)]}' { "log": [ { "commit": "02ddfb981de88a2c15621115dd7be2431252c568", "tree": "d130f96c9a2f9271ef968232c5d0d7263f7b4973", "parents": [ "30e268185e59c3d5a1233416a2135cfda5630644", "b0b7ee3b574a72283399b9232f6190be07f220c0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 13:01:31 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 13:01:31 2025 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"The single core change is an obvious bug fix (and falls within the LF\n guidelines for patches from sanctioned entities). The other driver\n changes are a bit larger but likewise pretty obvious\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: mpi3mr: Add level check to control event logging\n scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()\n scsi: core: Clear flags for scsi_cmnd that did not complete\n scsi: ufs: Introduce quirk to extend PA_HIBERN8TIME for UFS devices\n scsi: ufs: qcom: Add quirks for Samsung UFS devices\n scsi: target: iscsi: Fix timeout on deleted connection\n scsi: mpi3mr: Reset the pending interrupt flag\n scsi: mpi3mr: Fix pending I/O counter\n scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()\n" }, { "commit": "30e268185e59c3d5a1233416a2135cfda5630644", "tree": "11c6156d67551a4df690e9f7413647db288357f6", "parents": [ "e72e9e6933071fbbb3076811d3a0cc20e8720a5b", "47ce2af848b7301d8571f0e01a0d7c7162d51e4a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 12:59:05 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 12:59:05 2025 -0700" }, "message": "Merge tag \u0027landlock-6.15-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull landlock fixes from Mickaël Salaün:\n \"Fix some Landlock audit issues, add related tests, and updates\n documentation\"\n\n* tag \u0027landlock-6.15-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Update log documentation\n landlock: Fix documentation for landlock_restrict_self(2)\n landlock: Fix documentation for landlock_create_ruleset(2)\n selftests/landlock: Add PID tests for audit records\n selftests/landlock: Factor out audit fixture in audit_test\n landlock: Log the TGID of the domain creator\n landlock: Remove incorrect warning\n" }, { "commit": "e72e9e6933071fbbb3076811d3a0cc20e8720a5b", "tree": "a0745a1038a5ceb93695097dc9318fb666dde05e", "parents": [ "288537d9c9364356a4b2f6bd947f2e89cdaa353e", "cc0dec3f659d19805fcaf8822204137c9f27a912" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 09:14:50 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 09:14:50 2025 -0700" }, "message": "Merge tag \u0027net-6.15-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"No fixes from any subtree.\n\n Current release - regressions:\n\n - net: fix the missing unlock for detached devices\n\n Previous releases - regressions:\n\n - sched: fix UAF vulnerability in HFSC qdisc\n\n - lwtunnel: disable BHs when required\n\n - mptcp: pm: defer freeing of MPTCP userspace path manager entries\n\n - tipc: fix NULL pointer dereference in tipc_mon_reinit_self()\n\n - eth: virtio-net: disable delayed refill when pausing rx\n\n Previous releases - always broken:\n\n - phylink: fix suspend/resume with WoL enabled and link down\n\n - eth:\n - mlx5: fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()\n - xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n - enetc: fix frame corruption on bpf_xdp_adjust_head/tail() and XDP_PASS\n - stmmac: fix dwmac1000 ptp timestamp status offset\n - pds_core: prevent possible adminq overflow/stuck condition\n\n Misc:\n\n - a bunch of MAINTAINERS updates\"\n\n* tag \u0027net-6.15-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (32 commits)\n net: stmmac: fix multiplication overflow when reading timestamp\n net: stmmac: fix dwmac1000 ptp timestamp status offset\n net: dp83822: Fix OF_MDIO config check\n pds_core: make wait_context part of q_info\n pds_core: Remove unnecessary check in pds_client_adminq_cmd()\n pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result\n pds_core: Prevent possible adminq overflow/stuck condition\n net: dsa: mt7530: sync driver-specific behavior of MT7531 variants\n selftests/tc-testing: Add test for HFSC queue emptying during peek operation\n net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n net_sched: hfsc: Fix a UAF vulnerability in class handling\n selftests: mptcp: diag: use mptcp_lib_get_info_value\n mptcp: pm: Defer freeing of MPTCP userspace path manager entries\n net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration\n tipc: fix NULL pointer dereference in tipc_mon_reinit_self()\n virtio-net: disable delayed refill when pausing rx\n net: phy: leds: fix memory leak\n net: phylink: mac_link_(up|down)() clarifications\n net: phylink: fix suspend/resume with WoL enabled and link down\n net: lwtunnel: disable BHs when required\n ...\n" }, { "commit": "288537d9c9364356a4b2f6bd947f2e89cdaa353e", "tree": "fb246b092074adef1c5ce0e3c9e72b6d068c5bdf", "parents": [ "a79be02bba5c31f967885c7f3bf3a756d77d11d9", "8006aff15516a170640239c5a8e6696c0ba18d8e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 09:10:01 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 24 09:10:01 2025 -0700" }, "message": "Merge tag \u0027v6.15-p5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Revert acomp multibuffer tests which were buggy\n\n - Fix off-by-one regression in new scomp code\n\n - Lower quality setting on atmel-sha204a as it may not be random\n\n* tag \u0027v6.15-p5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: atmel-sha204a - Set hwrng quality to lowest possible\n crypto: scomp - Fix off-by-one bug when calculating last page\n Revert \"crypto: testmgr - Add multibuffer acomp testing\"\n" }, { "commit": "cc0dec3f659d19805fcaf8822204137c9f27a912", "tree": "310a8c48347ddec0e77a3a00b59420730a532c74", "parents": [ "607b310ada5ef4c738f9dffc758a62a9d309b084", "7b7491372f8ec2d8c08da18e5d629e55f41dda89" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 24 11:50:45 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 24 11:50:46 2025 +0200" }, "message": "Merge branch \u0027net-stmmac-fix-timestamp-snapshots-on-dwmac1000\u0027\n\nAlexis Lothore says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: fix timestamp snapshots on dwmac1000\n\nthis is the v2 of a small series containing two small fixes for the\ntimestamp snapshot feature on stmmac, especially on dwmac1000 version.\nThose issues have been detected on a socfpga (Cyclone V) platform. They\nkind of follow the big rework sent by Maxime at the end of last year to\nproperly split this feature support between different versions of the\nDWMAC IP.\n\nv1: https://lore.kernel.org/r/20250422-stmmac_ts-v1-0-b59c9f406041@bootlin.com\n\nSigned-off-by: Alexis Lothoré \u003calexis.lothore@bootlin.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250423-stmmac_ts-v2-0-e2cf2bbd61b1@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7b7491372f8ec2d8c08da18e5d629e55f41dda89", "tree": "310a8c48347ddec0e77a3a00b59420730a532c74", "parents": [ "73fa4597bdc035437fbcd84d6be32bd39f1f2149" ], "author": { "name": "Alexis Lothoré", "email": "alexis.lothore@bootlin.com", "time": "Wed Apr 23 09:12:10 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 24 11:50:20 2025 +0200" }, "message": "net: stmmac: fix multiplication overflow when reading timestamp\n\nThe current way of reading a timestamp snapshot in stmmac can lead to\ninteger overflow, as the computation is done on 32 bits. The issue has\nbeen observed on a dwmac-socfpga platform returning chaotic timestamp\nvalues due to this overflow. The corresponding multiplication is done\nwith a MUL instruction, which returns 32 bit values. Explicitly casting\nthe value to 64 bits replaced the MUL with a UMLAL, which computes and\nreturns the result on 64 bits, and so returns correctly the timestamps.\n\nPrevent this overflow by explicitly casting the intermediate value to\nu64 to make sure that the whole computation is made on u64. While at it,\napply the same cast on the other dwmac variant (GMAC4) method for\nsnapshot retrieval.\n\nFixes: 477c3e1f6363 (\"net: stmmac: Introduce dwmac1000 timestamping operations\")\nSigned-off-by: Alexis Lothoré \u003calexis.lothore@bootlin.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20250423-stmmac_ts-v2-2-e2cf2bbd61b1@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "73fa4597bdc035437fbcd84d6be32bd39f1f2149", "tree": "996e2bb3f1fa66701859c902bc968e23fde70423", "parents": [ "607b310ada5ef4c738f9dffc758a62a9d309b084" ], "author": { "name": "Alexis Lothore", "email": "alexis.lothore@bootlin.com", "time": "Wed Apr 23 09:12:09 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 24 11:50:20 2025 +0200" }, "message": "net: stmmac: fix dwmac1000 ptp timestamp status offset\n\nWhen a PTP interrupt occurs, the driver accesses the wrong offset to\nlearn about the number of available snapshots in the FIFO for dwmac1000:\nit should be accessing bits 29..25, while it is currently reading bits\n19..16 (those are bits about the auxiliary triggers which have generated\nthe timestamps). As a consequence, it does not compute correctly the\nnumber of available snapshots, and so possibly do not generate the\ncorresponding clock events if the bogus value ends up being 0.\n\nFix clock events generation by reading the correct bits in the timestamp\nregister for dwmac1000.\n\nFixes: 477c3e1f6363 (\"net: stmmac: Introduce dwmac1000 timestamping operations\")\nSigned-off-by: Alexis Lothoré \u003calexis.lothore@bootlin.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20250423-stmmac_ts-v2-1-e2cf2bbd61b1@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "607b310ada5ef4c738f9dffc758a62a9d309b084", "tree": "a314ddb4f6ae9f911da56ec008ffbd310fb3defb", "parents": [ "4fe09ff1a54a7ff8bb789b762b2f9a9fc0d7dba0" ], "author": { "name": "Johannes Schneider", "email": "johannes.schneider@leica-geosystems.com", "time": "Wed Apr 23 06:47:24 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 24 11:19:35 2025 +0200" }, "message": "net: dp83822: Fix OF_MDIO config check\n\nWhen CONFIG_OF_MDIO is set to be a module the code block is not\ncompiled. Use the IS_ENABLED macro that checks for both built in as\nwell as module.\n\nFixes: 5dc39fd5ef35 (\"net: phy: DP83822: Add ability to advertise Fiber connection\")\nSigned-off-by: Johannes Schneider \u003cjohannes.schneider@leica-geosystems.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20250423044724.1284492-1-johannes.schneider@leica-geosystems.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "4fe09ff1a54a7ff8bb789b762b2f9a9fc0d7dba0", "tree": "09ecbbac33d94497146f8a3265ddfd00c9557637", "parents": [ "497041d763016c2e8314d2f6a329a9b77c3797ca", "3f77c3dfffc7063428b100c4945ca2a7a8680380" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:21 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:21 2025 -0700" }, "message": "Merge branch \u0027pds_core-updates-and-fixes\u0027\n\nShannon Nelson says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npds_core: updates and fixes\n\nThis patchset has fixes for issues seen in recent internal testing\nof error conditions and stress handling.\n\nNote that the first patch in this series is a leftover from an\nearlier patchset that was abandoned:\nLink: https://lore.kernel.org/netdev/20250129004337.36898-2-shannon.nelson@amd.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250421174606.3892-1-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3f77c3dfffc7063428b100c4945ca2a7a8680380", "tree": "09ecbbac33d94497146f8a3265ddfd00c9557637", "parents": [ "f9559d818205a4a0b9cd87181ef46e101ea11157" ], "author": { "name": "Shannon Nelson", "email": "shannon.nelson@amd.com", "time": "Mon Apr 21 10:46:06 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:17 2025 -0700" }, "message": "pds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth.\n\nFixes: 01ba61b55b20 (\"pds_core: Add adminq processing and commands\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Shannon Nelson \u003cshannon.nelson@amd.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20250421174606.3892-5-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f9559d818205a4a0b9cd87181ef46e101ea11157", "tree": "d2b9b8100b7ecf0643070f988febdf8c5ffacfbb", "parents": [ "2567daad69cd1107fc0ec29b1615f110d7cf7385" ], "author": { "name": "Brett Creeley", "email": "brett.creeley@amd.com", "time": "Mon Apr 21 10:46:05 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:17 2025 -0700" }, "message": "pds_core: Remove unnecessary check in pds_client_adminq_cmd()\n\nWhen the pds_core driver was first created there were some race\nconditions around using the adminq, especially for client drivers.\nTo reduce the possibility of a race condition there\u0027s a check\nagainst pf-\u003estate in pds_client_adminq_cmd(). This is problematic\nfor a couple of reasons:\n\n1. The PDSC_S_INITING_DRIVER bit is set during probe, but not\n cleared until after everything in probe is complete, which\n includes creating the auxiliary devices. For pds_fwctl this\n means it can\u0027t make any adminq commands until after pds_core\u0027s\n probe is complete even though the adminq is fully up by the\n time pds_fwctl\u0027s auxiliary device is created.\n\n2. The race conditions around using the adminq have been fixed\n and this path is already protected against client drivers\n calling pds_client_adminq_cmd() if the adminq isn\u0027t ready,\n i.e. see pdsc_adminq_post() -\u003e pdsc_adminq_inc_if_up().\n\nFix this by removing the pf-\u003estate check in pds_client_adminq_cmd()\nbecause invalid accesses to pds_core\u0027s adminq is already handled by\npdsc_adminq_post()-\u003epdsc_adminq_inc_if_up().\n\nFixes: 10659034c622 (\"pds_core: add the aux client API\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Brett Creeley \u003cbrett.creeley@amd.com\u003e\nSigned-off-by: Shannon Nelson \u003cshannon.nelson@amd.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20250421174606.3892-4-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2567daad69cd1107fc0ec29b1615f110d7cf7385", "tree": "32bae68f7195ce418e9f1fafda39667e1a69f20d", "parents": [ "d9e2f070d8af60f2c8c02b2ddf0a9e90b4e9220c" ], "author": { "name": "Brett Creeley", "email": "brett.creeley@amd.com", "time": "Mon Apr 21 10:46:04 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:17 2025 -0700" }, "message": "pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result\n\nIf the FW doesn\u0027t support the PDS_CORE_CMD_FW_CONTROL command\nthe driver might at the least print garbage and at the worst\ncrash when the user runs the \"devlink dev info\" devlink command.\n\nThis happens because the stack variable fw_list is not 0\ninitialized which results in fw_list.num_fw_slots being a\ngarbage value from the stack. Then the driver tries to access\nfw_list.fw_names[i] with i \u003e\u003d ARRAY_SIZE and runs off the end\nof the array.\n\nFix this by initializing the fw_list and by not failing\ncompletely if the devcmd fails because other useful information\nis printed via devlink dev info even if the devcmd fails.\n\nFixes: 45d76f492938 (\"pds_core: set up device and adminq\")\nSigned-off-by: Brett Creeley \u003cbrett.creeley@amd.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Shannon Nelson \u003cshannon.nelson@amd.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20250421174606.3892-3-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d9e2f070d8af60f2c8c02b2ddf0a9e90b4e9220c", "tree": "992c04f277f907a069a8f3f25cdff318ac5fb296", "parents": [ "497041d763016c2e8314d2f6a329a9b77c3797ca" ], "author": { "name": "Brett Creeley", "email": "brett.creeley@amd.com", "time": "Mon Apr 21 10:46:03 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:50:17 2025 -0700" }, "message": "pds_core: Prevent possible adminq overflow/stuck condition\n\nThe pds_core\u0027s adminq is protected by the adminq_lock, which prevents\nmore than 1 command to be posted onto it at any one time. This makes it\nso the client drivers cannot simultaneously post adminq commands.\nHowever, the completions happen in a different context, which means\nmultiple adminq commands can be posted sequentially and all waiting\non completion.\n\nOn the FW side, the backing adminq request queue is only 16 entries\nlong and the retry mechanism and/or overflow/stuck prevention is\nlacking. This can cause the adminq to get stuck, so commands are no\nlonger processed and completions are no longer sent by the FW.\n\nAs an initial fix, prevent more than 16 outstanding adminq commands so\nthere\u0027s no way to cause the adminq from getting stuck. This works\nbecause the backing adminq request queue will never have more than 16\npending adminq commands, so it will never overflow. This is done by\nreducing the adminq depth to 16.\n\nFixes: 45d76f492938 (\"pds_core: set up device and adminq\")\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Brett Creeley \u003cbrett.creeley@amd.com\u003e\nSigned-off-by: Shannon Nelson \u003cshannon.nelson@amd.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20250421174606.3892-2-shannon.nelson@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "497041d763016c2e8314d2f6a329a9b77c3797ca", "tree": "c0a1528b1077d94893bfc98ee555a8ee5c78e07e", "parents": [ "fa44042a42b86d9bb8030479c477d9f002004fc3" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Apr 22 04:10:20 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 18:46:03 2025 -0700" }, "message": "net: dsa: mt7530: sync driver-specific behavior of MT7531 variants\n\nMT7531 standalone and MMIO variants found in MT7988 and EN7581 share\nmost basic properties. Despite that, assisted_learning_on_cpu_port and\nmtu_enforcement_ingress were only applied for MT7531 but not for MT7988\nor EN7581, causing the expected issues on MMIO devices.\n\nApply both settings equally also for MT7988 and EN7581 by moving both\nassignments form mt7531_setup() to mt7531_setup_common().\n\nThis fixes unwanted flooding of packets due to unknown unicast\nduring DA lookup, as well as issues with heterogenous MTU settings.\n\nFixes: 7f54cc9772ce (\"net: dsa: mt7530: split-off common parts from mt7531_setup\")\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e\nLink: https://patch.msgid.link/89ed7ec6d4fa0395ac53ad2809742bb1ce61ed12.1745290867.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fa44042a42b86d9bb8030479c477d9f002004fc3", "tree": "06c3b2a2a8b47f3ce960a58aba4efe2f4452a81a", "parents": [ "d861a5dbb960c5619ea78ae9f121b9b460685429", "7629d1a04ad2e76709401b655263040486972c2c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 17:16:52 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 17:16:53 2025 -0700" }, "message": "Merge branch \u0027net_sched-fix-uaf-vulnerability-in-hfsc-qdisc\u0027\n\nCong Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet_sched: Fix UAF vulnerability in HFSC qdisc\n\nThis patchset contains two bug fixes and a selftest for the first one\nwhich we have a reliable reproducer, please check each patch\ndescription for details.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250417184732.943057-1-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7629d1a04ad2e76709401b655263040486972c2c", "tree": "06c3b2a2a8b47f3ce960a58aba4efe2f4452a81a", "parents": [ "6ccbda44e2cc3d26fd22af54c650d6d5d801addf" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Thu Apr 17 11:47:32 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 17:16:50 2025 -0700" }, "message": "selftests/tc-testing: Add test for HFSC queue emptying during peek operation\n\nAdd a selftest to exercise the condition where qdisc implementations\nlike netem or codel might empty the queue during a peek operation.\nThis tests the defensive code path in HFSC that checks the queue length\nagain after peeking to handle this case.\n\nBased on the reproducer from Gerrard, improved by Jamal.\n\nReported-by: Gerrard Tai \u003cgerrard.tai@starlabs.sg\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20250417184732.943057-4-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ccbda44e2cc3d26fd22af54c650d6d5d801addf", "tree": "99bbfe170a36b3f6fddeb6479fcad59fdc8a4d65", "parents": [ "3df275ef0a6ae181e8428a6589ef5d5231e58b5c" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Thu Apr 17 11:47:31 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 17:16:50 2025 -0700" }, "message": "net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n\nSimilarly to the previous patch, we need to safe guard hfsc_dequeue()\ntoo. But for this one, we don\u0027t have a reliable reproducer.\n\nFixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 (\"Linux-2.6.12-rc2\")\nReported-by: Gerrard Tai \u003cgerrard.tai@starlabs.sg\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20250417184732.943057-3-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3df275ef0a6ae181e8428a6589ef5d5231e58b5c", "tree": "802ae4ab4417f65d95d77e7a2c49f81147403673", "parents": [ "d861a5dbb960c5619ea78ae9f121b9b460685429" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Thu Apr 17 11:47:30 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 17:16:50 2025 -0700" }, "message": "net_sched: hfsc: Fix a UAF vulnerability in class handling\n\nThis patch fixes a Use-After-Free vulnerability in the HFSC qdisc class\nhandling. The issue occurs due to a time-of-check/time-of-use condition\nin hfsc_change_class() when working with certain child qdiscs like netem\nor codel.\n\nThe vulnerability works as follows:\n1. hfsc_change_class() checks if a class has packets (q.qlen !\u003d 0)\n2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g.,\n codel, netem) might drop packets and empty the queue\n3. The code continues assuming the queue is still non-empty, adding\n the class to vttree\n4. This breaks HFSC scheduler assumptions that only non-empty classes\n are in vttree\n5. Later, when the class is destroyed, this can lead to a Use-After-Free\n\nThe fix adds a second queue length check after qdisc_peek_len() to verify\nthe queue wasn\u0027t emptied.\n\nFixes: 21f4d5cc25ec (\"net_sched/hfsc: fix curve activation in hfsc_change_class()\")\nReported-by: Gerrard Tai \u003cgerrard.tai@starlabs.sg\u003e\nReviewed-by: Konstantin Khlebnikov \u003ckoct9i@gmail.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20250417184732.943057-2-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d861a5dbb960c5619ea78ae9f121b9b460685429", "tree": "6ee40185896b522ad146e04e7b194b80be61b98c", "parents": [ "491ef1117c56476f199b481f8c68820fe4c3a7c2", "ce72fea219c13c6485503928181c547d0e26756b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 16:28:06 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 16:28:07 2025 -0700" }, "message": "Merge branch \u0027mptcp-pm-defer-freeing-userspace-pm-entries\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: pm: Defer freeing userspace pm entries\n\nHere are two unrelated fixes for MPTCP:\n\n- Patch 1: free userspace PM entry with RCU helpers. A fix for v6.14.\n\n- Patch 2: avoid a warning when running diag.sh selftest. A fix for\n v6.15-rc1.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250421-net-mptcp-pm-defer-freeing-v1-0-e731dc6e86b9@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ce72fea219c13c6485503928181c547d0e26756b", "tree": "6ee40185896b522ad146e04e7b194b80be61b98c", "parents": [ "13b4ece33cf9def67966bb8716783c42cec20617" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Mon Apr 21 19:07:14 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 16:27:58 2025 -0700" }, "message": "selftests: mptcp: diag: use mptcp_lib_get_info_value\n\nWhen running diag.sh in a loop, chk_dump_one will report the following\n\"grep: write error\":\n\n 13 ....chk 2 cestab [ OK ]\n grep: write error\n 14 ....chk dump_one [ OK ]\n 15 ....chk 2-\u003e0 msk in use after flush [ OK ]\n 16 ....chk 2-\u003e0 cestab after flush [ OK ]\n\nThis error is caused by a broken pipe. When the output of \u0027ss\u0027 is processed\nby grep, \u0027head -n 1\u0027 will exit immediately after getting the first line,\ncausing the subsequent pipe to close. At this time, if \u0027grep\u0027 is still\ntrying to write data to the closed pipe, it will trigger a SIGPIPE signal,\ncausing a write error.\n\nOne solution is not to use this problematic \"head -n 1\" command, but to use\nmptcp_lib_get_info_value() helper defined in mptcp_lib.sh to get the value\nof \u0027token\u0027.\n\nFixes: ba2400166570 (\"selftests: mptcp: add a test for mptcp_diag_dump_one\")\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nTested-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20250421-net-mptcp-pm-defer-freeing-v1-2-e731dc6e86b9@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "13b4ece33cf9def67966bb8716783c42cec20617", "tree": "4e6418f69658d4f5f5ea44ae775f7450970059c4", "parents": [ "491ef1117c56476f199b481f8c68820fe4c3a7c2" ], "author": { "name": "Mat Martineau", "email": "martineau@kernel.org", "time": "Mon Apr 21 19:07:13 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 23 16:27:58 2025 -0700" }, "message": "mptcp: pm: Defer freeing of MPTCP userspace path manager entries\n\nWhen path manager entries are deleted from the local address list, they\nare first unlinked from the address list using list_del_rcu(). The\nentries must not be freed until after the RCU grace period, but the\nexisting code immediately frees the entry.\n\nUse kfree_rcu_mightsleep() and adjust sk_omem_alloc in open code instead\nof using the sock_kfree_s() helper. This code path is only called in a\nnetlink handler, so the \"might sleep\" function is preferable to adding\na rarely-used rcu_head member to struct mptcp_pm_addr_entry.\n\nFixes: 88d097316371 (\"mptcp: drop free_list for deleting entries\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20250421-net-mptcp-pm-defer-freeing-v1-1-e731dc6e86b9@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a79be02bba5c31f967885c7f3bf3a756d77d11d9", "tree": "dab3f0fe3372bf62d98fca41f8ebd7cb36d1c85b", "parents": [ "82efd569a8909f2b13140c1b3de88535aea0b051" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 23 10:08:29 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 23 10:08:29 2025 -0700" }, "message": "Fix mis-uses of \u0027cc-option\u0027 for warning disablement\n\nThis was triggered by one of my mis-uses causing odd build warnings on\nsparc in linux-next, but while figuring out why the \"obviously correct\"\nuse of cc-option caused such odd breakage, I found eight other cases of\nthe same thing in the tree.\n\nThe root cause is that \u0027cc-option\u0027 doesn\u0027t work for checking negative\nwarning options (ie things like \u0027-Wno-stringop-overflow\u0027) because gcc\nwill silently accept options it doesn\u0027t recognize, and so \u0027cc-option\u0027\nends up thinking they are perfectly fine.\n\nAnd it all works, until you have a situation where _another_ warning is\nemitted. At that point the compiler will go \"Hmm, maybe the user\nintended to disable this warning but used that wrong option that I\ndidn\u0027t recognize\", and generate a warning for the unrecognized negative\noption.\n\nWhich explains why we have several cases of this in the tree: the\n\u0027cc-option\u0027 test really doesn\u0027t work for this situation, but most of the\ntime it simply doesn\u0027t matter that ity doesn\u0027t work.\n\nThe reason my recently added case caused problems on sparc was pointed\nout by Thomas Weißschuh: the sparc build had a previous explicit warning\nthat then triggered the new one.\n\nI think the best fix for this would be to make \u0027cc-option\u0027 a bit smarter\nabout this sitation, possibly by adding an intentional warning to the\ntest case that then triggers the unrecognized option warning reliably.\n\nBut the short-term fix is to replace \u0027cc-option\u0027 with an existing helper\ndesigned for this exact case: \u0027cc-disable-warning\u0027, which picks the\nnegative warning but uses the positive form for testing the compiler\nsupport.\n\nReported-by: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nLink: https://lore.kernel.org/all/20250422204718.0b4e3f81@canb.auug.org.au/\nExplained-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "82efd569a8909f2b13140c1b3de88535aea0b051", "tree": "802016c7b33648656021002a6963356f9e488789", "parents": [ "0251ddbffbeb213f0f74ef94b2cacce580eb8d76" ], "author": { "name": "Vlastimil Babka", "email": "vbabka@suse.cz", "time": "Wed Apr 23 10:21:29 2025 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 23 09:04:56 2025 -0700" }, "message": "locking/local_lock: fix _Generic() matching of local_trylock_t\n\nMichael Larabel reported [1] a nginx performance regression in v6.15-rc3\nand bisected it to commit 51339d99c013 (\"locking/local_lock, mm: replace\nlocaltry_ helpers with local_trylock_t type\")\n\nThe problem is the _Generic() usage with a default association that\nmasks the fact that \"local_trylock_t *\" association is not being\nselected as expected. Replacing the default with the only other\nexpected type \"local_lock_t *\" reveals the underlying problem:\n\n include/linux/local_lock_internal.h:174:26: error: ‘_Generic’ selector of type ‘__seg_gs local_lock_t *’ is not compatible with any association\n\nThe local_locki\u0027s are part of __percpu structures and thus the __percpu\nattribute is needed to associate the type properly. Add the attribute\nand keep the default replaced to turn any further mismatches into\ncompile errors.\n\nThe failure to recognize local_try_lock_t in __local_lock_release()\nmeans that a local_trylock[_irqsave]() operation will set tl-\u003eacquired\nto 1 (there\u0027s no _Generic() part in the trylock code), but then\nlocal_unlock[_irqrestore]() will not set tl-\u003eacquired back to 0, so\nfurther trylock operations will always fail on the same cpu+lock, while\nnon-trylock operations continue to work - a lockdep_assert() is also not\nbeing executed in the _Generic() part of local_lock() code.\n\nThis means consume_stock() and refill_stock() operations will fail\ndeterministically, resulting in taking the slow paths and worse\nperformance.\n\nFixes: 51339d99c013 (\"locking/local_lock, mm: replace localtry_ helpers with local_trylock_t type\")\nReported-by: Michael Larabel \u003cMichael@phoronix.com\u003e\nCloses: https://www.phoronix.com/review/linux-615-nginx-regression/2 [1]\nSigned-off-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0251ddbffbeb213f0f74ef94b2cacce580eb8d76", "tree": "e106f062df10f46f9d031c64b8b22d3989682302", "parents": [ "bc3372351d0c8b2726b7d4229b878342e3e6b0e8", "58465d86071b61415e25fb054201f61e83d21465" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 23 08:25:56 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 23 08:25:56 2025 -0700" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"A small number of fixes:\n\n - virtgpu is exempt from reset shutdown fow now - a more complete fix\n is in the works\n\n - spec compliance fixes in:\n - virtio-pci cap commands\n - vhost_scsi_send_bad_target\n - virtio console resize\n\n - missing locking fix in vhost-scsi\n\n - virtio ring - a KCSAN false positive fix\n\n - VHOST_*_OWNER documentation fix\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:\n vhost-scsi: Fix vhost_scsi_send_status()\n vhost-scsi: Fix vhost_scsi_send_bad_target()\n vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex\n vhost_task: fix vhost_task_create() documentation\n virtio_console: fix order of fields cols and rows\n virtio_console: fix missing byte order handling for cols and rows\n virtgpu: don\u0027t reset on shutdown\n virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN\n vhost: fix VHOST_*_OWNER documentation\n virtio_pci: Use self group type for cap commands\n" }, { "commit": "491ef1117c56476f199b481f8c68820fe4c3a7c2", "tree": "e37439ed06a834b8d5251f0b3705eacf7ec3f90e", "parents": [ "d63527e109e811ef11abb1c2985048fdb528b4cb" ], "author": { "name": "Bo-Cun Chen", "email": "bc-bocun.chen@mediatek.com", "time": "Thu Apr 17 17:41:07 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 18:51:48 2025 -0700" }, "message": "net: ethernet: mtk_eth_soc: net: revise NETSYSv3 hardware configuration\n\nChange hardware configuration for the NETSYSv3.\n - Enable PSE dummy page mechanism for the GDM1/2/3\n - Enable PSE drop mechanism when the WDMA Rx ring full\n - Enable PSE no-drop mechanism for packets from the WDMA Tx\n - Correct PSE free drop threshold\n - Correct PSE CDMA high threshold\n\nFixes: 1953f134a1a8b (\"net: ethernet: mtk_eth_soc: add NETSYS_V3 version support\")\nSigned-off-by: Bo-Cun Chen \u003cbc-bocun.chen@mediatek.com\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/b71f8fd9d4bb69c646c4d558f9331dd965068606.1744907886.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d63527e109e811ef11abb1c2985048fdb528b4cb", "tree": "346815a19eb82612b27590ab8e2cd5f31077acd0", "parents": [ "4bc12818b363bd30f0f7348dd9ab077290a637ae" ], "author": { "name": "Tung Nguyen", "email": "tung.quang.nguyen@est.tech", "time": "Thu Apr 17 14:47:15 2025 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 18:43:57 2025 -0700" }, "message": "tipc: fix NULL pointer dereference in tipc_mon_reinit_self()\n\nsyzbot reported:\n\ntipc: Node number set to 1055423674\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 3 UID: 0 PID: 6017 Comm: kworker/3:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: events tipc_net_finalize_work\nRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719\n...\nRSP: 0018:ffffc9000356fb68 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba\nRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010\nRBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007\nR13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010\nFS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tipc_net_finalize+0x10b/0x180 net/tipc/net.c:140\n process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238\n process_scheduled_works kernel/workqueue.c:3319 [inline]\n worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n kthread+0x3c2/0x780 kernel/kthread.c:464\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n...\nRIP: 0010:tipc_mon_reinit_self+0x11c/0x210 net/tipc/monitor.c:719\n...\nRSP: 0018:ffffc9000356fb68 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003ee87cba\nRDX: 0000000000000000 RSI: ffffffff8dbc56a7 RDI: ffff88804c2cc010\nRBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000007\nR13: fffffbfff2111097 R14: ffff88804ead8000 R15: ffff88804ead9010\nFS: 0000000000000000(0000) GS:ffff888097ab9000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000f720eb00 CR3: 000000000e182000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nThere is a racing condition between workqueue created when enabling\nbearer and another thread created when disabling bearer right after\nthat as follow:\n\nenabling_bearer | disabling_bearer\n--------------- | ----------------\ntipc_disc_timeout() |\n{ | bearer_disable()\n ... | {\n schedule_work(\u0026tn-\u003ework); | tipc_mon_delete()\n ... | {\n} | ...\n | write_lock_bh(\u0026mon-\u003elock);\n | mon-\u003eself \u003d NULL;\n | write_unlock_bh(\u0026mon-\u003elock);\n | ...\n | }\ntipc_net_finalize_work() | }\n{ |\n ... |\n tipc_net_finalize() |\n { |\n ... |\n tipc_mon_reinit_self() |\n { |\n ... |\n write_lock_bh(\u0026mon-\u003elock); |\n mon-\u003eself-\u003eaddr \u003d tipc_own_addr(net); |\n write_unlock_bh(\u0026mon-\u003elock); |\n ... |\n } |\n ... |\n } |\n ... |\n} |\n\n\u0027mon-\u003eself\u0027 is set to NULL in disabling_bearer thread and dereferenced\nlater in enabling_bearer thread.\n\nThis commit fixes this issue by validating \u0027mon-\u003eself\u0027 before assigning\nnode address to it.\n\nReported-by: syzbot+ed60da8d686dc709164c@syzkaller.appspotmail.com\nFixes: 46cb01eeeb86 (\"tipc: update mon\u0027s self addr when node addr generated\")\nSigned-off-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250417074826.578115-1-tung.quang.nguyen@est.tech\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8006aff15516a170640239c5a8e6696c0ba18d8e", "tree": "7e1100d6083bf63f2e831422746e2f1d0bfc4e4c", "parents": [ "002ba346e3d76bb2b09448beed06c5ea1b0e06b8" ], "author": { "name": "Marek Behún", "email": "kabel@kernel.org", "time": "Tue Apr 22 11:57:18 2025 +0200" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Wed Apr 23 09:32:57 2025 +0800" }, "message": "crypto: atmel-sha204a - Set hwrng quality to lowest possible\n\nAccording to the review by Bill Cox [1], the Atmel SHA204A random number\ngenerator produces random numbers with very low entropy.\n\nSet the lowest possible entropy for this chip just to be safe.\n\n[1] https://www.metzdowd.com/pipermail/cryptography/2014-December/023858.html\n\nFixes: da001fb651b00e1d (\"crypto: atmel-i2c - add support for SHA204A random number generator\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Marek Behún \u003ckabel@kernel.org\u003e\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nReviewed-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "002ba346e3d76bb2b09448beed06c5ea1b0e06b8", "tree": "b9fcaba65bb3ad91e67df75a6b5f0da5aba4373e", "parents": [ "aece1cf146741761a1243746db5b72f5ece68290" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Mon Apr 21 11:31:31 2025 +0800" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Wed Apr 23 09:32:57 2025 +0800" }, "message": "crypto: scomp - Fix off-by-one bug when calculating last page\n\nFix off-by-one bug in the last page calculation for src and dst.\n\nReported-by: Nhat Pham \u003cnphamcs@gmail.com\u003e\nFixes: 2d3553ecb4e3 (\"crypto: scomp - Remove support for some non-trivial SG lists\")\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "4bc12818b363bd30f0f7348dd9ab077290a637ae", "tree": "f8aa194c91aeeb6455495d5908fda4977784965e", "parents": [ "b7f0ee992adf601aa00c252418266177eb7ac2bc" ], "author": { "name": "Bui Quang Minh", "email": "minhquangbui99@gmail.com", "time": "Thu Apr 17 14:28:03 2025 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 18:29:13 2025 -0700" }, "message": "virtio-net: disable delayed refill when pausing rx\n\nWhen pausing rx (e.g. set up xdp, xsk pool, rx resize), we call\nnapi_disable() on the receive queue\u0027s napi. In delayed refill_work, it\nalso calls napi_disable() on the receive queue\u0027s napi. When\nnapi_disable() is called on an already disabled napi, it will sleep in\nnapi_disable_locked while still holding the netdev_lock. As a result,\nlater napi_enable gets stuck too as it cannot acquire the netdev_lock.\nThis leads to refill_work and the pause-then-resume tx are stuck\naltogether.\n\nThis scenario can be reproducible by binding a XDP socket to virtio-net\ninterface without setting up the fill ring. As a result, try_fill_recv\nwill fail until the fill ring is set up and refill_work is scheduled.\n\nThis commit adds virtnet_rx_(pause/resume)_all helpers and fixes up the\nvirtnet_rx_resume to disable future and cancel all inflights delayed\nrefill_work before calling napi_disable() to pause the rx.\n\nFixes: 413f0271f396 (\"net: protect NAPI enablement with netdev_lock()\")\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Bui Quang Minh \u003cminhquangbui99@gmail.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nLink: https://patch.msgid.link/20250417072806.18660-2-minhquangbui99@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7f0ee992adf601aa00c252418266177eb7ac2bc", "tree": "4a264a1bdf468f0f5e41ea4ada7cecbc3f7dc53e", "parents": [ "ce6815585d460c610e9881a5d347c0a34da287e4" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@siflower.com.cn", "time": "Thu Apr 17 11:25:56 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 18:25:18 2025 -0700" }, "message": "net: phy: leds: fix memory leak\n\nA network restart test on a router led to an out-of-memory condition,\nwhich was traced to a memory leak in the PHY LED trigger code.\n\nThe root cause is misuse of the devm API. The registration function\n(phy_led_triggers_register) is called from phy_attach_direct, not\nphy_probe, and the unregister function (phy_led_triggers_unregister)\nis called from phy_detach, not phy_remove. This means the register and\nunregister functions can be called multiple times for the same PHY\ndevice, but devm-allocated memory is not freed until the driver is\nunbound.\n\nThis also prevents kmemleak from detecting the leak, as the devm API\ninternally stores the allocated pointer.\n\nFix this by replacing devm_kzalloc/devm_kcalloc with standard\nkzalloc/kcalloc, and add the corresponding kfree calls in the unregister\npath.\n\nFixes: 3928ee6485a3 (\"net: phy: leds: Add support for \"link\" trigger\")\nFixes: 2e0bc452f472 (\"net: phy: leds: add support for led triggers on phy link state change\")\nSigned-off-by: Hao Guan \u003chao.guan@siflower.com.cn\u003e\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@siflower.com.cn\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20250417032557.2929427-1-dqfext@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ce6815585d460c610e9881a5d347c0a34da287e4", "tree": "ed02870a887e845c4d2e7c83d04bb99d6c3a32c6", "parents": [ "4c8925cb9db158c812e1e11f3e74b945df7c9801" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Wed Apr 16 22:53:19 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 18:21:53 2025 -0700" }, "message": "net: phylink: mac_link_(up|down)() clarifications\n\nAs a result of an email from the fbnic author, I reviewed the phylink\ndocumentation, and I have decided to clarify the wording in the\nmac_link_(up|down)() kernel documentation as this was written from the\npoint of view of mvneta/mvpp2 and is misleading.\n\nThe documentation talks about forcing the link - indeed, this is what\nis done in the mvneta and mvpp2 drivers but not at the physical layer\nbut the MACs idea, which has the effect of only allowing or stopping\npacket flow at the MAC. This \"link\" needs to be controlled when using\na PHY or fixed link to start or stop packet flow at the MAC. However,\nas the MAC and PCS are tightly integrated, if the MACs idea of the\nlink is forced down, it has the side effect that there is no way to\ndetermine that the media link has come up - in this mode, the MAC must\nbe allowed to follow its built-in PCS so we can read the link state.\n\nFrame the documentation in more generic terms, to avoid the thought\nthat the physical media link to the partner needs in some way to be\nforced up or down with these calls; it does not. If that were to be\ndone, it would be a self-fulfilling prophecy - e.g. if the media link\ngoes down, then mac_link_down() will be called, and if the media link\nis then placed into a forced down state, there is no possibility\nthat the media link will ever come up again - clearly this is a wrong\ninterpretation.\n\nThese methods are notifications to the MAC about what has happened to\nthe media link state - either from the PHY, or a PCS, or whatever\nmechanism fixed-link is using. Thus, reword them to get away from\ntalking about changing link state to avoid confusion with media link\nstate.\n\nThis is not a change of any requirements of these methods.\n\nAlso, remove the obsolete references to EEE for these methods, we now\nhave the LPI functions for configuring the EEE parameters which\nrenders this redundant, and also makes the passing of \"phy\" to the\nmac_link_up() function obsolete.\n\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/E1u5Ah5-001GO1-7E@rmk-PC.armlinux.org.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c8925cb9db158c812e1e11f3e74b945df7c9801", "tree": "b9baf082fd96a706d7d67dd9f683357a1e88415d", "parents": [ "c03a49f3093a4903c8a93c8b5c9a297b5343b169" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Wed Apr 16 17:16:01 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 22 16:56:44 2025 -0700" }, "message": "net: phylink: fix suspend/resume with WoL enabled and link down\n\nWhen WoL is enabled, we update the software state in phylink to\nindicate that the link is down, and disable the resolver from\nbringing the link back up.\n\nOn resume, we attempt to bring the overall state into consistency\nby calling the .mac_link_down() method, but this is wrong if the\nlink was already down, as phylink strictly orders the .mac_link_up()\nand .mac_link_down() methods - and this would break that ordering.\n\nFixes: f97493657c63 (\"net: phylink: add suspend/resume support\")\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\nTested-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\nLink: https://patch.msgid.link/E1u55Qf-0016RN-PA@rmk-PC.armlinux.org.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bc3372351d0c8b2726b7d4229b878342e3e6b0e8", "tree": "cb0af25fb43eb07c3b55f7b9ede0bf97b92aaeba", "parents": [ "e4b51cb60e16f09b95c9ee567692aaec50087747", "866bafae59ecffcf1840d846cd79740be29f21d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 22 10:22:38 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 22 10:22:38 2025 -0700" }, "message": "Merge tag \u0027for-6.15-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - subpage mode fixes:\n - access correct object (folio) when looking up bit offset\n - fix assertion condition for number of blocks per folio\n - fix upper boundary of locking range in hole punch\n\n - zoned fixes:\n - fix potential deadlock caught by lockdep when zone reporting and\n device freeze run in parallel\n - fix zone write pointer mismatch and NULL pointer dereference when\n metadata are converted from DUP to RAID1\n\n - fix error handling when reloc inode creation fails\n\n - in tree-checker, unify error code for header level check\n\n - block layer: add helpers to read zone capacity\n\n* tag \u0027for-6.15-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: zoned: skip reporting zone for new block group\n block: introduce zone capacity helper\n btrfs: tree-checker: adjust error code for header level check\n btrfs: fix invalid inode pointer after failure to create reloc inode\n btrfs: zoned: return EIO on RAID1 block group write pointer mismatch\n btrfs: fix the ASSERT() inside GET_SUBPAGE_BITMAP()\n btrfs: avoid page_lockend underflow in btrfs_punch_hole_lock_range()\n btrfs: subpage: access correct object when reading bitmap start in subpage_calc_start_bit()\n" }, { "commit": "e4b51cb60e16f09b95c9ee567692aaec50087747", "tree": "ed5fab8da99ddecd38fff6c9429472ab792ccd85", "parents": [ "a33b5a08cbbdd7aadff95f40cbb45ab86841679e", "30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 22 09:36:45 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 22 09:36:45 2025 -0700" }, "message": "Merge tag \u0027integrity-6.15-rc3-fix\u0027 of https://github.com/linux-integrity/linux\n\nPull integrity fix from Roberto Sassu:\n \"One performance fix to avoid unnecessarily taking the inode lock\"\n\n* tag \u0027integrity-6.15-rc3-fix\u0027 of https://github.com/linux-integrity/linux:\n ima: process_measurement() needlessly takes inode_lock() on MAY_READ\n" }, { "commit": "30d68cb0c37ebe2dc63aa1d46a28b9163e61caa2", "tree": "2d530ebf3a0d053e068146932c307007fa25f188", "parents": [ "9c32cda43eb78f78c73aee4aa344b777714e259b" ], "author": { "name": "Frederick Lawler", "email": "fred@cloudflare.com", "time": "Thu Mar 27 11:09:11 2025 -0500" }, "committer": { "name": "Roberto Sassu", "email": "roberto.sassu@huawei.com", "time": "Tue Apr 22 16:39:32 2025 +0200" }, "message": "ima: process_measurement() needlessly takes inode_lock() on MAY_READ\n\nOn IMA policy update, if a measure rule exists in the policy,\nIMA_MEASURE is set for ima_policy_flags which makes the violation_check\nvariable always true. Coupled with a no-action on MAY_READ for a\nFILE_CHECK call, we\u0027re always taking the inode_lock().\n\nThis becomes a performance problem for extremely heavy read-only workloads.\nTherefore, prevent this only in the case there\u0027s no action to be taken.\n\nSigned-off-by: Frederick Lawler \u003cfred@cloudflare.com\u003e\nAcked-by: Roberto Sassu \u003croberto.sassu@huawei.com\u003e\nSigned-off-by: Mimi Zohar \u003czohar@linux.ibm.com\u003e\n" }, { "commit": "c03a49f3093a4903c8a93c8b5c9a297b5343b169", "tree": "9c354c22347f412de2c7f9f406887a911e5637bf", "parents": [ "9e8d1013b0c38910cbc9e60de74dbe883878469d" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@uliege.be", "time": "Wed Apr 16 18:07:16 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 22 15:37:01 2025 +0200" }, "message": "net: lwtunnel: disable BHs when required\n\nIn lwtunnel_{output|xmit}(), dev_xmit_recursion() may be called in\npreemptible scope for PREEMPT kernels. This patch disables BHs before\ncalling dev_xmit_recursion(). BHs are re-enabled only at the end, since\nwe must ensure the same CPU is used for both dev_xmit_recursion_inc()\nand dev_xmit_recursion_dec() (and any other recursion levels in some\ncases) in order to maintain valid per-cpu counters.\n\nReported-by: Alexei Starovoitov \u003calexei.starovoitov@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAADnVQJFWn3dBFJtY+ci6oN1pDFL\u003dTzCmNbRgey7MdYxt_AP2g@mail.gmail.com/\nReported-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/m2h62qwf34.fsf@gmail.com/\nFixes: 986ffb3a57c5 (\"net: lwtunnel: fix recursion loops\")\nSigned-off-by: Justin Iurman \u003cjustin.iurman@uliege.be\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250416160716.8823-1-justin.iurman@uliege.be\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9e8d1013b0c38910cbc9e60de74dbe883878469d", "tree": "946975c480ec4136b4810ba2ec2f9a6b4577a737", "parents": [ "30a41ed32d3088cd0d682a13d7f30b23baed7e93" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Wed Apr 16 18:01:25 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 22 15:30:35 2025 +0200" }, "message": "net: selftests: initialize TCP header and skb payload with zero\n\nZero-initialize TCP header via memset() to avoid garbage values that\nmay affect checksum or behavior during test transmission.\n\nAlso zero-fill allocated payload and padding regions using memset()\nafter skb_put(), ensuring deterministic content for all outgoing\ntest packets.\n\nFixes: 3e1e58d64c3d (\"net: add generic selftest support\")\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250416160125.2914724-1-o.rempel@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "30a41ed32d3088cd0d682a13d7f30b23baed7e93", "tree": "3d27ba985278a83fe75007afad3c353a6fe97a3c", "parents": [ "b1eac30d9bc21cdaff97b2b23000085492efc662" ], "author": { "name": "Fiona Klute", "email": "fiona.klute@gmx.de", "time": "Wed Apr 16 12:24:13 2025 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 22 12:57:37 2025 +0200" }, "message": "net: phy: microchip: force IRQ polling mode for lan88xx\n\nWith lan88xx based devices the lan78xx driver can get stuck in an\ninterrupt loop while bringing the device up, flooding the kernel log\nwith messages like the following:\n\nlan78xx 2-3:1.0 enp1s0u3: kevent 4 may have been dropped\n\nRemoving interrupt support from the lan88xx PHY driver forces the\ndriver to use polling instead, which avoids the problem.\n\nThe issue has been observed with Raspberry Pi devices at least since\n4.14 (see [1], bug report for their downstream kernel), as well as\nwith Nvidia devices [2] in 2020, where disabling interrupts was the\nvendor-suggested workaround (together with the claim that phylib\nchanges in 4.9 made the interrupt handling in lan78xx incompatible).\n\nIperf reports well over 900Mbits/sec per direction with client in\n--dualtest mode, so there does not seem to be a significant impact on\nthroughput (lan88xx device connected via switch to the peer).\n\n[1] https://github.com/raspberrypi/linux/issues/2447\n[2] https://forums.developer.nvidia.com/t/jetson-xavier-and-lan7800-problem/142134/11\n\nLink: https://lore.kernel.org/0901d90d-3f20-4a10-b680-9c978e04ddda@lunn.ch\nFixes: 792aec47d59d (\"add microchip LAN88xx phy driver\")\nSigned-off-by: Fiona Klute \u003cfiona.klute@gmx.de\u003e\nCc: kernel-list@raspberrypi.com\nCc: stable@vger.kernel.org\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20250416102413.30654-1-fiona.klute@gmx.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a33b5a08cbbdd7aadff95f40cbb45ab86841679e", "tree": "ec163a453919e837b2247570f2b5e12824693f27", "parents": [ "a22509a4ee99e23c6bd8980b70dd78aade6baabd", "bc08b15b54b8aadbc8a8f413271c07a3f4bead87" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 21 19:16:29 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 21 19:16:29 2025 -0700" }, "message": "Merge tag \u0027sched_ext-for-6.15-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Use kvzalloc() so that large exit_dump buffer allocations don\u0027t fail\n easily\n\n - Remove cpu.weight / cpu.idle unimplemented warnings which are more\n annoying than helpful.\n\n This makes SCX_OPS_HAS_CGROUP_WEIGHT unnecessary. Mark it for\n deprecation\n\n* tag \u0027sched_ext-for-6.15-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Mark SCX_OPS_HAS_CGROUP_WEIGHT for deprecation\n sched_ext: Remove cpu.weight / cpu.idle unimplemented warnings\n sched_ext: Use kvzalloc for large exit_dump allocation\n" }, { "commit": "a22509a4ee99e23c6bd8980b70dd78aade6baabd", "tree": "22f1aa21387f911071cd5d465ee73ff8e74bbca7", "parents": [ "9d7a0577c9db35c4cc52db90bc415ea248446472", "1bf67c8fdbda21fadd564a12dbe2b13c1ea5eda7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 21 19:13:25 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 21 19:13:25 2025 -0700" }, "message": "Merge tag \u0027cgroup-for-6.15-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - Fix compilation in CONFIG_LOCKDEP \u0026\u0026 !CONFIG_PROVE_RCU configurations\n\n - Allow \"cpuset_v2_mode\" mount option for \"cpuset\" filesystem type to\n make life easier for android\n\n* tag \u0027cgroup-for-6.15-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset-v1: Add missing support for cpuset_v2_mode\n cgroup: Fix compilation issue due to cgroup_mutex not being exported\n" }, { "commit": "b1eac30d9bc21cdaff97b2b23000085492efc662", "tree": "9d51202142b92e051b8b27058617ce211f17aace", "parents": [ "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "020f0c8b3d396ec8190948f86063e1c45133f839" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 19:02:18 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 19:02:19 2025 -0700" }, "message": "Merge branch \u0027enetc-bug-fixes-for-bpf_xdp_adjust_head-and-bpf_xdp_adjust_tail\u0027\n\nVladimir Oltean says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nENETC bug fixes for bpf_xdp_adjust_head() and bpf_xdp_adjust_tail()\n\nIt has been reported that on the ENETC driver, bpf_xdp_adjust_head()\nand bpf_xdp_adjust_tail() are broken in combination with the XDP_PASS\nverdict. I have constructed a series a simple XDP programs and tested\nwith various packet sizes and confirmed that this is the case.\n\nPatch 3/3 fixes the core issue, which is that the sk_buff created on\nXDP_PASS is created by the driver as if XDP never ran, but in fact the\ngeometry needs to be adjusted according to the delta applied by the\nprogram on the original xdp_buff. It depends on commit 539c1fba1ac7\n(\"xdp: add generic xdp_build_skb_from_buff()\") which is not available in\n\"stable\" but perhaps should be.\n\nPatch 2/3 is a small refactor necessary for 3/3.\n\nPatch 1/3 fixes a related issue I noticed, which is that\nbpf_xdp_adjust_tail() with a positive offset works for linear XDP\nbuffers, but returns an error for non-linear ones, even if there is\nplenty of space in the final page fragment.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250417120005.3288549-1-vladimir.oltean@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "020f0c8b3d396ec8190948f86063e1c45133f839", "tree": "9d51202142b92e051b8b27058617ce211f17aace", "parents": [ "1d587faa5be7e9785b682cc5f58ba8f4100c13ea" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu Apr 17 15:00:05 2025 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 19:02:14 2025 -0700" }, "message": "net: enetc: fix frame corruption on bpf_xdp_adjust_head/tail() and XDP_PASS\n\nVlatko Markovikj reported that XDP programs attached to ENETC do not\nwork well if they use bpf_xdp_adjust_head() or bpf_xdp_adjust_tail(),\ncombined with the XDP_PASS verdict. A typical use case is to add or\nremove a VLAN tag.\n\nThe resulting sk_buff passed to the stack is corrupted, because the\nalgorithm used by the driver for XDP_PASS is to unwind the current\nbuffer pointer in the RX ring and to re-process the current frame with\nenetc_build_skb() as if XDP hadn\u0027t run. That is incorrect because XDP\nmay have modified the geometry of the buffer, which we then are\ncompletely unaware of. We are looking at a modified buffer with the\noriginal geometry.\n\nThe initial reaction, both from me and from Vlatko, was to shop around\nthe kernel for code to steal that would calculate a delta between the\nold and the new XDP buffer geometry, and apply that to the sk_buff too.\nWe noticed that veth and generic xdp have such code.\n\nThe headroom adjustment is pretty uncontroversial, but what turned out\nseverely problematic is the tailroom.\n\nveth has this snippet:\n\n\t\t__skb_put(skb, off); /* positive on grow, negative on shrink */\n\nwhich on first sight looks decent enough, except __skb_put() takes an\n\"unsigned int\" for the second argument, and the arithmetic seems to only\nwork correctly by coincidence. Second issue, __skb_put() contains a\nSKB_LINEAR_ASSERT(). It\u0027s not a great pattern to make more widespread.\nThe skb may still be nonlinear at that point - it only becomes linear\nlater when resetting skb-\u003edata_len to zero.\n\nTo avoid the above, bpf_prog_run_generic_xdp() does this instead:\n\n\t\tskb_set_tail_pointer(skb, xdp-\u003edata_end - xdp-\u003edata);\n\t\tskb-\u003elen +\u003d off; /* positive on grow, negative on shrink */\n\nwhich is more open-coded, uses lower-level functions and is in general a\nbit too much to spread around in driver code.\n\nThen there is the snippet:\n\n\tif (xdp_buff_has_frags(xdp))\n\t\tskb-\u003edata_len \u003d skb_shinfo(skb)-\u003exdp_frags_size;\n\telse\n\t\tskb-\u003edata_len \u003d 0;\n\nOne would have expected __pskb_trim() to be the function of choice for\nthis task. But it\u0027s not used in veth/xdpgeneric because the extraneous\nfragments were _already_ freed by bpf_xdp_adjust_tail() -\u003e\nbpf_xdp_frags_shrink_tail() -\u003e ... -\u003e __xdp_return() - the backing\nmemory for the skb frags and the xdp frags is the same, but they don\u0027t\nkeep individual references.\n\nIn fact, that is the biggest reason why this snippet cannot be reused\nas-is, because ENETC temporarily constructs an skb with the original len\nand the original number of frags. Because the extraneous frags are\nalready freed by bpf_xdp_adjust_tail() and returned to the page\nallocator, it means the entire approach of using enetc_build_skb() is\nquestionable for XDP_PASS. To avoid that, one would need to elevate the\npage refcount of all frags before calling bpf_prog_run_xdp() and drop it\nafter XDP_PASS.\n\nThere are other things that are missing in ENETC\u0027s handling of XDP_PASS,\nlike for example updating skb_shinfo(skb)-\u003emeta_len.\n\nThese are all handled correctly and cleanly in commit 539c1fba1ac7\n(\"xdp: add generic xdp_build_skb_from_buff()\"), added to net-next in\nDec 2024, and in addition might even be quicker that way. I have a very\nstrong preference towards backporting that commit for \"stable\", and that\nis what is used to fix the handling bugs. It is way too messy to go\nthis deep into the guts of an sk_buff from the code of a device driver.\n\nFixes: d1b15102dd16 (\"net: enetc: add support for XDP_DROP and XDP_PASS\")\nReported-by: Vlatko Markovikj \u003cvlatko.markovikj@etas.com\u003e\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20250417120005.3288549-4-vladimir.oltean@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d587faa5be7e9785b682cc5f58ba8f4100c13ea", "tree": "edf0adc5b6a3054256cddc1ee19554cf1b2e0ff4", "parents": [ "2768b2e2f7d25ae8984ebdcde8ec1014b6fdcd89" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu Apr 17 15:00:04 2025 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 19:02:14 2025 -0700" }, "message": "net: enetc: refactor bulk flipping of RX buffers to separate function\n\nThis small snippet of code ensures that we do something with the array\nof RX software buffer descriptor elements after passing the skb to the\nstack. In this case, we see if the other half of the page is reusable,\nand if so, we \"turn around\" the buffers, making them directly usable by\nenetc_refill_rx_ring() without going to enetc_new_page().\n\nWe will need to perform this kind of buffer flipping from a new code\npath, i.e. from XDP_PASS. Currently, enetc_build_skb() does it there\nbuffer by buffer, but in a subsequent change we will stop using\nenetc_build_skb() for XDP_PASS.\n\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20250417120005.3288549-3-vladimir.oltean@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2768b2e2f7d25ae8984ebdcde8ec1014b6fdcd89", "tree": "2eb2e4e9d0b904e0f0ab097513b6dd5f2594e202", "parents": [ "cc3628dcd851ddd8d418bf0c897024b4621ddc92" ], "author": { "name": "Vladimir Oltean", "email": "vladimir.oltean@nxp.com", "time": "Thu Apr 17 15:00:03 2025 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 19:02:14 2025 -0700" }, "message": "net: enetc: register XDP RX queues with frag_size\n\nAt the time when bpf_xdp_adjust_tail() gained support for non-linear\nbuffers, ENETC was already generating this kind of geometry on RX, due\nto its use of 2K half page buffers. Frames larger than 1472 bytes\n(without FCS) are stored as multi-buffer, presenting a need for multi\nbuffer support to work properly even in standard MTU circumstances.\n\nAllow bpf_xdp_frags_increase_tail() to know the allocation size of paged\ndata, so it can safely permit growing the tailroom of the buffer from\nXDP programs.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20250417120005.3288549-2-vladimir.oltean@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "tree": "645e99cb27092818920c1bfb8e1235a34111212f", "parents": [ "3a7012020532c5a5bb75201a073055f029332299" ], "author": { "name": "Alexey Nepomnyashih", "email": "sdl@nppct.ru", "time": "Thu Apr 17 12:21:17 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 18:56:46 2025 -0700" }, "message": "xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented.\n\nCc: stable@vger.kernel.org # v5.9+\nFixes: 6c5aa6fc4def (\"xen networking: add basic XDP support for xen-netfront\")\nSigned-off-by: Alexey Nepomnyashih \u003csdl@nppct.ru\u003e\nLink: https://patch.msgid.link/20250417122118.1009824-1-sdl@nppct.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3a7012020532c5a5bb75201a073055f029332299", "tree": "35965dc8e4d50b9c3146d5f3710270fb7678a528", "parents": [ "d3153c3b42707d26c81083b426f2ef0951bce545", "e00c1517f2bc73186a18ac2cb1d6c5fee7e95239" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 18:36:37 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 18:36:37 2025 -0700" }, "message": "Merge branch \u0027maintainers-update-entries-for-s390-network-driver-files\u0027\n\nSimon Horman says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMAINTAINERS: Update entries for s390 network driver files\n\nUpdate the entries for s390 network driver files to:\n\n* Add include/linux/ism.h to MAINTAINERS\n* Add s390 network driver files to the NETWORKING DRIVERS section\n\nThis is to aid developers, and tooling such as get_maintainer.pl alike\nto CC patches to all the appropriate people and mailing lists. And is\nin keeping with an ongoing effort for NETWORKING entries in MAINTAINERS\nto more accurately reflect the way code is maintained.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250417-ism-maint-v1-0-b001be8545ce@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e00c1517f2bc73186a18ac2cb1d6c5fee7e95239", "tree": "35965dc8e4d50b9c3146d5f3710270fb7678a528", "parents": [ "c083da15f06c808c44444bfcef3c939a07ad394b" ], "author": { "name": "Simon Horman", "email": "horms@kernel.org", "time": "Thu Apr 17 11:15:02 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 18:36:24 2025 -0700" }, "message": "MAINTAINERS: Add s390 networking drivers to NETWORKING DRIVERS\n\nThese files are already correctly covered by the S390 NETWORKING DRIVERS\nsection. In practice commits for these drivers feed into the Networking\nsubsystem. So it seems appropriate to also list them under NETWORKING\nDRIVERS.\n\nThis aids developers, and tooling such as get_maintainer.pl\nalike to CC patches to all the appropriate people and mailing lists.\nAnd is in keeping with an ongoing effort for NETWORKING entries\nin MAINTAINERS to more accurately reflect the way code is maintained.\n\nSigned-off-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250417-ism-maint-v1-2-b001be8545ce@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c083da15f06c808c44444bfcef3c939a07ad394b", "tree": "f84162c9fd5236750db12f7a17b61f889f5c22f1", "parents": [ "d3153c3b42707d26c81083b426f2ef0951bce545" ], "author": { "name": "Simon Horman", "email": "horms@kernel.org", "time": "Thu Apr 17 11:15:01 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 18:36:24 2025 -0700" }, "message": "MAINTAINERS: Add ism.h to S390 NETWORKING DRIVERS\n\nism.h appears to be part of s390 networking drivers\nso add it to the corresponding section in MAINTAINERS.\n\nThis aids developers, and tooling such as get_maintainer.pl\nalike to CC patches to the appropriate people and mailing lists.\nAnd is in keeping with an ongoing effort for NETWORKING entries\nin MAINTAINERS to more accurately reflect the way code is maintained.\n\nSigned-off-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250417-ism-maint-v1-1-b001be8545ce@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b0b7ee3b574a72283399b9232f6190be07f220c0", "tree": "31e38d260dd769350b7ffd6b66ab92e55ca29005", "parents": [ "08a966a917fe3d92150fa3cc15793ad5e57051eb" ], "author": { "name": "Ranjan Kumar", "email": "ranjan.kumar@broadcom.com", "time": "Tue Apr 15 15:45:46 2025 +0530" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Mon Apr 21 21:07:38 2025 -0400" }, "message": "scsi: mpi3mr: Add level check to control event logging\n\nEnsure event logs are only generated when the debug logging level\nMPI3_DEBUG_EVENT is enabled. This prevents unnecessary logging.\n\nSigned-off-by: Ranjan Kumar \u003cranjan.kumar@broadcom.com\u003e\nLink: https://lore.kernel.org/r/20250415101546.204018-1-ranjan.kumar@broadcom.com\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "08a966a917fe3d92150fa3cc15793ad5e57051eb", "tree": "c06fc9271dc9782a88705ea99c0fca210d522dc6", "parents": [ "54bebe46871d4e56e05fcf55c1a37e7efa24e0a8" ], "author": { "name": "Chenyuan Yang", "email": "chenyuan0y@gmail.com", "time": "Sat Apr 12 14:59:09 2025 -0500" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Mon Apr 21 20:50:11 2025 -0400" }, "message": "scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()\n\nAdd a NULL check for the returned hwq pointer by ufshcd_mcq_req_to_hwq().\n\nThis is similar to the fix in commit 74736103fb41 (\"scsi: ufs: core: Fix\nufshcd_abort_one racing issue\").\n\nSigned-off-by: Chenyuan Yang \u003cchenyuan0y@gmail.com\u003e\nLink: https://lore.kernel.org/r/20250412195909.315418-1-chenyuan0y@gmail.com\nFixes: ab248643d3d6 (\"scsi: ufs: core: Add error handling for MCQ mode\")\nReviewed-by: Peter Wang \u003cpeter.wang@mediatek.com\u003e\nReviewed-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "54bebe46871d4e56e05fcf55c1a37e7efa24e0a8", "tree": "07ab7a1097f40d36c4d8cd95e377e841f014b26f", "parents": [ "569330a34a31a52c904239439984a59972c11d28" ], "author": { "name": "Anastasia Kovaleva", "email": "a.kovaleva@yadro.com", "time": "Mon Mar 24 11:49:33 2025 +0300" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Mon Apr 21 20:45:04 2025 -0400" }, "message": "scsi: core: Clear flags for scsi_cmnd that did not complete\n\nCommands that have not been completed with scsi_done() do not clear the\nSCMD_INITIALIZED flag and therefore will not be properly reinitialized.\nThus, the next time the scsi_cmnd structure is used, the command may\nfail in scsi_cmd_runtime_exceeded() due to the old jiffies_at_alloc\nvalue:\n\n kernel: sd 16:0:1:84: [sdts] tag#405 timing out command, waited 720s\n kernel: sd 16:0:1:84: [sdts] tag#405 FAILED Result: hostbyte\u003dDID_OK driverbyte\u003dDRIVER_OK cmd_age\u003d66636s\n\nClear flags for commands that have not been completed by SCSI.\n\nFixes: 4abafdc4360d (\"block: remove the initialize_rq_fn blk_mq_ops method\")\nSigned-off-by: Anastasia Kovaleva \u003ca.kovaleva@yadro.com\u003e\nLink: https://lore.kernel.org/r/20250324084933.15932-2-a.kovaleva@yadro.com\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "d3153c3b42707d26c81083b426f2ef0951bce545", "tree": "91e2adc723cb6650095565dd4e48b58fc1e9f76d", "parents": [ "b9a4c74b0ec13f54a1362d993c7d204fde5fe4e3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 17 18:53:17 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 17:10:49 2025 -0700" }, "message": "net: fix the missing unlock for detached devices\n\nThe combined condition was left as is when we converted\nfrom __dev_get_by_index() to netdev_get_by_index_lock().\nThere was no need to undo anything with the former, for\nthe latter we need an unlock.\n\nFixes: 1d22d3060b9b (\"net: drop rtnl_lock for queue_mgmt operations\")\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20250418015317.1954107-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9a4c74b0ec13f54a1362d993c7d204fde5fe4e3", "tree": "497bd25db43cbf4007b6f5b2df9dc936d775d91a", "parents": [ "750d0ac001e85b754404178ee8ce01cbc76a03be", "fa8fd315127ca48c65e7e6692a84ffcf3d07168e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 17:09:16 2025 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 17:09:17 2025 -0700" }, "message": "Merge branch \u0027net-mlx5-fix-null-dereference-and-memory-leak-in-ttc_table-creation\u0027\n\nHenry Martin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/mlx5: Fix NULL dereference and memory leak in ttc_table creation\n\nThis patch series addresses two issues in the\nmlx5_create_inner_ttc_table() and mlx5_create_ttc_table() functions:\n\n1. A potential NULL pointer dereference if mlx5_get_flow_namespace()\nreturns NULL.\n\n2. A memory leak in the error path when ttc_type is invalid (default:\nswitch case).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250418023814.71789-1-bsdhenrymartin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fa8fd315127ca48c65e7e6692a84ffcf3d07168e", "tree": "497bd25db43cbf4007b6f5b2df9dc936d775d91a", "parents": [ "91037037ee3d611ce17f39d75f79c7de394b122a" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Fri Apr 18 10:38:14 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 17:09:11 2025 -0700" }, "message": "net/mlx5: Move ttc allocation after switch case to prevent leaks\n\nRelocate the memory allocation for ttc table after the switch statement\nthat validates params-\u003ens_type in both mlx5_create_inner_ttc_table() and\nmlx5_create_ttc_table(). This ensures memory is only allocated after\nconfirming valid input, eliminating potential memory leaks when invalid\nns_type cases occur.\n\nFixes: 137f3d50ad2a (\"net/mlx5: Support matching on l4_type for ttc_table\")\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nReviewed-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nLink: https://patch.msgid.link/20250418023814.71789-3-bsdhenrymartin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "91037037ee3d611ce17f39d75f79c7de394b122a", "tree": "09ebbf8fa31a8fb0c0c939c9bdb178cb0860b404", "parents": [ "750d0ac001e85b754404178ee8ce01cbc76a03be" ], "author": { "name": "Henry Martin", "email": "bsdhenrymartin@gmail.com", "time": "Fri Apr 18 10:38:13 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 21 17:09:11 2025 -0700" }, "message": "net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()\n\nAdd NULL check for mlx5_get_flow_namespace() returns in\nmlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent\nNULL pointer dereference.\n\nFixes: 137f3d50ad2a (\"net/mlx5: Support matching on l4_type for ttc_table\")\nSigned-off-by: Henry Martin \u003cbsdhenrymartin@gmail.com\u003e\nReviewed-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nLink: https://patch.msgid.link/20250418023814.71789-2-bsdhenrymartin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9d7a0577c9db35c4cc52db90bc415ea248446472", "tree": "c297acd4e8b0e95a4b8402216c6c299c43de8d98", "parents": [ "9c32cda43eb78f78c73aee4aa344b777714e259b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 15:30:53 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 15:30:53 2025 -0700" }, "message": "gcc-15: disable \u0027-Wunterminated-string-initialization\u0027 entirely for now\n\nI had left the warning around but as a non-fatal error to get my gcc-15\nbuilds going, but fixed up some of the most annoying warning cases so\nthat it wouldn\u0027t be *too* verbose.\n\nBecause I like the _concept_ of the warning, even if I detested the\nimplementation to shut it up.\n\nIt turns out the implementation to shut it up is even more broken than I\nthought, and my \"shut up most of the warnings\" patch just caused fatal\nerrors on gcc-14 instead.\n\nI had tested with clang, but when I upgrade my development environment,\nI try to do it on all machines because I hate having different systems\nto maintain, and hadn\u0027t realized that gcc-14 now had issues.\n\nThe ACPI case is literally why I wanted to have a *type* that doesn\u0027t\ntrigger the warning (see commit d5d45a7f2619: \"gcc-15: make\n\u0027unterminated string initialization\u0027 just a warning\"), instead of\nmarking individual places as \"__nonstring\".\n\nBut gcc-14 doesn\u0027t like that __nonstring location that shut gcc-15 up,\nbecause it\u0027s on an array of char arrays, not on one single array:\n\n drivers/acpi/tables.c:399:1: error: \u0027nonstring\u0027 attribute ignored on objects of type \u0027const char[][4]\u0027 [-Werror\u003dattributes]\n 399 | static const char table_sigs[][ACPI_NAMESEG_SIZE] __initconst __nonstring \u003d {\n | ^~~~~~\n\nand my attempts to nest it properly with a type had failed, because of\nhow gcc doesn\u0027t like marking the types as having attributes, only\nsymbols.\n\nThere may be some trick to it, but I was already annoyed by the bad\nattribute design, now I\u0027m just entirely fed up with it.\n\nI wish gcc had a proper way to say \"this type is a *byte* array, not a\nstring\".\n\nThe obvious thing would be to distinguish between \"char []\" and an\nexplicitly signed \"unsigned char []\" (as opposed to an implicitly\nunsigned char, which is typically an architecture-specific default, but\nfor the kernel is universal thanks to \u0027-funsigned-char\u0027).\n\nBut any \"we can typedef a 8-bit type to not become a string just because\nit\u0027s an array\" model would be fine.\n\nBut \"__attribute__((nonstring))\" is sadly not that sane model.\n\nReported-by: Chris Clayton \u003cchris2553@googlemail.com\u003e\nFixes: 4b4bd8c50f48 (\"gcc-15: acpi: sprinkle random \u0027__nonstring\u0027 crumbles around\")\nFixes: d5d45a7f2619 (\"gcc-15: make \u0027unterminated string initialization\u0027 just a warning\")\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9c32cda43eb78f78c73aee4aa344b777714e259b", "tree": "2c886ba08c3a91a3826a6c1f54e305f5dba3d359", "parents": [ "ac71fabf15679fc7bc56c51bc92bd4b626564c37" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 13:43:47 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 13:43:47 2025 -0700" }, "message": "Linux 6.15-rc3\n" }, { "commit": "ac71fabf15679fc7bc56c51bc92bd4b626564c37", "tree": "bf382eb804b10461b12483912155ac56d0e76ab0", "parents": [ "05e8d261a34e5c637e37be55c26e42cf5c75ee5c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:30:11 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:57:54 2025 -0700" }, "message": "gcc-15: work around sequence-point warning\n\nThe C sequence points are complicated things, and gcc-15 has apparently\nadded a warning for the case where an object is both used and modified\nmultiple times within the same sequence point.\n\nThat\u0027s a great warning.\n\nOr rather, it would be a great warning, except gcc-15 seems to not\nreally be very exact about it, and doesn\u0027t notice that the modification\nare to two entirely different members of the same object: the array\ncounter and the array entries.\n\nSo that seems kind of silly.\n\nThat said, the code that gcc complains about is unnecessarily\ncomplicated, so moving the array counter update into a separate\nstatement seems like the most straightforward fix for these warnings:\n\n drivers/net/wireless/intel/iwlwifi/mld/d3.c: In function ‘iwl_mld_set_netdetect_info’:\n drivers/net/wireless/intel/iwlwifi/mld/d3.c:1102:66: error: operation on ‘netdetect_info-\u003en_matches’ may be undefined [-Werror\u003dsequence-point]\n 1102 | netdetect_info-\u003ematches[netdetect_info-\u003en_matches++] \u003d match;\n | ~~~~~~~~~~~~~~~~~~~~~~~~~^~\n\n drivers/net/wireless/intel/iwlwifi/mld/d3.c:1120:58: error: operation on ‘match-\u003en_channels’ may be undefined [-Werror\u003dsequence-point]\n 1120 | match-\u003echannels[match-\u003en_channels++] \u003d\n | ~~~~~~~~~~~~~~~~~^~\n\nside note: the code at that second warning is actively buggy, and only\nworks on little-endian machines that don\u0027t do strict alignment checks.\n\nThe code casts an array of integers into an array of unsigned long in\norder to use our bitmap iterators. That happens to work fine on any\nsane architecture, but it\u0027s still wrong.\n\nThis does *not* fix that more serious problem. This only splits the two\nassignments into two statements and fixes the compiler warning. I need\nto get rid of the new warnings in order to be able to actually do any\nbuild testing.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "05e8d261a34e5c637e37be55c26e42cf5c75ee5c", "tree": "946d1ca767a6a84ef9be07834eca6e997626f5a3", "parents": [ "be913e7c4034bd7a5cbfc3d53188344dc588d45c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:18:55 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:57:54 2025 -0700" }, "message": "gcc-15: add \u0027__nonstring\u0027 markers to byte arrays\n\nAll of these cases are perfectly valid and good traditional C, but hit\nby the \"you\u0027re not NUL-terminating your byte array\" warning.\n\nAnd none of the cases want any terminating NUL character.\n\nMark them __nonstring to shut up gcc-15 (and in the case of the ak8974\nmagnetometer driver, I just removed the explicit array size and let gcc\nexpand the 3-byte and 6-byte arrays by one extra byte, because it was\nthe simpler change).\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "be913e7c4034bd7a5cbfc3d53188344dc588d45c", "tree": "8bb44000d647cb1204da798e25d9c1be71db4a15", "parents": [ "4b4bd8c50f4836ba7d3fcfd6c90f96d2605779fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:04:00 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:57:54 2025 -0700" }, "message": "gcc-15: get rid of misc extra NUL character padding\n\nThis removes two cases of explicit NUL padding that now causes warnings\nbecause of \u0027-Wunterminated-string-initialization\u0027 being part of -Wextra\nin gcc-15.\n\nGcc is being silly in this case when it says that it truncates a NUL\nterminator, because in these cases there were _multiple_ NUL characters.\n\nBut we can get rid of the warning by just simplifying the two\ninitializers that trigger the warning for me, so this does exactly that.\n\nI\u0027m not sure why the power supply code did that odd\n\n .attr_name \u003d #_name \"\\0\",\n\npattern: it was introduced in commit 2cabeaf15129 (\"power: supply: core:\nCleanup power supply sysfs attribute list\"), but that \u0027attr_name[]\u0027\nfield is an explicitly sized character array in a statically initialized\nvariable, and a string initializer always has a terminating NUL _and_\nstatically initialized character arrays are zero-padded anyway, so it\nreally seems to be rather extraneous belt-and-suspenders.\n\nThe zero_uuid[16] initialization in drivers/md/bcache/super.c makes\nperfect sense, but it isn\u0027t necessary for the same reasons, and not\nworth the new gcc warning noise.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4b4bd8c50f4836ba7d3fcfd6c90f96d2605779fe", "tree": "420f28060720d24630f4b804f57d8cfdc181794a", "parents": [ "d5d45a7f26194460964eb5677a9226697f7b7fdd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:02:18 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:57:54 2025 -0700" }, "message": "gcc-15: acpi: sprinkle random \u0027__nonstring\u0027 crumbles around\n\nThis is not great: I\u0027d much rather introduce a typedef that is a \"ACPI\nname byte buffer\", and use that to mark these special 4-byte ACPI names\nthat do not use NUL termination.\n\nBut as noted in the previous commit (\"gcc-15: make \u0027unterminated string\ninitialization\u0027 just a warning\") gcc doesn\u0027t actually seem to support\nthat notion, so instead you have to just mark every single array\ndeclaration individually.\n\nSo this is not pretty, but this gets rid of the bulk of the annoying\nwarnings during an allmodconfig build for me.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d5d45a7f26194460964eb5677a9226697f7b7fdd", "tree": "1fc57c7b0834b2bf99a1161a63dd07784191152a", "parents": [ "6fea5fabd3323cd27b2ab5143263f37ff29550cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 10:33:23 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 20 11:57:54 2025 -0700" }, "message": "gcc-15: make \u0027unterminated string initialization\u0027 just a warning\n\ngcc-15 enabling -Wunterminated-string-initialization in -Wextra by\ndefault was done with the best intentions, but the warning is still\nquite broken.\n\nWhat annoys me about the warning is that this is a very traditional AND\nCORRECT way to initialize fixed byte arrays in C:\n\n\tunsigned char hex[16] \u003d \"0123456789abcdef\";\n\nand we use this all over the kernel. And the warning is fine, but gcc\ndevelopers apparently never made a reasonable way to disable it. As is\n(sadly) tradition with these things.\n\nYes, there\u0027s \"__attribute__((nonstring))\", and we have a macro to make\nthat absolutely disgusting syntax more palatable (ie the kernel syntax\nfor that monstrosity is just \"__nonstring\").\n\nBut that attribute is misdesigned. What you\u0027d typically want to do is\ntell the compiler that you are using a type that isn\u0027t a string but a\nbyte array, but that doesn\u0027t work at all:\n\n\twarning: ‘nonstring’ attribute does not apply to types [-Wattributes]\n\nand because of this fundamental mis-design, you then have to mark each\ninstance of that pattern.\n\nThis is particularly noticeable in our ACPI code, because ACPI has this\nnotion of a 4-byte \"type name\" that gets used all over, and is exactly\nthis kind of byte array.\n\nThis is a sad oversight, because the warning is useful, but really would\nbe so much better if gcc had also given a sane way to indicate that we\nreally just want a byte array type at a type level, not the broken \"each\nand every array definition\" level.\n\nSo now instead of creating a nice \"ACPI name\" type using something like\n\n\ttypedef char acpi_name_t[4] __nonstring;\n\nwe have to do things like\n\n\tchar name[ACPI_NAMESEG_SIZE] __nonstring;\n\nin every place that uses this concept and then happens to have the\ntypical initializers.\n\nThis is annoying me mainly because I think the warning _is_ a good\nwarning, which is why I\u0027m not just turning it off in disgust. But it is\nhampered by this bad implementation detail.\n\n[ And obviously I\u0027m doing this now because system upgrades for me are\n something that happen in the middle of the release cycle: don\u0027t do it\n before or during travel, or just before or during the busy merge\n window period. ]\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6fea5fabd3323cd27b2ab5143263f37ff29550cb", "tree": "daf14fe856e36d8023a5ca15db5ea9e96b193fe8", "parents": [ "119009db267415049182774196e3cce9e13b52ef", "ea21641b6a79f9cdd64f8339983c71c89949dcb5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 21:46:58 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 21:46:58 2025 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2025-04-19-21-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc hotfixes from Andrew Morton:\n \"16 hotfixes. 2 are cc:stable and the remainder address post-6.14\n issues or aren\u0027t considered necessary for -stable kernels.\n\n All patches are basically for MM although five are alterations to\n MAINTAINERS\"\n\n[ Basic counting skills are clearly not a strictly necessary requirement\n for kernel maintainers. - Linus ]\n\n* tag \u0027mm-hotfixes-stable-2025-04-19-21-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n MAINTAINERS: add section for locking of mm\u0027s and VMAs\n mm: vmscan: fix kswapd exit condition in defrag_mode\n mm: vmscan: restore high-cpu watermark safety in kswapd\n MAINTAINERS: add Pedro as reviewer to the MEMORY MAPPING section\n mm/memory: move sanity checks in do_wp_page() after mapcount vs. refcount stabilization\n mm, hugetlb: increment the number of pages to be reset on HVO\n writeback: fix false warning in inode_to_wb()\n docs: ABI: replace mcroce@microsoft.com with new Meta address\n mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()\n MAINTAINERS: add memory advice section\n MAINTAINERS: add mmap trace events to MEMORY MAPPING\n mm: memcontrol: fix swap counter leak from offline cgroup\n MAINTAINERS: add MM subsection for the page allocator\n MAINTAINERS: update SLAB ALLOCATOR maintainers\n fs/dax: fix folio splitting issue by resetting old folio order + _nr_pages\n mm/page_alloc: fix deadlock on cpu_hotplug_lock in __accept_page()\n" }, { "commit": "119009db267415049182774196e3cce9e13b52ef", "tree": "5b2f7ccf4b05da5018e2a7f36621126ee45ebd08", "parents": [ "6fe8131757bd58693dba0775e919d46ce183dda2", "408e4504f97c0aa510330f0a04b7ed028fdf3154" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 14:31:08 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 14:31:08 2025 -0700" }, "message": "Merge tag \u0027vfs-6.15-rc3.fixes.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Revert the hfs{plus} deprecation warning that\u0027s also included in this\n pull request. The commit introducing the deprecation warning resides\n rather early in this branch. So simply dropping it would\u0027ve rebased\n all other commits which I decided to avoid. Hence the revert in the\n same branch\n\n [ Background - the deprecation warning discussion resulted in people\n stepping up, and so hfs{plus} will have a maintainer taking care of\n it after all.. - Linus ]\n\n - Switch CONFIG_SYSFS_SYCALL default to n and decouple from\n CONFIG_EXPERT\n\n - Fix an audit bug caused by changes to our kernel path lookup helpers\n this cycle. Audit needs the parent path even if the dentry it tried\n to look up is negative\n\n - Ensure that the kernel path lookup helpers leave the passed in path\n argument clean when they return an error. This is consistent with all\n our other helpers\n\n - Ensure that vfs_getattr_nosec() calls bdev_statx() so the relevant\n information is available to kernel consumers as well\n\n - Don\u0027t set a timer and call schedule() if the timer will expire\n immediately in epoll\n\n - Make netfs lookup tables with __nonstring\n\n* tag \u0027vfs-6.15-rc3.fixes.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n Revert \"hfs{plus}: add deprecation warning\"\n fs: move the bdex_statx call to vfs_getattr_nosec\n netfs: Mark __nonstring lookup tables\n eventpoll: Set epoll timeout if it\u0027s in the future\n fs: ensure that *path_locked*() helpers leave passed path pristine\n fs: add kern_path_locked_negative()\n hfs{plus}: add deprecation warning\n Kconfig: switch CONFIG_SYSFS_SYCALL default to n\n" }, { "commit": "6fe8131757bd58693dba0775e919d46ce183dda2", "tree": "e7c16fe71da35fb0f6433fc29bb0ec7bde5df0a7", "parents": [ "fa6ad96dca040e169f4008637d8d77f22631b34d", "24aaced72a686fb1dd8c3477987e1eaad76230a2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 13:59:04 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 13:59:04 2025 -0700" }, "message": "Merge tag \u0027i2c-for-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - Address translator: fix wrong include\n\n - ChromeOS EC tunnel: fix potential NULL pointer dereference\n\n* tag \u0027i2c-for-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: atr: Fix wrong include\n i2c: cros-ec-tunnel: defer probe if parent EC is not present\n" }, { "commit": "408e4504f97c0aa510330f0a04b7ed028fdf3154", "tree": "03fc3e22d87be7b2c61bbafd9459c198d21d587a", "parents": [ "777d0961ff95b26d5887fdae69900374364976f3" ], "author": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sat Apr 19 22:48:59 2025 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Sat Apr 19 22:48:59 2025 +0200" }, "message": "Revert \"hfs{plus}: add deprecation warning\"\n\nThis reverts commit ddee68c499f76ae47c011549df5be53db0057402.\n\nThere\u0027s ongoing discussion about better maintenance of at least hfsplus.\nRever the deprecation warning for now.\n\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "fa6ad96dca040e169f4008637d8d77f22631b34d", "tree": "9307ce59167a091a910a95ca8167bc048d7a781d", "parents": [ "1ca0f935a126950c2f0b305a50f31f3b00542b0d", "d481ee35247d2a01764667a25f6f512c292ba42d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 11:57:36 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 11:57:36 2025 -0700" }, "message": "Merge tag \u0027trace-v6.15-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Initialize hash variables in ftrace subops logic\n\n The fix that simplified the ftrace subops logic opened a path where\n some variables could be used without being initialized, and done\n subtly where the compiler did not catch it. Initialize those\n variables to the EMPTY_HASH, which is the default hash.\n\n - Reinitialize the hash pointers after they are freed\n\n Some of the hash pointers in the subop logic were freed but may still\n be referenced later. To prevent use-after-free bugs, initialize them\n back to the EMPTY_HASH.\n\n - Free the ftrace hashes when they are replaced\n\n The fix that simplified the subops logic updated some hash pointers,\n but left the original hash that they were pointing to where they are\n no longer used. This caused a memory leak. Free the hashes that are\n pointed to by the pointers when they are replaced.\n\n - Fix size initialization of ftrace direct function hash\n\n The ftrace direct function hash used by BPF initialized the hash size\n incorrectly. It checked the size of items to a hard coded 32, which\n made the hash bit size of 5. The hash size is supposed to be limited\n by the bit size of the hash, as the bitmask is allowed to be greater\n than 5. Rework the size check to first pass the number of elements to\n fls() and then compare that to FTRACE_HASH_MAX_BITS before allocating\n the hash.\n\n - Fix format output of ftrace_graph_ent_entry event\n\n The field depth of the ftrace_graph_ent_entry event is of size 4 but\n the output showed it as unsigned long and use \"%lu\". Change it to\n unsigned int and use \"%u\" in the print format that is displayed to\n user space.\n\n - Fix the trace event filter on strings\n\n Events can be filtered on numbers or string values. The return value\n checked from strncpy_from_kernel_nofault() and\n strncpy_from_user_nofault() was used to determine if reading the\n strings would fault or not. It would return fault if the value was\n non zero, which is basically meant that it was always considering the\n read as a fault.\n\n - Add selftest to test trace event string filtering\n\n In order to catch the breakage of the string filtering, add a self\n test to make sure that it continues to work.\n\n* tag \u0027trace-v6.15-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: selftests: Add testing a user string to filters\n tracing: Fix filter string testing\n ftrace: Fix type of ftrace_graph_ent_entry.depth\n ftrace: fix incorrect hash size in register_ftrace_direct()\n ftrace: Free ftrace hashes after they are replaced in the subops code\n ftrace: Reinitialize hash to EMPTY_HASH after freeing\n ftrace: Initialize variables for ftrace_startup/shutdown_subops()\n" }, { "commit": "1ca0f935a126950c2f0b305a50f31f3b00542b0d", "tree": "5fc37286150906c91496371c7165de542904ec65", "parents": [ "0bd2f269ae892ce7283fee8fcfe2c6c971d871bc", "a1d14d931bf700c1025db8c46d6731aa5cf440f9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 10:38:03 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 10:38:03 2025 -0700" }, "message": "Merge tag \u0027nfsd-6.15-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fixes from Chuck Lever:\n\n - v6.15 libcrc clean-up makes invalid configurations possible\n\n - Fix a potential deadlock introduced during the v6.15 merge window\n\n* tag \u0027nfsd-6.15-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n nfsd: decrease sc_count directly if fail to queue dl_recall\n nfs: add missing selections of CONFIG_CRC32\n" }, { "commit": "0bd2f269ae892ce7283fee8fcfe2c6c971d871bc", "tree": "dbfd8e55fdcc3776fd6215078d3ae2c884871bb4", "parents": [ "51c7960b87f465d01ea8d8ff174e81dd69f3b2b4", "c1b4071ec3a6a594df6c49bf8f04a60a88072525" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 10:02:43 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 10:02:43 2025 -0700" }, "message": "Merge tag \u0027rust-fixes-6.15\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix missing KASAN LLVM flags on first build (and fix spurious\n rebuilds) by skipping \u0027--target\u0027\n\n - Fix Make \u003c 4.3 build error by using \u0027$(pound)\u0027\n\n - Fix UML build error by removing \u0027volatile\u0027 qualifier from io\n helpers\n\n - Fix UML build error by adding \u0027dma_{alloc,free}_attrs()\u0027 helpers\n\n - Clean gendwarfksyms warnings by avoiding to export \u0027__pfx\u0027 symbols\n\n - Clean objtool warning by adding a new \u0027noreturn\u0027 function for\n 1.86.0\n\n - Disable \u0027needless_continue\u0027 Clippy lint due to new 1.86.0 warnings\n\n - Add missing \u0027ffi\u0027 crate to \u0027generate_rust_analyzer.py\u0027\n\n \u0027pin-init\u0027 crate:\n\n - Import a couple fixes from upstream\"\n\n* tag \u0027rust-fixes-6.15\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: helpers: Add dma_alloc_attrs() and dma_free_attrs()\n rust: helpers: Remove volatile qualifier from io helpers\n rust: kbuild: use `pound` to support GNU Make \u003c 4.3\n objtool/rust: add one more `noreturn` Rust function for Rust 1.86.0\n rust: kasan/kbuild: fix missing flags on first build\n rust: disable `clippy::needless_continue`\n rust: kbuild: Don\u0027t export __pfx symbols\n rust: pin-init: use Markdown autolinks in Rust comments\n rust: pin-init: alloc: restrict `impl ZeroableOption` for `Box` to `T: Sized`\n scripts: generate_rust_analyzer: Add ffi crate\n" }, { "commit": "51c7960b87f465d01ea8d8ff174e81dd69f3b2b4", "tree": "0cb697b7b0ef651bcb2a0e271ec72e352c9eff13", "parents": [ "8560697b23dc2f405cb463af2b17256a9888129d", "0467145fab3b3a7a1efd221722310fe32329b3da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 09:31:21 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 19 09:31:21 2025 -0700" }, "message": "Merge tag \u0027drm-fixes-2025-04-19\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Easter rc3 pull request, fixes in all the usuals, amdgpu, xe, msm,\n with some i915/ivpu/mgag200/v3d fixes, then a couple of bits in\n dma-buf/gem.\n\n Hopefully has no easter eggs in it.\n\n dma-buf:\n - Correctly decrement refcounter on errors\n\n gem:\n - Fix test for imported buffers\n\n amdgpu:\n - Cleaner shader sysfs fix\n - Suspend fix\n - Fix doorbell free ordering\n - Video caps fix\n - DML2 memory allocation optimization\n - HDP fix\n\n i915:\n - Fix DP DSC configurations that require 3 DSC engines per pipe\n\n xe:\n - Fix LRC address being written too late for GuC\n - Fix notifier vs folio deadlock\n - Fix race betwen dma_buf unmap and vram eviction\n - Fix debugfs handling PXP terminations unconditionally\n\n msm:\n - Display:\n - Fix to call dpu_plane_atomic_check_pipe() for both SSPPs in\n case of multi-rect\n - Fix to validate plane_state pointer before using it in\n dpu_plane_virtual_atomic_check()\n - Fix to make sure dereferencing dpu_encoder_phys happens after\n making sure it is valid in _dpu_encoder_trigger_start()\n - Remove the remaining intr_tear_rd_ptr which we initialized to\n -1 because NO_IRQ indices start from 0 now\n - GPU:\n - Fix IB_SIZE overflow\n\n ivpu:\n - Fix debugging\n - Fixes to frequency\n - Support firmware API 3.28.3\n - Flush jobs upon reset\n\n mgag200:\n - Set vblank start to correct values\n\n v3d:\n - Fix Indirect Dispatch\"\n\n* tag \u0027drm-fixes-2025-04-19\u0027 of https://gitlab.freedesktop.org/drm/kernel: (26 commits)\n drm/msm/a6xx+: Don\u0027t let IB_SIZE overflow\n drm/xe/pxp: do not queue unneeded terminations from debugfs\n drm/xe/dma_buf: stop relying on placement in unmap\n drm/xe/userptr: fix notifier vs folio deadlock\n drm/xe: Set LRC addresses before guc load\n drm/mgag200: Fix value in \u003cVBLKSTR\u003e register\n drm/gem: Internally test import_attach for imported objects\n drm/amdgpu: Use the right function for hdp flush\n drm/amd/display/dml2: use vzalloc rather than kzalloc\n drm/amdgpu: Add back JPEG to video caps for carrizo and newer\n drm/amdgpu: fix warning of drm_mm_clean\n drm/amd: Forbid suspending into non-default suspend states\n drm/amdgpu: use a dummy owner for sysfs triggered cleaner shaders v4\n drm/i915/dp: Check for HAS_DSC_3ENGINES while configuring DSC slices\n drm/i915/display: Add macro for checking 3 DSC engines\n dma-buf/sw_sync: Decrement refcount on error in sw_sync_ioctl_get_deadline()\n accel/ivpu: Add cmdq_id to job related logs\n accel/ivpu: Show NPU frequency in sysfs\n accel/ivpu: Fix the NPU\u0027s DPU frequency calculation\n accel/ivpu: Update FW Boot API to version 3.28.3\n ...\n" }, { "commit": "0467145fab3b3a7a1efd221722310fe32329b3da", "tree": "e3f7963b17dc51454e1af257b597e4dd594eb62e", "parents": [ "3748bef7b78bf2d3e2b595f6ca88947f954de77e", "9d78f02503227d3554d26cf8ca73276105c98f3e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 19 15:09:29 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 19 15:09:29 2025 +1000" }, "message": "Merge tag \u0027drm-msm-fixes-2025-04-18\u0027 of https://gitlab.freedesktop.org/drm/msm into drm-fixes\n\nFixes for v6.15-rc3\n\nDisplay:\n- Fix to call dpu_plane_atomic_check_pipe() for both SSPPs in\n case of multi-rect\n- Fix to validate plane_state pointer before using it in\n dpu_plane_virtual_atomic_check()\n- Fix to make sure dereferencing dpu_encoder_phys happens after\n making sure it is valid in _dpu_encoder_trigger_start()\n- Remove the remaining intr_tear_rd_ptr which we initialized\n to -1 because NO_IRQ indices start from 0 now\n\nGPU:\n- Fix IB_SIZE overflow\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Rob Clark \u003crobdclark@gmail.com\u003e\nLink: https://lore.kernel.org/r/CAF6AEGtVKXEVdzUzFWmQE8JmK3nx_hp+ynOd-5j3vnfcU-sgOA@mail.gmail.com\n" }, { "commit": "3748bef7b78bf2d3e2b595f6ca88947f954de77e", "tree": "c943a56d16440f46299175c9062cdd51e3aa2bee", "parents": [ "9bca5bcdeb0d157084a3de6ab1b17424eb875d10", "78600df8f593407a3df2d6c48c35d0ad203d7fb4" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 19 14:59:47 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Apr 19 14:59:52 2025 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2025-04-18\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- Fix LRC address being written too late for GuC\n- Fix notifier vs folio deadlock\n- Fix race betwen dma_buf unmap and vram eviction\n- Fix debugfs handling PXP terminations unconditionally\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nLink: https://lore.kernel.org/r/ndinq644zenywaaycxyfqqivsb2xer4z7err3dlpalbz33jfkm@ttabzsg6wnet\n" }, { "commit": "8560697b23dc2f405cb463af2b17256a9888129d", "tree": "f9c4737f619dc6287c1f1714be0d1949558dffe3", "parents": [ "3088d26962e802efa3aa5188f88f82a957f50b22", "95d2b9f693ff2a1180a23d7d59acc0c4e72f4c41" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 20:10:42 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 20:10:42 2025 -0700" }, "message": "Merge tag \u00276.15-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix hard link lease key problem when close is deferred\n\n - Revert the socket lockdep/refcount workarounds done in cifs.ko now\n that it is fixed at the socket layer\n\n* tag \u00276.15-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n Revert \"smb: client: fix TCP timers deadlock after rmmod\"\n Revert \"smb: client: Fix netns refcount imbalance causing leaks and use-after-free\"\n smb3 client: fix open hardlink on deferred close file error\n" }, { "commit": "aece1cf146741761a1243746db5b72f5ece68290", "tree": "c42a834d0e85f36430ec98f1849b82c14457c768", "parents": [ "b2e689baf220408aff8ee5dfb4edb0817e1632bb" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sat Apr 12 13:36:51 2025 +0800" }, "committer": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Sat Apr 19 11:07:58 2025 +0800" }, "message": "Revert \"crypto: testmgr - Add multibuffer acomp testing\"\n\nThis reverts commit 99585c2192cb1ce212876e82ef01d1c98c7f4699.\n\nRemove the acomp multibuffer tests as they are buggy.\n\nReported-by: Dmitry Antipov \u003cdmantipov@yandex.ru\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n" }, { "commit": "9d78f02503227d3554d26cf8ca73276105c98f3e", "tree": "a58649aa46cff7b87318146a9088fc9703195be0", "parents": [ "ddfa00afae800b3dea02fa36f3f4012a8379ae58" ], "author": { "name": "Rob Clark", "email": "robdclark@chromium.org", "time": "Mon Mar 17 08:00:06 2025 -0700" }, "committer": { "name": "Rob Clark", "email": "robdclark@chromium.org", "time": "Fri Apr 18 15:15:24 2025 -0700" }, "message": "drm/msm/a6xx+: Don\u0027t let IB_SIZE overflow\n\nIB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields\nwere added above the IB_SIZE. Accidentially setting them can cause\nbadness. Fix this by properly defining the CP_INDIRECT_BUFFER packet\nand using the generated builder macro to ensure unintended bits are not\nset.\n\nv2: add missing type attribute for IB_BASE\nv3: fix offset attribute in xml\n\nReported-by: Connor Abbott \u003ccwabbott0@gmail.com\u003e\nFixes: a83366ef19ea (\"drm/msm/a6xx: add A640/A650 to gpulist\")\nSigned-off-by: Rob Clark \u003crobdclark@chromium.org\u003e\nPatchwork: https://patchwork.freedesktop.org/patch/643396/\n" }, { "commit": "24aaced72a686fb1dd8c3477987e1eaad76230a2", "tree": "73d8f23bb915d48fb833e550eb56e534ea57de19", "parents": [ "75caec0c2aa3a7ec84348d438c74cb8a2eb4de97", "424eafe65647a8d6c690284536e711977153195a" ], "author": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Apr 18 23:42:56 2025 +0200" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Fri Apr 18 23:42:56 2025 +0200" }, "message": "Merge tag \u0027i2c-host-fixes-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-host-fixes for v6.15-rc3\n\n- ChromeOS EC tunnel: fix potential NULL pointer dereference\n" }, { "commit": "3088d26962e802efa3aa5188f88f82a957f50b22", "tree": "9d864619de4e0a05f77a9073385e873cfb82243b", "parents": [ "ac85740edf05751bf8730df5b898c92ed9b538b7", "d54d610243a4508183978871e5faff5502786cd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 14:04:57 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 14:04:57 2025 -0700" }, "message": "Merge tag \u0027x86-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc x86 fixes from Ingo Molnar:\n\n - Fix hypercall detection on Xen guests\n\n - Extend the AMD microcode loader SHA check to Zen5, to block loading\n of any unreleased standalone Zen5 microcode patches\n\n - Add new Intel CPU model number for Bartlett Lake\n\n - Fix the workaround for AMD erratum 1054\n\n - Fix buggy early memory acceptance between SEV-SNP guests and the EFI\n stub\n\n* tag \u0027x86-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot/sev: Avoid shared GHCB page for early memory acceptance\n x86/cpu/amd: Fix workaround for erratum 1054\n x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores\n x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches\n x86/xen: Fix __xen_hypercall_setfunc()\n" }, { "commit": "ac85740edf05751bf8730df5b898c92ed9b538b7", "tree": "b2f1cb034c7e64bb988ed2ba814934413449e514", "parents": [ "b372359fbc4af755965a1792c1f513583aa20c43", "3940f5349b476197fb079c5aa19c9a988de64efb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 14:02:45 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 14:02:45 2025 -0700" }, "message": "Merge tag \u0027timers-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Fix a lockdep false positive in the i8253 driver\"\n\n* tag \u0027timers-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/i8253: Call clockevent_i8253_disable() with interrupts disabled\n" }, { "commit": "b372359fbc4af755965a1792c1f513583aa20c43", "tree": "c53a68a2714aafdaa19a8bd96e70f6e472dba5ed", "parents": [ "b0c3bc35a54939eaf4fc5efa3200994d82cab1e7", "7950de14ff5fd8da355d872b887ee8b7b5a1f327" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:35:13 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:35:13 2025 -0700" }, "message": "Merge tag \u0027perf-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 perf event fixes from Ingo Molnar:\n \"Miscellaneous fixes and a hardware-enabling change:\n\n - Fix Intel uncore PMU IIO free running counters on SPR, ICX and SNR\n systems\n\n - Fix Intel PEBS buffer overflow handling\n\n - Fix skid in Intel PEBS sampling of user-space general purpose\n registers\n\n - Enable Panther Lake PMU support - similar to Lunar Lake\"\n\n* tag \u0027perf-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel: Add Panther Lake support\n perf/x86/intel: Allow to update user space GPRs from PEBS records\n perf/x86/intel: Don\u0027t clear perf metrics overflow bit unconditionally\n perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR\n perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX\n perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR\n" }, { "commit": "b0c3bc35a54939eaf4fc5efa3200994d82cab1e7", "tree": "5ae41864fd18f3c22b30bdc8e8c90a6b2c4ea6ec", "parents": [ "84aca3ca6a42dade09d05a541c8aaab5ea228087", "9b3ae50cb902322a2b5922b9fcf8132d9b4c2a24" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:28:41 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:28:41 2025 -0700" }, "message": "Merge tag \u0027irq-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc irq fixes from Ingo Molnar:\n\n - Fix BCM2712 irqchip driver Kconfig dependencies required on the\n Raspberry PI5\n\n - Fix spurious interrupts on RZ/G3E SMARC EVK systems\n\n - Fix crash regression on Sun/NIU hardware\n\n - Apply MSI driver quirk for Sun Neptune chips\n\n* tag \u0027irq-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/irq-bcm2712-mip: Enable driver when ARCH_BCM2835 is enabled\n irqchip/renesas-rzv2h: Prevent TINT spurious interrupt\n net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads\n PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads\n" }, { "commit": "84aca3ca6a42dade09d05a541c8aaab5ea228087", "tree": "3bd6a3118abd14f4363980f7dcf35a63b8dcf1e4", "parents": [ "3bf8a4598ff32b59248be017bce8d20a4e472c7a", "1013f5636fd808569c1f4c40a58a4efc70713a28" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:25:33 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:25:33 2025 -0700" }, "message": "Merge tag \u0027core-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc core fixes from Ingo Molnar:\n \"Fix a genksyms related bug, triggered by recent changes to the percpu\n code, and update the .clang-format file to not include obsolete\n function names\"\n\n* tag \u0027core-urgent-2025-04-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n genksyms: Handle typeof_unqual keyword and __seg_{fs,gs} qualifiers\n clang-format: Update the ForEachMacros list for v6.15-rc1\n" }, { "commit": "3bf8a4598ff32b59248be017bce8d20a4e472c7a", "tree": "2cafbcd9ae127770f5965b88712a75e56283c2bb", "parents": [ "30d451e3734b827d4064f2a77af6de65382860a4", "3f2925174f8bd811f9399cb4049f6b75fd2fba91" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:20:20 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:20:20 2025 -0700" }, "message": "Merge tag \u0027hardening-v6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening fixes from Kees Cook:\n\n - lib/prime_numbers: KUnit test should not select PRIME_NUMBERS (Geert\n Uytterhoeven)\n\n - ubsan: Fix panic from test_ubsan_out_of_bounds (Mostafa Saleh)\n\n - ubsan: Remove \u0027default UBSAN\u0027 from UBSAN_INTEGER_WRAP (Nathan\n Chancellor)\n\n - string: Add load_unaligned_zeropad() code path to sized_strscpy()\n (Peter Collingbourne)\n\n - kasan: Add strscpy() test to trigger tag fault on arm64 (Vincenzo\n Frascino)\n\n - Disable GCC randstruct for COMPILE_TEST\n\n* tag \u0027hardening-v6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n lib/prime_numbers: KUnit test should not select PRIME_NUMBERS\n ubsan: Fix panic from test_ubsan_out_of_bounds\n lib/Kconfig.ubsan: Remove \u0027default UBSAN\u0027 from UBSAN_INTEGER_WRAP\n hardening: Disable GCC randstruct for COMPILE_TEST\n kasan: Add strscpy() test to trigger tag fault on arm64\n string: Add load_unaligned_zeropad() code path to sized_strscpy()\n" }, { "commit": "30d451e3734b827d4064f2a77af6de65382860a4", "tree": "b33882a39e9c7261e235f0a08390c82925b9db19", "parents": [ "fe65616bf8bc1041ead8cae9edc982f62d2c120a", "b424bb88afb6719b30340f059bf50953424cdd9d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:18:01 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:18:01 2025 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fix from Bartosz Golaszewski:\n\n - check for both the new AND old (deprecated) setter callback when\n changing GPIO direction to output\n\n* tag \u0027gpio-fixes-for-v6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpiolib: Allow to use setters with return value for output-only gpios\n" }, { "commit": "fe65616bf8bc1041ead8cae9edc982f62d2c120a", "tree": "fe06dc759af7ad8d326db6e1add8c777e35397d6", "parents": [ "cb64c513b5fbc5a3290d89cbafcc8f9b07a29a46", "00c5ff5e9a55dca2e7ca29af4e5f8708731faf11" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:09:20 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:09:20 2025 -0700" }, "message": "Merge tag \u0027thermal-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fixes from Rafael Wysocki:\n \"Add missing DVFS support flags for the Lunar Lake and Panther Lake\n platforms to the int340x Intel thermal driver and fix DLVR support\n for Panther Lake in it (Srinivas Pandruvada)\"\n\n* tag \u0027thermal-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: intel: int340x: Fix Panther Lake DLVR support\n thermal: intel: int340x: Add missing DVFS support flags\n" }, { "commit": "cb64c513b5fbc5a3290d89cbafcc8f9b07a29a46", "tree": "499cee4ca1fccb61a6eb544956cae7dda8b27abe", "parents": [ "4b828867b3949d8e9dd698b906e2be5b7eaad4a5", "f3b25a1b48191048e2f190d878fc3175fc08ffaa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:06:12 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 13:06:12 2025 -0700" }, "message": "Merge tag \u0027pm-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These are mostly cpufreq fixes, some of which address recent\n regressions and some address older issues that have come to light\n during the last two weeks, and a runtime PM documentation correction:\n\n - Fix the performance-to-frequency scaling factor computation on\n systems using HWP in the intel_pstate driver after a recent\n incorrect update of it (Rafael Wysocki)\n\n - Fix the usage of the CPUFREQ_NEED_UPDATE_LIMITS cpufreq driver flag\n in the schedutil cpufreq governor after a recent update of it that\n has caused frequency limits changes to be missed sometimes (Rafael\n Wysocki)\n\n - Address some recently discovered synchronization issues related to\n frequency limits changes in the schedutil cpufreq governor and in\n the cpufreq core (Rafael Wysocki)\n\n - Fix ITMT support in the amd-pstate cpufreq driver so that it is\n enabled after asym priorities have been correctly initialized for\n all CPUs (K Prateek Nayak)\n\n - Fix changing min/max limits in the amd-pstate cpufreq driver while\n on the performance governor (Dhananjay Ugwekar)\n\n - Fix a function name in the runtime PM documentation that was\n previously incorrectly updated by mistake (Sakari Ailus)\"\n\n* tag \u0027pm-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq: Avoid using inconsistent policy-\u003emin and policy-\u003emax\n cpufreq/sched: Set need_freq_update in ignore_dl_rate_limit()\n cpufreq/sched: Explicitly synchronize limits_changed flag handling\n cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS\n Documentation: PM: runtime: Fix a reference to pm_runtime_autosuspend()\n cpufreq: intel_pstate: Fix hwp_get_cpu_scaling()\n cpufreq/amd-pstate: Enable ITMT support after initializing core rankings\n cpufreq/amd-pstate: Fix min_limit perf and freq updation for performance governor\n" }, { "commit": "f3b25a1b48191048e2f190d878fc3175fc08ffaa", "tree": "2d4f10106729021a083cce19da15c45ebede99f4", "parents": [ "dead17b1a26fd8b6202911211ec83ac1f6587658", "19e8019e06b478ab04683418c73ca297d114c425" ], "author": { "name": "Rafael J. Wysocki", "email": "rjw@rjwysocki.net", "time": "Fri Apr 18 20:55:48 2025 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rjw@rjwysocki.net", "time": "Fri Apr 18 20:55:48 2025 +0200" }, "message": "Merge branch \u0027pm-docs\u0027\n\nMerge a runtime PM documentation correction for 6.15-rc3.\n\n* pm-docs:\n Documentation: PM: runtime: Fix a reference to pm_runtime_autosuspend()\n" }, { "commit": "4b828867b3949d8e9dd698b906e2be5b7eaad4a5", "tree": "4006a6008a377832f68cd965634ab7fe498af555", "parents": [ "7f424c6690df7a5e807548371b9546d51546fc54", "615e705fc8c7bdb6816faf09b5b16a0441f050e7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:46:44 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:46:44 2025 -0700" }, "message": "Merge tag \u0027riscv-for-linus-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Palmer Dabbelt:\n\n - A fix for an issue where C instructions ended up in non-C builds, due\n to some broken inline assembly in the KGDB breakpoint insertion code\n\n - A fix to avoid spurious printk messages about misaligned access\n performance probing\n\n - A fix for a handful of issues with /proc/iomem\u0027s reserved region\n handling\n\n - A pair of fixes for module relocation processing\n\n - A few build-time fixes\n\n* tag \u0027riscv-for-linus-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: KGDB: Remove \".option norvc/.option rvc\" for kgdb_compiled_break\n riscv: KGDB: Do not inline arch_kgdb_breakpoint()\n riscv: Avoid fortify warning in syscall_get_arguments()\n riscv: Provide all alternative macros all the time\n riscv: module: Allocate PLT entries for R_RISCV_PLT32\n riscv: module: Fix out-of-bounds relocation access\n riscv: Properly export reserved regions in /proc/iomem\n riscv: Fix unaligned access info messages\n riscv: Avoid fortify warning in syscall_get_arguments()\n Documentation: riscv: Fix typo MIMPLID -\u003e MIMPID\n riscv: Use kvmalloc_array on relocation_hashtable\n" }, { "commit": "7f424c6690df7a5e807548371b9546d51546fc54", "tree": "4c5714275fcb6b685f7db9af594e51a3fe645a08", "parents": [ "338d40ceef38d9a36b48164e22768b40d6f89701", "b26c1a85f3fc3cc749380ff94199377fc2d0c203" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:35:11 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:35:11 2025 -0700" }, "message": "Merge tag \u0027linux_kselftest-kunit-fixes-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kunit fix from Shuah Khan:\n \"Fixes arch sh kunit qemu_configs script sh.py to honor kunit cmdline\"\n\n* tag \u0027linux_kselftest-kunit-fixes-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n kunit: qemu_configs: SH: Respect kunit cmdline\n" }, { "commit": "338d40ceef38d9a36b48164e22768b40d6f89701", "tree": "eea782de11e025f351d11a4db0d587e7ed703959", "parents": [ "7e74f756f5f643148ca5537bf2fee6767e4b0ed9", "07be53cfa81afe94b14fb4bfee8243f2e0125d5e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:32:31 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 11:32:31 2025 -0700" }, "message": "Merge tag \u0027linux_kselftest-fixes-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest fix from Shuah Khan:\n \"Fixes dynevent_limitations.tc test failure on dash by detecting and\n handling bash and dash differences in evaluating \\\\\"\n\n* tag \u0027linux_kselftest-fixes-6.15-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n selftests/ftrace: Differentiate bash and dash in dynevent_limitations.tc\n" }, { "commit": "7e74f756f5f643148ca5537bf2fee6767e4b0ed9", "tree": "25d7c5e5d32c290fe969fdac88e8bab997ae7769", "parents": [ "f7c2ca25848b1da1843b7e0fa848ea721af6b132", "a93ff742820f75bf8bb3fcf21d9f25ca6eb3d4c6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:37:44 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:37:44 2025 -0700" }, "message": "Merge tag \u0027v6.15-rc2-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix integer overflow in server disconnect deadtime calculation\n\n - Three fixes for potential use after frees: one for oplocks, and one\n for leases and one for kerberos authentication\n\n - Fix to prevent attempted write to directory\n\n - Fix locking warning for durable scavenger thread\n\n* tag \u0027v6.15-rc2-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: Prevent integer overflow in calculation of deadtime\n ksmbd: fix the warning from __kernel_write_iter\n ksmbd: fix use-after-free in smb_break_all_levII_oplock()\n ksmbd: fix use-after-free in __smb2_lease_break_noti()\n ksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"\n ksmbd: Fix dangling pointer in krb_authenticate\n" }, { "commit": "f7c2ca25848b1da1843b7e0fa848ea721af6b132", "tree": "b3ce0b4454e30fdaed21798d879464bd8a3cb814", "parents": [ "b1011b2b451c8b6d16be6b07f44f22a0a0dd7158", "81dd1feb19c7a812e51fa6e2f988f4def5e6ae39" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:21:14 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:21:14 2025 -0700" }, "message": "Merge tag \u0027block-6.15-20250417\u0027 of git://git.kernel.dk/linux\n\nPull block fixes from Jens Axboe:\n\n - MD pull via Yu:\n - fix raid10 missing discard IO accounting (Yu Kuai)\n - fix bitmap stats for bitmap file (Zheng Qixing)\n - fix oops while reading all member disks failed during\n check/repair (Meir Elisha)\n\n - NVMe pull via Christoph:\n - fix scan failure for non-ANA multipath controllers (Hannes\n Reinecke)\n - fix multipath sysfs links creation for some cases (Hannes\n Reinecke)\n - PCIe endpoint fixes (Damien Le Moal)\n - use NULL instead of 0 in the auth code (Damien Le Moal)\n\n - Various ublk fixes:\n - Slew of selftest additions\n - Improvements and fixes for IO cancelation\n - Tweak to Kconfig verbiage\n\n - Fix for page dirtying for blk integrity mapped pages\n\n - loop fixes:\n - buffered IO fix\n - uevent fixes\n - request priority inheritance fix\n\n - Various little fixes\n\n* tag \u0027block-6.15-20250417\u0027 of git://git.kernel.dk/linux: (38 commits)\n selftests: ublk: add generic_06 for covering fault inject\n ublk: simplify aborting ublk request\n ublk: remove __ublk_quiesce_dev()\n ublk: improve detection and handling of ublk server exit\n ublk: move device reset into ublk_ch_release()\n ublk: rely on -\u003ecanceling for dealing with ublk_nosrv_dev_should_queue_io\n ublk: add ublk_force_abort_dev()\n ublk: properly serialize all FETCH_REQs\n selftests: ublk: move creating UBLK_TMP into _prep_test()\n selftests: ublk: add test_stress_05.sh\n selftests: ublk: support user recovery\n selftests: ublk: support target specific command line\n selftests: ublk: increase max nr_queues and queue depth\n selftests: ublk: set queue pthread\u0027s cpu affinity\n selftests: ublk: setup ring with IORING_SETUP_SINGLE_ISSUER/IORING_SETUP_DEFER_TASKRUN\n selftests: ublk: add two stress tests for zero copy feature\n selftests: ublk: run stress tests in parallel\n selftests: ublk: make sure _add_ublk_dev can return in sub-shell\n selftests: ublk: cleanup backfile automatically\n selftests: ublk: add io_uring uapi header\n ...\n" }, { "commit": "b1011b2b451c8b6d16be6b07f44f22a0a0dd7158", "tree": "643146e9111d7f8bd0f717bcbe5af3938be711f7", "parents": [ "fc96b232f8e7c0a6c282f47726b2ff6a5fb341d2", "f12ecf5e1c5eca48b8652e893afcdb730384a6aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:13:52 2025 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 18 09:13:52 2025 -0700" }, "message": "Merge tag \u0027io_uring-6.15-20250418\u0027 of git://git.kernel.dk/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Correctly cap iov_iter-\u003enr_segs for imports of registered buffers,\n both kbuf and normal ones.\n\n Three cleanups to make it saner first, then two fixes for each of the\n buffer types.\n\n This fixes a performance regression where partial buffer usage\n doesn\u0027t trim the tail number of segments, leading the block layer to\n iterate the IOs to check if it needs splitting.\n\n - Two patches tweaking the newly introduced zero-copy rx API, mostly to\n keep the API consistent once we add multiple interface queues per\n ring support in the 6.16 release.\n\n - zc rx unmapping fix for a dead device\n\n* tag \u0027io_uring-6.15-20250418\u0027 of git://git.kernel.dk/linux:\n io_uring/zcrx: fix late dma unmap for a dead dev\n io_uring/rsrc: ensure segments counts are correct on kbuf buffers\n io_uring/rsrc: send exact nr_segs for fixed buffer\n io_uring/rsrc: refactor io_import_fixed\n io_uring/rsrc: separate kbuf offset adjustments\n io_uring/rsrc: don\u0027t skip offset calculation\n io_uring/zcrx: add pp to ifq conversion helper\n io_uring/zcrx: return ifq id to the user\n" }, { "commit": "d481ee35247d2a01764667a25f6f512c292ba42d", "tree": "d0bfb375c5888a9678e8ff665d9764afa782a318", "parents": [ "a8c5b0ed89a3f2c81c6ae0b041394e6eea0e7024" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Apr 18 10:12:08 2025 -0400" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Fri Apr 18 11:26:01 2025 -0400" }, "message": "tracing: selftests: Add testing a user string to filters\n\nRunning the following commands was broken:\n\n # cd /sys/kernel/tracing\n # echo \"filename.ustring ~ \\\"/proc*\\\"\" \u003e events/syscalls/sys_enter_openat/filter\n # echo 1 \u003e events/syscalls/sys_enter_openat/enable\n # ls /proc/$$/maps\n # cat trace\n\nAnd would produce nothing when it should have produced something like:\n\n ls-1192 [007] ..... 8169.828333: sys_openat(dfd: ffffffffffffff9c, filename: 7efc18359904, flags: 80000, mode: 0)\n\nAdd a test to check this case so that it will be caught if it breaks\nagain.\n\nLink: https://lore.kernel.org/linux-trace-kernel/20250417183003.505835fb@gandalf.local.home/\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Shuah Khan \u003cskhan@linuxfoundation.org\u003e\nLink: https://lore.kernel.org/20250418101208.38dc81f5@gandalf.local.home\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "58465d86071b61415e25fb054201f61e83d21465", "tree": "ef4ee05029b187f4d33db23f8f31f61fa8bab0e8", "parents": [ "b182687135474d7ed905a07cc6cb2734b359e13e" ], "author": { "name": "Dongli Zhang", "email": "dongli.zhang@oracle.com", "time": "Wed Apr 02 23:29:48 2025 -0700" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "vhost-scsi: Fix vhost_scsi_send_status()\n\nAlthough the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was\nsignaled by the commit 664ed90e621c (\"vhost/scsi: Set\nVIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits\"),\nvhost_scsi_send_bad_target() still assumes the response in a single\ndescriptor.\n\nSimilar issue in vhost_scsi_send_bad_target() has been fixed in previous\ncommit. In addition, similar issue for vhost_scsi_complete_cmd_work() has\nbeen fixed by the commit 6dd88fd59da8 (\"vhost-scsi: unbreak any layout for\nresponse\").\n\nFixes: 3ca51662f818 (\"vhost-scsi: Add better resource allocation failure handling\")\nSigned-off-by: Dongli Zhang \u003cdongli.zhang@oracle.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nReviewed-by: Mike Christie \u003cmichael.christie@oracle.com\u003e\nMessage-Id: \u003c20250403063028.16045-4-dongli.zhang@oracle.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "b182687135474d7ed905a07cc6cb2734b359e13e", "tree": "ec316f1ace1e99df2b798f9c8e65487e36a1a941", "parents": [ "f591cf9fce724e5075cc67488c43c6e39e8cbe27" ], "author": { "name": "Dongli Zhang", "email": "dongli.zhang@oracle.com", "time": "Wed Apr 02 23:29:47 2025 -0700" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "vhost-scsi: Fix vhost_scsi_send_bad_target()\n\nAlthough the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was\nsignaled by the commit 664ed90e621c (\"vhost/scsi: Set\nVIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits\"),\nvhost_scsi_send_bad_target() still assumes the response in a single\ndescriptor.\n\nIn addition, although vhost_scsi_send_bad_target() is used by both I/O\nqueue and control queue, the response header is always\nvirtio_scsi_cmd_resp. It is required to use virtio_scsi_ctrl_tmf_resp or\nvirtio_scsi_ctrl_an_resp for control queue.\n\nFixes: 664ed90e621c (\"vhost/scsi: Set VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits\")\nSigned-off-by: Dongli Zhang \u003cdongli.zhang@oracle.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nReviewed-by: Mike Christie \u003cmichael.christie@oracle.com\u003e\nMessage-Id: \u003c20250403063028.16045-3-dongli.zhang@oracle.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "f591cf9fce724e5075cc67488c43c6e39e8cbe27", "tree": "fbaf99f6dfaf7940868b0a17eb6548e0a53a932c", "parents": [ "fec0abf52609c20279243699d08b660c142ce0aa" ], "author": { "name": "Dongli Zhang", "email": "dongli.zhang@oracle.com", "time": "Wed Apr 02 23:29:46 2025 -0700" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex\n\nThe vhost-scsi completion path may access vq-\u003elog_base when vq-\u003elog_used is\nalready set to false.\n\n vhost-thread QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-\u003e vhost_add_used()\n -\u003e vhost_add_used_n()\n if (unlikely(vq-\u003elog_used))\n QEMU disables vq-\u003elog_used\n via VHOST_SET_VRING_ADDR.\n mutex_lock(\u0026vq-\u003emutex);\n vq-\u003elog_used \u003d false now!\n mutex_unlock(\u0026vq-\u003emutex);\n\n\t\t\t\t QEMU gfree(vq-\u003elog_base)\n log_used()\n -\u003e log_write(vq-\u003elog_base)\n\nAssuming the VMM is QEMU. The vq-\u003elog_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue.\n\nSigned-off-by: Dongli Zhang \u003cdongli.zhang@oracle.com\u003e\nAcked-by: Jason Wang \u003cjasowang@redhat.com\u003e\nReviewed-by: Mike Christie \u003cmichael.christie@oracle.com\u003e\nMessage-Id: \u003c20250403063028.16045-2-dongli.zhang@oracle.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "fec0abf52609c20279243699d08b660c142ce0aa", "tree": "5a1507d0b6e5423f9c6f9e38a25188f0144088eb", "parents": [ "5326ab737a47278dbd16ed3ee7380b26c7056ddd" ], "author": { "name": "Stefano Garzarella", "email": "sgarzare@redhat.com", "time": "Thu Mar 27 13:44:35 2025 +0100" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "vhost_task: fix vhost_task_create() documentation\n\nCommit cb380909ae3b (\"vhost: return task creation error instead of NULL\")\nchanged the return value of vhost_task_create(), but did not update the\ndocumentation.\n\nReflect the change in the documentation: on an error, vhost_task_create()\nreturns an ERR_PTR() and no longer NULL.\n\nSigned-off-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nMessage-Id: \u003c20250327124435.142831-1-sgarzare@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "5326ab737a47278dbd16ed3ee7380b26c7056ddd", "tree": "36dd46a963cece09645e3a34b119318b8e892412", "parents": [ "fbd3039a64b01b769040677c4fc68badeca8e3b2" ], "author": { "name": "Maximilian Immanuel Brandtner", "email": "maxbr@linux.ibm.com", "time": "Mon Mar 24 15:42:46 2025 +0100" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "virtio_console: fix order of fields cols and rows\n\nAccording to section 5.3.6.2 (Multiport Device Operation) of the virtio\nspec(version 1.2) a control buffer with the event VIRTIO_CONSOLE_RESIZE\nis followed by a virtio_console_resize struct containing cols then rows.\nThe kernel implements this the wrong way around (rows then cols) resulting\nin the two values being swapped.\n\nSigned-off-by: Maximilian Immanuel Brandtner \u003cmaxbr@linux.ibm.com\u003e\nMessage-Id: \u003c20250324144300.905535-1-maxbr@linux.ibm.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "fbd3039a64b01b769040677c4fc68badeca8e3b2", "tree": "167571bfba9f15d468ca3f61d52b72fb35129493", "parents": [ "183a08715af1491d381b4e22efd61578fbe05fa5" ], "author": { "name": "Halil Pasic", "email": "pasic@linux.ibm.com", "time": "Sat Mar 22 01:29:54 2025 +0100" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:08:11 2025 -0400" }, "message": "virtio_console: fix missing byte order handling for cols and rows\n\nAs per virtio spec the fields cols and rows are specified as little\nendian. Although there is no legacy interface requirement that would\nstate that cols and rows need to be handled as native endian when legacy\ninterface is used, unlike for the fields of the adjacent struct\nvirtio_console_control, I decided to err on the side of caution based\non some non-conclusive virtio spec repo archaeology and opt for using\nvirtio16_to_cpu() much like for virtio_console_control.event. Strictly\nby the letter of the spec virtio_le_to_cpu() would have been sufficient.\nBut when the legacy interface is not used, it boils down to the same.\n\nAnd when using the legacy interface, the device formatting these as\nlittle endian when the guest is big endian would surprise me more than\nit using guest native byte order (which would make it compatible with\nthe current implementation). Nevertheless somebody trying to implement\nthe spec following it to the letter could end up forcing little endian\nbyte order when the legacy interface is in use. So IMHO this ultimately\nneeds a judgement call by the maintainers.\n\nFixes: 8345adbf96fc1 (\"virtio: console: Accept console size along with resize control message\")\nSigned-off-by: Halil Pasic \u003cpasic@linux.ibm.com\u003e\nCc: stable@vger.kernel.org # v2.6.35+\nMessage-Id: \u003c20250322002954.3129282-1-pasic@linux.ibm.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n" }, { "commit": "183a08715af1491d381b4e22efd61578fbe05fa5", "tree": "0db4cfb86bb29f20b842ddb31896ff4a2479079b", "parents": [ "2e2f925fe737576df2373931c95e1a2b66efdfef" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Thu Apr 10 03:16:26 2025 -0400" }, "committer": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Fri Apr 18 10:05:49 2025 -0400" }, "message": "virtgpu: don\u0027t reset on shutdown\n\nIt looks like GPUs are used after shutdown is invoked.\nThus, breaking virtio gpu in the shutdown callback is not a good idea -\nguest hangs attempting to finish console drawing, with these warnings:\n\n[ 20.504464] WARNING: CPU: 0 PID: 568 at drivers/gpu/drm/virtio/virtgpu_vq.c:358 virtio_gpu_queue_ctrl_sgs+0x236/0x290 [virtio_gpu]\n[ 20.505685] Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 rfkill ip_set nf_tables nfnetlink vfat fat intel_rapl_msr intel_rapl_common intel_uncore_frequency_common nfit libnvdimm kvm_intel kvm rapl iTCO_wdt iTCO_vendor_support virtio_gpu virtio_dma_buf pcspkr drm_shmem_helper i2c_i801 drm_kms_helper lpc_ich i2c_smbus virtio_balloon joydev drm fuse xfs libcrc32c ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata virtio_net ghash_clmulni_intel net_failover virtio_blk failover serio_raw dm_mirror dm_region_hash dm_log dm_mod\n[ 20.511847] CPU: 0 PID: 568 Comm: kworker/0:3 Kdump: loaded Tainted: G W ------- --- 5.14.0-578.6675_1757216455.el9.x86_64 #1\n[ 20.513157] Hardware name: Red Hat KVM/RHEL, BIOS edk2-20241117-3.el9 11/17/2024\n[ 20.513918] Workqueue: events drm_fb_helper_damage_work [drm_kms_helper]\n[ 20.514626] RIP: 0010:virtio_gpu_queue_ctrl_sgs+0x236/0x290 [virtio_gpu]\n[ 20.515332] Code: 00 00 48 85 c0 74 0c 48 8b 78 08 48 89 ee e8 51 50 00 00 65 ff 0d 42 e3 74 3f 0f 85 69 ff ff ff 0f 1f 44 00 00 e9 5f ff ff ff \u003c0f\u003e 0b e9 3f ff ff ff 48 83 3c 24 00 74 0e 49 8b 7f 40 48 85 ff 74\n[ 20.517272] RSP: 0018:ff34f0a8c0787ad8 EFLAGS: 00010282\n[ 20.517820] RAX: 00000000fffffffb RBX: 0000000000000000 RCX: 0000000000000820\n[ 20.518565] RDX: 0000000000000000 RSI: ff34f0a8c0787be0 RDI: ff218bef03a26300\n[ 20.519308] RBP: ff218bef03a26300 R08: 0000000000000001 R09: ff218bef07224360\n[ 20.520059] R10: 0000000000008dc0 R11: 0000000000000002 R12: ff218bef02630028\n[ 20.520806] R13: ff218bef0263fb48 R14: ff218bef00cb8000 R15: ff218bef07224360\n[ 20.521555] FS: 0000000000000000(0000) GS:ff218bef7ba00000(0000) knlGS:0000000000000000\n[ 20.522397] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 20.522996] CR2: 000055ac4f7871c0 CR3: 000000010b9f2002 CR4: 0000000000771ef0\n[ 20.523740] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 20.524477] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 20.525223] PKRU: 55555554\n[ 20.525515] Call Trace:\n[ 20.525777] \u003cTASK\u003e\n[ 20.526003] ? show_trace_log_lvl+0x1c4/0x2df\n[ 20.526464] ? show_trace_log_lvl+0x1c4/0x2df\n[ 20.526925] ? virtio_gpu_queue_fenced_ctrl_buffer+0x82/0x2c0 [virtio_gpu]\n[ 20.527643] ? virtio_gpu_queue_ctrl_sgs+0x236/0x290 [virtio_gpu]\n[ 20.528282] ? __warn+0x7e/0xd0\n[ 20.528621] ? virtio_gpu_queue_ctrl_sgs+0x236/0x290 [virtio_gpu]\n[ 20.529256] ? report_bug+0x100/0x140\n[ 20.529643] ? handle_bug+0x3c/0x70\n[ 20.530010] ? exc_invalid_op+0x14/0x70\n[ 20.530421] ? asm_exc_invalid_op+0x16/0x20\n[ 20.530862] ? virtio_gpu_queue_ctrl_sgs+0x236/0x290 [virtio_gpu]\n[ 20.531506] ? virtio_gpu_queue_ctrl_sgs+0x174/0x290 [virtio_gpu]\n[ 20.532148] virtio_gpu_queue_fenced_ctrl_buffer+0x82/0x2c0 [virtio_gpu]\n[ 20.532843] virtio_gpu_primary_plane_update+0x3e2/0x460 [virtio_gpu]\n[ 20.533520] drm_atomic_helper_commit_planes+0x108/0x320 [drm_kms_helper]\n[ 20.534233] drm_atomic_helper_commit_tail+0x45/0x80 [drm_kms_helper]\n[ 20.534914] commit_tail+0xd2/0x130 [drm_kms_helper]\n[ 20.535446] drm_atomic_helper_commit+0x11b/0x140 [drm_kms_helper]\n[ 20.536097] drm_atomic_commit+0xa4/0xe0 [drm]\n[ 20.536588] ? __pfx___drm_printfn_info+0x10/0x10 [drm]\n[ 20.537162] drm_atomic_helper_dirtyfb+0x192/0x270 [drm_kms_helper]\n[ 20.537823] drm_fbdev_shmem_helper_fb_dirty+0x43/0xa0 [drm_shmem_helper]\n[ 20.538536] drm_fb_helper_damage_work+0x87/0x160 [drm_kms_helper]\n[ 20.539188] process_one_work+0x194/0x380\n[ 20.539612] worker_thread+0x2fe/0x410\n[ 20.540007] ? __pfx_worker_thread+0x10/0x10\n[ 20.540456] kthread+0xdd/0x100\n[ 20.540791] ? __pfx_kthread+0x10/0x10\n[ 20.541190] ret_from_fork+0x29/0x50\n[ 20.541566] \u003c/TASK\u003e\n[ 20.541802] ---[ end trace 0000000000000000 ]---\n\nIt looks like the shutdown is called in the middle of console drawing, so\nwe should either wait for it to finish, or let drm handle the shutdown.\n\nThis patch implements this second option:\n\nAdd an option for drivers to bypass the common break+reset handling.\nAs DRM is careful to flush/synchronize outstanding buffers, it looks like\nGPU can just have a NOP there.\n\nReviewed-by: Eric Auger \u003ceric.auger@redhat.com\u003e\nTested-by: Eric Auger \u003ceric.auger@redhat.com\u003e\nFixes: 8bd2fa086a04 (\"virtio: break and reset virtio devices on device_shutdown()\")\nCc: Eric Auger \u003ceauger@redhat.com\u003e\nCc: Jocelyn Falempe \u003cjfalempe@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nMessage-Id: \u003c8490dbeb6f79ed039e6c11d121002618972538a3.1744293540.git.mst@redhat.com\u003e\n" } ], "next": "d54d610243a4508183978871e5faff5502786cd4" }