after-free after a failed restore\n virtio: use consistent virtqueue terminology\n virtio_balloon: initialize wakeup_lock before virtqueues are set up\n MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers\n vhost-vdpa: initialize state before publishing cdev\n vhost: reject backend enable without a kick file\n vhost-scsi: reject delayed virtqueue setup\n virtio_ring: use shadow flags when detaching split descriptors\n vhost-scsi: validate event queue descriptor direction\n vhost-scsi: do not count PI bytes in the data length\n vdpa/snet: Don\u0027t discard the DPU error in snet_send_ctrl_msg()\n iommu/virtio: Reset device before deleting virtqueues on probe failure\n vhost: fix used ring index wrap in vhost_add_used_n_in_order\n vhost-scsi: zero misaligned I/O bounce pages\n vringh: reject empty / undersized indirect descriptor tables\n virtio_blk: Reset device on probe error paths after DRIVER_OK\n ...\n" }, { "commit": "d68ce4e71248e1ff5af9654b407541d9260b3ba5", "tree": "90d3a58f5651b3f3a78c0c753a9770e74b4dab6f", "parents": [ "46a062865b6b6b9a2ba199101b44feb925455c66", "71555ae8c7572fd99158013ca2e29187c5d2508d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:13:35 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:13:35 2026 -0800" }, "message": "Merge tag \u0027mm-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core\n\nPull core memory management fixes from David Hildenbrand:\n \"Here\u0027s a bigger set of MM fixes that we didn\u0027t manage to have ready\n for -rc1. All fixes are stable-worthy; the majority fixes nasty\n long-standing bugs instead of being purely hotfixes.\n\n We have some more of these kinds of stable-worthy fixes in the\n pipeline, but we\u0027ll focus on the really urgent fixes as we get closer\n to the release.\n\n (Leaving urgent MM fixes lurking for various weeks is not good, but\n having too many changes close to the release is also not good, it\u0027s\n tricky ...)\n\n Most issues were reported by Anthropic. Others were found while\n reworking proposed fixes, and of course some of the fixes were just\n reported and fixed on the mailing list.\n\n All fixes were in linux-next for several days without changes. Some\n commit IDs changed recently when I had to drop some non-stable fixes,\n rebased to -rc1 and picked up more trailers.\n\n This includes fixes to:\n - THP (Transparent Huge Pages)\n - GUP (Get User Pages)\n - KSM (Kernel Samepage Merging)\n - USERFAULTFD\n - SHARED MEMORY (shmem/tmpfs/memfd)\n - HUGETLB\n - Core MM, PAGE CACHE and MEMORY RECLAIM\n\n The main changes are:\n\n - Prevent information leaks through memfd pinning, and out-of bounds\n writes in GUP.\n\n - Fix data loss in shmem, THP collapse, KSM and memfd pinning.\n\n - Fix corruption and reference-counting errors with huge PMD/PUD\n mappings, and incorrect TLB flushing and unmapping.\n\n - Fix various use-after-free bugs, deadlocks and unkillable loops,\n witha a focus on shmem swap handling.\n\n - Fix execution-seal enforcement for memfd (incl. hugetlb).\n\n Other changes fix accounting, quota and userfaultfd (un)registration\n handling\"\n\n* tag \u0027mm-core-7.4-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core: (61 commits)\n mm/gup: check folio-\u003emapping under folio lock in memfd_pin_folios()\n khugepaged: fix readahead lock inversion in collapse_file()\n mm/huge_memory: set the mmu_gather page size in zap_huge_pud()\n mm/memory-tiers: unregister empty tiers outside memory_tier_lock\n mm/cma: don\u0027t release CMA pages still in use\n mm/vma: don\u0027t leak the charge for stack growth\n mm/huge_memory: split huge PUDs when adjusting VMA boundaries\n mm/vma: call -\u003emay_split() before a partial merge\n mm/ksm: check large swap-cache folios before mapping them\n mm/ksm: fix use of a freed anon_vma at swap-in\n mm/ksm: reset the unstable trees of all nodes\n mm: fix deadlock of mremap() against UFFDIO_MOVE\n mm: fix unkillable fault loop on MAP_DROPPABLE memory\n mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit\n mm/memory: reject remote COW faults on PFN mappings\n mm/madvise: fix data loss from MADV_FREE on a KSM page\n mm/mremap: fix moving PUD leaves\n mm/mremap: recheck PUDs under the page table lock\n mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs\n mm/mmu_notifier: set -\u003emm only after mmgrab()\n ...\n" }, { "commit": "46a062865b6b6b9a2ba199101b44feb925455c66", "tree": "e2949d7e0aeda38114a1df371b34893c46c145d5", "parents": [ "afd661f6a26438c407bd9928ea16e80c14b121d9", "5b4696e0bfc358619adaeab25ad35b4979af8331" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:05:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 13:05:13 2026 -0800" }, "message": "Merge tag \u0027mm-nonmm-hotfixes-stable-2026-11-04-20-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull non-MM fixes from Andrew Morton:\n \"22 patches. 17 are cc:stable.\n\n Most are OCFS2 fixes. These address extended-attribute corruption,\n missing attributes and kernel BUGs, along with crashes during cluster\n configuration, lock migration, recovery and unmount. Extent movement\n is also fixed to validate its range against a stable file size.\n\n Three FAT changes prevent a failed-write/FIBMAP race from spuriously\n making the filesystem read-only, correct directory link counts after\n rename, and speed up file expansion. The reported QEMU benchmarks show\n particularly large improvements on synchronous mounts.\n\n A taint-string fix prevents an out-of-bounds read which can expose\n slab contents in the kernel log. There are also build fixes for\n OpenRISC modules on CPUs without hardware multiply and for Clang 24\"\n\n* tag \u0027mm-nonmm-hotfixes-stable-2026-11-04-20-26\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits)\n ocfs2: cache the mount context for dentry lock callbacks\n ocfs2: wait for filecheck kobject release after a failed add\n fat: fix parent link count when replacing a sibling directory\n ocfs2/cluster: unlink socket containers before releasing resources\n ocfs2: stop recovery before shutting down local allocators\n ocfs2/dlm: serialize migration MLE cleanup on failure\n panic: zero the dynamically allocated taint buffer\n ocfs2: keep locking_state within the cluster connection lifetime\n MAINTAINERS: mailmap: use Clément Léger\u0027s linux.dev mail address\n MAINTAINERS: add an IPC entry\n ocfs2: validate move extents against a stable EOF\n fat: hold truncate_lock in fat_write_failed()\n fat: preallocate space before expanding in fat_cont_expand()\n ocfs2: do not read the entry array of an empty xattr block\n ocfs2: do not index before the entry array when dividing an empty bucket\n ocfs2: do not read the entry array of an empty xattr bucket\n ocfs2: find the xattr entry again after converting a block to a bucket\n ocfs2: find the xattr entry again after defragmenting a bucket\n ocfs2: read the xattr entry hash before defragmenting the bucket\n ocfs2/heartbeat: serialize concurrent writes to a region\u0027s dev attribute\n ...\n" }, { "commit": "28f7d31c2aeb350df9a0116093fade0a840fb4ce", "tree": "8c02276ad07123e0d1156e52475480ce3c10db6f", "parents": [ "e6ac1da6a53c5f670bf09e60a2500d15be68d2fc", "f33c8bc785401669b29229bcf3d0086ba9f5b87c" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Nov 05 13:47:13 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Nov 05 13:47:13 2026 -0700" }, "message": "Merge tag \u0027nvme-7.4-2026-11-05\u0027 of git://git.infradead.org/nvme into block-7.4\n\nPull NVMe fixes from Keith:\n\n\"- Fix a passthru reference leak that hangs disabling a target passthru\n controller (7.4-rc1 regression)\n - Fix namespace removal race with SRCU readers of the namespace list\n - Fix use-after-free in nvme-tcp controller teardown after a failed\n connect\n - Fix NULL dereference in nvme-rdma when a reconnect adds queues\n - nvmet-rdma device removal and disconnect fixes\n - nvmet-tcp TLS record type handling and bounded connection accept work\n - Don\u0027t leak stale memory in the nvmet ANA log page\n - Harden nvmet against invalid input: keep-alive timeout overflow,\n incomplete DHCHAP messages, configfs address bounds, arbitration\n burst mask, and locking for traffic based keep alive updates\n - Keep the old nvmet auth keys if setting new ones fails\n - Delete nvme-loop controller on failed reset\n - Fix extra cdev reference put and unregister on a zero pr_register key\n - Fix a TLS key reference leak in the nvme keyring\n - Quirks for ADATA XPG GAMMIX S70 BLADE and KIOXIA XG10d\n - Speed up nvmet namespace disable\n - Misc cleanups\"\n\n* tag \u0027nvme-7.4-2026-11-05\u0027 of git://git.infradead.org/nvme: (29 commits)\n nvmet: cache passthru reference in __nvmet_req_complete()\n nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n nvmet: bound the traddr and trsvcid configfs writes\n nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n nvme: wait for SRCU readers before splicing the namespace list\n srcu: Add list_splice_init_srcu()\n nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for KIOXIA XG10d\n nvmet: don\u0027t return memory contents beyond valid data when reading ANA log page\n nvme-pci: add NO_FUA quirk for ADATA XPG GAMMIX S70 BLADE\n nvmet: drop the extra RCU grace period in nvmet_ns_disable()\n nvme-keyring: Add a missing key_put() call to nvme_tls_key_lookup()\n nvmet-rdma: disconnect a queue on device removal\n nvmet-rdma: queue the release work under the mutex\n nvmet-rdma: take a device off the list last\n nvmet-tcp: limit the connections accepted per work run\n nvmet-rdma: disconnect only established queues\n nvmet-auth: keep the old keys if the new ones fail\n nvmet-tcp: ask for the TLS record type on every receive\n nvme-loop: delete the controller if a reset fails\n nvmet-rdma: remove dead allocated field in nvmet_rdma_rsp\n ...\n" }, { "commit": "afd661f6a26438c407bd9928ea16e80c14b121d9", "tree": "6ecd7744905f3e3949e4b5f07deb5bf79ff0fdfc", "parents": [ "05441d697f7f9a927264f4058cbbc6a03dfcac9d", "19eab4cf787c917bfb7615460933e4ae894af65b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 12:32:29 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 05 12:32:29 2026 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-11-04-20-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - \"mm: avoid losing atomic VMA flags\" (Lorenzo Stoakes):\n\n Preserve guard-page and soft-dirty state across VMA changes. Prevent\n fork and THP collapse from losing guard markers, and keep changes\n visible to applications which track modified memory.\n\n - \"MAINTAINERS: MM updates\" (David Hildenbrand):\n\n Start routing more MM components through mm/core.git and add Zi Yan\n as a THP co-maintainer. Update component coverage and integration\n branches as part of the transition to separate MM component trees.\n\n - \"mm/hugetlb: fix mremap bugs\" (Li Zhe):\n\n Fix hugetlb mremap deadlocks and truncated move lengths. Prevent\n userfaultfd poison markers from affecting other processes through\n shared hugetlb page tables.\n\n - \"MAINTAINERS updates for page and slab allocators\" (Vlastimil Babka):\n\n Add Johannes Weiner as a page allocator co-maintainer and update page\n and slab allocator entries for their component trees and integration\n through mm/linux.\n\n - \"mm/damon: fix three race bugs in sysfs and core\" (SJ Park):\n\n Serialize DAMOS tuning updates and stop monitoring contexts from\n sharing mutable state. Avoid interference between concurrent DAMON\n instances and incorrect auto-tuning.\n\n - \"mm: page_alloc: fix reserve access for non-blocking requests\"\n (Johannes Weiner):\n\n Stop ordinary non-blocking allocations from consuming reserves or\n bypassing watermarks. Avoid severe allocation stalls under memory\n pressure and preserve reserves for requests entitled to use them.\n\n - \"mm/cma: accept memory of CMA areas reserved with memblock_reserve()\"\n (Mike Rapoport):\n\n Accept memory in fixed-address and multi-range CMA reservations.\n Prevent fatal accesses to these pages in TDX and SEV-SNP guests.\n\n - Summary of singletons in this merge:\n\n Several fixes address crashes and unsafe memory access. Failed THP\n collapse now flushes stale translations before releasing pages which\n another collapse can free. A truncation race with MADV_DONTNEED could\n remove still-mapped shmem pages and hit a kernel BUG. Large-folio\n page-table scans no longer wrap addresses and crash near\n address-space boundaries. Hugetlb vmemmap optimization no longer\n causes write faults from racing reference-count operations.\n Memory-cgroup teardown is also protected against reclaim work\n accessing released state.\n\n KSM now preserves userfaultfd protection during merging and\n unmerging, and retains soft-dirty information needed by incremental\n memory dumpers. Reads of /proc/PID/maps and related files no longer\n omit continuously mapped ranges during concurrent VMA changes. There\n are also fixes for expanding mixed mappings with mremap() and\n querying NUMA placement with tagged addresses. Swapoff checks for\n signals while processing large address spaces and shmem files, so it\n can be interrupted without holding up suspend until the whole object\n is read.\n\n Costly allocations with cheap smaller-order fallbacks avoid direct\n reclaim and compaction. Reported arm64 PostgreSQL tests improved from\n 58,602 to 157,246 transactions per second with defrag_mode disabled;\n this addresses a buffered-write regression under fragmentation.\n Background reclaim can recover on the highest-numbered memory node\n after it has given up, and 32-bit writeback threshold calculations no\n longer overflow and assign incorrect dirty-memory limits.\n\n* tag \u0027mm-hotfixes-stable-2026-11-04-20-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (43 commits)\n MAINTAINERS: move SLAB ALLOCATOR under MEMORY MANAGEMENT\n MAINTAINERS: add Johannes as the page allocator co-maintainer\n MAINTAINERS: route more MM changes through mm/core.git\n MAINTAINERS: rename and move MEMORY HOT(UN)PLUG\n MAINTAINERS: add missing files to MM component sections\n MAINTAINERS: sort entries in MM sections\n MAINTAINERS: add Zi Yan as co-maintainer for MEMORY MANAGEMENT - THP\n MAINTAINERS: TMPFS (SHMEM FILESYSTEM) updates\n MAINTAINERS: mention for-next branch in MEMORY MANAGEMENT - MEMORY MAP\n mm: memcontrol: fix NULL pointer deref and UAF from high_work_func() on dying memcg\n mm/cma: accept memory of CMA areas reserved at a fixed address\n mm/cma: accept memory of multi-range CMA areas\n mm/page_alloc: avoid direct reclaim and compaction for costly __GFP_NORETRY allocations\n mm: page_alloc: remove ALLOC_NON_BLOCK from ALLOC_RESERVES\n mm: page_alloc: do not give all non-blocking requests reserve access\n mm/hugetlb_vmemmap: map the shared tail page writable\n fs/proc/task_mmu: fix missed VMAs when reading /proc/PID/maps and friends\n selftests/mm: fix khugepaged_race build with older glibc\n mm/vma: update VMA iterator state on error in new VMA merge\n mm/migrate: snapshot the source nid before the misplaced migration\n ...\n" }, { "commit": "f33c8bc785401669b29229bcf3d0086ba9f5b87c", "tree": "9b6c7eabee8f955a3495814d779a9961707cb9d5", "parents": [ "c92055eb22a8e135011c14c5eb40f5da0a0c8153" ], "author": { "name": "Nilay Shroff", "email": "nilay@linux.ibm.com", "time": "Thu Nov 05 17:54:55 2026 +0530" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: cache passthru reference in __nvmet_req_complete()\n\n__nvmet_req_complete() releases the passthru reference held while\nprocessing a passthru request. However, it currently does so after\ncalling ops-\u003equeue_response().\n\nOnce ops-\u003equeue_response() is called, the transport may complete and\nrecycle the request on another CPU. If the request is reused, its\nreq-\u003ep.ref_held field may be reset to false before\n__nvmet_req_complete() checks it in nvmet_put_passthru_ref().\nConsequently, the passthru reference may not be released, leaving\nwait_for_completion(\u0026passthru-\u003edisable_done) in\n__nvmet_passthru_ctrl_disable() blocked indefinitely.\n\nFix this by caching the passthru pointer at the beginning of\n__nvmet_req_complete(), while the request is still valid, and use\nthe cached pointer to release the reference after queuing the\nresponse. This also changes nvmet_put_passthru_ref() to accept\nthe passthru pointer directly instead of accessing it through\nthe request.\n\nReported-by: Shin\u0027ichiro Kawasaki \u003cshinichiro.kawasaki@wdc.com\u003e\nCloses: https://lore.kernel.org/all/auhpmq499RVE9YpC@shinmob/\nFixes: 5e12d81874a1 (\"nvmet: fix use-after-free in passthru I/O hotpath\")\nTested-by: Shin\u0027ichiro Kawasaki \u003cshinichiro.kawasaki@wdc.com\u003e\nSigned-off-by: Nilay Shroff \u003cnilay@linux.ibm.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "c92055eb22a8e135011c14c5eb40f5da0a0c8153", "tree": "fa4b50506e6550c7fd89c4a6ee6db9a7bf2debc6", "parents": [ "cf399d4abbeddc317f8160a79fefb4016c469862" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 21:14:46 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: drop the redundant auth check in nvmet_parse_io_cmd()\n\nnvmet_parse_io_cmd() calls nvmet_check_auth_status() and then\nnvmet_check_ctrl_status(), which performs the same check again. The\nfirst call cannot fail either: this path only handles commands from I/O\nqueues, and nvmet_check_auth_status() returns true unconditionally for\nqid \u003e 0. Drop the duplicate.\n\nNo functional change.\n\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "cf399d4abbeddc317f8160a79fefb4016c469862", "tree": "4e82fd3db3751cac5f1950f57c58bfe1aabf958a", "parents": [ "6d7388d1097f6b2367026114ce8d9e7b8b9d3426" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 03:07:27 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:01 2026 -0800" }, "message": "nvmet: bound the traddr and trsvcid configfs writes\n\nnvmet_addr_traddr_store() and nvmet_addr_trsvcid_store() reject a write\nonly when count is larger than NVMF_TRADDR_SIZE (256) respectively\nNVMF_TRSVCID_SIZE (32). A write of exactly that many characters is\naccepted, and the following\n\n\tsscanf(page, \"%s\\n\", port-\u003edisc_addr.traddr)\n\nhas no field width. configfs terminates the buffer at page[count], so\nthe scan writes 256 characters plus the trailing NUL, i.e. 257 bytes,\ninto traddr[256]. The extra byte lands in the following tsas field of\nthe discovery log entry, silently clearing the first TSAS byte (the\nRDMA queue type, or the TLS section type for TCP). trsvcid has the\nsame off-by-one with a 32-byte write; there the extra byte lands in\nthe reserved bytes that follow trsvcid.\n\nLimit the scans to one byte less than the destination arrays. The\ncount checks can stay as they are so that a normal newline-terminated\nwrite is still accepted.\n\nFixes: 9ba2a5cb8896 (\"nvmet: filter newlines from user input\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "6d7388d1097f6b2367026114ce8d9e7b8b9d3426", "tree": "af5320504a32362cbfb6cc78a454d57b4d06378b", "parents": [ "8a0449832b50cd4f99f2d2952cfc1476e5f26d0f" ], "author": { "name": "Shao Mingyin", "email": "shao.mingyin@zte.com.cn", "time": "Wed Nov 04 03:07:25 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 08:53:00 2026 -0800" }, "message": "nvmet: take subsys-\u003elock when forcing reconnects for tbkas\n\nnvmet_subsys_attr_tbkas_store() walks subsys-\u003ectrls to force a reconnect\nwhile holding only nvmet_config_sem. The list is protected by\nsubsys-\u003elock: nvmet_alloc_ctrl() adds entries and nvmet_ctrl_free()\nremoves them under that lock, and the controller free path does not take\nnvmet_config_sem. Writing attr_tbkas concurrently with a controller\ngoing away, for example on a keep-alive timeout or a fatal error, can\ntherefore dereference a controller that has already been removed and\nfreed.\n\nTake subsys-\u003elock around the list walk, as\nnvmet_subsys_attr_qid_max_store() already does for the same loop.\ndelete_ctrl() only schedules the asynchronous teardown, so it does not\nrecurse into subsys-\u003elock.\n\nFixes: e98e45e9465b (\"nvmet: Add traffic based keep alive support to configfs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shao Mingyin \u003cshao.mingyin@zte.com.cn\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "22733b6e2e1ebf75228a1e15b9fb9760a86137cc", "tree": "c7388fd1cb44ed49347418ae058ead753d2c473b", "parents": [ "d54c3cc224dab59cb6b4db43cceaf84a4b39c87a", "cf09d02dc0c49593fdd9e0ec2f17251cba39a94e" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Nov 05 16:56:23 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Nov 05 16:56:23 2026 +0100" }, "message": "Merge tag \u0027asoc-fix-v7.4-rc1\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.4\n\nMore fixes that have come in since -rc1, a lot of this is quirks but\nthere\u0027s some bug fixes as well. The bug fixes should mostly be those\nthat seem to be affecting actual users rather than just being pure\nstatic analysis work. I also took some fixes for missing Kconfig\ndependencies which won\u0027t have any runtime impact.\n" }, { "commit": "8a0449832b50cd4f99f2d2952cfc1476e5f26d0f", "tree": "6de8cf5e1bbac48b33d3b1817453378f3a331cf8", "parents": [ "d06917d0ba226206dbd606330d73a8eb1e3029c1" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Wed Nov 04 01:30:40 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 07:07:47 2026 -0800" }, "message": "nvme: wait for SRCU readers before splicing the namespace list\n\nReaders walk ctrl-\u003enamespaces under ctrl-\u003esrcu, and some of them sleep\nthere, e.g. nvme_wait_freeze() waiting for I/O to drain.\n\nnvme_remove_namespaces() moves the list onto its on-stack ns_list with\nlist_splice_init_rcu(), which only waits for RCU readers before\nrelinking the entries. A reader still on the last namespace then follows\nits next pointer to ns_list instead of ctrl-\u003enamespaces and treats the\nstack as a namespace. Deleting a controller while a Format NVM\npassthrough waits for a delayed read on the last namespace gives:\n\n BUG: KASAN: stack-out-of-bounds in nvme_wait_freeze+0x102/0x120\n Read of size 8 at addr ff110001d2f3fc38 by task nvme/4413\n Call Trace:\n nvme_wait_freeze\n nvme_passthru_start\n nvme_submit_user_cmd\n nvme_user_cmd\n nvme_dev_ioctl\n BUG: unable to handle page fault for address: ffffffff8af04850\n\nUse list_splice_init_srcu() instead, which waits for the SRCU readers.\nThis also takes the RCU grace period out of every controller deletion.\nDeleting 64 tcp controllers with one namespace each, median of 3 runs on\neach of two boots per kernel:\n\n before after\n nvme disconnect-all (ms) 3491 / 3509 2996 / 3165\n nvme_remove_namespaces() avg (ms) 39.0 / 40.5 31.9 / 34.7\n\nFixes: be647e2c76b2 (\"nvme: use srcu for iterating namespace list\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "d06917d0ba226206dbd606330d73a8eb1e3029c1", "tree": "0ba263e46c61c4d5e27df305a4034abe68b8e503", "parents": [ "c64d9b2c1f4fd1d8fa52dab37b48428a99c4d58d" ], "author": { "name": "Qiliang Yuan", "email": "odys.yuan@gmail.com", "time": "Wed Nov 04 01:30:39 2026 -0500" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Nov 05 07:07:47 2026 -0800" }, "message": "srcu: Add list_splice_init_srcu()\n\nlist_splice_init_rcu() makes a list look empty to new readers, waits for\nthe current ones with the given sync function, and only then links the\nentries into the new list. The sync function takes no argument, so it\ncan wait for RCU readers but not for the readers of an srcu_struct.\n\nPassing synchronize_rcu() for a list read under SRCU still builds, but\nleaves SRCU readers on the entries while the last one\u0027s next pointer is\nmoved onto the new list head. nvme_remove_namespaces() does this today.\n\nAdd list_splice_init_srcu(), which waits for the readers of the given\nsrcu_struct instead.\n\nCc: stable@vger.kernel.org\nSuggested-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Qiliang Yuan \u003codys.yuan@gmail.com\u003e\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "d54c3cc224dab59cb6b4db43cceaf84a4b39c87a", "tree": "ec48011fc133df1832996515c6f33fc03f5245aa", "parents": [ "022e9f8f094279ecd632b3846968790fad7d8ad6" ], "author": { "name": "Nguyen Thanh Nhat", "email": "nguyenthanhnhat397@gmail.com", "time": "Thu Nov 05 20:03:30 2026 +0700" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Nov 05 16:00:46 2026 +0100" }, "message": "ALSA: hda/realtek: Add quirk for Acer Predator PHN16-71\n\nThe Acer Predator PHN16-71 (subsystem ID 1025:170f) with a Realtek\nALC245 codec does not detect external headset microphone on the 3.5mm\ncombo jack because 0x19 pin is marked as unconnected (0x411111f0). Add a\nquirk using ALC2XX_FIXUP_HEADSET_MIC.\n\nSigned-off-by: Nguyen Thanh Nhat \u003cnguyenthanhnhat397@gmail.com\u003e\nLink: https://patch.msgid.link/20261105130330.6797-1-nguyenthanhnhat397@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "456c965ca46c59a4a241c755e6565fd883a522f4", "tree": "2ca28af3032268b7b7f416947266224ae6d7faa4", "parents": [ "ff209a7294988aac52b2522b1d0d7349da4541ec" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Tue Nov 03 13:50:40 2026 -0800" }, "committer": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Thu Nov 05 15:36:25 2026 +0100" }, "message": "MIPS: SB1250: Validate and update IRQ affinity\n\nsb1250_set_affinity() selects the first online CPU in the requested\naffinity mask without checking whether such a CPU exists. If the\nintersection is empty, the resulting CPU index is invalid and must\nnot be passed to cpu_logical_map().\n\nReject affinity masks containing no online CPU with -EINVAL before\naccessing the CPU mapping or interrupt mapper registers.\n\nAlso update the effective affinity mask to reflect the single logical\nCPU selected as the interrupt target.\n\nFixes: 421d1563c662 (\"mips: Validate online cpus in irq_set_affinity() callbacks\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\n" }, { "commit": "ff209a7294988aac52b2522b1d0d7349da4541ec", "tree": "bb88404c8b96e3871e23df6103f5dbed8eb929cb", "parents": [ "36c8aa2840fd1561de6b2e7518e6aa75a47ec7eb" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Thu Oct 22 09:31:00 2026 -0700" }, "committer": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Thu Nov 05 15:34:31 2026 +0100" }, "message": "MIPS: Cobalt: Include legacy IDE ports in the PCI I/O window\n\nThe Cobalt PCI I/O window starts at 0x1000, excluding the VIA IDE\ncontroller\u0027s fixed compatibility-mode ports at 0x170, 0x1f0, 0x376 and\n0x3f6. Since pcibios_enable_device() was converted to\npci_enable_resources(), these unclaimed resources cause pata_via to\nfail to probe with -EINVAL.\n\nStart the PCI I/O window at zero to cover the southbridge legacy ports,\nretaining 0x1000 as the allocation minimum via PCIBIOS_MIN_IO. Register\nthe PCI controller from plat_mem_setup(), before the VIA reservations\nand i8259 initialization, so the legacy resources do not conflict with\nthe host bridge window and prevent PCI bus scanning.\n\nKeep the VIA resource reservations in plat_mem_setup() after the PCI\ncontroller registration and use insert_resource() to nest them beneath\nthe PCI window. The i8259 and RTC resources are also claimed beneath it.\n\nBoot-tested on a Qube2 with a MIPS64 kernel. All seven PCI functions\nenumerate, both tulip devices bind, and pata_via initializes both ATA\nhosts and detects the ST380012A 80 GB disk. All 18 boot checks pass,\nincluding a read-only disk test and Ethernet ping.\n\nFixes: ae81aad5c2e1 (\"MIPS: PCI: Use pci_enable_resources()\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nReviewed-by: Maciej W. Rozycki \u003cmacro@orcam.me.uk\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\n" }, { "commit": "36c8aa2840fd1561de6b2e7518e6aa75a47ec7eb", "tree": "7ce3148b4a6f08e9edc14e3bd31ed500dfab766c", "parents": [ "a55a7df2cf788234850d9053ecc25a5470175929" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Wed Oct 21 21:24:17 2026 +0200" }, "committer": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Thu Nov 05 15:31:32 2026 +0100" }, "message": "MIPS: sgi-ip32: Report the real CRIME revision\n\nCRIME_ID\u0027s low nibble reads 1 on both rev 1.1 and 1.4 chips, so it does\nnot give the revision. ID 0xa has it in bits 63:32, and ID 0xb is rev\n1.5. Decode it, and drop the unused CRIME_ID_REV.\n\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\n" }, { "commit": "a55a7df2cf788234850d9053ecc25a5470175929", "tree": "83814362ea948f3c4e03b49ae418c6411b9ae169", "parents": [ "4e65c502b8975e7c3c3d84aba59cd04af1dd6b8a" ], "author": { "name": "Imre Kaloz", "email": "kaloz@kernel.org", "time": "Wed Oct 21 21:24:16 2026 +0200" }, "committer": { "name": "Thomas Bogendoerfer", "email": "tsbogend@alpha.franken.de", "time": "Thu Nov 05 15:30:55 2026 +0100" }, "message": "MIPS: sgi-ip32: Leave MACE PCI control alone in config accesses\n\nmace_pci_read_config() clears the master abort interrupt enable in the\nMACE PCI control register around each config read. A register read\nfollowed by two register writes can hang CRIME 1.1 under DMA load.\n\nAck master aborts in the error register instead, and follow every\nwrite with a read so back-to-back accesses cannot form that sequence.\n\nFixes: c990081bf87b (\"[MIPS] Fix IP32 breakage\")\nCc: stable@vger.kernel.org\nSigned-off-by: Imre Kaloz \u003ckaloz@kernel.org\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\n" } ], "next": "4e65c502b8975e7c3c3d84aba59cd04af1dd6b8a" }