)]}'
{
  "log": [
    {
      "commit": "2f080c6800e0d40580a0eb9d2918e500c483fac5",
      "tree": "86f808bc79479d08776df414832b64672b2203b9",
      "parents": [
        "708018168a93a2c205585f72548b3375aec2ec06"
      ],
      "author": {
        "name": "Yeoreum Yun",
        "email": "yeoreum.yun@arm.com",
        "time": "Fri Jun 05 15:43:25 2026 +0100"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:49 2026 +0300"
      },
      "message": "tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in\n\ncommit 746d9e9f62a6 (\"tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it\u0027s built-in\")\nprobe tpm_crb_ffa forcefully when it\u0027s built-in to integrate with IMA.\n\nHowever, IMA now provides the IMA_INIT_LATE_SYNC build option, which\ninitialises IMA at the late_initcall_sync level, so this change is no\nlonger required.\n\nSigned-off-by: Yeoreum Yun \u003cyeoreum.yun@arm.com\u003e\nLink: https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git/commit/?h\u003dfor-next/ffa/updates\u0026id\u003dcc7e8f21b9f0c229d68cf19a837cba82b5ac2d87 [0]\nLink: https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git/commit/?h\u003dfor-next/ffa/updates\u0026id\u003de659fc8e537c7a21d5d693d6f30d8852f2fa8d91 [1]\nLink: https://lore.kernel.org/r/20260605144325.434436-5-yeoreum.yun@arm.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "708018168a93a2c205585f72548b3375aec2ec06",
      "tree": "f141d621ccf809df3dd1aaca1f9bb96ccd73d20e",
      "parents": [
        "d13bdce4fd469182215cb6180d06e8af4a26f9f8"
      ],
      "author": {
        "name": "Michael Bommarito",
        "email": "michael.bommarito@gmail.com",
        "time": "Sun May 31 08:44:28 2026 -0400"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt\n\ntpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls\ncrypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret()\nwithout installing a completion callback, discards both return values,\nand immediately frees the kpp_request via kpp_request_free(). When the\nresolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE,\nkeembay-ocs), either operation returns -EINPROGRESS and the deferred\ncompletion worker dereferences the freed request.\n\nThe path fires automatically from the hwrng_fillfn kernel thread via\ntpm_get_random -\u003e tpm2_get_random -\u003e tpm2_start_auth_session -\u003e\ntpm_buf_append_salt on every entropy poll, without any userland action.\n\nInstall crypto_req_done as the completion callback, wrap both KPP\noperations in crypto_wait_req(), and propagate errors to the caller.\nThe wait is a no-op for synchronous backends.\n\nFixes: 1085b8276bb4 (\"tpm: Add the rest of the session HMAC API\")\nCc: stable@vger.kernel.org # v6.10+\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "d13bdce4fd469182215cb6180d06e8af4a26f9f8",
      "tree": "8e49cbb0fecb8cb12f6a1494123c631250204fce",
      "parents": [
        "9c3827fbb797c29d41ec23383c332ee001b160dd"
      ],
      "author": {
        "name": "Jim Broadus",
        "email": "jbroadus@gmail.com",
        "time": "Tue May 26 16:22:44 2026 -0700"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: tpm_tis: Add settle time for some TPMs\n\nSome TPMs fail to grant locality when requested immediately after being\nrelinquished. In this case, the TPM_ACCESS_REQUEST_USE bit of the\nTPM_ACCESS register is cleared immediately without setting\nTPM_ACCESS_ACTIVE_LOCALITY.\n\nThis issue can be seen at boot since tpm_chip_start, called right\nafter locality is relinquished, will fail. This causes the probe to\nfail:\n\ntpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -1\n\nThis occurs on some older Dell Latitudes. For the Nuvoton TPM used in\nthese machines, add a delay after locality is relinquished.\n\nSigned-off-by: Jim Broadus \u003cjbroadus@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260526232245.5409-3-jbroadus@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "9c3827fbb797c29d41ec23383c332ee001b160dd",
      "tree": "9e3de44c2fd9fe20b095ab2dae5a9dbe1d992e3b",
      "parents": [
        "f641b6c1a9cff4a8e2d8979ae57083439b128c9c"
      ],
      "author": {
        "name": "Jim Broadus",
        "email": "jbroadus@gmail.com",
        "time": "Tue May 26 16:22:43 2026 -0700"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: tpm_tis: store entire did_vid\n\nThe entire 32 bit did_vid is read from the device, but only the 16 bit\nvendor id portion was stored in the tpm_tis_data structure. Storing the\nentire value allows the device id to be used to handle quirks. Printing\nthe vid and did in the error case also helps identify problem devices.\n\nSigned-off-by: Jim Broadus \u003cjbroadus@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260526232245.5409-2-jbroadus@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "f641b6c1a9cff4a8e2d8979ae57083439b128c9c",
      "tree": "3a738bceb5432b579140bd8bcce79df45f226e3f",
      "parents": [
        "36d62601ed89125bce5175f68107d062d906d522"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Tue May 12 18:16:23 2026 +0200"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm_crb: Check ACPI_COMPANION() against NULL during probe\n\nEvery platform driver can be forced to match a device that doesn\u0027t match\nits list of device IDs because of device_match_driver_override(), so\nplatform drivers that rely on the existence of a device\u0027s ACPI companion\nobject need to verify its presence.\n\nAccordingly, add a requisite ACPI_COMPANION() check against NULL to the\ntpm_crb driver.\n\nFixes: 48fe2cddc85c (\"tpm_crb: Convert ACPI driver to a platform one\")\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nLink: https://lore.kernel.org/r/2848144.mvXUDI8C0e@rafael.j.wysocki\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "36d62601ed89125bce5175f68107d062d906d522",
      "tree": "e3e8fae13d13feaa17bc7b20608e58f83afbb130",
      "parents": [
        "e58abb912ad3fe77ec0273eb3a00b424f297e2f8"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sat May 09 21:51:07 2026 +0300"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()\n\nwait_event_interruptible_timeout() evaluates its condition after setting\nthe current task state to TASK_INTERRUPTIBLE.\n\nWith CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait\npath is used:\n\n    tpm_tis_status()\n      tpm_tis_spi_read_bytes()\n        tpm_tis_spi_transfer_full()\n          spi_bus_lock()\n            mutex_lock()\n\nAddress this with the following measures:\n\n1. Call wait_tpm_stat_cond() only while tasking is running.\n2. Use wait_woken() to wait for changes.\n\nCc: stable@vger.kernel.org # v4.19+\nCc: Linus Walleij \u003clinusw@kernel.org\u003e\nReported-by: Stefan Wahren \u003cwahrenst@gmx.net\u003e\nCloses: https://lore.kernel.org/linux-integrity/6964bec7-3dbb-453b-89ef-9b990217a8b9@gmx.net/\nFixes: 1a339b658d9d (\"tpm_tis_spi: Pass the SPI IRQ down to the driver\")\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nTested-by: Stefan Wahren \u003cwahrenst@gmx.net\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "e58abb912ad3fe77ec0273eb3a00b424f297e2f8",
      "tree": "3bfceb43fb6634edf8d10929e24279244ede2c9d",
      "parents": [
        "3bdce5aa6a46e9878bd98a80115245c5f695a201"
      ],
      "author": {
        "name": "Gunnar Kudrjavets",
        "email": "gunnarku@amazon.com",
        "time": "Sun May 10 17:11:27 2026 +0000"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name()\n\ntpm_buf_append_name() supports callers passing a pre-computed name\nfor handles. When name is non-NULL, the code skips the\ntpm2_read_public() path but leaves name_size_alg uninitialized\nbefore it is used as the memcpy size argument.\n\nNo current in-tree caller passes a non-NULL name, but future use\ncases such as name caching would exercise this path. Initialize\nname_size_alg by calling name_size() on the caller-provided name,\nsharing the error check and assignment with the existing\ntpm2_read_public() path. This prevents unmasking a latent bug when\nthe non-NULL name path is eventually used.\n\nAssisted-by: Kiro:claude-opus-4.6\nReviewed-by: Justinien Bouron \u003cjbouron@amazon.com\u003e\nReviewed-by: Muhammad Hammad Ijaz \u003cmhijaz@amazon.com\u003e\nSigned-off-by: Gunnar Kudrjavets \u003cgunnarku@amazon.com\u003e\nLink: https://lore.kernel.org/r/20260510171152.4607-1-gunnarku@amazon.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "3bdce5aa6a46e9878bd98a80115245c5f695a201",
      "tree": "ea9b2c88fbdbc97fffffc858b6ac325bfc46e03a",
      "parents": [
        "589096bb177b770b9c61f0be523bcdf01fe7f9c8"
      ],
      "author": {
        "name": "Baoli Zhang",
        "email": "baoli.zhang@linux.intel.com",
        "time": "Tue Apr 21 08:50:20 2026 +0800"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: restore timeout for key creation commands\n\nCommit 207696b17f38 (\"tpm: use a map for tpm2_calc_ordinal_duration()\")\ninadvertently reduced the timeout for TPM2 key creation commands\n(`CREATE_PRIMARY`, `CREATE`, `CREATE_LOADED`) from 300 seconds to 30\nseconds.\n\nThis causes intermittent timeout failures, with several failures observed\nacross hundreds of test runs on some Intel platforms using Infineon\nSLB9670 and SLB9672 TPM modules. Restore the timeout to 300 seconds to\navoid spurious failures.\n\nCc: stable@vger.kernel.org # v6.18+\nFixes: 207696b17f38 (\"tpm: use a map for tpm2_calc_ordinal_duration()\")\nCo-developed-by: Lili Li \u003clili.li@intel.com\u003e\nSigned-off-by: Lili Li \u003clili.li@intel.com\u003e\nSigned-off-by: Baoli Zhang \u003cbaoli.zhang@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20260421005021.13765-1-baoli.zhang@linux.intel.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "589096bb177b770b9c61f0be523bcdf01fe7f9c8",
      "tree": "13babf79090504bd3dc461402e7e12ff81ed1706",
      "parents": [
        "e4e6a50ca78886fbe8d2600bd6d4e8e6e71ef3e3"
      ],
      "author": {
        "name": "David Windsor",
        "email": "dwindsor@gmail.com",
        "time": "Tue May 05 16:27:38 2026 -0400"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:48 2026 +0300"
      },
      "message": "tpm: svsm: constify tpm_chip_ops\n\nConstify the SVSM vTPM ops. It is statically initialized and never\nwritten to, so let\u0027s store it in .rodata.\n\nEvery other tpm_class_ops instance in drivers/char/tpm/ is already\nconst.\n\nSigned-off-by: David Windsor \u003cdwindsor@gmail.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://lore.kernel.org/r/20260505202738.145800-1-dwindsor@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "e4e6a50ca78886fbe8d2600bd6d4e8e6e71ef3e3",
      "tree": "cf49f61b41a976214f9a62efa4a36d97512cc2bc",
      "parents": [
        "7af9d786525f54cc9f125f5ccd46ef782dd79308"
      ],
      "author": {
        "name": "Shaomin Chen",
        "email": "eeesssooo020@gmail.com",
        "time": "Wed Jun 10 13:10:05 2026 +0300"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:04 2026 +0300"
      },
      "message": "keys: Pin request_key_auth payload in instantiate paths\n\nA: request_key()       B: KEYCTL_INSTANTIATE_IOV\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d       \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\ncreate auth key\nstore rka in auth key\nwait for helper\n                       get auth key\n                       load rka from auth key\n                       copy user payload\n                       sleep on #PF\n\nhelper completed\ndetach and free rka\ndestroy auth key\n                       wake up\n                       use rka-\u003etarget_key\n                       **USE-AFTER-FREE**\n\nGive request_key_auth payloads a refcount.  Take a payload reference while\nauthkey-\u003esem stabilizes the payload and revocation state.  Hold that\nreference across the instantiate and reject paths.  Drop the auth key\nowning reference from revoke and destroy.\n\n[jarkko: Replaced the first two paragraphs of text with an actual\n concurrency scenario.]\nCc: stable@vger.kernel.org # v5.10+\nFixes: b5f545c880a2 (\"[PATCH] keys: Permit running process to instantiate keys\")\nReported-by: Shaomin Chen \u003ceeesssooo020@gmail.com\u003e\nCloses: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com\nSigned-off-by: Shaomin Chen \u003ceeesssooo020@gmail.com\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "7af9d786525f54cc9f125f5ccd46ef782dd79308",
      "tree": "c6c6e309cdfa2bcdead7830aaecfaf0182b40dbc",
      "parents": [
        "b6c2918cbb38c640783fd510c47f9ffabce328ce"
      ],
      "author": {
        "name": "Mohammed EL Kadiri",
        "email": "med08elkadiri@gmail.com",
        "time": "Wed Jun 10 07:50:52 2026 +0100"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:04 2026 +0300"
      },
      "message": "keys: prevent slab cache merging for key_jar\n\nAdd SLAB_NO_MERGE to key_jar to prevent the allocator from merging it\nwith other similarly-sized caches. This hardens struct key isolation by\nensuring dedicated slab pages.\n\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nSigned-off-by: Mohammed EL Kadiri \u003cmed08elkadiri@gmail.com\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260610065052.9120-1-med08elkadiri@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "b6c2918cbb38c640783fd510c47f9ffabce328ce",
      "tree": "23a425cfa29ed0051f29b3df9fd2c138ba8cdc57",
      "parents": [
        "d2aa06eca25ea44dc66d2ea005c83a9155efb80d"
      ],
      "author": {
        "name": "David Laight",
        "email": "david.laight.linux@gmail.com",
        "time": "Sat Jun 06 21:26:03 2026 +0100"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:04 2026 +0300"
      },
      "message": "keys: Replace strcpy(derived_buf, \"AUTH_KEY\") with strscpy(..., HASH_SIZE)\n\nderived_buf is guaranteed to be HASH_SIZE - and it is more than enough.\nThe strscpy() degenerates into an memcpy() (as did the strcpy()).\nDo the same for the associated \"ENC_KEY\" copy.\n\nRemoves a possibly unbounded strcpy().\n\nSigned-off-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260606202633.5018-9-david.laight.linux@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "d2aa06eca25ea44dc66d2ea005c83a9155efb80d",
      "tree": "a49f6045e099a44665e49c5a9959190f34d7bef7",
      "parents": [
        "33e70fd37e9c0192d92cdb904a84983002412a85"
      ],
      "author": {
        "name": "Gui-Dong Han",
        "email": "hanguidong02@gmail.com",
        "time": "Fri May 29 11:34:06 2026 +0800"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:04 2026 +0300"
      },
      "message": "KEYS: Use acquire when reading state in keyring search\n\nThe negative-key race fix added release/acquire ordering for key use.\n\nPublish payload before state; read state before payload.\n\nkeyring_search_iterator() still uses READ_ONCE() before match callbacks.\nAn asymmetric match callback calls asymmetric_key_ids(), which reads\nkey-\u003epayload.data[asym_key_ids].\n\nUse key_read_state() there to complete that ordering.\n\nFixes: 363b02dab09b (\"KEYS: Fix race between updating and finding a negative key\")\nSigned-off-by: Gui-Dong Han \u003changuidong02@gmail.com\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260529033406.20673-1-hanguidong02@gmail.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "33e70fd37e9c0192d92cdb904a84983002412a85",
      "tree": "6b8e6703440feba1f9f63270253583dc7a9b9bec",
      "parents": [
        "44b5914587df4f2098756984ecb7c41c6cc059e0"
      ],
      "author": {
        "name": "Len Bao",
        "email": "len.bao@gmx.us",
        "time": "Sat May 16 15:22:47 2026 +0000"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:04 2026 +0300"
      },
      "message": "keys/trusted_keys: mark \u0027migratable\u0027 as __ro_after_init\n\nThe \u0027migratable\u0027 variable is initialized only during the init phase\nin the \u0027init_trusted\u0027 function and never changed. So, mark it as\n__ro_after_init.\n\nSigned-off-by: Len Bao \u003clen.bao@gmx.us\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260516152249.41851-1-len.bao@gmx.us\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "44b5914587df4f2098756984ecb7c41c6cc059e0",
      "tree": "7bb50856a10da30a10466edd9675f5f743be18ff",
      "parents": [
        "c3cd7529a2c3a2eeedb867aca8b2b73e322d665d"
      ],
      "author": {
        "name": "Thorsten Blum",
        "email": "thorsten.blum@linux.dev",
        "time": "Mon May 04 11:31:00 2026 +0200"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:03 2026 +0300"
      },
      "message": "keys: use kmalloc_flex in user_preparse\n\nUse kmalloc_flex() when allocating a new struct user_key_payload in\nuser_preparse() to replace the open-coded size arithmetic and to keep\nthe size type-safe.\n\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nLink: https://lore.kernel.org/r/20260504093058.49720-3-thorsten.blum@linux.dev\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "c3cd7529a2c3a2eeedb867aca8b2b73e322d665d",
      "tree": "254c7c317b08acc66806e65e75b9e321acbc09c9",
      "parents": [
        "b3eef846426994b32f2cf3ef74cfd70ba4906a7b"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Thu Apr 09 19:07:51 2026 +0300"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:03 2026 +0300"
      },
      "message": "KEYS: trusted: Debugging as a feature\n\nTPM_DEBUG, and other similar flags, are a non-standard way to specify a\nfeature in Linux kernel. Introduce CONFIG_TRUSTED_KEYS_DEBUG for trusted\nkeys, and use it to replace these ad-hoc feature flags.\n\nGiven that trusted keys debug dumps can contain sensitive data, harden the\nfeature as follows:\n\n1. In the Kconfig description postulate that pr_debug() statements must be\n   used.\n2. Use pr_debug() statements in TPM 1.x driver to print the protocol dump.\n3. Require trusted.debug\u003d1 on the kernel command line (default: 0) to\n   activate dumps at runtime, even when CONFIG_TRUSTED_KEYS_DEBUG\u003dy.\n\nTraces, when actually needed, can be easily enabled by providing\ntrusted.dyndbg\u003d\u0027+p\u0027 and trusted.debug\u003d1 in the kernel command-line.\n\nReported-by: Nayna Jain \u003cnayna@linux.ibm.com\u003e\nCloses: https://lore.kernel.org/all/7f8b8478-5cd8-4d97-bfd0-341fd5cf10f9@linux.ibm.com/\nReviewed-by: Nayna Jain \u003cnayna@linux.ibm.com\u003e\nTested-by: Srish Srinivasan \u003cssrish@linux.ibm.com\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "b3eef846426994b32f2cf3ef74cfd70ba4906a7b",
      "tree": "3a96c06f039143a97cfe656cdb0ec8f1151140b1",
      "parents": [
        "0c1547b35b5ccc194b5764ffad9b5630d43c4ded"
      ],
      "author": {
        "name": "Eric Biggers",
        "email": "ebiggers@kernel.org",
        "time": "Wed Apr 08 11:41:35 2026 +0300"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:03 2026 +0300"
      },
      "message": "KEYS: encrypted: Remove unnecessary selection of CRYPTO_RNG\n\nencrypted-keys uses the regular Linux RNG (get_random_bytes()), not the\nduplicative crypto_rng one.  So it does not need to select CRYPTO_RNG.\n\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nReviewed-by: Mimi Zohar \u003czohar@linux.ibm.com\u003e\nReviewed-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "0c1547b35b5ccc194b5764ffad9b5630d43c4ded",
      "tree": "a04c78d601bc2d7e4c20ae6caa2bb6f093998d3f",
      "parents": [
        "2b07ea76fd28989bde5993532d7a943a6f90e246"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Mon Jun 01 23:11:54 2026 +0300"
      },
      "committer": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko@kernel.org",
        "time": "Sun Jun 14 00:04:03 2026 +0300"
      },
      "message": "KEYS: fix overflow in keyctl_pkey_params_get_2()\n\nThe length for the internal output buffer is calculated incorrectly, which\ncan result overflow when a too small buffer is provided.\n\nFix the bug by allocating internal output with the size of the maximum\nlength of the cryptographic primitive instead of caller provided size.\n\nLink: https://lore.kernel.org/keyrings/20260531024914.3712130-1-jarkko@kernel.org/\nCc: stable@vger.kernel.org # v4.20+\nFixes: 00d60fd3b932 (\"KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]\")\nReported-by: Alessandro Groppo \u003cale.grpp@gmail.com\u003e\nTested-by: Alessandro Groppo \u003cale.grpp@gmail.com\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\n"
    },
    {
      "commit": "2b07ea76fd28989bde5993532d7a943a6f90e246",
      "tree": "914251a4bffac169d2efa16b3bffa7d9e4671daa",
      "parents": [
        "a5e98d1679809cbad0f88f1b6b60e92134d8ee13",
        "0d046ae106255cba5eb83b23f78ee93f3620247d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Jun 13 08:23:36 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Jun 13 08:23:36 2026 -0700"
      },
      "message": "Merge tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull debugobjects fix from Ingo Molnar:\n\n - Fix potential debugobjects deadlock on PREEMPT_RT kernels (Waiman\n   Long)\n\n* tag \u0027core-urgent-2026-06-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  debugobjects: Don\u0027t call fill_pool() in early boot hardirq context\n"
    },
    {
      "commit": "a5e98d1679809cbad0f88f1b6b60e92134d8ee13",
      "tree": "8620070459b18bf31ce5627366e2f44b9fb3442e",
      "parents": [
        "062871f1371b2e02a272ff5279c6479aff0a37ef",
        "35ebcfcc9ef29afcf258db854ccf25572c75baef"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Jun 13 08:14:17 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Jun 13 08:14:17 2026 -0700"
      },
      "message": "Merge tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"The biggest news here is that this is my last pull request as I2C\n  maintainer after 13.5 years. Starting with the 7.2 cycle, Andi Shyti\n  is taking over who helped me greatly maintaining the host drivers for\n  a while now. Thank you, Andi, and good luck with the subsystem. I\u0027ll\n  be around for help, of course.\n\n  Technically, there are two patches which might be a tad large for this\n  late cycle, but most of them is explaining comments, so I think they\n  are suitable.\n\n   - MAINTAINERS:\n      - hand over I2C maintainership to Andi\n      - minor updates\n\n   - rust: fix I2cAdapter refcount double increment\n\n   - imx: keep clock and pinctrl states consistent in runtime PM\n\n   - imx-lpi2c: fix DMA resource leaks on PIO fallback\n\n   - qcom-cci: fix NULL pointer dereference on remove\n\n   - riic: fix reset refcount leak on resume_noirq error path\n\n   - stm32f7: account for analog filter in timing computation\n\n   - tegra:\n      - fix suspend/resume handling in NOIRQ phase\n      - update Tegra410 I2C timings to match hardware specs\"\n\n* tag \u0027i2c-for-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n  dt-bindings: i2c: mux-gpio: name correct maintainer\n  MAINTAINERS: hand over I2C to Andi Shyti\n  i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()\n  MAINTAINERS: i2c: designware: Remove inactive reviewer\n  i2c: tegra: Fix NOIRQ suspend/resume\n  i2c: tegra: Update Tegra410 I2C timing parameters\n  i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()\n  i2c: stm32f7: fix timing computation ignoring i2c-analog-filter\n  i2c: imx: fix clock and pinctrl state inconsistency in runtime PM\n  i2c: riic: fix refcount leak in riic_i2c_resume_noirq()\n  rust: i2c: fix I2cAdapter refcounts double increment\n"
    },
    {
      "commit": "062871f1371b2e02a272ff5279c6479aff0a37ef",
      "tree": "e088c0636470795dbdb8563d01867a94a9e3c750",
      "parents": [
        "4fa048ed72531d6c2a2147fa9b52b6a5451213a2",
        "3f786abd23951f3f600a62fef42469d9200d5f52"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 17:23:05 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 17:23:05 2026 -0700"
      },
      "message": "Merge tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Two fixes for the mcp23s08 driver.\n\n - Revert an earlier fix to the AMD pin controller that was all wrong. A\n   proper fix is being developed.\n\n* tag \u0027pinctrl-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n  Revert \"pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\"\n  pinctrl: mcp23s08: Read spi-present-mask as u8 not u32\n  pinctrl: mcp23s08: Initialize mcp-\u003edev and mcp-\u003eaddr before regmap init\n"
    },
    {
      "commit": "4fa048ed72531d6c2a2147fa9b52b6a5451213a2",
      "tree": "694b56bbd68008cda854051e488c787b7e9d616c",
      "parents": [
        "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0",
        "7c62657a10625e4e113de248d41f543d5a2f3a1a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 15:51:16 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 15:51:16 2026 -0700"
      },
      "message": "Merge tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Looks like it\u0027s settled down a bit more thankfully. Small changes\n  across the board, amdgpu/xe leading with some colorop changes in the\n  core/amd. Otherwise some misc driver fixes.\n\n  colorop:\n   - make lut interpolation mutable\n   - track colorop updates correctly\n\n  amdgpu:\n   - UserQ fix\n   - Userptr fix\n   - MCCS freesync fix\n   - track colorop changes correctly\n\n  amdkfd:\n   - Fix an event information leak\n   - Events bounds check fix\n   - Trap cleanup fix\n\n  i915:\n   - Check supported link rates DPCD read\n   - Fix phys BO pread/pwrite with offset\n\n  xe:\n   - fix oops in suspend/shutdown without display\n   - RAS fixes\n   - Use HW_ERR prefix in log\n   - include all registered queues in TLB invalidation\n   - Fix refcount leak in xe_range_tree in error paths\n   - fix job timeout recovery for unstarted jobs and kernel queues\n\n  amdxdna:\n   - fix possible leak of mm_struct\n\n  ivpu:\n   - fix integer truncation\n\n  vc4:\n   - fix leak in krealloc() error handling\n\n  virtio:\n   - fix dma_fence ref-count leak\"\n\n* tag \u0027drm-fixes-2026-06-13\u0027 of https://gitlab.freedesktop.org/drm/kernel: (24 commits)\n  accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n  drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n  drm/xe: fix refcount leak in xe_range_fence_insert()\n  drm/xe: include all registered queues in TLB invalidation\n  drm/xe/hw_error: Use HW_ERR prefix in log\n  drm/xe/drm_ras: Add per node cleanup action\n  drm/xe/drm_ras: Make counter allocation drm managed\n  drm/xe/display: fix oops in suspend/shutdown without display\n  drm/amd/display: use plane color_mgmt_changed to track colorop changes\n  drm/atomic: track individual colorop updates\n  drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n  drm/colorop: Remove read-only comments from interpolation fields\n  drm/i915/gem: Fix phys BO pread/pwrite with offset\n  drm/vc4: fix krealloc() memory leak\n  drm/virtio: Fix driver removal with disabled KMS\n  drm/i915/edp: Check supported link rates DPCD read\n  accel/ivpu: Fix signed integer truncation in IPC receive\n  drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()\n  drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n  drm/amdkfd: Unwind debug trap enable on copy_to_user failure\n  ...\n"
    },
    {
      "commit": "7c62657a10625e4e113de248d41f543d5a2f3a1a",
      "tree": "0489a36702999be344762419119adb9d6d92a25b",
      "parents": [
        "6fe5552f678bdbb925388ecff30a257b382cb9f6",
        "2f41af638c92bac6f1f9275ea2d1901baef578f3"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Jun 13 07:50:04 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Jun 13 07:52:40 2026 +1000"
      },
      "message": "Merge tag \u0027drm-misc-fixes-2026-06-12\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namd:\n- track colorop changes correctly\n\namdxdna:\n- fix possible leak of mm_struct\n\ncolorop:\n- make lut interpolation mutable\n- track colorop updates correctly\n\nivpu:\n- fix integer truncation\n\nvc4:\n- fix leak in krealloc() error handling\n\nvirtio:\n- fix dma_fence ref-count leak\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260612081418.GA17001@2a02-2455-9062-2500-e496-5a17-62ba-545e.dyn6.pyur.net\n"
    },
    {
      "commit": "2a2974b5145cdf2f4db134be1a2157e9ca4a1cf0",
      "tree": "b9717d818a60b051be6af12f543c3c5ff8b5e792",
      "parents": [
        "28608283615e5e7e92ea79c8ea13507f4b5e0cbe",
        "d898796a8e7ed8528c775f33da056e9978c4c248"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 13:49:45 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 13:49:45 2026 -0700"
      },
      "message": "Merge tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fix from Bjorn Helgaas:\n\n - Add Frank Li as PCI endpoint reviewer (Frank Li)\n\n* tag \u0027pci-v7.1-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n  MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n"
    },
    {
      "commit": "d898796a8e7ed8528c775f33da056e9978c4c248",
      "tree": "2c431a26832cac72b5054db0f8a903f92f42830c",
      "parents": [
        "254f49634ee16a731174d2ae34bc50bd5f45e731"
      ],
      "author": {
        "name": "Frank Li",
        "email": "Frank.Li@nxp.com",
        "time": "Thu Jun 11 17:00:05 2026 -0400"
      },
      "committer": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Fri Jun 12 15:15:38 2026 -0500"
      },
      "message": "MAINTAINERS: Add Frank Li as PCI endpoint reviewer\n\nI have volunteered to review PCI endpoint-related changes.  Add myself as a\nreviewer to be notified when related patches are posted.\n\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Krzysztof Wilczyński \u003ckwilczynski@kernel.org\u003e\nLink: https://patch.msgid.link/20260611210007.529205-1-Frank.Li@oss.nxp.com\n"
    },
    {
      "commit": "28608283615e5e7e92ea79c8ea13507f4b5e0cbe",
      "tree": "eea3e0785303e33f3bcba976cd211084b128add4",
      "parents": [
        "880b719ca0da9d2470fd2652e8ed959ca5143280",
        "3c60184e39b57e5efe664fe8540cdbc1bc7ea899"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 11:06:16 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 11:06:16 2026 -0700"
      },
      "message": "Merge tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A couple of driver specific fixes: a small targeted fix for hardware\n  error handling on DesignWare controllers and another for handling of\n  custom chip select management on Qualcomm GENI controllers\"\n\n* tag \u0027spi-fix-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n  spi: dw: fix race between IRQ handler and error handler on SMP\n  spi: qcom-geni: Fix cs_change handling on the last transfer\n"
    },
    {
      "commit": "880b719ca0da9d2470fd2652e8ed959ca5143280",
      "tree": "a40dde0f220d9195a4ef66306cce8279b62f62c8",
      "parents": [
        "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24",
        "29fe1bd01b99714f3136f922230a643c2742cda9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:49:59 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:49:59 2026 -0700"
      },
      "message": "Merge tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Tweak for an off-by-one in the CQ ring accounting for the min wait\n   support.\n\n - Don\u0027t truncate end buffer length for a bundle, as the transfer might\n   not happen. It\u0027s not required in the first place, as the completion\n   side handles this condition already.\n\n* tag \u0027io_uring-7.1-20260611\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n  io_uring/wait: fix min_timeout behavior\n  io_uring/kbuf: don\u0027t truncate end buffer for bundles\n"
    },
    {
      "commit": "2e04e0961e9226d7e1fdd5bda3373289ba7a3f24",
      "tree": "7550e06f803c22c412a6997c40287512ee57240f",
      "parents": [
        "c133f0433ad78ef51b5b4d3d26ed1940236d71a2",
        "e47832c73b83ec21e67026726a1c8124697792af"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:29:06 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:29:06 2026 -0700"
      },
      "message": "Merge tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB / Thunderbolt fixes from Greg KH:\n \"Here are some small bugfixes for USB serial and Thunderbolt drivers\n  for some reported and found issues. Included in here are:\n\n   - usb serial overflow bugs fixed\n\n   - new usb serial device id\n\n   - thunderbolt validation fixes for reported issues\n\n  All of these have been in linux-next this week with no reported\n  issues\"\n\n* tag \u0027usb-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n  USB: serial: kl5kusb105: fix bulk-out buffer overflow\n  USB: serial: option: add usb-id for Dell Wireless DW5826e-m\n  USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n  USB: serial: io_ti: fix heap overflow in get_manuf_info()\n  thunderbolt: Limit XDomain response copy to actual frame size\n  thunderbolt: Validate XDomain request packet size before type cast\n  thunderbolt: Clamp XDomain response data copy to allocation size\n  thunderbolt: Bound root directory content to block size\n  thunderbolt: Reject zero-length property entries in validator\n"
    },
    {
      "commit": "c133f0433ad78ef51b5b4d3d26ed1940236d71a2",
      "tree": "6deb9241d5434b3d4f1a83fcca32c6868a562d0b",
      "parents": [
        "9a837eff9032ca0e047b068ff101d2183eb0afa1",
        "88e994c57a79f62d5338231d8d37ee8dd98baffe"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:10:12 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 10:10:12 2026 -0700"
      },
      "message": "Merge tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are two small bugfixes for a staging driver to fix a\n  much-reported issue.\n\n  The fixes are for the rtl8723bs driver and it\u0027s something that many\n  scanning tools keep tripping over in convoluted ways (and seems to be\n  able to be triggered by network traffic)\n\n  These fixes have been in linux-next for many weeks with no reported\n  issues, sorry for the delay in getting them to you\"\n\n* tag \u0027staging-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n  staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction\n  staging: rtl8723bs: fix buffer over-read in rtw_update_protection\n"
    },
    {
      "commit": "9a837eff9032ca0e047b068ff101d2183eb0afa1",
      "tree": "9281b338a1335e104441b7dffc780efff0ac77bd",
      "parents": [
        "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4",
        "07ebe87915d8accdaba20c4f88c5ae430fe62fbb"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 09:00:28 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 09:00:28 2026 -0700"
      },
      "message": "Merge tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc driver fixes from Greg KH:\n \"Here are some small driver fixes for 7.1-final to resolve some\n  reported issues. Included in here are:\n\n   - slimbus qcom driver bugfixes\n\n   - nvmem driver bugfixes\n\n   - fastrpc driver bugfixes\n\n   - stratix10 firmware driver bugfixes\n\n  All of these have been in linux-next for over a week with no\n  reported issues\"\n\n* tag \u0027char-misc-7.1-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n  misc: fastrpc: fix use-after-free race in fastrpc_map_create\n  misc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n  misc: fastrpc: fix DMA address corruption due to find_vma misuse\n  misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n  slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl-\u003elock\n  slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD\n  slimbus: qcom-ngd-ctrl: Initialize controller resources in controller\n  slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd\n  slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership\n  slimbus: qcom-ngd-ctrl: Fix probe error path ordering\n  slimbus: qcom-ngd-ctrl: Fix up platform_driver registration\n  slimbus: qcom-ngd-ctrl: fix OF node refcount\n  nvmem: core: fix use-after-free bugs in error paths\n  nvmem: layouts: onie-tlv: fix hang on unknown types\n  firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe\n  firmware: stratix10-svc: Don\u0027t fail probe when async ops unsupported\n  firmware: stratix10-svc: Return -EOPNOTSUPP when ATF async unsupported\n"
    },
    {
      "commit": "1dadb7e7eb5a052a58fb2ec8d60c07186158efc4",
      "tree": "8dacc111044d2dcecf7c5fef2c9bf74eded2f574",
      "parents": [
        "fd41dc46db5eecf21c9d53fe034a731a2767030a",
        "b0d1553d51c3d188baae6d77e6f3dfb415a7b623"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 08:52:10 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 08:52:10 2026 -0700"
      },
      "message": "Merge tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A few small fixes for the last spurt. All changes are small, mostly\n  consisting of driver-specific fixes, along with two UAF fixes for the\n  ALSA timer core.\n\n  Core:\n   - Two UAF fixes in ALSA timer core\n\n  ASoC:\n   - SDCA: Fix NULL pointer dereference\n   - amd / yc: Add DMI quirk for ASUS ExpertBook PM1403CDA\n   - SOF amd: Fix garbage/spurious warnings\n   - wm_adsp: Fix potential NULL dereference when removing firmware\n     controls\n   - loongson: Fix negative position calculation\n   - spi-rzv2h-rspi: Fix SPDR read access width on 16-bit RX path\"\n\n* tag \u0027sound-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n  ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n  ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n  spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n  ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1403CDA\n  ASoC: SOF: amd: set ipc flags to zero\n  ASoC: SOF: amd: fix for ipc flags check\n  ASoC: wm_adsp: Fix NULL dereference when removing firmware controls\n  ALSA: timer: Fix UAF at snd_timer_user_params()\n  ALSA: timer: Forcibly close timer instances at closing\n"
    },
    {
      "commit": "fd41dc46db5eecf21c9d53fe034a731a2767030a",
      "tree": "7feafea0af1648abcbcd8844d5b5ed483be107c4",
      "parents": [
        "f51cae6603c05b4b1fac65c773592e5bc8037251",
        "9c648f3554920721d8878807cd794fe2d7f989e8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 08:44:56 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Jun 12 08:44:56 2026 -0700"
      },
      "message": "Merge tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"Two more small fixes came in, both addressing corner cases in platform\n  specific code: the microchip mpfs system controller probe and the CPU\n  power management on 32-bit rockchips SoCs\"\n\n* tag \u0027soc-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n  ARM: rockchip: keep reset control around\n  soc: microchip: mpfs-sys-controller: fix resource leak on probe error\n"
    },
    {
      "commit": "35ebcfcc9ef29afcf258db854ccf25572c75baef",
      "tree": "fef851d3e7f8e223cf9c6f78172384a7e850b81a",
      "parents": [
        "5cad752e1e73c326c9d784ceb34c9129285539c5",
        "9bffa2a61551da9ac32171f09d556974cb96d70a"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Fri Jun 12 17:05:44 2026 +0200"
      },
      "committer": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Fri Jun 12 17:05:44 2026 +0200"
      },
      "message": "Merge tag \u0027i2c-host-fixes-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v7.1-rc8\n\n- imx: keep clock and pinctrl states consistent in runtime PM\n- imx-lpi2c: fix DMA resource leaks on PIO fallback\n- qcom-cci: fix NULL pointer dereference on remove\n- riic: fix reset refcount leak on resume_noirq error path\n- stm32f7: account for analog filter in timing computation\n- tegra: fix suspend/resume handling in NOIRQ phase\n- tegra: update Tegra410 I2C timings to match hardware specs\n- MAINTAINERS: hand over I2C maintainership to Andi\n"
    },
    {
      "commit": "5cad752e1e73c326c9d784ceb34c9129285539c5",
      "tree": "99da4fd8ce62e4d051c0ed2fae69600b6b98c790",
      "parents": [
        "498cc8f0a93b3e71d186e30d1b93b6f3eca96738"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Thu Jun 11 14:20:53 2026 +0200"
      },
      "committer": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Fri Jun 12 16:58:38 2026 +0200"
      },
      "message": "dt-bindings: i2c: mux-gpio: name correct maintainer\n\nThe YAML conversion added me as maintainer but I can\u0027t recall being\nasked nor do I want to maintain it. Add Peter as maintainer for the\nbinding as he is maintainer of the driver.\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nAcked-by: Peter Korsgaard \u003cpeter.korsgaard@barco.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\n"
    },
    {
      "commit": "9bffa2a61551da9ac32171f09d556974cb96d70a",
      "tree": "5a510a275dbf1012c1f2d6e8b34fa7aa16ead2b6",
      "parents": [
        "695fcefd4a81466ef9c529790b4e96f1ea2ba051"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Tue Jun 09 11:16:14 2026 +0200"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Fri Jun 12 11:11:58 2026 +0200"
      },
      "message": "MAINTAINERS: hand over I2C to Andi Shyti\n\nAfter 13.5 years of maintaining I2C, it is finally time for me to move\nto other areas. So, I hereby transfer I2C maintainership to Andi Shyti.\nHe has been taking care of the I2C host drivers for a while now and\nkindly agreed to look after the whole subsystem. Thank you, Andi! I also\nwant to thank all contributors, reviewers, and fellow maintainers making\nall these years a mostly smooth ride. Happy hacking, everyone!\n\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260609091612.8228-4-wsa+renesas@sang-engineering.com\n"
    },
    {
      "commit": "6fe5552f678bdbb925388ecff30a257b382cb9f6",
      "tree": "c63ead6390afc3bfdba9d3ee89e8c9946e15b71f",
      "parents": [
        "c7be308858890007b4da9b6498a1c1f3e6647dee",
        "347ccc0453fca2c669e8dc8a72000e76ca4adf10"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Jun 12 13:57:16 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Jun 12 13:57:17 2026 +1000"
      },
      "message": "Merge tag \u0027drm-xe-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nUAPI Changes:\n\nCross-subsystem Changes:\n\nCore Changes:\n\nDriver Changes:\n - fix oops in suspend/shutdown without display (Jani)\n - RAS fixes (Raag)\n - Use HW_ERR prefix in log (Raag)\n - include all registered queues in TLB invalidation (Tangudu)\n - Fix refcount leak in xe_range_tree in error paths (Wentao)\n - fix job timeout recovery for unstarted jobs and kernel queues (Rodrigo)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/aitt8ZkYmxIT9cdP@gsse-cloud1.jf.intel.com\n"
    },
    {
      "commit": "c7be308858890007b4da9b6498a1c1f3e6647dee",
      "tree": "e31a5cd8d17179c0dab0056cacbdb83aee0d0b7e",
      "parents": [
        "2aaaf5931b16938a017b7db51b8d9fadad857adc",
        "d21ad938398bca695a511307de38a65889e3b354"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Jun 12 13:32:49 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Jun 12 13:32:49 2026 +1000"
      },
      "message": "Merge tag \u0027drm-intel-fixes-2026-06-11\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Check supported link rates DPCD read [edp] (Nikita Zhandarovich)\n- Fix phys BO pread/pwrite with offset [gem] (Joonas Lahtinen)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aipkcUDnTlzre-8F@linux\n"
    },
    {
      "commit": "f51cae6603c05b4b1fac65c773592e5bc8037251",
      "tree": "d21144c1263676433eeceb4dbc25e8eb8789fe6e",
      "parents": [
        "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce",
        "6ec91df8aff77e2e8fe3179c1f3fc15b43a40ba3"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 14:22:26 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 14:22:26 2026 -0700"
      },
      "message": "Merge tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fix from Marek Szyprowski:\n \"Three more fixes for the DMA-mapping code, related to PCI P2PDMA, DMA\n  debug and DMA link ranges API (Li RongQing and Jason Gunthorpe)\"\n\n* tag \u0027dma-mapping-7.1-2026-06-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n  iommu/dma: Do not try to iommu_map a 0 length region in swiotlb\n  dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device\n  dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments\n"
    },
    {
      "commit": "b0d1553d51c3d188baae6d77e6f3dfb415a7b623",
      "tree": "76dd45e84f64a07e4a57bc6f8434055021d06850",
      "parents": [
        "053a401b592be424fea9d57c789f66cd5d8cec11",
        "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 11 21:29:47 2026 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Jun 11 21:29:47 2026 +0200"
      },
      "message": "Merge tag \u0027asoc-fix-v7.1-rc7\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA few more fixes for this release, some smaller driver specific ones\nplus a final quirk.\n"
    },
    {
      "commit": "2b414a95b8f7307d42173ba9e580d6d3e2bcbfce",
      "tree": "e3349ab3ed37a969406d19f956d659503a006c92",
      "parents": [
        "22e2036479cb77df6281ebbd376ae6c330774790",
        "1f57f68c4dd101e5e8ffc9ffa6428f45bcdd776a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:30:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:30:37 2026 -0700"
      },
      "message": "Merge tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fix from Alexander Gordeev:\n\n - s390 selects GENERIC_LOCKBREAK when PREEMPT is enabled to tackle an\n   old compile error that no longer exists. Since recently PREEMPT is\n   always enabled, this LOCKBREAK config causes massive performance\n   regressions.\n\n   Remove GENERIC_LOCKBREAK from s390 Kconfig to fix the degradation.\n\n* tag \u0027s390-7.1-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n  s390: Remove GENERIC_LOCKBREAK Kconfig option\n"
    },
    {
      "commit": "22e2036479cb77df6281ebbd376ae6c330774790",
      "tree": "d872b0d89bf987fe6abf5897d6034baea0b5608f",
      "parents": [
        "79f2670da86722d075633d20fa57418994ee6940",
        "7360b96099806396f4ce15233f6dddcb69248d34"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:17:49 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 10:17:49 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from IPsec and netfilter.\n\n  This is relatively small, mostly because we are a bit behind our PW\n  queue. I\u0027m not aware of any pending regression.\n\n  Current release - regressions:\n\n   - netfilter: nf_tables_offload: drop device refcount on error\n\n  Previous releases - regressions:\n\n   - core: add pskb_may_pull() to skb_gro_receive_list()\n\n   - xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\n   - ipv6: fix a potential NPD in cleanup_prefix_route()\n\n   - ipv4: fix use-after-free caused by the fqdir_pre_exit() flush\n\n   - eth:\n      - bnxt_en: fix NULL pointer dereference\n      - emac: fix use-after-free during device removal\n      - octeontx2-af: fix memory leak in rvu_setup_hw_resources()\n      - tun: zero the whole vnet header in tun_put_user()\n      - sit: reload inner IPv6 header after GSO offloads\n\n  Previous releases - always broken:\n\n   - core: fix double-free in netdev_nl_bind_rx_doit()\n\n   - netfilter: nf_log: validate MAC header was set before dumping it\n\n   - xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n\n   - tcp: restrict SO_ATTACH_FILTER to priv users\n\n   - mctp: usb: fix race between urb completion and rx_retry\n     cancellation\n\n   - eth:\n      - mlx5: fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list\n      - mvpp2: sync RX data at the hardware packet offset\"\n\n* tag \u0027net-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)\n  octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n  ipv6: Fix a potential NPD in cleanup_prefix_route()\n  net: txgbe: initialize PHY interface to 0\n  net: txgbe: distinguish module types by checking identifier\n  net: txgbe: initialize module info buffer\n  net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n  net: mvpp2: refill RX buffers before XDP or skb use\n  net: mvpp2: limit XDP frame size to the RX buffer\n  net: mvpp2: sync RX data at the hardware packet offset\n  netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n  netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n  netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n  netfilter: nf_log: validate MAC header was set before dumping it\n  netfilter: x_tables: avoid leaking percpu counter pointers\n  netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n  netfilter: nf_tables_offload: drop device refcount on error\n  netfilter: revalidate bridge ports\n  rds: mark snapshot pages dirty in rds_info_getsockopt()\n  ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n  ptp: ocp: fix resource freeing order\n  ...\n"
    },
    {
      "commit": "79f2670da86722d075633d20fa57418994ee6940",
      "tree": "0d2f43a8115f545204ab0fb32e800718516f4bab",
      "parents": [
        "6e9e0dfc7f2e34627a4280b8e168479018d95732",
        "fba0510cd62666951dcc0221527edc0c47ae6599"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 09:54:51 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 09:54:51 2026 -0700"
      },
      "message": "Merge tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - imx: Fix OF node refcount\n\n - ti: Fix wakeup configuration for parent devices of wakeup sources\n\n* tag \u0027pmdomain-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n  pmdomain: imx: fix OF node refcount\n  pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source\n"
    },
    {
      "commit": "2f41af638c92bac6f1f9275ea2d1901baef578f3",
      "tree": "89ac96a1ae37f6f1c7755df1aa0c9bc5709bea21",
      "parents": [
        "d79716401a954677a93c4dd51fec65beccb38296"
      ],
      "author": {
        "name": "Lizhi Hou",
        "email": "lizhi.hou@amd.com",
        "time": "Wed Jun 10 08:11:27 2026 -0700"
      },
      "committer": {
        "name": "Lizhi Hou",
        "email": "lizhi.hou@amd.com",
        "time": "Thu Jun 11 09:50:07 2026 -0700"
      },
      "message": "accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()\n\naie2_populate_range() jumps back to the again label without calling\nmmput(mm), leaking a reference to the mm_struct.\n\nAdd the missing mmput() before jumping to again.\n\nFixes: e486147c912f (\"accel/amdxdna: Add BO import and export\")\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com\n"
    },
    {
      "commit": "6e9e0dfc7f2e34627a4280b8e168479018d95732",
      "tree": "ea9e9c32d46105105c8aff10deab06aa3f7cfda0",
      "parents": [
        "9716c086c8e8b141d35aa61f2e96a2e83de212a7",
        "a23226b7c1f69eafd9ced4e037fb51c9758c0501"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 09:15:57 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Jun 11 09:15:57 2026 -0700"
      },
      "message": "Merge tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix NULL pointer dereference in gpio-mvebu\n\n - fix runtime PM leak in remove path in gpio-zynq\n\n - reject invalid module params in gpio-mockup\n\n - fix generic IRQ chip leak in remove parh in gpio-rockchip\n\n - fix resource leaks in GPIO chip cleanup path on hog failure\n\n - fix a regression in how GPIO hogging code handles multiple GPIO chips\n   reusing the same OF node\n\n* tag \u0027gpio-fixes-for-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n  gpiolib: handle gpio-hogs only once\n  gpio: fix cleanup path on hog failure\n  gpio: rockchip: fix generic IRQ chip leak on remove\n  gpio: mockup: reject invalid gpio_mockup_ranges widths\n  gpio: zynq: fix runtime PM leak on remove\n  gpio: mvebu: fix NULL pointer dereference in suspend/resume\n"
    },
    {
      "commit": "e4c60a1d4b6ccc66aefb3789cd908d4f9482eefd",
      "tree": "61b183bfed5b976e4620b489cec82301a20e41b6",
      "parents": [
        "6ad3914e06a48a02e362d0df2b1073c7c567c93d"
      ],
      "author": {
        "name": "Kean Ren",
        "email": "rh_king@163.com",
        "time": "Thu Jun 11 10:37:57 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Jun 11 15:55:23 2026 +0100"
      },
      "message": "ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions\n\nsdca_dev_unregister_functions() iterates over all SDCA function\ndescriptors and calls sdca_dev_unregister() on each func_dev without\nchecking for NULL. When a function registration has failed partway\nthrough, or the device cleanup races with probe deferral, func_dev\nentries may be NULL, leading to a kernel oops:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  RIP: 0010:device_del+0x1e/0x3e0\n  Call Trace:\n   sdca_dev_unregister_functions+0x37/0x60 [snd_soc_sdca]\n   release_nodes+0x35/0xb0\n   devres_release_all+0x90/0x100\n   device_unbind_cleanup+0xe/0x80\n   device_release_driver_internal+0x1c1/0x200\n   bus_remove_device+0xc6/0x130\n   device_del+0x161/0x3e0\n   device_unregister+0x17/0x60\n   sdw_delete_slave+0xb6/0xd0 [soundwire_bus]\n   sdw_bus_master_delete+0x1e/0x50 [soundwire_bus]\n   ...\n   sof_probe_work+0x19/0x30 [snd_sof]\n\nThis was observed on a Lenovo ThinkPad X1 Carbon G14 (Panther Lake)\nwith the SOF audio driver probe failing due to missing Panther Lake\nfirmware, causing the subsequent cleanup of SoundWire devices to\ntrigger the crash.\n\nFix this with three changes:\n\n1) Add a NULL guard in sdca_dev_unregister() so that callers do not\n   need to pre-validate the pointer (defense in depth).\n\n2) In sdca_dev_unregister_functions(), skip NULL func_dev entries\n   and clear func_dev to NULL after unregistration, making the\n   function idempotent and safe against double-invocation.\n\n3) In sdca_dev_register_functions(), roll back all previously\n   registered functions when a later one fails, so the function\n   array is never left in a partially-populated state.\n\nFixes: 4496d1c65bad (\"ASoC: SDCA: add function devices\")\nSigned-off-by: Kean Ren \u003crh_king@163.com\u003e\nReviewed-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260611023757.1553960-1-rh_king@163.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "347ccc0453fca2c669e8dc8a72000e76ca4adf10",
      "tree": "092779b1e82f7b088e379c4179af4bd7c7831156",
      "parents": [
        "ba36786b21d19082e696eda85bfcd49e7071944a"
      ],
      "author": {
        "name": "Rodrigo Vivi",
        "email": "rodrigo.vivi@intel.com",
        "time": "Wed Jun 10 11:25:49 2026 -0400"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Thu Jun 11 06:39:43 2026 -0700"
      },
      "message": "drm/xe: fix job timeout recovery for unstarted jobs and kernel queues\n\nA job that GuC never scheduled (never started) indicates a GuC\nscheduling failure; previously such jobs were silently errored out\ninstead of triggering a GT reset to recover. Trigger a GT reset and\nresubmit them, but only when the queue was not already killed or banned:\nan unstarted job on an already banned queue is the ban working as\nintended and must neither clear the ban nor kick off a reset, otherwise\na banned userspace queue could be resurrected and spam GT resets.\n\nKernel queues are always recovered this way and wedge the device once\nrecovery attempts are exhausted, since kernel work must not silently\nfail. A started job that times out on a userspace VM bind queue stays\nbanned rather than being reset and retried.\n\nThe queue is banned early in the timeout handler to signal the G2H\nscheduling-done handler so it wakes the disable-scheduling waiter;\nwithout it the waiter sleeps the full 5s timeout. When a reset is\nwarranted the ban is cleared before rearming so that\nguc_exec_queue_start() can resubmit jobs after the GT reset - a\nstill-banned queue would block resubmission and cause an infinite TDR\nloop. The already-banned case is gated out before this point via\nskip_timeout_check, so it is unaffected.\n\nv2: (Himal) Do it for any queue type, not just kernel/migration\nv3: - (Sashiko and Sanjay): don\u0027t clear the ban / GT reset for already\n      killed/banned queues on unstarted-job timeout\n    - Update commit message\n    - (Matt) Add Fixes tag\n\nFixes: fe05cee4d953 (\"drm/xe: Don\u0027t short circuit TDR on jobs not started\")\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nCc: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nAssisted-by: GitHub-Copilot:claude-sonnet-4.6\nAssisted-by: GitHub-Copilot:claude-opus-4.8\nTested-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Himal Prasad Ghimiray \u003chimal.prasad.ghimiray@intel.com\u003e\nLink: https://patch.msgid.link/20260610152548.404575-3-rodrigo.vivi@intel.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit b1107d085e7e8ed15ba6f80c102528a9c8a6cb0e)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "ba36786b21d19082e696eda85bfcd49e7071944a",
      "tree": "4c7fb38d4903c3cc758fac88447962d09b14ecb2",
      "parents": [
        "e4aaac46593733a06ec1a1f1a63128206d67fcaa"
      ],
      "author": {
        "name": "Wentao Liang",
        "email": "vulab@iscas.ac.cn",
        "time": "Wed Jun 10 10:27:05 2026 -0700"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Thu Jun 11 06:39:40 2026 -0700"
      },
      "message": "drm/xe: fix refcount leak in xe_range_fence_insert()\n\nxe_range_fence_insert() acquires a reference on fence via\ndma_fence_get() and stores it in rfence-\u003efence.  It then calls\ndma_fence_add_callback() and handles two cases: when the callback\nis successfully registered (err \u003d\u003d 0) the fence is transferred to\nthe tree for later cleanup; when the fence is already signaled\n(err \u003d\u003d -ENOENT) it manually drops the extra reference with\ndma_fence_put(fence).\n\nHowever, dma_fence_add_callback() can fail with other errors\n(e.g. -EINVAL) and in that case the code falls through to the free:\nlabel without releasing the acquired reference, leaking it.\n\nFix the leak by adding an else branch that calls dma_fence_put()\nbefore jumping to free: for any error other than -ENOENT.\n\nFixes: 845f64bdbfc9 (\"drm/xe: Introduce a range-fence utility\")\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260610172705.3450560-1-matthew.brost@intel.com\n(cherry picked from commit 98c4a4201290823c2c5c7ba21692bd9a64b61021)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "7360b96099806396f4ce15233f6dddcb69248d34",
      "tree": "0d26fe1f8292949f5da3727d3500f37b5f22046f",
      "parents": [
        "64ced6c0882756db52cbedf50bc66338de4a4045"
      ],
      "author": {
        "name": "Kiran Kumar K",
        "email": "kirankumark@marvell.com",
        "time": "Mon Jun 08 15:24:55 2026 +0530"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 12:59:34 2026 +0200"
      },
      "message": "octeontx2-af: fix IP fragment flag corruption on custom KPU profile load\n\nnpc_cn20k_apply_custom_kpu() overwrites KPU profile entries with custom\nfirmware values and then calls npc_cn20k_update_action_entries_n_flags()\nover all entries.  Since the same function already ran during default\nprofile initialisation, entries not overridden by the custom firmware\nget their flags translated twice, corrupting the CN20K-specific values.\n\nFix this by extracting the per-entry translation into a helper\nnpc_cn20k_translate_action_flags() and calling it as each custom entry\nis loaded, removing the redundant batch call at the end.\n\nFixes: ef992a0f12e8 (\"octeontx2-af: npc: cn20k: MKEX profile support\")\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Kiran Kumar K \u003ckirankumark@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260608095455.1499203-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "64ced6c0882756db52cbedf50bc66338de4a4045",
      "tree": "e367659ac44fc0518a60896bec81e60840fa6755",
      "parents": [
        "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e",
        "c7d573551f9286100a055ef696cde6af54549677"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 12:29:59 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 12:30:00 2026 +0200"
      },
      "message": "Merge tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Revalidate bridge ports, add missing NULL checks to fetch the bridge\n   device by the port. From Florian Westphal.\n\n2) Fix netdevice refcount leak in the error path of nft_fwd hardware\n   offload function, also from Florian.\n\n3) Unregister helper expectfn callback on conntrack helper module\n   removal, otherwise dangling pointer remains in place,\n   from Weiming Shi.\n\n4) Fix possible pointer infoleak in getsockopt() IPT_SO_GET_ENTRIES,\n   From Kyle Zeng.\n\n5) Validate that device MAC header is present before nf_syslog\n   accesses it. From Xiang Mei.\n\n6-8) Three patches to address a possible infoleak of stale stack\n     data in three nf_tables expressions, due to mismatch in the\n     _init() and _eval() function which is possible since 14fb07130c7d.\n     From Davide Ornaghi and Florian Westphal.\n\nnetfilter pull request 26-06-10\n\n* tag \u0027nf-26-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n  netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n  netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n  netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n  netfilter: nf_log: validate MAC header was set before dumping it\n  netfilter: x_tables: avoid leaking percpu counter pointers\n  netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n  netfilter: nf_tables_offload: drop device refcount on error\n  netfilter: revalidate bridge ports\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610161629.214092-1-pablo@netfilter.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6ad3914e06a48a02e362d0df2b1073c7c567c93d",
      "tree": "b650bd7c92e779976173b5b0bf2b6c22e96cd0e1",
      "parents": [
        "310628484ef06f95c5589374fade917a5689787b"
      ],
      "author": {
        "name": "Li Jun",
        "email": "lijun01@kylinos.cn",
        "time": "Thu Jun 11 09:00:45 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Thu Jun 11 11:21:24 2026 +0100"
      },
      "message": "ASoC: loongson: Fix invalid position error in ls_pcm_pointer\n\nThe \"invalid position\" error occurred when the DMA position descriptor\nreturned an invalid address value (e.g., pos \u003d -1048838144). This happened\nbecause the `bytes_to_frames()` function returns a signed value, but when\n`addr \u003c runtime-\u003edma_addr`, the subtraction produces a negative result that\ngets interpreted as a large unsigned integer in comparisons.\nwhen the addr is abnormal, for example,the DMA controller is abnormal in\nhardware,x\u003d0 should not be a point(x \u003d\u003d runtime-\u003ebuffer_size),but a range,\nwhich includes the addr address being less than runtime -\u003edma1-adr, and\nthe addr exceeding the DMA address range.the value of pos should not better\na negative，return 0, maybe better.\n\n[   32.834431][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   32.845019][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   32.855588][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   32.866145][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   32.995394][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   33.006025][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n[   33.016748][ 2]  soc-audio soc-audio: invalid position: , pos \u003d -1048838144\n\nSigned-off-by: Li Jun \u003clijun01@kylinos.cn\u003e\n[Remove XRUN reporting I\u0027d mistakenly avised adding on prior review -- broonie]\nLink: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "29899ec61ac6fcc9d46f5f8d0b72117d9a676c2e",
      "tree": "ab82359e5c0d7089f7fceaa8a065b7736927e3b1",
      "parents": [
        "b70c687b7cf267fb08586667a3946c8851cad672",
        "26aad08a928901296aabfbc7a33ecb951656bb98"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 12:00:49 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 12:00:49 2026 +0200"
      },
      "message": "Merge tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2026-06-10\n\n1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n   Propagate SKBFL_SHARED_FRAG when paged fragments are moved between\n   skbs so ESP can decide whether in-place crypto is safe.\n\n2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n   Replace the unlocked read of xtfs-\u003era_newskb with a local flag so a\n   concurrent reassembly can no longer free first_skb between\n   spin_unlock and the post-loop check.\n\n3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n   Prune the inexact bin under xfrm_policy_lock so a concurrent\n   xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill()\n   dereferences it.\n\n4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n   Move hrtimer_cancel() for the output and drop timers ahead of their\n   spinlocks, breaking the softirq/lock cycle that could deadlock\n   against the timer callbacks on SMP.\n\n5) xfrm: espintcp: do not reuse an in-progress partial send\n   Fail a new send when espintcp_push_msgs() returns with emsg-\u003elen\n   still set, so a blocking caller can no longer overwrite ctx-\u003epartial\n   while a previous transfer still owns it.\n\n6) esp: fix page frag reference leak on skb_to_sgvec failure\n   Add a flag to esp_ssg_unref() to unconditionally unref the source\n   scatterlist, releasing the old page references that are otherwise\n   leaked when the second skb_to_sgvec() in esp_output_tail() fails.\n\nPlease pull or let me know if there are problems.\n\nipsec-2026-06-10\n\n* tag \u0027ipsec-2026-06-10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:\n  esp: fix page frag reference leak on skb_to_sgvec failure\n  xfrm: espintcp: do not reuse an in-progress partial send\n  xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()\n  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n  xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload\n  xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b70c687b7cf267fb08586667a3946c8851cad672",
      "tree": "39c7bed2d853db117c8467e216891b644ea9ee62",
      "parents": [
        "0068940907d33217ae01217f84910a5cde606c17"
      ],
      "author": {
        "name": "Ido Schimmel",
        "email": "idosch@nvidia.com",
        "time": "Tue Jun 09 17:54:48 2026 +0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 11:57:11 2026 +0200"
      },
      "message": "ipv6: Fix a potential NPD in cleanup_prefix_route()\n\naddrconf_get_prefix_route() can return the fib6_null_entry sentinel\nentry which has a NULL fib6_table pointer. Therefore, before setting the\nroute\u0027s expiration time, check that we are not working with this entry,\nas otherwise a NPD will be triggered [1].\n\nNote that the other callers of addrconf_get_prefix_route() are not\nsusceptible to this bug:\n\n1. addrconf_prefix_rcv(): Requests a route with the \u0027RTF_ADDRCONF |\n   RTF_PREFIX_RT\u0027 flags which are not set on fib6_null_entry.\n\n2. modify_prefix_route(): Fixed by commit a747e02430df (\"ipv6: avoid\n   possible NULL deref in modify_prefix_route()\").\n\n3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for\n   fib6_null_entry and returns an error.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[...]\nCall Trace:\n\u003cTASK\u003e\n__kasan_check_byte (mm/kasan/common.c:573)\nlock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))\n_raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))\ncleanup_prefix_route (net/ipv6/addrconf.c:1280)\nipv6_del_addr (net/ipv6/addrconf.c:1342)\ninet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)\ninet6_rtm_deladdr (net/ipv6/addrconf.c:4812)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6997)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2555)\nnetlink_unicast (net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1899)\n__sock_sendmsg (net/socket.c:802 (discriminator 4))\n____sys_sendmsg (net/socket.c:2698)\n___sys_sendmsg (net/socket.c:2752)\n__sys_sendmsg (net/socket.c:2784)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nFixes: 5eb902b8e719 (\"net/ipv6: Remove expired routes with a separated list of routes.\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nReviewed-by: David Ahern \u003cdahern@nvidia.com\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0068940907d33217ae01217f84910a5cde606c17",
      "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489",
      "parents": [
        "b59873c9c40d0cbc16df86cf6cb5430330a0ac74",
        "47f848aac4e79bdb197f849fa86e71fff1ad36ef"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 10:55:15 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 10:55:16 2026 +0200"
      },
      "message": "Merge branch \u0027net-txgbe-fix-module-identification\u0027\n\nJiawen Wu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: txgbe: fix module identification\n\nFor AML devices, there are some issues where the wrong module\nindentified then configure PHY failed.\n\nThe module info buffers should be initialized to 0 before the firmware\nreturns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee\nzeroed contents, so explicitly clear the temporary interface masks before\nsetting supported interfaces.\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "47f848aac4e79bdb197f849fa86e71fff1ad36ef",
      "tree": "aa2ce14e471e9d7d586d306e7e1cad4466719489",
      "parents": [
        "f2df54ddbfb04a006ee326a5d8270434a414e0af"
      ],
      "author": {
        "name": "Jiawen Wu",
        "email": "jiawenwu@trustnetic.com",
        "time": "Mon Jun 08 15:08:42 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 10:55:14 2026 +0200"
      },
      "message": "net: txgbe: initialize PHY interface to 0\n\nDECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a\nnew macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to\nbe zeroed before setting supported interfaces.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f2df54ddbfb04a006ee326a5d8270434a414e0af",
      "tree": "c324685962425d4260e8e82d6284466bf54d671f",
      "parents": [
        "0487cfca46517ff6699c72dc1a8872b0af3c31a9"
      ],
      "author": {
        "name": "Jiawen Wu",
        "email": "jiawenwu@trustnetic.com",
        "time": "Mon Jun 08 15:08:41 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 10:55:14 2026 +0200"
      },
      "message": "net: txgbe: distinguish module types by checking identifier\n\nRework txgbe_identify_module() to validate module identifiers through\nexplicit type checks instead of relying on transceiver_type heuristics.\nWhen using the SFP module, transceiver_type could be a random value,\nbecause it was read from an invalid register.\n\nFixes: 57d39faed4c9 (\"net: txgbe: improve functions of AML 40G devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0487cfca46517ff6699c72dc1a8872b0af3c31a9",
      "tree": "d6b994cf0f085cd66054d5fd0265b8c54bd4c7b5",
      "parents": [
        "b59873c9c40d0cbc16df86cf6cb5430330a0ac74"
      ],
      "author": {
        "name": "Jiawen Wu",
        "email": "jiawenwu@trustnetic.com",
        "time": "Mon Jun 08 15:08:40 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 10:55:14 2026 +0200"
      },
      "message": "net: txgbe: initialize module info buffer\n\nThe module info buffer should be initialized to 0 before the firmware\nreturns information. Otherwise, there is a risk that the buffer field\nnot filled by the firmware is random value.\n\nFixes: 343929799ace (\"net: txgbe: Support to handle GPIO IRQs for AML devices\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b59873c9c40d0cbc16df86cf6cb5430330a0ac74",
      "tree": "b0eb340983a1a9528d273b170e237255f038c236",
      "parents": [
        "512db8267b73a220a64180d95ab5eebe7c4964a8",
        "77a6b90ce56bc982dcfa94229b8e28e6abb16e95"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:33 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:33 2026 +0200"
      },
      "message": "Merge branch \u0027net-mvpp2-fix-xdp-rx-buffer-handling\u0027\n\nTil Kaiser says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mvpp2: fix XDP RX buffer handling\n\nThis is v5 of the earlier XDP_PASS fix. The XDP_PASS change is\nretained, and the series also fixes related RX/XDP buffer handling\nissues found during review.\n\nTested with tools/testing/selftests/drivers/net/xdp.py on mvpp2\nhardware.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "77a6b90ce56bc982dcfa94229b8e28e6abb16e95",
      "tree": "b0eb340983a1a9528d273b170e237255f038c236",
      "parents": [
        "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6"
      ],
      "author": {
        "name": "Til Kaiser",
        "email": "mail@tk154.de",
        "time": "Sun Jun 07 15:49:43 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:31 2026 +0200"
      },
      "message": "net: mvpp2: build skb from XDP-adjusted data on XDP_PASS\n\nWhen an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()\nand then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets\nderived from the original RX descriptor. Packet geometry changes made by\nthe XDP program are therefore discarded before the skb reaches the stack.\n\nUpdate rx_offset and rx_bytes from xdp.data and xdp.data_end for\nXDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen\nby XDP, and makes RX byte accounting for XDP_PASS follow the length of the\nskb passed to the network stack.\n\nKeep a separate rx_sync_size for page-pool recycling on skb allocation\nfailure, which must stay tied to the received buffer range.\n\nNon-PASS verdicts continue to account the descriptor length because no skb\nis passed up in those cases.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6",
      "tree": "adb0381ccb32e0e21023ba87db46fa17078dfb79",
      "parents": [
        "f3c6aa078927e6fe8121c9c591ddee8716c5305a"
      ],
      "author": {
        "name": "Til Kaiser",
        "email": "mail@tk154.de",
        "time": "Sun Jun 07 15:49:42 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:31 2026 +0200"
      },
      "message": "net: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nFixes: d6526926de73 (\"net: mvpp2: fix memory leak in mvpp2_rx\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f3c6aa078927e6fe8121c9c591ddee8716c5305a",
      "tree": "1c280e4029f2d969be34e95055b03c9791b4492e",
      "parents": [
        "180235600934bef6add3be637c296d6cf3272e67"
      ],
      "author": {
        "name": "Til Kaiser",
        "email": "mail@tk154.de",
        "time": "Sun Jun 07 15:49:41 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:31 2026 +0200"
      },
      "message": "net: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool-\u003efrag_size so XDP tailroom matches\nthe actual buffer backing the packet.\n\nFixes: 07dd0a7aae7f (\"mvpp2: add basic XDP support\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "180235600934bef6add3be637c296d6cf3272e67",
      "tree": "ecb9855b324d5a209827608ae91fc302d3d85901",
      "parents": [
        "512db8267b73a220a64180d95ab5eebe7c4964a8"
      ],
      "author": {
        "name": "Til Kaiser",
        "email": "mail@tk154.de",
        "time": "Sun Jun 07 15:49:40 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Jun 11 09:57:31 2026 +0200"
      },
      "message": "net: mvpp2: sync RX data at the hardware packet offset\n\nmvpp2 programs the RX queue packet offset, so hardware writes received\ndata at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at\ndma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the\nunused headroom and misses the same number of bytes at the packet tail.\n\nOn non-coherent DMA systems this can leave the CPU reading stale cache\ncontents for the end of the received frame.\n\nUse dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range\noffset so the sync covers the Marvell header and packet data actually\nwritten by hardware.\n\nFixes: e1921168bbd4 (\"mvpp2: sync only the received frame\")\nSigned-off-by: Til Kaiser \u003cmail@tk154.de\u003e\nLink: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "9716c086c8e8b141d35aa61f2e96a2e83de212a7",
      "tree": "918331b178b771fa02019c3fc60c8da519c22ddf",
      "parents": [
        "767622308a1d8b111038fca0059b964da1f6d9c4",
        "6100a82e34cb75571feba920a9c18f60698d598a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jun 10 11:53:55 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jun 10 11:53:55 2026 -0700"
      },
      "message": "Merge tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These address some remaining fallout after introducing dynamic EPP\n  support in the amd-pstate driver during the current development cycle:\n\n   - Restore allowing writing EPP of 0 when in performance mode in the\n     amd-pstate driver which was unnecessarily disallowed by one of the\n     recent updates (Mario Limonciello)\n\n   - Remove stale documentation of the epp_cached field in struct\n     amd_cpudata that has been dropped recently (Zhan Xusheng)\"\n\n* tag \u0027pm-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  cpufreq/amd-pstate: Fix setting EPP in performance mode\n  cpufreq/amd-pstate: drop stale @epp_cached kdoc\n"
    },
    {
      "commit": "e4aaac46593733a06ec1a1f1a63128206d67fcaa",
      "tree": "8544b7271c0230c1b1008acd1ad26e0d925db736",
      "parents": [
        "381b3576a87f4ed6e76adb78d7d9400428f8f4b7"
      ],
      "author": {
        "name": "Tangudu Tilak Tirumalesh",
        "email": "tilak.tirumalesh.tangudu@intel.com",
        "time": "Mon Jun 08 21:57:44 2026 +0530"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Wed Jun 10 09:33:29 2026 -0700"
      },
      "message": "drm/xe: include all registered queues in TLB invalidation\n\nContext-based TLB invalidation currently selects only scheduling-active\nexec queues via q-\u003eops-\u003eactive(). During rebind flows, queues may be\nsuspended (or transitioning through resume) while still owning valid\ntranslations, causing them to be skipped from invalidation and leading\nto missed TLB invalidations on LR rebinds.\n\nThe underlying issue is a TOCTOU: q-\u003eguc-\u003estate bits are flipped lock-free\nfrom enable_scheduling(), disable_scheduling{,_deregister}(), the\nsuspend/resume sched-msg handlers, handle_sched_done(), and\nguc_exec_queue_stop(); nothing in send_tlb_inval_ctx_ppgtt() serializes\nagainst them, so any state-based predicate can race.\n\nInclude all the registered queues so that TLB invalidations are not\nmissed. This is race-free because list membership on vm-\u003eexec_queues.list\nis stable under vm-\u003eexec_queues.lock held by the caller. The performance\nimpact is expected to be minimal and harmless. If it does turn out to be\na concern, we can come back with a race-safe solution to ignore certain\nqueues.\n\nFixes: 6cdaa5346d6f (\"drm/xe: Add context-based invalidation to GuC TLB invalidation backend\")\nAssisted-by: Claude:claude-opus-4.6\nSuggested-by: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nSigned-off-by: Tangudu Tilak Tirumalesh \u003ctilak.tirumalesh.tangudu@intel.com\u003e\nReviewed-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260608162745.338725-2-tilak.tirumalesh.tangudu@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit aa625e1e9f0710e424fe4f0e3f032807df81b5b0)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "381b3576a87f4ed6e76adb78d7d9400428f8f4b7",
      "tree": "6a6ef436b54ca5037ee139ecafd77e7fe2b119e5",
      "parents": [
        "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae"
      ],
      "author": {
        "name": "Raag Jadav",
        "email": "raag.jadav@intel.com",
        "time": "Tue Jun 02 10:18:44 2026 +0530"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Wed Jun 10 09:33:25 2026 -0700"
      },
      "message": "drm/xe/hw_error: Use HW_ERR prefix in log\n\nHardware errors should be logged with HW_ERR prefix. Make them\nconsistent with existing logs.\n\nFixes: 01aab7e1c9d4 (\"drm/xe/xe_hw_error: Add support for PVC SoC errors\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-5-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit ad60a618c49fef07d1860bfb1091140d29f5eddb)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "3e3f5b0c5ae6845b4d8d23f079e872635cd8b0ae",
      "tree": "16a72ad3985e16f0d23c9a636606bb86438be4c7",
      "parents": [
        "4dcfcdc9fbb5efef21e149adf349d42d84c9da04"
      ],
      "author": {
        "name": "Raag Jadav",
        "email": "raag.jadav@intel.com",
        "time": "Tue Jun 02 10:18:43 2026 +0530"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Wed Jun 10 09:33:22 2026 -0700"
      },
      "message": "drm/xe/drm_ras: Add per node cleanup action\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Add per node cleanup action which guarantees\ncleanup on unwind and also simplifies the cleanup logic.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-4-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 67fc5543d8274b2fcbef87734fad0469358f4478)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "4dcfcdc9fbb5efef21e149adf349d42d84c9da04",
      "tree": "d83dccc2072546a25d046b7d72c36321cadcdb66",
      "parents": [
        "68938cc08e23a94fd881e845837ff918de005ce7"
      ],
      "author": {
        "name": "Raag Jadav",
        "email": "raag.jadav@intel.com",
        "time": "Tue Jun 02 10:18:42 2026 +0530"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Wed Jun 10 09:33:18 2026 -0700"
      },
      "message": "drm/xe/drm_ras: Make counter allocation drm managed\n\ncleanup_node_param() is not registered for previous node in case of counter\nallocation failure, which results in stale memory of previous node that\nisn\u0027t cleaned up on unwind. Fix this using drm managed allocation, which is\nguaranteed to be cleaned up on unwind.\n\nFixes: b40db12b542f (\"drm/xe/xe_drm_ras: Add support for XE DRM RAS\")\nSigned-off-by: Raag Jadav \u003craag.jadav@intel.com\u003e\nReviewed-by: Riana Tauro \u003criana.tauro@intel.com\u003e\nLink: https://patch.msgid.link/20260602044919.702209-3-raag.jadav@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 58d77c77ea0c5cb2b755ebe23e973c8272acd896)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "68938cc08e23a94fd881e845837ff918de005ce7",
      "tree": "333af8b83be098430cb8576342f728825a4be97e",
      "parents": [
        "4549871118cf616eecdd2d939f78e3b9e1dddc48"
      ],
      "author": {
        "name": "Jani Nikula",
        "email": "jani.nikula@intel.com",
        "time": "Fri May 15 19:09:20 2026 +0300"
      },
      "committer": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Wed Jun 10 09:33:09 2026 -0700"
      },
      "message": "drm/xe/display: fix oops in suspend/shutdown without display\n\nThe xe driver keeps track of whether to probe display, and whether\ndisplay hardware is there, using xe-\u003einfo.probe_display. It gets set to\nfalse if there\u0027s no display after intel_display_device_probe(). However,\nthe display may also be disabled via fuses, detected at a later time in\nintel_display_device_info_runtime_init().\n\nIn this case, the xe driver does for_each_intel_crtc() on uninitialized\nmode config in xe_display_flush_cleanup_work(), leading to a NULL\npointer dereference, and generally calls display code with display info\ncleared.\n\nCheck for intel_display_device_present() after\nintel_display_device_info_runtime_init(), and reset\nxe-\u003einfo.probe_display as necessary. Also do unset_display_features()\nfor completeness, although display runtime init has already done\nthat. This will need to be unified across all cases later.\n\nMove intel_display_device_info_runtime_init() call slightly earlier,\nsimilar to i915, to avoid a bunch of unnecessary setup for no display\ncases.\n\nNote #1: The xe driver has no business doing low level display plumbing\nlike for_each_intel_crtc() to begin with. It all needs to happen in\ndisplay code.\n\nNote #2: The actual bug is present already in commit 44e694958b95\n(\"drm/xe/display: Implement display support\"), but the oops was likely\nintroduced later at commit ddf6492e0e50 (\"drm/xe/display: Make display\nsuspend/resume work on discrete\").\n\nFixes: 44e694958b95 (\"drm/xe/display: Implement display support\")\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7904\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6150\nCc: stable@vger.kernel.org # v6.8+\nReviewed-by: Suraj Kandpal \u003csuraj.kandpal@intel.com\u003e\nLink: https://patch.msgid.link/20260515160920.1082842-1-jani.nikula@intel.com\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n(cherry picked from commit 7c3eb9f47533220888a67266448185fd0775d4da)\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\n"
    },
    {
      "commit": "c7d573551f9286100a055ef696cde6af54549677",
      "tree": "3b55982a657bd6eaadfa6632b3acc0ec7c1f8dc4",
      "parents": [
        "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c"
      ],
      "author": {
        "name": "Davide Ornaghi",
        "email": "d.ornaghi97@gmail.com",
        "time": "Wed Jun 10 12:39:13 2026 +0200"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 18:00:32 2026 +0200"
      },
      "message": "netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register\n\nNFT_META_BRI_IIFHWADDR declares its destination register with\nlen \u003d ETH_ALEN (6 bytes), which the register-init tracking rounds up to\ntwo 32-bit registers (8 bytes). nft_meta_bridge_get_eval() then does\nmemcpy(dest, br_dev-\u003edev_addr, ETH_ALEN), writing only 6 bytes and\nleaving the upper 2 bytes of the second register as uninitialised\nnft_do_chain() stack. A downstream load of that register span leaks\nthose stale bytes to userspace.\n\nZero the second register before the memcpy so the full declared span is\nwritten.\n\nFixes: cbd2257dc96e (\"netfilter: nft_meta_bridge: introduce NFT_META_BRI_IIFHWADDR support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "ab185e0c4fb82dfba6fb86f8271e06f931d9c64c",
      "tree": "fe4753675107e422020c0706b4ef3453286bef14",
      "parents": [
        "772cecf198da732faebb5dcfc46d66a505be8495"
      ],
      "author": {
        "name": "Davide Ornaghi",
        "email": "d.ornaghi97@gmail.com",
        "time": "Wed Jun 10 12:39:12 2026 +0200"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 18:00:19 2026 +0200"
      },
      "message": "netfilter: nft_fib: fix stale stack leak via the OIFNAME register\n\nFor NFT_FIB_RESULT_OIFNAME the destination register is declared with\nlen \u003d IFNAMSIZ (four 32-bit registers), but on the lookup-fail,\nRTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one\nregister via \"*dest \u003d 0\". The remaining three registers are left as\nwhatever was on the stack in nft_do_chain()\u0027s struct nft_regs, and a\ndownstream expression that loads the register span can leak that\nuninitialised kernel stack to userspace.\n\nThe NFTA_FIB_F_PRESENT existence check has the same shape: it is only\nmeaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type\nwhile the eval stores a single byte via nft_reg_store8(), leaving the rest\nof the declared span stale.\n\nFix both:\n\n - replace the bare \"*dest \u003d 0\" in the eval with nft_fib_store_result(),\n   which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already\n   used on the other early-return path), and\n\n - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its\n   destination as a single u8, so the marked span matches the one byte\n   the eval writes.\n\nFixes: f6d0cbcf09c5 (\"netfilter: nf_tables: add fib expression\")\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Davide Ornaghi \u003cd.ornaghi97@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "772cecf198da732faebb5dcfc46d66a505be8495",
      "tree": "477ccc145bc5973aa7d806445cd8e4f6b38a0b4c",
      "parents": [
        "a84b6fedbc97078788be78dbdd7517d143ad1a77"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Jun 09 21:28:09 2026 +0200"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 18:00:12 2026 +0200"
      },
      "message": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n\nnft_exthdr_init() passes user-controlled priv-\u003elen to\nnft_parse_register_store(), which marks that many bytes in the\nregister bitmap as initialized.  However, when NFT_EXTHDR_F_PRESENT\nis set, the eval paths write only 1 byte (nft_reg_store8) or\n4 bytes (*dest \u003d 0 on TCP/DCCP error path).  When len \u003e 4,\nregisters beyond the first are never written, retaining\nuninitialized stack data from nft_regs.\n\nBail out if userspace requests too much data when F_PRESENT is set.\n\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nFixes: c078ca3b0c5b (\"netfilter: nft_exthdr: Add support for existence check\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "a84b6fedbc97078788be78dbdd7517d143ad1a77",
      "tree": "b949480e102f10fa258f524b96b607699c7151c6",
      "parents": [
        "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Tue Jun 09 15:55:02 2026 -0700"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 18:00:01 2026 +0200"
      },
      "message": "netfilter: nf_log: validate MAC header was set before dumping it\n\nThe fallback path of dump_mac_header() guards the MAC header access\nonly with \"skb-\u003emac_header !\u003d skb-\u003enetwork_header\", without checking\nskb_mac_header_was_set(). When the MAC header is unset, mac_header is\n0xffff, so the test passes and skb_mac_header(skb) returns\nskb-\u003ehead + 0xffff, ~64 KiB past the buffer; the loop then reads\ndev-\u003ehard_header_len bytes out of bounds into the kernel log.\n\nThis is reachable via the netdev logger: nf_log_unknown_packet() calls\ndump_mac_header() unconditionally, and an skb sent through AF_PACKET\nwith PACKET_QDISC_BYPASS reaches the egress hook with mac_header still\nunset (__dev_queue_xmit(), which would reset it, is bypassed).\n\nAdd the skb_mac_header_was_set() check the ARPHRD_ETHER path already\nuses, and replace the open-coded MAC header length test with\nskb_mac_header_len(). Only skbs with an unset MAC header are affected;\nvalid ones are dumped as before.\n\n BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n Read of size 1 at addr ffff88800ea49d3f by task exploit/148\n Call Trace:\n  kasan_report (mm/kasan/report.c:595)\n  dump_mac_header (net/netfilter/nf_log_syslog.c:831)\n  nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)\n  nf_log_packet (net/netfilter/nf_log.c:260)\n  nft_log_eval (net/netfilter/nft_log.c:60)\n  nft_do_chain (net/netfilter/nf_tables_core.c:285)\n  nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)\n  nf_hook_slow (net/netfilter/core.c:619)\n  nf_hook_direct_egress (net/packet/af_packet.c:257)\n  packet_xmit (net/packet/af_packet.c:280)\n  packet_sendmsg (net/packet/af_packet.c:3114)\n  __sys_sendto (net/socket.c:2265)\n\nFixes: 7eb9282cd0ef (\"netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f",
      "tree": "e2886b33a6821900694c7e4fc017a6a89c360de1",
      "parents": [
        "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3"
      ],
      "author": {
        "name": "Kyle Zeng",
        "email": "kylebot@openai.com",
        "time": "Sat Jun 06 01:10:31 2026 -0700"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 17:59:01 2026 +0200"
      },
      "message": "netfilter: x_tables: avoid leaking percpu counter pointers\n\nThe native and compat get-entries paths copy the fixed rule entry header\nfrom the kernelized rule blob to userspace before overwriting the entry\u0027s\ncounter fields with a sanitized counter snapshot.\n\nOn SMP kernels, entry-\u003ecounters.pcnt contains the percpu allocation\naddress used by x_tables rule counters. A caller can provide a userspace\nbuffer that faults during the initial fixed-header copy after pcnt has\nbeen copied but before the later sanitized counter copy runs. The syscall\nthen returns -EFAULT while leaving the raw percpu pointer in userspace.\n\nCopy only the fixed entry prefix before counters from the kernelized rule\nblob, then copy the sanitized counter snapshot into the counter field.\nApply this ordering to the IPv4, IPv6, and ARP native and compat\nget-entries implementations so a fault cannot expose the internal percpu\ncounter pointer.\n\nFixes: 71ae0dff02d7 (\"netfilter: xtables: use percpu rule counters\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3",
      "tree": "8ab258ae3560c0e20835e1745b54c9a9aa886bf3",
      "parents": [
        "efc542561729a2859397dad51bda1fe41262beb1"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Wed Jun 03 00:38:17 2026 -0700"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 17:58:39 2026 +0200"
      },
      "message": "netfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp-\u003eexpectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp-\u003eexpectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp-\u003eexpectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n  init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n  nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n  ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n  nf_hook_slow (net/netfilter/core.c:619)\n  __ip_local_out (net/ipv4/ip_output.c:120)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n  tcp_connect (net/ipv4/tcp_output.c:4374)\n  tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n  __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose -\u003eexpectfn matches the descriptor being torn\ndown. Call it from each NAT helper\u0027s exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.\n\nFixes: f587de0e2feb (\"[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "efc542561729a2859397dad51bda1fe41262beb1",
      "tree": "2bb16a7ee4276bb9c7d2905291e42b5cee73b3c6",
      "parents": [
        "ccb9fd4b87538ccf19ccff78ee26700526d94867"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Fri Jun 05 13:47:12 2026 +0200"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 17:58:29 2026 +0200"
      },
      "message": "netfilter: nf_tables_offload: drop device refcount on error\n\nReported by sashiko:\nIf nft_flow_action_entry_next() returns NULL, dev reference leaks.\n\nFixes: c6f85577584b (\"netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it\")\nReported-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "ccb9fd4b87538ccf19ccff78ee26700526d94867",
      "tree": "85002bc68f328b5d7c414d4157689881fa3d000f",
      "parents": [
        "4aacf509e537a711fa71bca9f234e5eb6968850e"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Jun 02 17:04:25 2026 +0200"
      },
      "committer": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Wed Jun 10 17:58:20 2026 +0200"
      },
      "message": "netfilter: revalidate bridge ports\n\nebt_redirect_tg() dereferences br_port_get_rcu() return without a\nNULL check, causing a kernel panic when the bridge port has been\nremoved between the original hook invocation and an NFQUEUE\nreinject.\n\nA mere NULL check isn\u0027t sufficient, however.  As sashiko review\npoints out userspace can not only remove the port from the bridge,\nit could also place the device in a different virtual device, e.g.\nmacvlan.\n\nIf this happens, we must drop the packet, there is no way for us to\nreinject it into the bridge path.\n\nSwitch to _upper API, we don\u0027t need the bridge port structure.\nAlso, this fix keeps another bug intact:\n\nBoth nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER\ntoo aggressive, which prevents certain logging features when queueing\nin bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old\nCONFIG_BRIDGE_NETFILTER cruft is off.\n\nFixes tag is a common ancestor, this was always broken.\n\nFixes: f350a0a87374 (\"bridge: use rx_handler_data pointer to store net_bridge_port pointer\")\nReported-by: Ji\u0027an Zhou \u003ceilaimemedsnaimel@gmail.com\u003e\nAssisted-by: Claude:claude-sonnet-4-6\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n"
    },
    {
      "commit": "310628484ef06f95c5589374fade917a5689787b",
      "tree": "b7c193be0159a3845cb02809e8b359cd0a337cb2",
      "parents": [
        "0e152e4126fa14e697d8514cdd1567b18c679f08"
      ],
      "author": {
        "name": "Felix Gu",
        "email": "ustc.gu@gmail.com",
        "time": "Wed Jun 10 20:08:17 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Jun 10 16:39:13 2026 +0100"
      },
      "message": "spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX\n\nThe RZ/V2H hardware manual (section 7.5.2.2.1) specifies that read access\nsize for the SPI Data Register (SPDR) are fixed at 32 bits. The\nRZV2H_RSPI_RX macro for the 16-bit data path used readw(), violating\nthis requirement.\n\nSwitch to readl() for the 16-bit RX path to conform to the hardware\nspecification.\n\nFixes: 8b61c8919dff (\"spi: Add driver for the RZ/V2H(P) RSPI IP\")\nSuggested-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Felix Gu \u003custc.gu@gmail.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Fabrizio Castro \u003cfabrizio.castro.jz@renesas.com\u003e\nLink: https://patch.msgid.link/20260610-rzv2h-rspi-v2-1-40c80b4a2c90@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    },
    {
      "commit": "512db8267b73a220a64180d95ab5eebe7c4964a8",
      "tree": "3b8a0b6a7ed0b5cf632cf6eef72cf7ff1924f0e3",
      "parents": [
        "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9"
      ],
      "author": {
        "name": "Breno Leitao",
        "email": "leitao@debian.org",
        "time": "Mon Jun 08 02:32:05 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Jun 10 08:18:16 2026 -0700"
      },
      "message": "rds: mark snapshot pages dirty in rds_info_getsockopt()\n\nrds_info_getsockopt() pins the destination user pages with FOLL_WRITE and\nthe RDS_INFO_* producers memcpy the snapshot into them through\nkmap_atomic(). Because that copy goes through the kernel direct map, the\ndirty bit on the user PTE is never set, so unpin_user_pages() releases the\npages without marking them dirty. A file-backed destination page can then\nbe reclaimed without writeback, silently discarding the copied data.\n\nUse unpin_user_pages_dirty_lock() with make_dirty\u003dtrue so the modified\npages are marked dirty before they are unpinned.\n\nFixes: a8c879a7ee98 (\"RDS: Info and stats\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260608-rds_fix-v1-1-006c88543408@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9",
      "tree": "df7e012789b2152c7b475522d48e3d05cc4fe710",
      "parents": [
        "627366c51145a07f675b1800fb5ea2ec960bd900"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Mon Jun 08 16:46:13 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Jun 10 08:16:07 2026 -0700"
      },
      "message": "ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n\nIn vti6_tnl_lookup(), when an exact match for a tunnel fails,\nthe code falls back to searching for wildcard tunnels:\n\n- Tunnels matching the packet\u0027s local address, with any remote address\n  wildcard remote).\n\n- Tunnels matching the packet\u0027s remote address, with any local address\n  (wildcard local).\n\nHowever, vti6 stores all these different types of tunnels in the same\nhash table (ip6n-\u003etnls_r_l) prone to hash collisions.\n\nThe bug is that the fallback search loops in vti6_tnl_lookup() were\nmissing checks to ensure that the candidate tunnel actually has\na wildcard address.\n\nFixes: fbe68ee87522 (\"vti6: Add a lookup method for tunnels with wildcard endpoints.\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20260608164613.933023-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "767622308a1d8b111038fca0059b964da1f6d9c4",
      "tree": "567c86cdc36bf13a566c93f28a0d38f5e0a87a4f",
      "parents": [
        "805d5a2b792819171be100c50c9ddafa0f8c2231",
        "15b4155138505669d3d43d7692459ee8ea2a86e7"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jun 10 07:18:32 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jun 10 07:18:32 2026 -0700"
      },
      "message": "Merge tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n\n - Fix the implementation of the CFI branch landing pad control prctl()s\n   to return -EINVAL if unknown control bits are set, rather than\n   silently ignoring the request; and add a kselftest for this case\n\n - Fix unaligned access performance testing to happen earlier in boot,\n   which fixes a performance regression in the lib/checksum code\n\n - Fix a binfmt_elf warning when dumping core (due to missing\n   .core_note_name for CFI registers)\n\n* tag \u0027riscv-for-linux-7.1-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n  riscv: cfi: reject unknown flags in PR_SET_CFI\n  riscv: Fix fast_unaligned_access_speed_key not getting initialized\n  riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI\n"
    },
    {
      "commit": "805d5a2b792819171be100c50c9ddafa0f8c2231",
      "tree": "cd654c208c02a858c590003e3e05039c430facf3",
      "parents": [
        "acb7500801e98639f6d8c2d796ed9f64cba83d3a"
      ],
      "author": {
        "name": "Jann Horn",
        "email": "jannh@google.com",
        "time": "Fri Jun 05 22:27:33 2026 +0200"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Jun 10 07:09:20 2026 -0700"
      },
      "message": "namespace: restrict OPEN_TREE_NAMESPACE/FSMOUNT_NAMESPACE to directories\n\nopen_tree(..., OPEN_TREE_NAMESPACE) and\nfsmount(..., FSMOUNT_NAMESPACE, ...) currently work on non-directories,\nlike regular files. That\u0027s bad for two reasons:\n\n - It ends up mounting a regular file over the inherited namespace root,\n   which is a directory; mounting a non-directory over a directory is\n   normally explicitly forbidden, see for example do_move_mount()\n\n - It causes setns() on the new namespace to set the cwd to a regular\n   file, which the rest of VFS does not expect\n\nFix it by restricting create_new_namespace() (which is used by both of\nthese flags) to directories.\n\nLeave the behavior for OPEN_TREE_CLONE as-is, that seems unproblematic.\n\nFixes: 9b8a0ba68246 (\"mount: add OPEN_TREE_NAMESPACE\")\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: stable@kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "e47832c73b83ec21e67026726a1c8124697792af",
      "tree": "4754bd2d9943abebe43080690e90c53e5cee525c",
      "parents": [
        "4316acc7ddaaa4572da1a55a2bc561d341c9c2a4",
        "96d47e40bf9db4a9efd5c8fb53287a508d165f14"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jun 10 12:25:33 2026 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jun 10 12:25:33 2026 +0200"
      },
      "message": "Merge tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial fixes for 7.1-rc8\n\nHere is one more buffer overflow fix.\n\nThis one has been in linux-next overnight with no reported issues.\n\n* tag \u0027usb-serial-7.1-rc8\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n  USB: serial: kl5kusb105: fix bulk-out buffer overflow\n"
    },
    {
      "commit": "d79716401a954677a93c4dd51fec65beccb38296",
      "tree": "afffed2d3f386137b5e8dfbdb6dec0a111edcf91",
      "parents": [
        "2e235e2a2784b12b735321e5b42240ca51c49b0f"
      ],
      "author": {
        "name": "Melissa Wen",
        "email": "mwen@igalia.com",
        "time": "Tue Jun 09 12:20:21 2026 +0200"
      },
      "committer": {
        "name": "Melissa Wen",
        "email": "melissa.srw@gmail.com",
        "time": "Wed Jun 10 07:13:37 2026 -0300"
      },
      "message": "drm/amd/display: use plane color_mgmt_changed to track colorop changes\n\nEnsure the driver tracks changes in any colorop property of a plane\ncolor pipeline by using the same mechanism of CRTC color management and\nupdate plane color blocks when any colorop property changes. It fixes an\nissue observed on gamescope settings for night mode which is done via\nshaper/3D-LUT updates.\n\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com\n"
    },
    {
      "commit": "2e235e2a2784b12b735321e5b42240ca51c49b0f",
      "tree": "676ea24469c0131f742531df9b198f4b76c7c0ec",
      "parents": [
        "94ff735296d371045fce163451a3d65e44ac4729"
      ],
      "author": {
        "name": "Melissa Wen",
        "email": "mwen@igalia.com",
        "time": "Tue Jun 09 12:20:20 2026 +0200"
      },
      "committer": {
        "name": "Melissa Wen",
        "email": "melissa.srw@gmail.com",
        "time": "Wed Jun 10 07:13:36 2026 -0300"
      },
      "message": "drm/atomic: track individual colorop updates\n\nAs we do for CRTC color mgmt properties, use color_mgmt_changed flag to\ntrack any value changes in the color pipeline of a given plane, so that\ndrivers can update color blocks as soon as plane color pipeline or\nindividual colorop values change. Since we\u0027re here, only announce and\ntrack changes to plane COLOR_PIPELINE prop if its value is actually\nchanging.\n\nFixes: 8c5ea1745f4c (\"drm/colorop: Add BYPASS property\")\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: 41651f9d42eb (\"drm/colorop: Add 1D Curve subtype\")\nFixes: 3410108037d5 (\"drm/colorop: Add multiplier type\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nFixes: e5719e7f1900 (\"drm/colorop: Add 3x4 CTM type\")\nFixes: 99a4e4f08abe (\"drm/colorop: Add 1D Curve Custom LUT type\")\nFixes: 2afc3184f3b3 (\"drm/plane: Add COLOR PIPELINE property\")\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e #v1\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com\n"
    },
    {
      "commit": "94ff735296d371045fce163451a3d65e44ac4729",
      "tree": "4d7280de41157b84aaf9fa34cc45102b5f29697c",
      "parents": [
        "e480228cf65583040c894bb9cc02e1d5b328cee0"
      ],
      "author": {
        "name": "Melissa Wen",
        "email": "mwen@igalia.com",
        "time": "Tue Jun 09 12:20:19 2026 +0200"
      },
      "committer": {
        "name": "Melissa Wen",
        "email": "melissa.srw@gmail.com",
        "time": "Wed Jun 10 07:13:35 2026 -0300"
      },
      "message": "drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable\n\nAs interpolation props are actually mutable props, any changes should be\nhandled by drm_colorop_state. Move their enum and make it correctly\nbehaves as mutable.\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com\n"
    },
    {
      "commit": "e480228cf65583040c894bb9cc02e1d5b328cee0",
      "tree": "896f108a6f7f47426d32ec12eff1c461d7570781",
      "parents": [
        "5d563a5da8717629ae72f9eadf1e0e340bd1658b"
      ],
      "author": {
        "name": "Alex Hung",
        "email": "alex.hung@amd.com",
        "time": "Tue Jun 09 12:20:18 2026 +0200"
      },
      "committer": {
        "name": "Melissa Wen",
        "email": "melissa.srw@gmail.com",
        "time": "Wed Jun 10 07:13:34 2026 -0300"
      },
      "message": "drm/colorop: Remove read-only comments from interpolation fields\n\nThe lut1d_interpolation and lut3d_interpolation fields and their\nassociated properties were marked as read-only, but userspace\ncan set them via drm_atomic_colorop_set_property().\n\nFixes: 7fa3ee8c0a79 (\"drm/colorop: Define LUT_1D interpolation\")\nFixes: db971856bbe0 (\"drm/colorop: Add 3D LUT support to color pipeline\")\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nSigned-off-by: Alex Hung \u003calex.hung@amd.com\u003e\nFixes: 9ba25915efba (\"drm/amd/display: Add support for sRGB EOTF in DEGAM block\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nSigned-off-by: Melissa Wen \u003cmelissa.srw@gmail.com\u003e\nLink: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com\n"
    },
    {
      "commit": "d21ad938398bca695a511307de38a65889e3b354",
      "tree": "7a7842d24c2dc98a5822194a4a1f624b5b612cae",
      "parents": [
        "2673cefa99ca918e7ac5b0388ff578a83656c896"
      ],
      "author": {
        "name": "Joonas Lahtinen",
        "email": "joonas.lahtinen@linux.intel.com",
        "time": "Wed Jun 10 09:03:14 2026 +0300"
      },
      "committer": {
        "name": "Tvrtko Ursulin",
        "email": "tursulin@ursulin.net",
        "time": "Wed Jun 10 09:23:22 2026 +0100"
      },
      "message": "drm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\nReported-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nFixes: c6790dc22312 (\"drm/i915: Wean off drm_pci_alloc/drm_pci_free\")\nCc: \u003cstable@vger.kernel.org\u003e # v4.5+\nCc: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nLink: https://patch.msgid.link/20260610060314.26111-1-joonas.lahtinen@linux.intel.com\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)\nSigned-off-by: Tvrtko Ursulin \u003ctursulin@ursulin.net\u003e\n"
    },
    {
      "commit": "a23226b7c1f69eafd9ced4e037fb51c9758c0501",
      "tree": "bdb1249e86f117d266f43007e12e8a20d577d87f",
      "parents": [
        "64911f5aac534191e6b9a52ca1d50ba870a12d86"
      ],
      "author": {
        "name": "Daniel Drake",
        "email": "dan@reactivated.net",
        "time": "Mon Jun 08 22:01:08 2026 +0100"
      },
      "committer": {
        "name": "Bartosz Golaszewski",
        "email": "bartosz.golaszewski@oss.qualcomm.com",
        "time": "Wed Jun 10 10:12:57 2026 +0200"
      },
      "message": "gpiolib: handle gpio-hogs only once\n\nCommit d1d564ec49929 (\"gpio: move hogs into GPIO core\") introduced a\nbehaviour change that breaks boot on Raspberry Pi 5 when using the\nfirmware-supplied device tree:\n\n  gpiochip_add_data_with_key: GPIOs 544..575\n    (/soc@107c000000/gpio@7d517c00) failed to register, -22\n  brcmstb-gpio 107d517c00.gpio: Could not add gpiochip for bank 1\n  brcmstb-gpio 107d517c00.gpio: probe with driver brcmstb-gpio failed\n    with error -22\n\ngpio-brcmstb registers two gpio_chips against the device tree\nnode gpio@7d517c00, one for each bank. The firmware-supplied DT includes\na gpio-hog on RP1 RUN, and this gpio-hog is attempted to be applied to\n*both* gpio_chips. This succeeds against bank 0 (which hosts the GPIO)\nand fails for bank 1 (which does not).\n\nIn the previous implementation, failures to apply gpio-hogs were\nquietly ignored. In the new code, the error code propagates and causes\nprobe to fail.\n\nClosely approximate the previous behaviour by using the OF_POPULATED flag\nto ensure that each gpio-hog is processed only once. The flag was\npreviously being set before the gpio-hogs were processed, so as part\nof this change, the flag now gets set only after the gpio-hog is actioned.\nThe handling of gpio-hogs on a DT node with multiple gpio_chips remains a\nbit incomplete/unclear, but this at least retains the ability to apply\nhogs to the first gpio_chip per node.\n\nFixes: d1d564ec49929 (\"gpio: move hogs into GPIO core\")\nSigned-off-by: Daniel Drake \u003cdan@reactivated.net\u003e\nLink: https://patch.msgid.link/20260608210108.36248-1-dan@reactivated.net\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n"
    },
    {
      "commit": "64911f5aac534191e6b9a52ca1d50ba870a12d86",
      "tree": "0c1f69b8aac45264830b5a5b0d898425842077fe",
      "parents": [
        "1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"
      ],
      "author": {
        "name": "Bartosz Golaszewski",
        "email": "bartosz.golaszewski@oss.qualcomm.com",
        "time": "Tue Jun 09 14:17:50 2026 +0200"
      },
      "committer": {
        "name": "Bartosz Golaszewski",
        "email": "bartosz.golaszewski@oss.qualcomm.com",
        "time": "Wed Jun 10 09:29:19 2026 +0200"
      },
      "message": "gpio: fix cleanup path on hog failure\n\nIf gpiochip_hog_lines() successfully processes some hogs but fails on\na later one, the error handling path in gpiochip_add_data_with_key()\njumps directly to err_remove_of_chip. This leaks resources allocated\nearlier for ACPI, interrupts and hogs that were successfully processed.\nUse the right label in error path.\n\nCloses: https://sashiko.dev/#/patchset/20260608210108.36248-1-dan%40reactivated.net\nFixes: d1d564ec4992 (\"gpio: move hogs into GPIO core\")\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260609-gpio-hogs-fixes-v1-2-b4064f8070e7@oss.qualcomm.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n"
    },
    {
      "commit": "627366c51145a07f675b1800fb5ea2ec960bd900",
      "tree": "990be156d92cb46ee485603636a17cde5e1fb1c9",
      "parents": [
        "7f2fcff15e99bb852f6967396ed12b38376e2c8d"
      ],
      "author": {
        "name": "Vadim Fedorenko",
        "email": "vadim.fedorenko@linux.dev",
        "time": "Mon Jun 08 15:59:52 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 19:26:56 2026 -0700"
      },
      "message": "ptp: ocp: fix resource freeing order\n\nCommit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable\nevents\") added a call to ptp_disable_all_events() which changes the\nconfiguration of pins if they support EXTTS events. In ptp_ocp_detach()\npins resources are freed before ptp_clock_unregister() and it leads to\nuse-after-free during driver removal. Fix it by changing the order of\nfree/unregister calls. To avoid irq handler running on the other core\nwhile ptp device unregistering, call synchronize_irq() after HW is\nconfigured to stop producing irqs and no irqs are in-flight.\n\nFixes: a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable events\")\nSigned-off-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260608155952.240304-1-vadim.fedorenko@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "7f2fcff15e99bb852f6967396ed12b38376e2c8d",
      "tree": "9e55df43af361295d6b49d09c03eed3bba79fab5",
      "parents": [
        "34080db3e70ddf94c38512ad2331e3c3afca6cc1"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Sat Jun 06 22:44:28 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:33:18 2026 -0700"
      },
      "message": "tun: zero the whole vnet header in tun_put_user()\n\ntun_put_user() declares an on-stack struct virtio_net_hdr_v1_hash_tunnel\nwithout zeroing it. For a non-tunnel skb, virtio_net_hdr_tnl_from_skb()\nonly initializes the first 10 bytes (sizeof(struct virtio_net_hdr)),\nleaving bytes 10..23 (num_buffers and the hash/tunnel fields) as stack\ngarbage.\n\nAn unprivileged user can set the vnet header size to 24 with\nTUNSETVNETHDRSZ, so __tun_vnet_hdr_put() copies all 24 bytes of the\npartially-initialized struct to userspace, leaking 14 bytes of kernel\nstack on every read of a non-tunnel packet.\n\nFix it the same way tun_get_user() already does by zeroing the whole\nheader right after declaration.\n\nFixes: 288f30435132 (\"tun: enable gso over UDP tunnel support.\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260607054428.3050243-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "34080db3e70ddf94c38512ad2331e3c3afca6cc1",
      "tree": "4c2f6bc5d976a1095a47e92e9fd9bd7a44caef19",
      "parents": [
        "1ee90b77b727df903033db873c75caac5c27ec98"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Sat Jun 06 12:24:48 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:32:54 2026 -0700"
      },
      "message": "net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion\n\nrds_ib_xmit_atomic() always programs a masked atomic opcode\n(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)\nfor every RDS atomic cmsg.  But the completion-side switch in\nrds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked\natomic completion falls through to default and returns rm \u003d\u003d NULL while\nsend-\u003es_op is left set.  rds_ib_send_cqe_handler() then dereferences the\nNULL rm via rm-\u003em_final_op, oopsing in softirq context.  An unprivileged\nAF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection\ntriggers it; on hardware that natively accepts masked atomics (mlx4,\nmlx5) no extra setup is needed.\n\n  RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!\n  Oops: general protection fault [#1] SMP KASAN\n  KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]\n  RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)\n  Call Trace:\n   \u003cIRQ\u003e\n   rds_ib_send_cqe_handler (net/rds/ib_send.c:282)\n   poll_scq (net/rds/ib_cm.c:274)\n   rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)\n   tasklet_action_common (kernel/softirq.c:943)\n   handle_softirqs (kernel/softirq.c:573)\n   run_ksoftirqd (kernel/softirq.c:479)\n   \u003c/IRQ\u003e\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nHandle the masked atomic opcodes in the same case as the non-masked\nones: they map to the same struct rds_message.atomic union member, so\nthe existing container_of()/rds_ib_send_unmap_atomic() body is correct\nfor them.\n\nFixes: 20c72bd5f5f9 (\"RDS: Implement masked atomic operations\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260606192447.1179255-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "1ee90b77b727df903033db873c75caac5c27ec98",
      "tree": "fa75c2bd3b0ed9cffc4194f8bff69d673a1718c9",
      "parents": [
        "6f4c80a2a7e6d06753b89a578b710a2499a5e62b"
      ],
      "author": {
        "name": "Kyle Zeng",
        "email": "kylebot@openai.com",
        "time": "Sat Jun 06 19:18:19 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:32:08 2026 -0700"
      },
      "message": "net: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type \u003d\u003d PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership.\n\nFixes: 8605330aac5a (\"tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260607021819.49698-1-kylebot@openai.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "6f4c80a2a7e6d06753b89a578b710a2499a5e62b",
      "tree": "2b6aaf21646e46bbab6f4801c2c31236c3a27457",
      "parents": [
        "d289d5307762d1838aaece22c6b6fcad9e8865f9"
      ],
      "author": {
        "name": "Xin Long",
        "email": "lucien.xin@gmail.com",
        "time": "Sun Jun 07 19:03:47 2026 -0400"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:16:51 2026 -0700"
      },
      "message": "sctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk).  Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n  sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n  within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n  payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d289d5307762d1838aaece22c6b6fcad9e8865f9",
      "tree": "2c008ad8dcfc38cd1c966da1512feb37083df696",
      "parents": [
        "f8373d7090b745728de66308deeecc67e8d319ce"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Mon Jun 08 15:59:18 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:15:47 2026 -0700"
      },
      "message": "ip6_vti: set netns_immutable on the fallback device.\n\njohn1988 and Noam Rathaus reported that vti6_init_net() does not set the\nnetns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).\n\nOther similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)\ncorrectly set this flag during their fallback device initialization to\nprevent them from being moved to another network namespace.\n\nFixes: 61220ab34948 (\"vti6: Enable namespace changing\")\nReported-by: Noam Rathaus \u003cnoamr@ssd-disclosure.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20260608155918.787644-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "f8373d7090b745728de66308deeecc67e8d319ce",
      "tree": "5af795adee2dd851c0090a2115ffa86d3e76e92c",
      "parents": [
        "d930276f2cddd0b7294cac7a8fe7b877f6d9e08d"
      ],
      "author": {
        "name": "Michael Bommarito",
        "email": "michael.bommarito@gmail.com",
        "time": "Mon Jun 08 08:22:34 2026 -0400"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 18:12:30 2026 -0700"
      },
      "message": "sctp: fix uninit-value in __sctp_rcv_asconf_lookup()\n\n__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF\nchunk can hold the ADDIP header and a parameter header, then calls\naf-\u003efrom_addr_param(), which reads the full address (16 bytes for IPv6)\ntrusting the parameter\u0027s declared length.\n\nAn unauthenticated peer can send a truncated trailing ASCONF chunk that\ndeclares an IPv6 address parameter but stops after the 4-byte parameter\nheader; reached from the no-association lookup path, from_addr_param() then\nreads uninitialized bytes past the parameter.\n\nImpact: an unauthenticated SCTP peer makes the receive path read up to 16\nbytes of uninitialized memory past a truncated ASCONF address parameter.\n\nThe sibling __sctp_rcv_init_lookup() bounds parameters with\nsctp_walk_params(); this path open-codes the fetch and omits the bound.\nVerify the whole address parameter lies within the chunk before\nfrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43\n(\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").\n\nFixes: df2185771439 (\"[SCTP]: Update association lookup to look at ASCONF chunks as well\")\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d930276f2cddd0b7294cac7a8fe7b877f6d9e08d",
      "tree": "85fd60da08cdd488a2863a90dc68603f0436cf36",
      "parents": [
        "a5f8a90ac9f77c678a9781c0a464b635e0d63e49"
      ],
      "author": {
        "name": "Kyle Meyer",
        "email": "kyle.meyer@hpe.com",
        "time": "Fri Jun 05 17:25:24 2026 -0500"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 17:52:46 2026 -0700"
      },
      "message": "bnxt_en: Fix NULL pointer dereference\n\nPCIe errors detected by a Root Port or Downstream Port cause error\nrecovery services to run on all subordinate devices regardless of\nadministrative state.\n\nThe .error_detected() callback, bnxt_io_error_detected(), disables\nand synchronizes IRQs via bnxt_disable_int_sync(), which calls\nbnxt_cp_num_to_irq_num() to map completion rings to IRQs using\nbp-\u003ebnapi.\n\nSince bp-\u003ebnapi is allocated on NIC open and freed on NIC close, PCIe\nerror recovery on a closed NIC can dereference a NULL pointer.\n\nCheck if bp-\u003ebnapi is NULL before disabling and synchronizing IRQs.\n\nFixes: e5811b8c09df (\"bnxt_en: Add IRQ remapping logic.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kyle Meyer \u003ckyle.meyer@hpe.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/aiNM1CY2-StPilxW@hpe.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
      "tree": "1a686298be8be6edcbbca8365866f197865a337e",
      "parents": [
        "0aa05daef7848a5ac11158949dc73cd741995dc1"
      ],
      "author": {
        "name": "Wyatt Feng",
        "email": "bronzed_45_vested@icloud.com",
        "time": "Fri Jun 05 13:53:42 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Jun 09 17:26:25 2026 -0700"
      },
      "message": "sctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions.\n\nFixes: 637784ade221 (\"sctp: introduce priority based stream scheduler\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Wyatt Feng \u003cbronzed_45_vested@icloud.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/d78954ecd94954653ee299400e98d74a03a6f7d3.1780603399.git.bronzed_45_vested@icloud.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "acb7500801e98639f6d8c2d796ed9f64cba83d3a",
      "tree": "1d142242540514e6af00a31ace858acb79fdebf8",
      "parents": [
        "06f4462d05bdfb6f1fb7b1f263f5a3425ab210f7",
        "df996599cc69a9b74ff437c67751cf8a61f62e39"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jun 09 17:20:00 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jun 09 17:20:00 2026 -0700"
      },
      "message": "Merge tag \u0027trace-rv-v7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull runtime verifier fixes from Steven Rostedt:\n\n - Fix reset ordering on per-task destruction\n\n   Reset the task before dropping the slot instead of after, which was\n   causing out-of-bound memory accesses.\n\n - Fix HA monitor synchronization and cleanup\n\n   Ensure synchronous cleanup for HA monitors by running timer callbacks\n   in RCU read-side critical sections and using synchronize_rcu() during\n   destruction.\n\n - Avoid armed timers after tasks exit\n\n   Add automatic cleanup for per-task HA monitors to prevent timers from\n   firing after task exit.\n\n - Fix memory ordering for DA/HA monitors\n\n   Fix race conditions during monitor start by using release-acquire\n   semantics for the monitoring flag.\n\n - Fix initialization for DA/HA monitors\n\n   Ensure monitors are not initialized relying on potentially corrupted\n   state like the monitoring flag, that is not reset by all monitors\n   type and may have an unknown state in monitors reusing the storage\n   (per-task).\n\n - Fix memory safety in per-task and per-object monitors\n\n   Prevent use-after-free and out-of-bounds access by synchronizing with\n   in-flight tracepoint probes using tracepoint_synchronize_unregister()\n   before freeing monitor storage or releasing task slots.\n\n - Adjust monitors for preemptible tracepoints\n\n   Fix monitors that relied on tracepoints disabling preemption.\n   Explicitly disable task migration when per-CPU monitors handle events\n   to avoid accessing the wrong state and update the opid monitor logic.\n\n - Fix incorrect __user specifier usage\n\n   Remove __user from a non-pointer variable in the extract_params()\n   helper.\n\n - Fix bugs in the rv tool\n\n   Ensure strings are NUL-terminated, fix substring matching in monitor\n   searches, and improve cleanup and exit status handling.\n\n - Fix several bugs in rvgen\n\n   Fix LTL literal stringification, subparsers\u0027 options handling, and\n   suffix stripping in dot2k.\n\n* tag \u0027trace-rv-v7.1-rc6-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n  verification/rvgen: Fix ltl2k writing True as a literal\n  verification/rvgen: Fix options shared among commands\n  verification/rvgen: Fix suffix strip in dot2k\n  tools/rv: Fix cleanup after failed trace setup\n  tools/rv: Fix substring match when listing container monitors\n  tools/rv: Fix substring match bug in monitor name search\n  tools/rv: Ensure monitor name and desc are NUL-terminated\n  rv: Use 0 to check preemption enabled in opid\n  rv: Prevent task migration while handling per-CPU events\n  rv: Ensure synchronous cleanup for HA monitors\n  rv: Add automatic cleanup handlers for per-task HA monitors\n  rv: Do not rely on clean monitor when initialising HA\n  rv: Fix monitor start ordering and memory ordering for monitoring flag\n  rv: Ensure all pending probes terminate on per-obj monitor destroy\n  rv: Prevent in-flight per-task handlers from using invalid slots\n  rv: Reset per-task DA monitors before releasing the slot\n  rv: Fix __user specifier usage in extract_params()\n"
    },
    {
      "commit": "06f4462d05bdfb6f1fb7b1f263f5a3425ab210f7",
      "tree": "cab4ce06dafc836671a351b487912c3fa25e9710",
      "parents": [
        "685441a6d3f17404b47087d051963bc7fb665ef0",
        "e9e41d3035032ed6053d8bad7b7077e1cb3a6540"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jun 09 17:05:19 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Jun 09 17:05:19 2026 -0700"
      },
      "message": "Merge tag \u0027trace-tools-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull RTLA fix from Steven Rostedt:\n\n - Fix multi-character short option parsing\n\n   Fix regression in parsing of multiple-character short options\n   (eg -p100 /\u003d -p 100/, -un /\u003d -u -n/) caused by getopt_long()\n   internal state corruption after a refactoring.\n\n* tag \u0027trace-tools-v7.1-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n  rtla: Fix parsing of multi-character short options\n"
    },
    {
      "commit": "3c60184e39b57e5efe664fe8540cdbc1bc7ea899",
      "tree": "9f1e83fec35e132bd02065e5b1edaf4085b7fa93",
      "parents": [
        "5ac5ec84734fd338867055d4d7b650f18a023cb0"
      ],
      "author": {
        "name": "Peng Yang",
        "email": "pyangyyd@gmail.com",
        "time": "Mon Jun 08 17:58:49 2026 +0800"
      },
      "committer": {
        "name": "Mark Brown",
        "email": "broonie@kernel.org",
        "time": "Wed Jun 10 00:07:39 2026 +0100"
      },
      "message": "spi: dw: fix race between IRQ handler and error handler on SMP\n\nOn SMP systems, dw_spi_handle_err() can be called from the SPI core\nkthread while the IRQ handler is still accessing the FIFO on another\nCPU. Resetting the chip via dw_spi_reset_chip() during an active FIFO\nread/write causes a bus error.\n\nFix this by calling disable_irq() before the chip reset, which masks\nthe IRQ and waits for any in-flight handler to complete via\nsynchronize_irq(). This ensures no handler is accessing the FIFO when\nthe reset occurs.\n\nSigned-off-by: Peng Yang \u003cpyangyyd@amazon.com\u003e\nSuggested-by: Jonathan Chocron \u003cjonnyc@amazon.com\u003e\nLink: https://patch.msgid.link/20260608095849.3446-1-pyangyyd@amazon.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n"
    }
  ],
  "next": "0e152e4126fa14e697d8514cdd1567b18c679f08"
}