)]}' { "log": [ { "commit": "5d6919055dec134de3c40167a490f33c74c12581", "tree": "0e7e0941442a542fdfda179691ab09ae3a56579b", "parents": [ "afaa0a477099cb7256e26fe11289c753a225ac97" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 14:08:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 14:08:09 2026 -0700" }, "message": "Linux 7.1-rc3\n" }, { "commit": "afaa0a477099cb7256e26fe11289c753a225ac97", "tree": "22a2d5e2ce4fdc91a752914ee3f3e6fafd854448", "parents": [ "aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71", "8cf5dd235eff6008cb04c3d8064d2acfa90616f1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 12:21:57 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 12:21:57 2026 -0700" }, "message": "Merge tag \u0027edac_urgent_for_v7.1_rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull EDAC fix from Borislav Petkov:\n\n - Fix a string leak in the versalnet driver\n\n* tag \u0027edac_urgent_for_v7.1_rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:\n EDAC/versalnet: Fix device name memory leak\n" }, { "commit": "aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71", "tree": "8df99db7b35ddbdadb96329569a3926d0a88cfdf", "parents": [ "a1a10cdbc6551ba359169a3033f193b7f8c1b95d" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Fri May 08 17:53:09 2026 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 08:15:57 2026 -0700" }, "message": "rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n\nThe DATA-packet handler in rxrpc_input_call_event() and the RESPONSE\nhandler in rxrpc_verify_response() copy the skb to a linear one before\ncalling into the security ops only when skb_cloned() is true. An skb\nthat is not cloned but still carries externally-owned paged fragments\n(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via\n__ip_append_data, or a chained skb_has_frag_list()) falls through to\nthe in-place decryption path, which binds the frag pages directly into\nthe AEAD/skcipher SGL via skb_to_sgvec().\n\nExtend the gate to also unshare when skb_has_frag_list() or\nskb_has_shared_frag() is true. This catches the splice-loopback vector\nand other externally-shared frag sources while preserving the\nzero-copy fast path for skbs whose frags are kernel-private (e.g. NIC\npage_pool RX, GRO). The OOM/trace handling already in place is reused.\n\nFixes: d0d5c0cd1e71 (\"rxrpc: Use skb_unshare() rather than skb_cow_data()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a1a10cdbc6551ba359169a3033f193b7f8c1b95d", "tree": "c6860829503420e552a7d0b32a5bcdc75ec2d196", "parents": [ "515186b7be488f37c63c2436fc2d1a160ef9bb95", "de019f203b0d472c98ead4081ad4f05d92c9b826" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 08:10:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 10 08:10:47 2026 -0700" }, "message": "Merge tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk driver fixes from Stephen Boyd:\n\n - Mark the DDR bus clk critical in the SpaceMiT driver so that\n boot doesn\u0027t fail\n\n - Fix boot on Mobile EyeQ by creating the auxiliary device for\n the ethernet PHY\n\n - Plug an OF node leak in Rockchip rk808 clk driver\n\n* tag \u0027clk-fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: rk808: fix OF node reference imbalance\n MAINTAINERS: add myself as a reviewer for the clk subsystem\n reset: eyeq: drop device_set_of_node_from_dev() done by parent\n clk: eyeq: add EyeQ5 children auxiliary device for generic PHYs\n clk: eyeq: use the auxiliary device creation helper\n clk: spacemit: k3: mark top_dclk as CLK_IS_CRITICAL\n" }, { "commit": "515186b7be488f37c63c2436fc2d1a160ef9bb95", "tree": "62c8b2ddb6e003607ab2da667711418bbb2acae7", "parents": [ "1bfaee9d3351b9b32a99766bbfb1f5baed60ddef", "3ac1a467e37683f602221e243fa3c59b0de81165" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 18:42:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 18:42:54 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix sk_local_storage diag dump via netlink (Amery Hung)\n\n - Fix off-by-one in arena direct-value access (Junyoung Jang)\n\n - Reject TCP_NODELAY in bpf-tcp congestion control (KaFai Wan)\n\n - Fix type confusion in bpf_*_sock() (Kuniyuki Iwashima)\n\n - Reject TX-only AF_XDP sockets (Linpu Yu)\n\n - Don\u0027t run arg-tracking analysis twice on main subprog (Paul Chaignon)\n\n - Fix NULL pointer dereference in bpf_sk_storage_clone and fib lookup\n (Weiming Shi)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf: Fix off-by-one boundary validation in arena direct-value access\n xskmap: reject TX-only AF_XDP sockets\n bpf: Don\u0027t run arg-tracking analysis twice on main subprog\n bpf: Free reuseport cBPF prog after RCU grace period.\n bpf: tcp: Fix type confusion in sol_tcp_sockopt().\n bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock().\n bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock().\n mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow()\n selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.\n bpf: tcp: Fix type confusion in bpf_tcp_sock().\n tools/headers: Regenerate stddef.h to fix BPF selftests\n bpf: Fix sk_local_storage diag dumping uninitialized special fields\n bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup()\n sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}().\n bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths\n selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY\n selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks\n bpf: Reject TCP_NODELAY in bpf-tcp-cc\n bpf: Reject TCP_NODELAY in TCP header option callbacks\n" }, { "commit": "3ac1a467e37683f602221e243fa3c59b0de81165", "tree": "6d94789f54da9f5664370898c5c5e4d56d49b4a0", "parents": [ "bf6d507f7e3c65751d52fd8caf1ea4e003922624" ], "author": { "name": "Junyoung Jang", "email": "graypanda.inzag@gmail.com", "time": "Mon Apr 27 02:25:05 2026 +0900" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat May 09 16:18:39 2026 -0700" }, "message": "bpf: Fix off-by-one boundary validation in arena direct-value access\n\nBPF_MAP_TYPE_ARENA accepts BPF_PSEUDO_MAP_VALUE offsets at exactly\nthe end of the arena mapping (off \u003d\u003d arena_size). The boundary check\nin arena_map_direct_value_addr() uses `\u003e` instead of `\u003e\u003d`, which\nincorrectly allows a one-past-end pointer to be accepted.\n\nChange the condition to `\u003e\u003d` to correctly reject offsets that fall\noutside the valid arena user_vm range.\n\nFixes: 317460317a02 (\"bpf: Introduce bpf_arena.\")\nSigned-off-by: Junyoung Jang \u003cgraypanda.inzag@gmail.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nLink: https://lore.kernel.org/r/20260426172505.1947915-1-graypanda.inzag@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "bf6d507f7e3c65751d52fd8caf1ea4e003922624", "tree": "c2d08f534341e6b59afc2b7ed6955abe7f4cc1ca", "parents": [ "512809bb8a370d071f66fc53abe67368e171dec5" ], "author": { "name": "Linpu Yu", "email": "linpu5433@gmail.com", "time": "Fri May 08 22:43:43 2026 +0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat May 09 16:17:01 2026 -0700" }, "message": "xskmap: reject TX-only AF_XDP sockets\n\nXSKMAP entries are used as redirect targets for incoming XDP frames.\nA TX-only AF_XDP socket lacks an Rx ring and cannot handle redirected\ntraffic, but xsk_map_update_elem() currently allows such sockets to\nbe inserted into the map.\n\nRedirecting packets to such a socket on the veth generic-XDP path\ncauses a kernel crash in xsk_generic_rcv().\n\nThis became possible after xsk_is_setup_for_bpf_map() was removed from\nthe XSKMAP update path, which allowed bound TX-only sockets to be\ninserted into the map.\n\nReject TX-only sockets during XSKMAP updates to avoid the crash.\nThey remain fully operational for pure Tx purposes outside XSKMAP.\n\nFixes: 968be23ceaca (\"xsk: Fix possible segfault at xskmap entry insertion\")\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSigned-off-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nSigned-off-by: Linpu Yu \u003clinpu5433@gmail.com\u003e\nReviewed-by: Jason Xing \u003ckerneljasonxing@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260508144344.694-1-linpu5433@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "512809bb8a370d071f66fc53abe67368e171dec5", "tree": "dbcfc80d25360ec47f2572a84595651b6f6e9e6b", "parents": [ "18fc650ccd7fe3376eca89203668cfb8268f60df" ], "author": { "name": "Paul Chaignon", "email": "paul.chaignon@gmail.com", "time": "Thu May 07 20:22:06 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat May 09 16:12:40 2026 -0700" }, "message": "bpf: Don\u0027t run arg-tracking analysis twice on main subprog\n\nBecause subprog 0, the main subprog, is considered a global function,\nwe end up running the arg-tracking dataflow analysis twice on it. That\nresults in slightly longer verification but mostly in more verbose\nverifier logs. This patch fixes it by keeping only the iteration over\nglobal subprogs.\n\nWhen running over all of Cilium\u0027s programs with BPF_LOG_LEVEL2, this\nreduces verbosity by ~20% on average.\n\nFixes: bf0c571f7feb6 (\"bpf: introduce forward arg-tracking dataflow analysis\")\nSigned-off-by: Paul Chaignon \u003cpaul.chaignon@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/e4d7b53d4963ef520541a782f5fc8108a168877c.1778176504.git.paul.chaignon@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "1bfaee9d3351b9b32a99766bbfb1f5baed60ddef", "tree": "e92981148ddf0c726e32e43de926d7a26ff4671f", "parents": [ "e92b2872d0b198a77c0a438c5cdb1c5510762c1b", "0c8c88b8eb82a2a41bec5f17c076d6312dc40316" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 11:47:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 11:47:39 2026 -0700" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Fix a regression in overlayfs caused by an fsverity API change\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n ovl: fix verity lazy-load guard broken by fsverity_active() semantic change\n" }, { "commit": "e92b2872d0b198a77c0a438c5cdb1c5510762c1b", "tree": "17726ad1d02f6644898721e90bcbffbd85e953aa", "parents": [ "ec89572766744e844df24c27d31c97b4c00f4e07", "2adc8664018c1cc595c7c0c98474a33c7fe32a85" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 11:24:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 11:24:02 2026 -0700" }, "message": "Merge tag \u0027rust-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Add \u0027bindgen\u0027 target to make UML 32-bit builds work with GCC\n\n - Disable two Clippy warnings (\u0027collapsible_{if,match}\u0027)\n\n \u0027pin-init\u0027 crate:\n\n - Fix unsoundness issue that created \u0026\u0027static references\"\n\n* tag \u0027rust-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: allow `clippy::collapsible_if` globally\n rust: allow `clippy::collapsible_match` globally\n rust: pin-init: fix incorrect accessor reference lifetime\n rust: pin-init: internal: move alignment check to `make_field_check`\n rust: arch: um: Fix building 32-bit UML with GCC\n" }, { "commit": "ec89572766744e844df24c27d31c97b4c00f4e07", "tree": "dae5dc05a2d707d83ecb85871977b49284cfbc0b", "parents": [ "234d72ae02e48cd0cf0f6e8f8f7d57c0cf7bcc66", "99076a17a112ac43cbd37f6883898ae649166303" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:32:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:32:50 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - ads7871: Fix endianness bug in 16-bit register reads\n\n - lm75: Fix configuration register writes and AS6200/TMP112 setup and\n alarm handling\n\n - lm63: Fix TOCTOU problems\n\n - corsair-psu: Close HID device on probe errors\n\n - ltc2992: Fix overflow and threshold range\n\n - Documentation: fix link to ideapad-laptop.c file\n\n - Remove stale CONFIG_SENSORS_SBRMI Makefile reference\n\n* tag \u0027hwmon-for-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (ads7871) Fix endianness bug in 16-bit register reads\n hwmon: (lm75) Fix configuration register writes.\n hwmon: (lm75) Fix AS6200 and TMP112 setup and alarm handling\n hwmon: (lm63) Add locking to avoid TOCTOU\n hwmon: (corsair-psu) Close HID device on probe errors\n hwmon: Remove stale CONFIG_SENSORS_SBRMI Makefile reference\n Documentation: hwmon: fix link to ideapad-laptop.c file\n hwmon: (ltc2992) Fix u32 overflow in power read path\n hwmon: (ltc2992) Clamp threshold writes to hardware range\n" }, { "commit": "234d72ae02e48cd0cf0f6e8f8f7d57c0cf7bcc66", "tree": "1f344ede1d3e71b3187705d521df8604cbf8c395", "parents": [ "fe3e5bc9e3c280017d4ba05d7fcc8997029e53cd", "bc851db06045a40c18233dd76ef0562d7f8bb6db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:26:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:26:08 2026 -0700" }, "message": "Merge tag \u0027staging-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are two small staging driver fixes for 7.1-rc3. They are:\n\n - vme_user root device leak fix\n\n - NULL dereference bugfix in the rtl8723bs driver\n\n Both of these have been in linux-next all this week with no reported\n issues\"\n\n* tag \u0027staging-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc\n staging: vme_user: fix root device leak on init failure\n" }, { "commit": "fe3e5bc9e3c280017d4ba05d7fcc8997029e53cd", "tree": "27ac7c2c37e1fa44dc306f069489c2dc7eab2732", "parents": [ "656a95c4a0faf9ebb8e15e7e38ade41164018c99", "4fd44d47e8ab760eef11968d093200cce6752d95" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:16:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:16:24 2026 -0700" }, "message": "Merge tag \u0027usb-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB driver fixes from Greg KH:\n \"Here are some small USB driver fixes for 7.1-rc3 to resolve some\n reported issues, and a new device id. These are:\n\n - usblp driver heap leak fixes\n\n - ulpi driver memory leak fix\n\n - typec driver fixes\n\n - dwc3 driver fix\n\n - omap dma driver fix\n\n - new option driver device id addition\n\n All of these have been in linux-next for over a week with no reported\n issues\"\n\n* tag \u0027usb-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n USB: serial: option: add Telit Cinterion LE910Cx compositions\n usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl\n usb: usblp: fix heap leak in IEEE 1284 device ID via short response\n usb: dwc3: Move GUID programming after PHY initialization\n usb: typec: tcpm: fix debug accessory mode detection for sink ports\n usb: typec: tcpm: reset internal port states on soft reset AMS\n usb: ulpi: fix memory leak on ulpi_register() error paths\n USB: omap_udc: DMA: Don\u0027t enable burst 4 mode\n" }, { "commit": "656a95c4a0faf9ebb8e15e7e38ade41164018c99", "tree": "d8080aa5f9b39f553e5db665142a262c5ec6ff81", "parents": [ "bf0e022821fa516cd6eb0292fcb4ccdd4e201c9f", "3051cd060fa496df42954291fa2306ed2eab4ecc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:10:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:10:07 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - sanitize more input parameters in the core (found by syzkaller)\n\n - usual set of driver fixes (proper completion handling, applying\n quirks, correct workqueue selection...)\n\n - ID additions to simplify dependency handling\n\n - new email address for Peter Rosin\n\n* tag \u0027i2c-for-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: smbus: reject oversized block transfers in the common path\n MAINTAINERS: Update mail for Peter Rosin\n i2c: stub: Reject I2C block transfers with invalid length\n i2c: Compare the return value of gpiod_get_direction against GPIO_LINE_DIRECTION_OUT\n i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl\n i2c: acpi: Add ELAN0678 to i2c_acpi_force_100khz_device_ids\n dt-bindings: i2c: apple,i2c: Add t8122 compatible\n i2c: stm32f7: reinit_completion() per transfer not per msg\n dt-bindings: i2c: amlogic: Add compatible for T7 SOC\n i2c: testunit: Replace system_long_wq with system_dfl_long_wq\n" }, { "commit": "bf0e022821fa516cd6eb0292fcb4ccdd4e201c9f", "tree": "fb677bfdb7650a1234f1c9639b8a9575c27b259c", "parents": [ "70390501d1944d4e5b8f7352be180fceb3a44132", "f583bd5f64d40e083dde5bb22846c4d93e59d471" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:03:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 09 08:03:21 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - Fix KASAN sanitization flag for core_$(BITS).o\n\n - Fixes for handling offset values in pseries htmdump\n\n - Fix interrupt mask in cpm1_gpiochip_add16()\n\n - ps3/pasemi fixes to drop redundant result assignment\n\n - Fixes in papr-hvpipe code path\n\n - powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events\n\nThanks to Aboorva Devarajan, Athira Rajeev, Christophe Leroy (CS GROUP),\nGeert Uytterhoeven, Haren Myneni, Krzysztof Kozlowski, Mukesh Kumar\nChaurasiya (IBM), Nathan Chancellor, Ritesh Harjani (IBM), Shivani\nNittor, Sourabh Jain, Thomas Zimmermann, and Venkat Rao Bagalkote.\n\n* tag \u0027powerpc-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (21 commits)\n powerpc/pasemi: Drop redundant res assignment\n powerpc/ps3: Drop redundant result assignment\n powerpc/vdso: Drop -DCC_USING_PATCHABLE_FUNCTION_ENTRY from 32-bit flags with clang\n arch/powerpc: Drop CONFIG_FIRMWARE_EDID from defconfig files\n powerpc/perf: Update check for PERF_SAMPLE_DATA_SRC marked events\n powerpc/8xx: Fix interrupt mask in cpm1_gpiochip_add16()\n powerpc/vmx: avoid KASAN instrumentation in enter_vmx_ops() for kexec\n powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o\n pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ()\n pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg()\n pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info\n pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release()\n pseries/papr-hvpipe: Fix the usage of copy_to_user()\n pseries/papr-hvpipe: Fix \u0026 simplify error handling in papr_hvpipe_init()\n pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()\n pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace\n pseries/papr-hvpipe: Fix race with interrupt handler\n powerpc/pseries/htmdump: Add memory configuration dump support to htmdump module\n powerpc/pseries/htmdump: Fix the offset value used in htm status dump\n powerpc/pseries/htmdump: Fix the offset value used in processor configuration dump\n ...\n" }, { "commit": "70390501d1944d4e5b8f7352be180fceb3a44132", "tree": "e561144140b1684248dae01a3eb573eb1ca4fa7d", "parents": [ "6e1e5a33e809105f44401b6a962a2c63e360f561", "5772f6535227ebd104065d80afa8ed3478d34c5c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:28:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:28:45 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix memory map enumeration bug in the Xen e820 parsing code (Juergen\n Gross)\n\n - Re-enable e820 BIOS fallback if e820 table is empty (David Gow)\n\n* tag \u0027x86-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot/e820: Re-enable BIOS fallback if e820 table is empty\n x86/xen: Fix a potential problem in xen_e820_resolve_conflicts()\n" }, { "commit": "6e1e5a33e809105f44401b6a962a2c63e360f561", "tree": "6a249a35c63f47ce9e66862d9c30f3a4b9ae1f4f", "parents": [ "7f0023215262221ca08d56be2203e8a4770be033", "bd3c45dd01283ada23b0a388c578dcf5600deb8a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:03:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 20:03:39 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Fix CPU hotplug activation race in the timer migration code, by\n Frederic Weisbecker\"\n\n* tag \u0027timers-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timers/migration: Fix another hotplug activation race\n" }, { "commit": "7f0023215262221ca08d56be2203e8a4770be033", "tree": "33c8dec5486e41d6b1e29dbaab172b3cbc0ddc41", "parents": [ "e5cf0260a7472b4f34a46c418c14bec272aac404", "9f6d929ee2c6f0266edb564bcd2bd47fd6e884a8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:42:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:42:10 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix spurious failures in rseq self-tests (Mark Brown)\n\n - Fix rseq rseq::cpu_id_start ABI regression due to TCMalloc\u0027s creative\n use of the supposedly read-only field\n\n The fix is to introduce a new ABI variant based on a new (larger)\n rseq area registration size, to keep the TCMalloc use of rseq\n backwards compatible on new kernels (Thomas Gleixner)\n\n - Fix wakeup_preempt_fair() for not waking up task (Vincent Guittot)\n\n - Fix s64 mult overflow in vruntime_eligible() (Zhan Xusheng)\n\n* tag \u0027sched-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/fair: Fix wakeup_preempt_fair() for not waking up task\n sched/fair: Fix overflow in vruntime_eligible()\n selftests/rseq: Expand for optimized RSEQ ABI v2\n rseq: Reenable performance optimizations conditionally\n rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode\n selftests/rseq: Validate legacy behavior\n selftests/rseq: Make registration flexible for legacy and optimized mode\n selftests/rseq: Skip tests if time slice extensions are not available\n rseq: Revert to historical performance killing behaviour\n rseq: Don\u0027t advertise time slice extensions if disabled\n rseq: Protect rseq_reset() against interrupts\n rseq: Set rseq::cpu_id_start to 0 on unregistration\n selftests/rseq: Don\u0027t run tests with runner scripts outside of the scripts\n" }, { "commit": "e5cf0260a7472b4f34a46c418c14bec272aac404", "tree": "76b74ef486f2be0ae3b70a7561d3eb155921d663", "parents": [ "27a26ccfd528da725a999ea1e3102503c61eb655", "aa4384bc8f4360167f3c3d5322121fe892289ea2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:39:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 19:39:18 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix deadlock in the perf_mmap() failure path (Peter Zijlstra)\n\n - Intel ACR (Auto Counter Reload) fixes (Dapeng Mi):\n - Fix validation and configuration of ACR masks\n - Fix ACR rescheduling bug causing stale masks\n - Disable the PMI on ACR-enabled hardware\n - Enable ACR on Panther Cover uarch too\n\n* tag \u0027perf-urgent-2026-05-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/intel: Enable auto counter reload for DMR\n perf/x86/intel: Disable PMI for self-reloaded ACR events\n perf/x86/intel: Always reprogram ACR events to prevent stale masks\n perf/x86/intel: Improve validation and configuration of ACR masks\n perf/core: Fix deadlock in perf_mmap() failure path\n" }, { "commit": "27a26ccfd528da725a999ea1e3102503c61eb655", "tree": "8aff9a1860c107d49f33dd9f77adb9299a2577a1", "parents": [ "678ede852f918581fbc43c61f4c4737a3df99cac", "5cbb61bf4168859d97c068d88d364f4f1f440325" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:18:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:18:35 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fix from Catalin Marinas:\n\n - ptrace(PTRACE_SETREGSET) fix to zero the target\u0027s fpsimd_state rather\n than the tracer\u0027s\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64/fpsimd: ptrace: zero target\u0027s fpsimd_state, not the tracer\u0027s\n" }, { "commit": "678ede852f918581fbc43c61f4c4737a3df99cac", "tree": "ac7075d034931918ad413ed7c62e439b16aa2222", "parents": [ "cbf457c584b5cbd0d44e8f05edaf3e189e894a68", "9ef40a09c5de18f0d275a451f5c2a7fd4f07158b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:08:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 16:08:58 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Don\u0027t fallback to bus reset after failed slot reset; a bus reset\n isn\u0027t safe if the .reset_slot() callback is implemented (Keith Busch)\n\n - Update saved_config_space upon resource assignment to fix passthrough\n regressions when x86 pcibios_assign_resources() updates BARs (Lukas\n Wunner)\n\n - Initialize a temporary pci_dev-\u003edev in sysfs \u0027new_id\u0027 attribute to\n fix a lockdep regression after driver_override was moved from PCI to\n device core (Samiullah Khawaja)\n\n - Update MAINTAINERS email addresses (Marek Vasut, Hans Zhang)\n\n - Add MAINTAINERS reviewer for PCIe Cadence IP (Aksh Garg)\n\n* tag \u0027pci-v7.1-fixes-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer\n MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1\n MAINTAINERS: Update Marek Vasut email for PCIe R-Car\n PCI: Initialize temporary device in new_id_store()\n PCI: Update saved_config_space upon resource assignment\n PCI: Don\u0027t fallback to bus reset after failed slot reset\n" }, { "commit": "9ef40a09c5de18f0d275a451f5c2a7fd4f07158b", "tree": "e8d643ee3a8c58bb949dcb6435f95957587ae9de", "parents": [ "78e115d806b0eea83a0e4df182a689823aa80511" ], "author": { "name": "Aksh Garg", "email": "a-garg7@ti.com", "time": "Fri May 08 11:39:51 2026 +0530" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:07 2026 -0500" }, "message": "MAINTAINERS: Add Aksh Garg as PCIe CADENCE reviewer\n\nI wish to contribute to the review process for Cadence PCIe IP drivers,\nhence add myself as a reviewer.\n\nSigned-off-by: Aksh Garg \u003ca-garg7@ti.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260508060951.840233-1-a-garg7@ti.com\n" }, { "commit": "78e115d806b0eea83a0e4df182a689823aa80511", "tree": "51fbdb1ed7b05de8ecc68a4475d08ce212ddd242", "parents": [ "bf5421b3d8d3d9216d045af89d4f7e2f75375554" ], "author": { "name": "Hans Zhang", "email": "18255117159@163.com", "time": "Fri May 08 10:30:06 2026 +0800" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "MAINTAINERS: Update Hans Zhang email for PCIe CIX Sky1\n\nUpdate my email address as my work email account is no longer in use.\n\nSigned-off-by: Hans Zhang \u003c18255117159@163.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260508023006.1787674-1-18255117159@163.com\n" }, { "commit": "bf5421b3d8d3d9216d045af89d4f7e2f75375554", "tree": "852dfa89cabc5a64dd41279a2779d77fd8e401b2", "parents": [ "f45a49a2380a47332817b7248c61a0ebbc6f0d00" ], "author": { "name": "Marek Vasut", "email": "marek.vasut+renesas@mailbox.org", "time": "Tue Apr 28 07:19:54 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "MAINTAINERS: Update Marek Vasut email for PCIe R-Car\n\nUse up to date address. No functional change.\n\nSigned-off-by: Marek Vasut \u003cmarek.vasut+renesas@mailbox.org\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260428052030.51101-1-marek.vasut+renesas@mailbox.org\n" }, { "commit": "f45a49a2380a47332817b7248c61a0ebbc6f0d00", "tree": "d7ef8e4ba7f470ca0eb563c22b0e3efcd4668d75", "parents": [ "909f7bf9b080c10df3c3b38533906dbf09ff1d8b" ], "author": { "name": "Samiullah Khawaja", "email": "skhawaja@google.com", "time": "Tue May 05 23:43:27 2026 +0000" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "PCI: Initialize temporary device in new_id_store()\n\nWhen setting new_id of a PCI device driver using sysfs a lockdep splat\noccurs. This is because new_id_store() builds a temporary pci_dev for\npci_match_device(), which calls device_match_driver_override(). That\ndepends on the driver_override.lock added by cb3d1049f4ea (\"driver core:\ngeneralize driver_override in struct device\").\n\nThe new driver_override.lock was not initialized in the temporary pci_dev,\nresulting in this lockdep splat.\n\nInitialize the temporary pci_dev to fix this.\n\nRepro:\n\n Build with CONFIG_LOCKDEP\u003dy, boot with QEMU, and add a new ID:\n\n # echo \"8086 10f5\" \u003e /sys/bus/pci/drivers/e1000e/new_id\n\n INFO: trying to register non-static key.\n The code is fine but needs lockdep annotation, or maybe\n you didn\u0027t initialize this object before use?\n turning off the locking correctness validator.\n CPU: 2 UID: 0 PID: 177 Comm: liveupdate-iomm Not tainted 7.0.0+ #9 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x5d/0x80\n register_lock_class+0x77e/0x790\n lock_acquire+0xbf/0x2e0\n pci_match_device+0x24/0x180\n new_id_store+0x189/0x1d0\n kernfs_fop_write_iter+0x14f/0x210\n vfs_write+0x263/0x5e0\n ksys_write+0x79/0xf0\n do_syscall_64+0x117/0xf80\n\nFixes: 10a4206a2401 (\"PCI: use generic driver_override infrastructure\")\nFixes: 8895d3bcb8ba (\"PCI: Fail new_id for vendor/device values already built into driver\")\nSigned-off-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\n[bhelgaas: add commit log details and repro, trim backtrace]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nReviewed-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\nLink: https://patch.msgid.link/20260505234327.716630-1-skhawaja@google.com\n" }, { "commit": "909f7bf9b080c10df3c3b38533906dbf09ff1d8b", "tree": "3f03f1ea366dca8a0f4064257197f466a856896d", "parents": [ "cfcbfe5cb11650d53f7cafd7adfd556690b77114" ], "author": { "name": "Lukas Wunner", "email": "lukas@wunner.de", "time": "Wed Apr 15 17:56:06 2026 +0200" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Fri May 08 15:50:06 2026 -0500" }, "message": "PCI: Update saved_config_space upon resource assignment\n\nBernd reports passthrough failure of a Digital Devices Cine S2 V6 DVB\nadapter plugged into an ASRock X570S PG Riptide board with BIOS version\nP5.41 (09/07/2023):\n\n ddbridge 0000:05:00.0: detected Digital Devices Cine S2 V6 DVB adapter\n ddbridge 0000:05:00.0: cannot read registers\n ddbridge 0000:05:00.0: fail\n\nBIOS assigns an incorrect BAR to the DVB adapter which doesn\u0027t fit into the\nupstream bridge window. The kernel corrects the BAR assignment:\n\n pci 0000:07:00.0: BAR 0 [mem 0xfffffffffc500000-0xfffffffffc50ffff 64bit]: can\u0027t claim; no compatible bridge window\n pci 0000:07:00.0: BAR 0 [mem 0xfc500000-0xfc50ffff 64bit]: assigned\n\nCorrection of the BAR assignment happens in an x86-specific fs_initcall,\npcibios_assign_resources(), after device enumeration in a subsys_initcall.\nThis order was introduced at the behest of Linus in 2004:\n\n https://git.kernel.org/tglx/history/c/a06a30144bbc\n\nNo other architecture performs such a late BAR correction.\n\nBernd bisected the issue to commit a2f1e22390ac (\"PCI/ERR: Ensure error\nrecoverability at all times\"), but it only occurs in the absence of commit\n4d4c10f763d7 (\"PCI: Explicitly put devices into D0 when initializing\").\nThis combination exists in stable kernel v6.12.70, but not in mainline,\nhence Bernd cannot reproduce the issue with mainline.\n\nSince a2f1e22390ac, config space is saved on enumeration, prior to BAR\ncorrection. Upon passthrough, the corrected BAR is overwritten with the\nincorrect saved value by:\n\n vfio_pci_core_register_device()\n vfio_pci_set_power_state()\n pci_restore_state()\n\nBut only if the device\u0027s current_state is PCI_UNKNOWN, as it was prior to\ncommit 4d4c10f763d7. Since the commit, it is PCI_D0, which changes the\nbehavior of vfio_pci_set_power_state() to no longer restore the state\nwithout saving it first.\n\nAlexandre is reporting the same issue as Bernd, but in his case, mainline\nis affected as well. The difference is that on Alexandre\u0027s system, the\nhost kernel binds a driver to the device which is unbound prior to\npassthrough, whereas on Bernd\u0027s system no driver gets bound by the host\nkernel.\n\nUnbinding sets current_state to PCI_UNKNOWN in pci_device_remove(), so when\nvfio-pci is subsequently bound to the device, pci_restore_state() is once\nagain called without invoking pci_save_state() first.\n\nTo robustly fix the issue, always update saved_config_space upon resource\nassignment.\n\nReported-by: Bernd Schumacher \u003cbernd@bschu.de\u003e\nCloses: https://lore.kernel.org/r/acfZrlP0Ua_5D3U4@eldamar.lan/\nReported-by: Alexandre N. \u003can.tech@mailo.com\u003e\nCloses: https://lore.kernel.org/r/dd3c3358-de0f-4a56-9c81-04aceaab4058@mailo.com/\nFixes: a2f1e22390ac (\"PCI/ERR: Ensure error recoverability at all times\")\nSigned-off-by: Lukas Wunner \u003clukas@wunner.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nTested-by: Bernd Schumacher \u003cbernd@bschu.de\u003e\nTested-by: Alexandre N. \u003can.tech@mailo.com\u003e\nCc: stable@vger.kernel.org # v6.12+\nLink: https://patch.msgid.link/febc3f354e0c1f5a9f5b3ee9ffddaa44caccf651.1776268054.git.lukas@wunner.de\n" }, { "commit": "18fc650ccd7fe3376eca89203668cfb8268f60df", "tree": "97bd54c5a1cda4885fecf357852e1c5803e80d2a", "parents": [ "f3b8c28135c339e6993ffb79579447a109537a11" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sun Apr 26 01:26:43 2026 +0000" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri May 08 22:40:05 2026 +0200" }, "message": "bpf: Free reuseport cBPF prog after RCU grace period.\n\nEulgyu Kim reported the splat below with a repro. [0]\n\nThe repro sets up a UDP reuseport group with a cBPF prog and\nreplaces it with a new one while another thread is sending\na UDP packet to the group.\n\nThe reuseport prog is freed by sk_reuseport_prog_free().\nbpf_prog_put() is called for \"e\"BPF prog to destruct through\nmultiple stages while cBPF prog is freed immediately by\nbpf_release_orig_filter() and bpf_prog_free().\n\nIf a reuseport prog is detached from the setsockopt() path\n(reuseport_attach_prog() or reuseport_detach_prog()),\nsk_reuseport_prog_free() is called without waiting for RCU\nreaders to complete, resulting in various bugs.\n\nLet\u0027s defer freeing the reuseport cBPF prog after one RCU\ngrace period.\n\nNote \"e\"BPF prog is safe as is unless the fast path starts\nto touch fields destroyed in bpf_prog_put_deferred() and\n__bpf_prog_put_noref().\n\n[0]:\nBUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\nRead of size 4 at addr ffffc9000051e004 by task slowme/10208\nCPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\n udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495\n __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723\n __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752\n __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752\n ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207\n ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n __netif_receive_skb_one_core net/core/dev.c:6181 [inline]\n __netif_receive_skb net/core/dev.c:6294 [inline]\n process_backlog+0xaa4/0x1960 net/core/dev.c:6645\n __napi_poll+0xae/0x340 net/core/dev.c:7709\n napi_poll net/core/dev.c:7772 [inline]\n net_rx_action+0x5d7/0xf50 net/core/dev.c:7929\n handle_softirqs+0x22b/0x870 kernel/softirq.c:622\n do_softirq+0x76/0xd0 kernel/softirq.c:523\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450\n local_bh_enable include/linux/bottom_half.h:33 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]\n __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890\n neigh_output include/net/neighbour.h:556 [inline]\n ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237\n NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n ip_output+0x29f/0x450 net/ipv4/ip_output.c:438\n ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508\n udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195\n udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n __sys_sendto+0x554/0x680 net/socket.c:2206\n __do_sys_sendto net/socket.c:2213 [inline]\n __se_sys_sendto net/socket.c:2209 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2209\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x415a2d\nCode: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d\nRDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003\nRBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010\nR10: 0000000000000000 R11: 0000000000000212 R12: 00007f6bc31e46c0\nR13: ffffffffffffffb8 R14: 0000000000000000 R15: 00007ffc9b0d70b0\n \u003c/TASK\u003e\n\nFixes: 538950a1b752 (\"soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF\")\nReported-by: Eulgyu Kim \u003ceulgyukim@snu.ac.kr\u003e\nReported-by: Taeyang Lee \u003c0wn@theori.io\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://lore.kernel.org/bpf/20260426012647.3233119-1-kuniyu@google.com\n" }, { "commit": "cbf457c584b5cbd0d44e8f05edaf3e189e894a68", "tree": "a66d0b53c9cb283ee90048551f53c99233c59cab", "parents": [ "8be01e1280912a84f6bcf963ceed6c9f13ba1986", "f7700a4415afb3ac1767a556094e4ef8bd440e41" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:18:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:18:13 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fix for ublk not doing an actual issue from the task_work fallback\n path. Any request hitting that should be canceled automatically\n\n - Fix for uring_cmd prep side handling, for the block side uring_cmd\n discard handling\n\n - Fix for missing validation of the io and physical block size shifts\n\n - Fix for a use-after-free in ublk\u0027s cancel command handling\n\n* tag \u0027block-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n ublk: fix use-after-free in ublk_cancel_cmd()\n ublk: validate physical_bs_shift, io_min_shift and io_opt_shift\n block: only read from sqe on initial invocation of blkdev_uring_cmd()\n ublk: don\u0027t issue uring_cmd from fallback task work\n" }, { "commit": "8be01e1280912a84f6bcf963ceed6c9f13ba1986", "tree": "2eafcd00bc9c5ce2b4e69c9c445c238d8e9f5f73", "parents": [ "81d6f7807536a0436dfada07e9292e3702d2bed4", "45d2b37a37ab98484693533496395c610a2cab96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:12:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 13:12:48 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Ensure that the absolute timeouts for both the command side and the\n waiting side honor the callers time namespace\n\n - Ensure tracked NAPI entries are cleared at unregistration time, as\n the NAPI polling loop checks the list state rather than the general\n NAPI state. This can lead to NAPI polling even after unregistration\n has been done. If unregistered, all NAPI polling should be disabled\n\n - Fix for eventfd recursive invocation handling\n\n* tag \u0027io_uring-7.1-20260508\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/wait: honour caller\u0027s time namespace for IORING_ENTER_ABS_TIMER\n io_uring/timeout: honour caller\u0027s time namespace for IORING_TIMEOUT_ABS\n io_uring/eventfd: reset deferred signal state\n io_uring/napi: clear tracked NAPI entries on unregister\n" }, { "commit": "f3b8c28135c339e6993ffb79579447a109537a11", "tree": "5a72f3fd80218d19ecd2841a1effb21fefcc5074", "parents": [ "0c7ae130698e70107430254e79fbe996b4d37ab5", "1c2958e4ab1ed4594db16425dbcab33c56ea8330" ], "author": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 09:55:33 2026 -0700" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:11 2026 -0700" }, "message": "Merge branch \u0027bpf-tcp-fix-type-confusion-in-bpf-helper-functions\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: tcp: Fix type confusion in bpf helper functions.\n\nbpf_tcp_sock() only check if sk-\u003esk_protocol is IPPROTO_TCP,\nbut RAW socket can bypass it:\n\n socket(AF_INET, SOCK_RAW, IPPROTO_TCP)\n\nThe same issues exist in other bpf functions:\n\n * bpf_mptcp_sock_from_subflow()\n * bpf_skc_to_tcp_sock()\n * bpf_skc_to_tcp6_sock()\n * sol_tcp_sockopt()\n\nPatch 1 fixes bpf_tcp_sock() and Patch 2 adds a test for it.\nPatch 3 ~ 6 fix the rest of the functions above.\n\nChanges:\n v2:\n * Inverse if (err) to if (!err) in the selftest\n * Add patch 3 ~ 6\n\n v1: https://lore.kernel.org/bpf/20260430184405.1227386-1-kuniyu@google.com/\n https://lore.kernel.org/mptcp/20260430-mptcp-bpf-mptcp-sock-type-v1-1-d2ed5cda7da9@kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260504210610.180150-1-kuniyu@google.com\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\n" }, { "commit": "1c2958e4ab1ed4594db16425dbcab33c56ea8330", "tree": "5a72f3fd80218d19ecd2841a1effb21fefcc5074", "parents": [ "843064b0a77eed3d6d63ffc53aeaa359672b4e12" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon May 04 21:04:53 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:10 2026 -0700" }, "message": "bpf: tcp: Fix type confusion in sol_tcp_sockopt().\n\nsol_tcp_sockopt() only checks if sk-\u003esk_protocol is IPPROTO_TCP,\nbut RAW socket can bypass it:\n\n socket(AF_INET, SOCK_RAW, IPPROTO_TCP)\n\nLet\u0027s use sk_is_tcp().\n\nNote that initially sol_tcp_sockopt() checked sk-\u003esk_prot-\u003esetsockopt.\n\nFixes: 2ab42c7b871f (\"bpf: Check the protocol of a sock to agree the calls to bpf_setsockopt().\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nLink: https://patch.msgid.link/20260504210610.180150-7-kuniyu@google.com\n" }, { "commit": "843064b0a77eed3d6d63ffc53aeaa359672b4e12", "tree": "01444c3d6f6c45aca6dd30a8ea85efa3bf723d13", "parents": [ "decb84b8383ab7acff94db208ef7ed19f9c55e1f" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon May 04 21:04:52 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:10 2026 -0700" }, "message": "bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock().\n\nbpf_skc_to_tcp6_sock() only checks if sk-\u003esk_protocol is IPPROTO_TCP\nand sk-\u003esk_family is AF_INET6, but RAW socket can bypass it:\n\n socket(AF_INET6, SOCK_RAW, IPPROTO_TCP)\n\nLet\u0027s check sk-\u003esk_type too.\n\nFixes: af7ec1383361 (\"bpf: Add bpf_skc_to_tcp6_sock() helper\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nLink: https://patch.msgid.link/20260504210610.180150-6-kuniyu@google.com\n" }, { "commit": "decb84b8383ab7acff94db208ef7ed19f9c55e1f", "tree": "ee35979c9c9943c53ffcf920e562eaa113b90a75", "parents": [ "7995b216a731db657f356f6ae37a42f445b9a0ec" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon May 04 21:04:51 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:10 2026 -0700" }, "message": "bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock().\n\nbpf_skc_to_tcp_sock() only checks if sk-\u003esk_protocol is\nIPPROTO_TCP, but RAW socket can bypass it:\n\n socket(AF_INET, SOCK_RAW, IPPROTO_TCP)\n\nLet\u0027s use sk_is_tcp().\n\nFixes: 478cfbdf5f13 (\"bpf: Add bpf_skc_to_{tcp, tcp_timewait, tcp_request}_sock() helpers\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nLink: https://patch.msgid.link/20260504210610.180150-5-kuniyu@google.com\n" }, { "commit": "7995b216a731db657f356f6ae37a42f445b9a0ec", "tree": "ebb6f27d4ada3382130d60caa56c74b206cf7f9e", "parents": [ "d73549b8bb7fa6147666c579d66f72bf076f719f" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Mon May 04 21:04:50 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:10 2026 -0700" }, "message": "mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow()\n\nbpf_mptcp_sock_from_subflow() only checks if sk-\u003esk_protocol is\nIPPROTO_TCP, but RAW socket can bypass it:\n\n socket(AF_INET, SOCK_RAW, IPPROTO_TCP)\n\nIn this case, it would NOT be valid to call sk_is_mptcp() which will\nassume sk is a pointer to a struct tcp_sock, and wrongly checks for:\ntcp_sk(sk)-\u003eis_mptcp.\n\nFixes: 3bc253c2e652 (\"bpf: Add bpf_skc_to_mptcp_sock_proto\")\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260504210610.180150-4-kuniyu@google.com\n" }, { "commit": "d73549b8bb7fa6147666c579d66f72bf076f719f", "tree": "671d11ee83bc7c94d524e581e0fd14b5c48af5e0", "parents": [ "481c2265286ef302327c93403a8cf7b3fe4506d0" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon May 04 21:04:49 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 11:38:08 2026 -0700" }, "message": "selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.\n\nLet\u0027s extend sockopt_sk.c to cover bpf_tcp_sock() for the\nwrong socket type.\n\nBefore:\n # ./test_progs -t sockopt_sk\n [ 151.948613] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0\n [ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259\n ...\n run_test:FAIL:getsetsockopt unexpected error: -1 (errno 0)\n #427 sockopt_sk:FAIL\n\nAfter:\n #427 sockopt_sk:OK\n\nWhile at it, missing free() is fixed up.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nLink: https://patch.msgid.link/20260504210610.180150-3-kuniyu@google.com\n" }, { "commit": "81d6f7807536a0436dfada07e9292e3702d2bed4", "tree": "6462eef5cf421a8b468913981ee0bc398c602179", "parents": [ "8bb44576c5ec0e6b29ee048b88235f6f407b6979", "f98b48151cc502ada59d9778f0112d21f2586ca3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:24:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:24:35 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix for two ACL issues (security fix to validate dacloffset better\n and chmod fix)\n\n - Fix out of bounds reads (in check_wsl_eas and smb2_check_msg for\n symlinks)\n\n - Two Kerberos fixes including an important one when AES-256 encryption\n chosen\n\n - Fix open_cached_dir problem when directory leases disabled\n\n* tag \u0027v7.1-rc3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: validate dacloffset before building DACL pointers\n smb/client: fix out-of-bounds read in smb2_compound_op()\n smb/client: fix out-of-bounds read in symlink_data()\n smb: client: Zero-pad short GSS session keys per MS-SMB2\n smb: client: Use FullSessionKey for AES-256 encryption key derivation\n smb: client: use kzalloc to zero-initialize security descriptor buffer\n cifs: abort open_cached_dir if we don\u0027t request leases\n" }, { "commit": "8bb44576c5ec0e6b29ee048b88235f6f407b6979", "tree": "db53c2e02d5ba99a5faa25f47ae7cc69a8acef04", "parents": [ "4bdbce450f4273fcda6d5c2e22df7083421332cf", "4bacec2317527ba04b7172145848f1c206999ea1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:14:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:14:51 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"There\u0027s two main series here, fixing issues that came up in the\n Microchip QSPI and Freescale i.MX drivers. Both of those could result\n in some quite noticable issues if they were encountered in production.\n We also have one minor documentation fix in the ch341 driver\"\n\n* tag \u0027spi-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: ch341: correct company name in MODULE_DESCRIPTION\n spi: microchip-core-qspi: remove some inline markings\n spi: microchip-core-qspi: don\u0027t attempt to transmit during emulated read-only dual/quad operations\n spi: microchip-core-qspi: control built-in cs manually\n spi: imx: Propagate prepare_transfer() error from spi_imx_setupxfer()\n spi: imx: Fix UAF on package-1 prepare failure in spi_imx_dma_data_prepare()\n spi: imx: Fix precedence bug in spi_imx_dma_max_wml_find()\n" }, { "commit": "4bdbce450f4273fcda6d5c2e22df7083421332cf", "tree": "8aa7248bf06f17da3faea40d0a27db8dd16e4535", "parents": [ "51d24842acb9b8d643046c71314cc3d7a846a3cf", "628497e6d925d43efb56e3ffecef0a9d217926b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:07:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 10:07:59 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"A straightforward fix for an incorrect description of one of the\n regulators on the Qualcomm PMH0101\"\n\n* tag \u0027regulator-fix-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: qcom-rpmh: Fix index for pmh0101 ldo16\n" }, { "commit": "481c2265286ef302327c93403a8cf7b3fe4506d0", "tree": "d6fa29aa679230fc497baf5f56a171d0000ed87e", "parents": [ "0c7ae130698e70107430254e79fbe996b4d37ab5" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon May 04 21:04:48 2026 +0000" }, "committer": { "name": "Martin KaFai Lau", "email": "martin.lau@kernel.org", "time": "Fri May 08 09:55:32 2026 -0700" }, "message": "bpf: tcp: Fix type confusion in bpf_tcp_sock().\n\nbpf_tcp_sock() only checks if sk-\u003esk_protocol is IPPROTO_TCP,\nbut RAW socket can bypass it:\n\n socket(AF_INET, SOCK_RAW, IPPROTO_TCP)\n\nCalling bpf_setsockopt() in SOCKOPT prog triggers out-of-bounds\naccess to another slab object. [0]\n\nLet\u0027s use sk_is_tcp().\n\n[0]:\nBUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt (net/core/filter.c:5519)\nRead of size 8 at addr ffff88801083d760 by task test_progs/1259\n\nCPU: 1 UID: 0 PID: 1259 Comm: test_progs Tainted: G OE 7.0.0-11175-gb5c111f4967b #1 PREEMPT(full)\nTainted: [O]\u003dOOT_MODULE, [E]\u003dUNSIGNED_MODULE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n sol_tcp_sockopt (net/core/filter.c:5519)\n __bpf_getsockopt (net/core/filter.c:5633)\n bpf_sk_getsockopt (net/core/filter.c:5654)\n bpf_prog_629ba00a1601e9f2__setsockopt+0x86/0x22c\n __cgroup_bpf_run_filter_setsockopt (./include/linux/bpf.h:1402 ./include/linux/filter.h:722 ./include/linux/filter.h:729 kernel/bpf/cgroup.c:81 kernel/bpf/cgroup.c:2026)\n do_sock_setsockopt (net/socket.c:2363)\n __x64_sys_setsockopt (net/socket.c:2406)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\nRIP: 0033:0x7f85f82fe7de\nCode: 55 48 63 c9 48 63 ff 45 89 c9 48 89 e5 48 83 ec 08 6a 2c e8 34 69 f7 ff c9 c3 66 90 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 e1\nRSP: 002b:00007ffe59dcecd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85f82fe7de\nRDX: 000000000000001c RSI: 0000000000000006 RDI: 000000000000000d\nRBP: 00007ffe59dcef20 R08: 000000000000003c R09: 0000000000000000\nR10: 00007ffe59dcef00 R11: 0000000000000202 R12: 00007ffe59dcf268\nR13: 0000000000000003 R14: 00007f85f9da5000 R15: 000055b2f3201400\n \u003c/TASK\u003e\n\nThe buggy address belongs to the object at ffff88801083d280\n which belongs to the cache RAW of size 1792\nThe buggy address is located 1248 bytes inside of\n allocated 1792-byte region [ffff88801083d280, ffff88801083d980)\n\nFixes: 655a51e536c0 (\"bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://patch.msgid.link/20260504210610.180150-2-kuniyu@google.com\n" }, { "commit": "51d24842acb9b8d643046c71314cc3d7a846a3cf", "tree": "a8dedc1edb8802a637ec69529071540902e7d508", "parents": [ "fa7431eb99245e0a283d470101e44be1d2c2aeb3", "5e28b7b94408897e41c63477aabc9e1db439bc8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:23:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:23:06 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-08-1\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes, lots of them but all pretty small, amdgpu and xe are the\n usual but then a large amount of fixes all over.\n\n core:\n - fix race condition in handle change ioctl\n\n fb-helper:\n - fix clipping\n\n rust:\n - fix unsound initialization\n - fix GEM state cleanup\n - fix wrong ARef import\n\n ttm:\n - update GPU MM stats on pool shrinking\n\n i915:\n - Re-enable ccs modifiers on dg2\n\n nova:\n - fix mailing list\n\n xe:\n - Add NULL check for media_gt in intel_hdcp_gsc_check_status\n - Fix EAGAIN sign in pf_migration_consume\n - Fix MMIO access using PF view instead of VF view during migration\n - Exclude indirect ring state page from ADS engine state size\n\n amdgpu:\n - GFX9 fixes\n - Hawaii SMU fixes\n - SDMA4 fix\n - GART fix\n - Userq fixes\n\n amdkfd:\n - GPUVM TLB flush fix\n - Hotplug fix\n\n radeon:\n - Hawaii SMU fixes\n\n bochs:\n - fix managed cleanup\n\n bridge:\n - tda998x: fix sparse warnings on type correctness\n\n etnaviv:\n - schedule armed jobs\n\n exynos:\n - managed bridge cleanup\n\n ivpu:\n - disallow reexport of GEM buffer objects\n\n noveau:\n - revert support for GA100\n\n panel:\n - boe-tv101wum-nl16: use correct MIPI_DSI mode\n - feyjang-fy07024di26a30d: fix error reporting\n - himax-hx83102: use correct MIPI_DSI mode\n - himax-hx83121a: fix error checks\n - himax-hx83121a: select DRM_DISPLAY_DSC_HELPER\n\n qaic:\n - fix RAS message handling\n\n qxl:\n - clean up polling\n\n sti:\n - managed bridge cleanup\n\n* tag \u0027drm-fixes-2026-05-08-1\u0027 of https://gitlab.freedesktop.org/drm/kernel: (37 commits)\n drm: Set old handle to NULL before prime swap in change_handle\n drm/bochs: Drop manual put on probe error path\n drm/xe/guc: Exclude indirect ring state page from ADS engine state size\n drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration\n drm/xe/pf: Fix EAGAIN sign in pf_migration_consume()\n drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()\n drm/exynos: remove bridge when component_add fails\n drm/amdgpu: nuke amdgpu_userq_fence_slab v2\n drm/amdgpu/userq: fix access to stale wptr mapping\n drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_count\n drm/amdgpu: zero-initialize GART table on allocation\n drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission\n drm/radeon: add missing revision check for CI\n drm/amdgpu/pm: align Hawaii mclk workaround with radeon\n drm/amdgpu/pm: add missing revision check for CI\n drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ\n drm/amdkfd: Make all TLB-flushes heavy-weight\n drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds\n drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds\n drm/panel: feiyang-fy07024di26a30d: return display-on error\n ...\n" }, { "commit": "4fd44d47e8ab760eef11968d093200cce6752d95", "tree": "fa312a1c181e1dea255f4f26db4c6adb64558c63", "parents": [ "b38e53cbfb9d84732e5984fbd73e128d592415c5", "100201d349edd226ca3470c894c92dccc67ee7a8" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 08 17:18:43 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 08 17:18:43 2026 +0200" }, "message": "Merge tag \u0027usb-serial-7.1-rc3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus\n\nJohan writes:\n\nUSB serial device ids for 7.1-rc3\n\nHere are some new modem device ids.\n\nThis one has been in linux-next with no reported issues.\n\n* tag \u0027usb-serial-7.1-rc3\u0027 of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:\n USB: serial: option: add Telit Cinterion LE910Cx compositions\n" }, { "commit": "fa7431eb99245e0a283d470101e44be1d2c2aeb3", "tree": "8935c264a00e3fd541b3e47902cb0da453861615", "parents": [ "917719c412c48687d4a176965d1fa35320ec457c", "10161b4a791d5c4b7ea16512c1ddb133c3f8f953" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:16:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 08 08:16:07 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"Core:\n - Cache-flushing fix for non-x86 platforms\n\n AMD-Vi:\n - Security fix when SEV-SNP is enabled\n - Operator precedence fix in DTE setting\"\n\n* tag \u0027iommu-fixes-v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Fix precedence order in set_dte_passthrough()\n iommu/pages: Fix iommu_pages_flush_incoherent() for non-x86\n iommu/amd: Use maximum PPR log buffer size when SNP is enabled on Family 0x19\n iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19\n" }, { "commit": "f7700a4415afb3ac1767a556094e4ef8bd440e41", "tree": "4ced987546c335d15f5e9949eb826357d60da84e", "parents": [ "86f33ca9bea30cf011f2b1edad4593faea9c6e98" ], "author": { "name": "Ming Lei", "email": "tom.leiming@gmail.com", "time": "Fri May 08 20:37:46 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 08 06:44:42 2026 -0600" }, "message": "ublk: fix use-after-free in ublk_cancel_cmd()\n\nWhen ublk_reset_ch_dev() clears io-\u003ecmd via ublk_queue_reinit()\nconcurrently with ublk_cancel_cmd(), ublk_cancel_cmd() can read a\nstale pointer and pass it to io_uring_cmd_done(), causing a\nuse-after-free.\n\nFix by synchronizing the two paths with ubq-\u003ecancel_lock:\n\n- ublk_cancel_cmd(): read and clear io-\u003ecmd under cancel_lock,\n then call io_uring_cmd_done() on the saved local copy outside\n the lock.\n\n- ublk_reset_ch_dev(): hold cancel_lock across ublk_queue_reinit()\n so that io-\u003ecmd and io-\u003eflags are cleared atomically with respect\n to ublk_cancel_cmd().\n\nFixes: 216c8f5ef0f2 (\"ublk: replace monitor with cancelable uring_cmd\")\nSigned-off-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260508123746.242018-1-tom.leiming@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "5e28b7b94408897e41c63477aabc9e1db439bc8c", "tree": "5e1e537c1489485035e638cb121f562da66e53d9", "parents": [ "d8a70292c3e1759804dcc1a60e53ead86b466a3a" ], "author": { "name": "Francis, David", "email": "David.Francis@amd.com", "time": "Tue Apr 28 19:25:50 2026 +0000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 17:53:59 2026 +1000" }, "message": "drm: Set old handle to NULL before prime swap in change_handle\n\nThere was a potential race condition in change_handle. The ioctl\nbriefly had a single object with two idr entries; a concurrent\ngem_close could delete the object and remove one of the handles\nwhile leaving the other one dangling, which could subsequently\nbe dereferenced for a use-after-free.\n\nTo fix this, do the same dance that gem_close itself does.\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\nFirst idr_replace the old handle to NULL. Later, if the prime\noperations are successful, actually close it.\n\ncreate_tail required a similar dance to avoid a similar problem.\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\nIt idr_allocs the new handle with NULL, then swaps in the correct\nobject later to avoid races. We don\u0027t need to do that here, since\nthe only operations that could race are drm_prime, and\nchange_handle holds the prime lock for the entire duration.\n\nv2: cleanups of error paths\n\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nCo-authored-by: Dave Airlie \u003cairlied@gmail.com\u003e\nReported-by: Puttimet Thammasaeng \u003cpwn8official@gmail.com\u003e\nTested-by: Vitaly Prosyak \u003cVitaly.Prosyak@amd.com\u003e\nCc: Simona Vetter \u003csimona@ffwll.ch\u003e\nCc: stable@vger.kernel.org\nCc: Christian Koenig \u003cChristian.Koenig@amd.com\u003e\nFixes: 53096728b8910 (\"drm: Add DRM prime interface to reassign GEM handle\")\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n" }, { "commit": "d8a70292c3e1759804dcc1a60e53ead86b466a3a", "tree": "35f23cc5a9a70e2aae3dcd4ef0397dcc9c568d68", "parents": [ "765e717dfb751f9ccebb35fdb0773f929d50cb6f", "4e02e0afa95f691dc7cc17538cdd648089a843f0" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 16:13:07 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 17:50:12 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-05-06\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.1-2026-05-06:\n\namdgpu:\n- GFX9 fixes\n- Hawaii SMU fixes\n- SDMA4 fix\n- GART fix\n- Userq fixes\n\namdkfd:\n- GPUVM TLB flush fix\n- Hotplug fix\n\nradeon:\n- Hawaii SMU fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260506154631.1733034-1-alexander.deucher@amd.com\n" }, { "commit": "765e717dfb751f9ccebb35fdb0773f929d50cb6f", "tree": "c9b9116ba4c9a7a4f0857d13ed0f5078b0e38962", "parents": [ "22e170e9a37ea2155bdf0bb743483f2d455160ba", "b15838b03cd0c6cf35651cfde62d17f14bb1d566" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 12:03:01 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 12:11:16 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nbochs:\n- fix managed cleanup\n\nbridge:\n- tda998x: fix sparse warnings on type correctness\n\netnaviv:\n- schedule armed jobs\n\nexynos:\n- managed bridge cleanup\n\nfb-helper:\n- fix clipping\n\nivpu:\n- disallow reexport of GEM buffer objects\n\nnoveau:\n- revert support for GA100\n\npanel:\n- boe-tv101wum-nl16: use correct MIPI_DSI mode\n- feyjang-fy07024di26a30d: fix error reporting\n- himax-hx83102: use correct MIPI_DSI mode\n- himax-hx83121a: fix error checks\n- himax-hx83121a: select DRM_DISPLAY_DSC_HELPER\n\nqaic:\n- fix RAS message handling\n\nqxl:\n- clean up polling\n\nsti:\n- managed bridge cleanup\n\nttm:\n- update GPU MM stats on pool shrinking\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260507115213.GA206508@linux.fritz.box\n" }, { "commit": "917719c412c48687d4a176965d1fa35320ec457c", "tree": "183392dde41e467c737e8162f67fcc357c732797", "parents": [ "fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0", "868f31e4061eca8c3cd607d79d954d5e54f204aa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 17:26:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 17:26:43 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260507\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n\n - Allow for multiple opens of /sys/fs/selinux/policy\n\n Prevent a single process from blocking others from reading the\n SELinux policy loaded in the kernel. This does have the side effect\n of potentially allowing userspace to trigger additional kernel memory\n allocations as part of the open/read operation, but this is mitigated\n by requiring the SELinux security/read_policy permission.\n\n - Reduce the critical sections where the SELinux policy mutex is held\n\n This includes the patch to the policy loader code where we move the\n permission checks and an allocation outside the mutex as well as the\n the patch to checkreqprot which drops the code/lock entirely.\n\n While the checkreqprot code had effectively been dropped in an\n earlier release, portions of the code still remained that would have\n triggered the mutex to perform an IMA measurement. This finally drops\n all of that while preserving the user visible behavior.\n\n - Eliminate potential sources of log spamming\n\n There were a few areas where processes could flood the system logs\n and hide other, more critical events. The previously disabled\n checkreqprot and runtime disable knobs in selinuxfs were two such\n areas that have now been greatly simplified and a pr_err() replaced\n with a pr_err_once().\n\n The third such place is the /sys/fs/selinux/user file, which hasn\u0027t\n been used by a userspace release since 2020 and was scheduled for\n removal after 2025; this effectively disables this functionality, but\n similar to checkreqprot, it is done in a way that should not break\n old userspace.\n\n* tag \u0027selinux-pr-20260507\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: shrink critical section in sel_write_load()\n selinux: allow multiple opens of /sys/fs/selinux/policy\n selinux: prune /sys/fs/selinux/user\n selinux: prune /sys/fs/selinux/disable\n selinux: prune /sys/fs/selinux/checkreqprot\n" }, { "commit": "99076a17a112ac43cbd37f6883898ae649166303", "tree": "d0288446ee8cc6e671be1f4ab5dd2b2e9e6ad450", "parents": [ "05aaac8746c5786eaa779b163fae4ddcd5172707" ], "author": { "name": "Tabrez Ahmed", "email": "tabreztalks@gmail.com", "time": "Sat May 02 07:38:42 2026 +0530" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 07 16:30:12 2026 -0700" }, "message": "hwmon: (ads7871) Fix endianness bug in 16-bit register reads\n\nThe ads7871_read_reg16() function relies on spi_w8r16() to read the\n16-bit sensor output. The ADS7871 device transmits the Least Significant\nByte (LSB) first.\n\nOn Little-Endian architectures, spi_w8r16() correctly reconstructs the\n16-bit value. However, on Big-Endian architectures, the byte swapping\ncauses the first received byte (LSB) to be placed in the most significant\nbyte of the u16, resulting in corrupted voltage readings.\n\nTo fix this, cast the integer result of spi_w8r16() to a restricted\n__le16 type and convert it to the host CPU\u0027s native byte order using\nle16_to_cpu(). Negative error codes returned by the SPI core are caught\nand returned prior to the conversion to avoid mangling the error status.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260418034601.90226-1-tabreztalks@gmail.com\nFixes: e0c70b8078629 (\"hwmon: add TI ads7871 a/d converter driver\")\nSuggested-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Tabrez Ahmed \u003ctabreztalks@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260502020844.110038-2-tabreztalks@gmail.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "05aaac8746c5786eaa779b163fae4ddcd5172707", "tree": "5c557a68cd36e6f9422cb39f8843640ff6b1c1e3", "parents": [ "3607422cdeebd1f0c259964bf33aaa9792e21930" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Sat May 02 19:32:07 2026 +0200" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 07 16:30:12 2026 -0700" }, "message": "hwmon: (lm75) Fix configuration register writes.\n\nSensors configurations are defined by set and clear masks. These\ndo not follow a consistent \"clear mask is a superset of set mask\"\nrule. This relaxed definition breaks lm75_write_config()\n\nstatic inline int lm75_write_config(struct lm75_data *data, u16 set_mask,\n\t\t\t\t u16 clr_mask)\n{\n\treturn regmap_update_bits(data-\u003eregmap, LM75_REG_CONF,\n\t\t\t\t clr_mask | LM75_SHUTDOWN, set_mask);\n}\n\nBasically all bits from set_mask that are not defined in clr_mask are\ndropped. Fix that by enhancing the helper to always combine clr_mask\nand set_mask into the mask bits of regmap_update_bits().\n\nFixes: 6da24a25f766 (\"hwmon: (lm75) Hide register size differences in regmap access functions\")\nSuggested-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nLink: https://lore.kernel.org/r/20260502173207.3567876-3-markus.stockhausen@gmx.de\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "3607422cdeebd1f0c259964bf33aaa9792e21930", "tree": "4f9cfcdb5a5f15a8643647073e1ccf3d7b279ba2", "parents": [ "dff205550e714f1cb65f27409586e2612905fa88" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Sat May 02 19:32:06 2026 +0200" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 07 16:29:05 2026 -0700" }, "message": "hwmon: (lm75) Fix AS6200 and TMP112 setup and alarm handling\n\nThe initialization of the AS6200 has two shortcomings\n\n- The device-add-commit states \"Conversion mode: continuous\" but the\n the lm75_params structure uses set_mask \u003d 0x94c0. This activates\n single shot mode (bit 15). According to the datasheet \"The device\n features a single shot measurement mode if the device is in sleep\n mode (SM\u003d1)\". This is quite contradictionary.\n- It is the only device that activates polarity active-high (bit 10)\n\nAll this is paired with a undefined clear mask bug in function\nlm75_write_config() that was introduced with a later refactoring\ncommit.\n\n[as6200] \u003d {\n\t.config_reg_16bits \u003d true,\n\t.set_mask \u003d 0x94C0,\n -\u003e .clr_mask not defined here\n\t.default_resolution \u003d 12,\n...\nstatic inline int lm75_write_config(struct lm75_data *data, u16 set_mask,\n\t\t\t\t u16 clr_mask)\n{\n\treturn regmap_update_bits(data-\u003eregmap, LM75_REG_CONF,\n\t\t\t\t clr_mask | LM75_SHUTDOWN, set_mask);\n}\n\nregmap_update_bits() requires clr_mask to be a superset of set_mask.\nSo basically all sensors with \"wrong\" masks like the AS6200 are not\ninitialized as intended.\n\nFix that by\n\n- Change the set_mask to 0xc010 to reflect the current active-low\n setup properly and to drive the sensor in continous mode. This\n takes into account that the config register is little endian and\n the first byte sent to the chip is the LSB.\n- Adapt the alarm handling so it can report the alarm correctly\n even if it is high active. This is done by comparing config register\n bit 5 and 10 (translated to 2 and 13).\n\nThis commit does not introduce any ABI breakage as the mutliple bugs\neffectly drive the AS6200 in standard active-low mode.\n\nFixes: 4b6358e1fe46 (\"hwmon: (lm75) Add AMS AS6200 temperature sensor\")\nSuggested-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nLink: https://lore.kernel.org/r/20260502173207.3567876-2-markus.stockhausen@gmx.de\n[groeck: Update set_mask for as6200 further: As modeled, the upper bits\n contain the conversion rate, so the config register needs to be set to\n 0xc010 instead of 0x10c0 to reflect 8 samples/s and 4 consecutive faults.\n Fix the same problem for TMP112.]\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "22e170e9a37ea2155bdf0bb743483f2d455160ba", "tree": "a95590b703d859bade99591b2104fb3a40b6e7f0", "parents": [ "17dd4d44e99046a6e1676be8cef13ce85adc0750", "b29987dfd943e655df6e3b641ecffad5cc1509c2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:51:01 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:51:02 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nUAPI Changes:\n\nCross-subsystem Changes:\n\nCore Changes:\n\nDriver Changes:\n- Add NULL check for media_gt in intel_hdcp_gsc_check_status (Gustavo)\n- Fix EAGAIN sign in pf_migration_consume (Shuicheng)\n- Fix MMIO access using PF view instead of VF view during migration (Shuicheng)\n- Exclude indirect ring state page from ADS engine state size (Satya)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/afw5lsrjE4pStEml@gsse-cloud1.jf.intel.com\n" }, { "commit": "17dd4d44e99046a6e1676be8cef13ce85adc0750", "tree": "fafe4588548c9f61d12165da34842a71198862f7", "parents": [ "2c5d5ecda5f165c0c064f24b736d585db10098c6", "0a69ac25bd596d50823d530d0a2004336668c0df" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:34:34 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:50:23 2026 +1000" }, "message": "Merge tag \u0027drm-rust-fixes-2026-05-07\u0027 of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes\n\nDRM Rust fixes for v7.1-rc3\n\n- Fix unsound initialization in drm::Device::new(); if pinned\n initialization of drm::Device::Data fails, make sure\n drm::Device::release() isn\u0027t called, so we don\u0027t run the data\u0027s\n destructor\n\n- Fix missing GEM state cleanup in the init failure case; call\n drm_gem_private_object_fini() if drm_gem_object_init() fails\n\n- Fix wrong ARef import in the DRM shmem GEM helper abstraction\n\n- Replace the nouveau mailing list with the new nova-gpu mailing list\n for both nova-core and nova-drm, and remove unused patchwork entries\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: \"Danilo Krummrich\" \u003cdakr@kernel.org\u003e\nLink: https://patch.msgid.link/DIBZJ40ZC4J3.Y1DLA7JTS2PC@kernel.org\n" }, { "commit": "2c5d5ecda5f165c0c064f24b736d585db10098c6", "tree": "4ce12fdc938bf8f2771837ccee7fe2ea5624e380", "parents": [ "7fd2df204f342fc17d1a0bfcd474b24232fb0f32", "aab3d205a086233c612fee86009265451793e0c2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:21:32 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 08 08:21:34 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-05-06\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Re-enable ccs modifiers on dg2 (Juha-Pekka Heikkila)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/aftSjG1D0-hKISDy@linux\n" }, { "commit": "f98b48151cc502ada59d9778f0112d21f2586ca3", "tree": "0008181319aa30c98bbe66095384e015e6affdc3", "parents": [ "8d09328dfda089675e4c049f3f256064a1d1996b" ], "author": { "name": "Michael Bommarito", "email": "michael.bommarito@gmail.com", "time": "Mon Apr 20 10:47:47 2026 -0400" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:36 2026 -0500" }, "message": "smb: client: validate dacloffset before building DACL pointers\n\nparse_sec_desc(), build_sec_desc(), and the chown path in\nid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd\nbefore proving a DACL header fits inside the returned security\ndescriptor.\n\nOn 32-bit builds a malicious server can return dacloffset near\nU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip\npast the later pointer-based bounds checks. build_sec_desc() and\nid_mode_to_cifs_acl() can then dereference DACL fields from the wrapped\npointer in the chmod/chown rewrite paths.\n\nValidate dacloffset numerically before building any DACL pointer and\nreuse the same helper at the three DACL entry points.\n\nFixes: bc3e9dd9d104 (\"cifs: Change SIDs in ACEs while transferring file ownership.\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-4-6\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8d09328dfda089675e4c049f3f256064a1d1996b", "tree": "8a2aa8a93ead70129a9c2bc7997c09f04b410b1a", "parents": [ "d62b8d236fab503c6fec1d3e9a38bea71feaca20" ], "author": { "name": "Zisen Ye", "email": "zisenye@stu.xidian.edu.cn", "time": "Wed May 06 11:49:08 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:32 2026 -0500" }, "message": "smb/client: fix out-of-bounds read in smb2_compound_op()\n\nIf a server sends a truncated response but a large OutputBufferLength, and\nterminates the EA list early, check_wsl_eas() returns success without\nvalidating that the entire OutputBufferLength fits within iov_len.\n\nThen smb2_compound_op() does:\n memcpy(idata-\u003ewsl.eas, data[0], size[0]);\n\nWhere size[0] is OutputBufferLength. If iov_len is smaller than size[0],\nmemcpy can read beyond the end of the rsp_iov allocation and leak adjacent\nkernel heap memory.\n\nLink: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/\nFixes: ea41367b2a60 (\"smb: client: introduce SMB2_OP_QUERY_WSL_EA\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zisen Ye \u003czisenye@stu.xidian.edu.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "d62b8d236fab503c6fec1d3e9a38bea71feaca20", "tree": "fe51b8cdc8236c5f66fbf7b63bec9d9b8ae516a8", "parents": [ "8cb6fc3231500233ddaf63cb7fd5435008d9ed5f" ], "author": { "name": "Zisen Ye", "email": "zisenye@stu.xidian.edu.cn", "time": "Sat May 02 18:48:36 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:29 2026 -0500" }, "message": "smb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read.\n\nLink: https://lore.kernel.org/linux-cifs/297d8d9b-adf7-42fd-a1c2-5b1f230032bc@chenxiaosong.com/\nFixes: 76894f3e2f71 (\"cifs: improve symlink handling for smb2+\")\nCc: Stable@vger.kernel.org\nSigned-off-by: Zisen Ye \u003czisenye@stu.xidian.edu.cn\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "8cb6fc3231500233ddaf63cb7fd5435008d9ed5f", "tree": "53976d5eb90f610ccb312028b1e5298766728997", "parents": [ "5be7a0cef3229fb3b63a07c0d289daf752545424" ], "author": { "name": "Piyush Sachdeva", "email": "s.piyush1024@gmail.com", "time": "Thu May 07 22:22:14 2026 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:01 2026 -0500" }, "message": "smb: client: Zero-pad short GSS session keys per MS-SMB2\n\nPer MS-SMB2 section 3.2.5.3, Session.SessionKey is the first 16 bytes\nof the GSS cryptographic key, right-padded with zero bytes if the key\nis shorter than 16 bytes.\n\nSMB2_auth_kerberos() copies the GSS session key from the cifs.upcall\nresponse using kmemdup(msg-\u003edata, msg-\u003esesskey_len, ...) and stores\nthe GSS-reported length verbatim in ses-\u003eauth_key.len. generate_key()\nreads SMB2_NTLMV2_SESSKEY_SIZE bytes from this buffer when feeding the\nHMAC-SHA256 KDF for signing key derivation. If a GSS mechanism returns\na session key shorter than 16 bytes (e.g. a deprecated single-DES\nKerberos enctype with an 8-byte session key), the KDF call performs an\nout-of-bounds slab read and derives keys that do not match the server,\nwhich pads per the spec.\n\nModern KDCs disable short-key enctypes by default, so this is latent\nrather than reachable in production, but it is still a kernel heap\nover-read.\n\nAllocate auth_key.response with kzalloc() at a length of\nmax(msg-\u003esesskey_len, SMB2_NTLMV2_SESSKEY_SIZE), copy the GSS key in,\nand rely on kzalloc()\u0027s zero initialization for the spec-mandated\npadding. Set ses-\u003eauth_key.len to the padded length. Larger GSS keys\n(e.g. the 32-byte aes256-cts-hmac-sha1-96 session key) continue to be\nstored at their natural length, preserving the FullSessionKey path.\n\nEmit a cifs_dbg(VFS, ...) message when a short key is encountered to\nsurface deprecated-enctype usage.\n\nNTLMv2 and NTLMSSP code paths produce a 16-byte session key by\nconstruction and are unaffected.\n\nSigned-off-by: Piyush Sachdeva \u003cpsachdeva@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cs.piyush1024@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "5be7a0cef3229fb3b63a07c0d289daf752545424", "tree": "8c90ee860cc7230f345595463c831f9ebd3c4131", "parents": [ "5e489c6c47a2ac15edbaca153b9348e42c1eacab" ], "author": { "name": "Piyush Sachdeva", "email": "s.piyush1024@gmail.com", "time": "Thu May 07 22:22:13 2026 +0530" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 07 14:09:01 2026 -0500" }, "message": "smb: client: Use FullSessionKey for AES-256 encryption key derivation\n\nWhen Kerberos authentication is used with AES-256 encryption (AES-256-CCM\nor AES-256-GCM), the SMB3 encryption and decryption keys must be derived\nusing the full session key (Session.FullSessionKey) rather than just the\nfirst 16 bytes (Session.SessionKey).\n\nPer MS-SMB2 section 3.2.5.3.1, when Connection.Dialect is \"3.1.1\" and\nConnection.CipherId is AES-256-CCM or AES-256-GCM, Session.FullSessionKey\nmust be set to the full cryptographic key from the GSS authentication\ncontext. The encryption and decryption key derivation (SMBC2SCipherKey,\nSMBS2CCipherKey) must use this FullSessionKey as the KDF input. The\nsigning key derivation continues to use Session.SessionKey (first 16\nbytes) in all cases.\n\nPreviously, generate_key() hardcoded SMB2_NTLMV2_SESSKEY_SIZE (16) as the\nHMAC-SHA256 key input length for all derivations. When Kerberos with\nAES-256 provides a 32-byte session key, the KDF for encryption/decryption\nwas using only the first 16 bytes, producing keys that did not match the\nserver\u0027s, causing mount failures with sec\u003dkrb5 and require_gcm_256\u003d1.\n\nAdd a full_key_size parameter to generate_key() and pass the appropriate\nsize from generate_smb3signingkey():\n - Signing: always SMB2_NTLMV2_SESSKEY_SIZE (16 bytes)\n - Encryption/Decryption: ses-\u003eauth_key.len when AES-256, otherwise 16\n\nAlso fix cifs_dump_full_key() to report the actual session key length for\nAES-256 instead of hardcoded CIFS_SESS_KEY_SIZE, so that userspace tools\nlike Wireshark receive the correct key for decryption.\n\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Bharath SM \u003cbharathsm@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cpsachdeva@microsoft.com\u003e\nSigned-off-by: Piyush Sachdeva \u003cs.piyush1024@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0", "tree": "fc6254372916832b89cb60f94464d41a48b2f045", "parents": [ "19cbc75c56c0ed4fa3f637e3c41a98895a68dfae", "41ae14071cd7f6a7770e2fe1f8a0859d4c2c6ba4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 10:32:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 10:32:03 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Netfilter, IPsec, Bluetooth and WiFi.\n\n Current release - fix to a fix:\n\n - ipmr: add __rcu to netns_ipv4.mrt, make sure we hold the RCU lock\n in all relevant places\n\n Current release - new code bugs:\n\n - fixes for the recently added resizable hash tables\n\n - ipv6: make sure we default IPv6 tunnel drivers to \u003dm now that IPv6\n itself is built in\n\n - drv: octeontx2-af: fixes for parser/CAM fixes\n\n Previous releases - regressions:\n\n - phy: micrel: fix LAN8814 QSGMII soft reset\n\n - wifi:\n - cw1200: revert \"Fix locking in error paths\"\n - ath12k: fix crash on WCN7850, due to adding the same queue\n buffer to a list multiple times\n\n Previous releases - always broken:\n\n - number of info leak fixes\n\n - ipv6: implement limits on extension header parsing\n\n - wifi: number of fixes for missing bound checks in the drivers\n\n - Bluetooth: fixes for races and locking issues\n\n - af_unix:\n - fix an issue between garbage collection and PEEK\n - fix yet another issue with OOB data\n\n - xfrm: esp: avoid in-place decrypt on shared skb frags\n\n - netfilter: replace skb_try_make_writable() by skb_ensure_writable()\n\n - openvswitch: vport: fix race between tunnel creation and linking\n leading to invalid memory accesses (type confusion)\n\n - drv: amd-xgbe: fix PTP addend overflow causing frozen clock\n\n Misc:\n\n - sched/isolation: make HK_TYPE_KTHREAD an alias of HK_TYPE_DOMAIN\n (for relevant IPVS change)\"\n\n* tag \u0027net-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (190 commits)\n net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()\n net: sparx5: fix wrong chip ids for TSN SKUs\n net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()\n tcp: Fix dst leak in tcp_v6_connect().\n ipmr: Call ipmr_fib_lookup() under RCU.\n net: phy: broadcom: Save PHY counters during suspend\n net/smc: fix missing sk_err when TCP handshake fails\n af_unix: Reject SIOCATMARK on non-stream sockets\n veth: fix OOB txq access in veth_poll() with asymmetric queue counts\n eth: fbnic: fix double-free of PCS on phylink creation failure\n net: ethernet: cortina: Drop half-assembled SKB\n selftests: mptcp: pm: restrict \u0027unknown\u0027 check to pm_nl_ctl\n selftests: mptcp: check output: catch cmd errors\n mptcp: pm: prio: skip closed subflows\n mptcp: pm: ADD_ADDR rtx: return early if no retrans\n mptcp: pm: ADD_ADDR rtx: skip inactive subflows\n mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker\n mptcp: pm: ADD_ADDR rtx: free sk if last\n mptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n mptcp: pm: ADD_ADDR rtx: fix potential data-race\n ...\n" }, { "commit": "41ae14071cd7f6a7770e2fe1f8a0859d4c2c6ba4", "tree": "baf3da55b33fee0456b680154bd3a952c6d450f3", "parents": [ "b131dc93f7bf1b1461f5bde0c06c4c2384aa5b58" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed May 06 09:25:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 09:08:47 2026 -0700" }, "message": "net: sparx5: configure serdes for 1000BASE-X in sparx5_port_init()\n\nsparx5_port_init() only invokes sparx5_serdes_set() and the associated\nshadow-device enable and low-speed device switch for SGMII and QSGMII.\nOn any port with a high-speed primary device (DEV5G/DEV10G/DEV25G)\nconfigured for 1000BASE-X the serdes is therefore left uninitialized,\nthe DEV2G5 shadow is never enabled, and the port stays pointed at its\nhigh-speed device rather than the DEV2G5. The PCS1G block looks\nhealthy in isolation, but no frames reach the link partner.\n\nAdd 1000BASE-X to the check so the same three steps run.\n\nNote: the same issue might apply to 2500BASE-X, but that will,\neventually, be addressed in a separate commit.\n\nReported-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nFixes: 946e7fd5053a (\"net: sparx5: add port module support\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-4-fb236aa96908@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b131dc93f7bf1b1461f5bde0c06c4c2384aa5b58", "tree": "64c5ef73c89dbb589355cd1cdcba3e6a4e9cc40e", "parents": [ "dedf6c90386d99b878763c183a08b61d3ce4824e" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed May 06 09:25:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 09:08:46 2026 -0700" }, "message": "net: sparx5: fix wrong chip ids for TSN SKUs\n\nThe TSN SKUs in enum spx5_target_chiptype have incorrect IDs:\n\n SPX5_TARGET_CT_7546TSN \u003d 0x47546,\n SPX5_TARGET_CT_7549TSN \u003d 0x47549,\n SPX5_TARGET_CT_7552TSN \u003d 0x47552,\n SPX5_TARGET_CT_7556TSN \u003d 0x47556,\n SPX5_TARGET_CT_7558TSN \u003d 0x47558,\n\nThe value read back from the chip is GCB_CHIP_ID_PART_ID, which is a\nGENMASK(27, 12) field, i.e. at most 16 bits wide. It can never match\nthese IDs, so probing a TSN part fails with a \"Target not supported\"\nerror.\n\nFix the enum to use the actual 16-bit part IDs returned by the\nhardware: 0x0546, 0x0549, 0x0552, 0x0556 and 0x0558.\n\nReported-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nFixes: 3cfa11bac9bb (\"net: sparx5: add the basic sparx5 driver\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260506-misc-fixes-sparx5-lan969x-v2-3-fb236aa96908@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19cbc75c56c0ed4fa3f637e3c41a98895a68dfae", "tree": "5dbb8e9287d0494e4fb67bbd636fc259a91c1dfa", "parents": [ "1e38f888f9f070591e54c690e78f2ff8affa8881", "06bc7ff0a1e0f2b0102e1314e3527a7ec0997851" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:55:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:55:15 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Again a collection of small fixes, mostly for device-specific ones.\n\n The only big LOC is about the removal of pretty old dead code in\n ab8500 codec driver, while the rest all nice small changes.\n\n Core / API:\n - Fix race in deferred fasync state checks\n - Fix UMP group filtering in sequencer\n\n ASoC:\n - cs35l56: fixes for driver cleanup and error paths\n - tas2764/2770: workaround for bogus temperature readings\n - wm_adsp: fixes for firmware unit tests\n - amd-yc: more DMI quirks for laptops\n - Minor fixes for fsl_xcvr and spacemit\n\n HD-Audio:\n - Mute LED and speaker quirks for HP, Lenovo, and Xiaomi laptops\n\n USB-audio:\n - New device-specific quirks (Motu, JBL, AlphaTheta, Razer)\n - Fix of MIDI2 playback on resume\n\n Others:\n - Firewire-tascam control event fix\n - Minor cleanups and fixes for sparc/dbri and pcmtest\"\n\n* tag \u0027sound-7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (28 commits)\n ASoC: cs35l56: Destroy workqueue in probe error path\n ASoC: cs35l56: Don\u0027t use devres to unregister component\n ALSA: sparc/dbri: add missing fallthrough\n ALSA: core: Serialize deferred fasync state checks\n ALSA: hda/realtek: Add mute LED fixup for HP Pavilion 15-cs1xxx\n ALSA: seq: Fix UMP group 16 filtering\n ASoC: wm_adsp_fw_find_test: Clear searched_fw_files in find-by-index test\n ASoC: wm_adsp_fw_find_test: Redirect wm_adsp_release_firmware_files()\n ASoC: tas2770: Deal with bogus initial temperature value\n ASoC: tas2764: Deal with bogus initial temperature register value\n ALSA: usb-audio: add clock quirk for Motu 1248\n ALSA: usb-audio: midi2: Restart output URBs on resume\n ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 15-fh0xxx\n ALSA: usb-audio: Add quirk flags for JBL Pebbles\n ALSA: firewire-tascam: Do not drop unread control events\n ALSA: usb-audio: Add quirk flags for AlphaTheta EUPHONIA\n ASoC: fsl_xcvr: Fix event generation for cached controls\n ASoC: sdw_utils: avoid the SDCA companion function not supported failure\n ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table\n ASoC: cs35l56: Fix out-of-bounds in dev_err() in cs35l56_read_onchip_spkid()\n ...\n" }, { "commit": "1e38f888f9f070591e54c690e78f2ff8affa8881", "tree": "4245c06c44aa6772b5d10008607d7c4177d35064", "parents": [ "b3737eac0a0f70b2a6b6a872213f0f235624e487", "863810d4985ad214f70c1623f24384ccc850f2a2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:46:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:46:27 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - Silence unknown board warning for 8D41 (hp-wmi)\n\n - Fix uninitialized variable in fan RPM handling (lenovo/wmi-other)\n\n - Check min_size also when ACPI does not return an out object (wmi)\n\n* tag \u0027platform-drivers-x86-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: lenovo: wmi-other: Fix uninitialized variable in lwmi_om_hwmon_write()\n platform/x86: hp-wmi: silence unknown board warning for 8D41\n platform/wmi: Fix unchecked min_size in wmidev_invoke_method()\n" }, { "commit": "b3737eac0a0f70b2a6b6a872213f0f235624e487", "tree": "95b2e7c3b82566b33cd3bfab80ec9dcc5470a977", "parents": [ "8ab992f815d6736b5c7a6f5fd7bfe7bc106bb3dc", "ec1fcddb3117d9452210e838fd37389ee61e10e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:43:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 07 08:43:25 2026 -0700" }, "message": "Merge tag \u0027pmdomain-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - Fix detach procedure for virtual devices in genpd\n\n - mediatek: Fix use-after-free in scpsys_get_bus_protection_legacy()\n\n* tag \u0027pmdomain-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()\n pmdomain: core: Fix detach procedure for virtual devices in genpd\n" }, { "commit": "dedf6c90386d99b878763c183a08b61d3ce4824e", "tree": "e8b26e8dc2337596a4b3d4d6b06890bda83cba06", "parents": [ "ecddc523cfdb85b3e132f13e293224ebfdfab564" ], "author": { "name": "Joey Lu", "email": "a0987203069@gmail.com", "time": "Wed May 06 16:46:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:41:30 2026 -0700" }, "message": "net: stmmac: dwmac-nuvoton: fix NULL pointer dereference in nvt_set_phy_intf_sel()\n\npriv-\u003edev was never initialized after devm_kzalloc() allocates the\nprivate data structure. When nvt_set_phy_intf_sel() is later invoked\nvia the phylink interface_select callback, it calls\nnvt_gmac_get_delay(priv-\u003edev, ...) which dereferences the NULL pointer.\n\nFix this by assigning priv-\u003edev \u003d dev immediately after allocation.\n\nFixes: 4d7c557f58ef (\"net: stmmac: dwmac-nuvoton: Add dwmac glue for Nuvoton MA35 family\")\nSigned-off-by: Joey Lu \u003ca0987203069@gmail.com\u003e\nLink: https://patch.msgid.link/20260506084614.192894-2-a0987203069@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ecddc523cfdb85b3e132f13e293224ebfdfab564", "tree": "c53ebfe64284fc4e9e5249f6a82c38ed76005901", "parents": [ "019c892e46544af0ae94ec833f79aa903c837666" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed May 06 07:04:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:39:15 2026 -0700" }, "message": "tcp: Fix dst leak in tcp_v6_connect().\n\nIf a socket is bound to a wildcard address, tcp_v[46]_connect()\nupdates it with a non-wildcard address based on the route lookup.\n\nAfter bhash2 was introduced in the cited commit, we must call\ninet_bhash2_update_saddr() to update the bhash2 entry as well.\n\nIf inet_bhash2_update_saddr() fails, we must release the refcount\nfor dst by ip_route_connect() or ip6_dst_lookup_flow().\n\nWhile tcp_v4_connect() calls ip_rt_put() in the error path,\ntcp_v6_connect() does not call dst_release().\n\nLet\u0027s call dst_release() when inet_bhash2_update_saddr() fails\nin tcp_v6_connect().\n\nFixes: 28044fc1d495 (\"net: Add a bhash2 table hashed by port and address\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260506070443.1699879-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "019c892e46544af0ae94ec833f79aa903c837666", "tree": "5c997721e6c4594f0614677e21225fb3e11c9f35", "parents": [ "32cd651d14fc72a93703ea2384cb5cd8998523a8" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed May 06 06:59:53 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:38:37 2026 -0700" }, "message": "ipmr: Call ipmr_fib_lookup() under RCU.\n\nYi Lai reported RCU splat in reg_vif_xmit() below. [0]\n\nWhen CONFIG_IP_MROUTE_MULTIPLE_TABLES\u003dn, ipmr_fib_lookup()\nuses rcu_dereference() without explicit rcu_read_lock().\n\nAlthough rcu_read_lock_bh() is already held by the caller\n__dev_queue_xmit(), lockdep requires explicit rcu_read_lock()\nfor rcu_dereference().\n\nLet\u0027s move up rcu_read_lock() in reg_vif_xmit() to\ncover ipmr_fib_lookup().\n\n[0]:\nWARNING: suspicious RCU usage\n7.1.0-rc2-next-20260504-9d0d467c3572 #1 Not tainted\n -----------------------------\nnet/ipv4/ipmr.c:329 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active \u003d 2, debug_locks \u003d 1\n2 locks held by syz.2.17/1779:\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:891 [inline]\n #0: ffffffff87896440 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x239/0x4140 net/core/dev.c:4792\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: spin_lock include/linux/spinlock.h:342 [inline]\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __netif_tx_lock include/linux/netdevice.h:4795 [inline]\n #1: ffff88801a199d18 (_xmit_PIMREG#2){+...}-{3:3}, at: __dev_queue_xmit+0x1d5d/0x4140 net/core/dev.c:4865\n\nstack backtrace:\nCPU: 1 UID: 0 PID: 1779 Comm: syz.2.17 Not tainted 7.1.0-rc2-next-20260504-9d0d467c3572 #1 PREEMPT(lazy)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x121/0x150 lib/dump_stack.c:120\n dump_stack+0x19/0x20 lib/dump_stack.c:129\n lockdep_rcu_suspicious+0x15b/0x1f0 kernel/locking/lockdep.c:6878\n ipmr_fib_lookup net/ipv4/ipmr.c:329 [inline]\n reg_vif_xmit+0x2ee/0x3c0 net/ipv4/ipmr.c:540\n __netdev_start_xmit include/linux/netdevice.h:5382 [inline]\n netdev_start_xmit include/linux/netdevice.h:5391 [inline]\n xmit_one net/core/dev.c:3889 [inline]\n dev_hard_start_xmit+0x170/0x700 net/core/dev.c:3905\n __dev_queue_xmit+0x1df1/0x4140 net/core/dev.c:4871\n dev_queue_xmit include/linux/netdevice.h:3423 [inline]\n packet_xmit+0x252/0x370 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3082 [inline]\n packet_sendmsg+0x39ad/0x5650 net/packet/af_packet.c:3114\n sock_sendmsg_nosec net/socket.c:797 [inline]\n __sock_sendmsg net/socket.c:812 [inline]\n ____sys_sendmsg+0xa21/0xba0 net/socket.c:2716\n ___sys_sendmsg+0x121/0x1c0 net/socket.c:2770\n __sys_sendmsg+0x177/0x220 net/socket.c:2802\n __do_sys_sendmsg net/socket.c:2807 [inline]\n __se_sys_sendmsg net/socket.c:2805 [inline]\n __x64_sys_sendmsg+0x80/0xc0 net/socket.c:2805\n x64_sys_call+0x1d9c/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc1/0x1020 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f37e563ee5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007ffe5caa7fa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00000000005c5fa0 RCX: 00007f37e563ee5d\nRDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004\nRBP: 00000000005c5fa0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00000000005c5fac R15: 00000000005c5fa0\n \u003c/TASK\u003e\n\nFixes: b3b6babf4751 (\"ipmr: Free mr_table after RCU grace period.\")\nReported-by: syzkaller \u003csyzkaller@googlegroups.com\u003e\nReported-by: Yi Lai \u003cyi1.lai@intel.com\u003e\nCloses: https://lore.kernel.org/netdev/afrY34dLXNUboevf@ly-workstation/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260506065955.1695753-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "32cd651d14fc72a93703ea2384cb5cd8998523a8", "tree": "041c5e83ffbe44bf298d0907759f2b33d7653fbe", "parents": [ "9032f7676935a13fd402608223d326c5f62da9c0" ], "author": { "name": "Justin Chen", "email": "justin.chen@broadcom.com", "time": "Tue May 05 10:39:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:47 2026 -0700" }, "message": "net: phy: broadcom: Save PHY counters during suspend\n\nThe PHY counters can be lost if the PHY is reset during suspend. We\nneed to save the values into the shadow counters or the accounting\nwill be incorrect over multiple suspend and resume cycles.\n\nFixes: 820ee17b8d3b (\"net: phy: broadcom: Add support code for reading PHY counters\")\nSigned-off-by: Justin Chen \u003cjustin.chen@broadcom.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260505173926.2870069-1-justin.chen@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9032f7676935a13fd402608223d326c5f62da9c0", "tree": "f77ab2af6c01765f231cd8402fdbf19b6f79a2bc", "parents": [ "d119775f2bad827edc28071c061fdd4a91f889a5" ], "author": { "name": "D. Wythe", "email": "alibuda@linux.alibaba.com", "time": "Wed May 06 09:41:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:34 2026 -0700" }, "message": "net/smc: fix missing sk_err when TCP handshake fails\n\nIn smc_connect_work(), when the underlying TCP handshake fails, the error\ncode (rc) must be propagated to sk_err to ensure userspace can correctly\nretrieve the error status via SO_ERROR. Currently, the code only handles\na restricted set of error codes (e.g., EPIPE, ECONNREFUSED). If other\nerrors occurs, such as EHOSTUNREACH, sk_err remains unset (zero).\n\nThis affects applications that rely on SO_ERROR to determine connect\noutcome. For example, higher versions of Go\u0027s netpoller treats\nSO_ERROR \u003d\u003d 0 combined with a failed getpeername() as a spurious wakeup\nand re-enters epoll_wait(). Under ET mode, no further edge will be\ngenerated since the socket is already in a terminal state, causing the\nconnect to hang indefinitely or until a user-specified timeout, if one\nis set.\n\nFixes: 50717a37db03 (\"net/smc: nonblocking connect rework\")\nSigned-off-by: D. Wythe \u003calibuda@linux.alibaba.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260506014105.27093-1-alibuda@linux.alibaba.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d119775f2bad827edc28071c061fdd4a91f889a5", "tree": "a8307d50171cc273deb9c6c7afa514c15aab5b32", "parents": [ "08f566e8f83bb70f04ad5aba5be352c490a01c8a" ], "author": { "name": "Jiexun Wang", "email": "wangjiexun2025@gmail.com", "time": "Wed May 06 22:08:23 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu May 07 08:36:02 2026 -0700" }, "message": "af_unix: Reject SIOCATMARK on non-stream sockets\n\nSIOCATMARK reports whether the receive queue is at the urgent mark for\nMSG_OOB.\n\nIn AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.\nSOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(),\nso they should not support SIOCATMARK either.\n\nReturn -EOPNOTSUPP for non-stream sockets before checking the receive\nqueue.\n\nFixes: 314001f0bf92 (\"af_unix: Add OOB support\")\nCc: stable@kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nSuggested-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Jiexun Wang \u003cwangjiexun2025@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260506140825.2987635-1-n05ec@lzu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08f566e8f83bb70f04ad5aba5be352c490a01c8a", "tree": "675eeeb44f57a5c54254b4f8550b9872906bb99a", "parents": [ "593dfd40a94ca0ab20297ea4629d94268deed0ed" ], "author": { "name": "Jesper Dangaard Brouer", "email": "hawk@kernel.org", "time": "Tue May 05 15:21:53 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 07 16:24:07 2026 +0200" }, "message": "veth: fix OOB txq access in veth_poll() with asymmetric queue counts\n\nXDP redirect into a veth device (via bpf_redirect()) calls\nveth_xdp_xmit(), which enqueues frames into the peer\u0027s ptr_ring using\n smp_processor_id() % peer-\u003ereal_num_rx_queues\nas the ring index. With an asymmetric veth pair where the peer has\nfewer TX queues than RX queues, that index can exceed\npeer-\u003ereal_num_tx_queues.\n\nveth_poll() then resolves peer_txq for the ring via:\n\n peer_txq \u003d peer_dev ? netdev_get_tx_queue(peer_dev, queue_idx) : NULL;\n\nwhere queue_idx \u003d rq-\u003exdp_rxq.queue_index. When queue_idx exceeds\npeer_dev-\u003ereal_num_tx_queues this is an out-of-bounds (OOB) access\ninto the peer\u0027s netdev_queue array, triggering DEBUG_NET_WARN_ON_ONCE\nin netdev_get_tx_queue().\n\nThe normal ndo_start_xmit path is not affected: the stack clamps\nskb-\u003equeue_mapping via netdev_cap_txqueue() before invoking\nndo_start_xmit, so rxq in veth_xmit() never exceeds real_num_tx_queues.\n\nFix veth_poll() by clamping: only dereference peer_txq when queue_idx is\nwithin bounds, otherwise set it to NULL. The out-of-range rings are fed\nexclusively via XDP redirect (veth_xdp_xmit), never via ndo_start_xmit\n(veth_xmit), so the peer txq was never stopped and there is nothing to\nwake; NULL is the correct fallback.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260502071828.616C3C19425@smtp.kernel.org/\nFixes: dc82a33297fc (\"veth: apply qdisc backpressure on full ptr_ring to reduce TX drops\")\nSigned-off-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20260505132159.241305-2-hawk@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "593dfd40a94ca0ab20297ea4629d94268deed0ed", "tree": "43fe426f1d05fcdbec0353de83d9c24059304755", "parents": [ "b266bacba796ff5c4dcd2ae2fc08aacf7ab39153" ], "author": { "name": "Bobby Eshleman", "email": "bobbyeshleman@meta.com", "time": "Mon May 04 18:42:11 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 07 12:34:42 2026 +0200" }, "message": "eth: fbnic: fix double-free of PCS on phylink creation failure\n\nfbnic_phylink_create() stores the newly allocated PCS in fbn-\u003epcs and\nthen calls phylink_create(). When phylink_create() fails, the error path\ncorrectly destroys the PCS via xpcs_destroy_pcs(), but the caller,\nfbnic_netdev_alloc(), responds by invoking fbnic_netdev_free() which\ncalls fbnic_phylink_destroy(). That function finds fbn-\u003epcs non-NULL and\ncalls xpcs_destroy_pcs() a second time on the already-freed object,\ntriggering a refcount underflow use-after-free:\n\n[ 1.934973] fbnic 0000:01:00.0: Failed to create Phylink interface, err: -22\n[ 1.935103] ------------[ cut here ]------------\n[ 1.935179] refcount_t: underflow; use-after-free.\n[ 1.935252] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90, CPU#0: swapper/0/1\n[ 1.935389] Modules linked in:\n[ 1.935484] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-virtme-04244-g1f5ffc672165-dirty #1 PREEMPT(lazy)\n[ 1.935661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[ 1.935826] RIP: 0010:refcount_warn_saturate+0x59/0x90\n[ 1.935931] Code: 44 48 8d 3d 49 f9 a7 01 67 48 0f b9 3a e9 bf 1e 96 00 48 8d 3d 48 f9 a7 01 67 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 47 f9 a7 01 \u003c67\u003e 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 46 f9 a7 01 67 48 0f b9 3a\n[ 1.936274] RSP: 0000:ffffd0d440013c58 EFLAGS: 00010246\n[ 1.936376] RAX: 0000000000000000 RBX: ffff8f39c188c278 RCX: 000000000000002b\n[ 1.936524] RDX: ffff8f39c004f000 RSI: 0000000000000003 RDI: ffffffff96abab00\n[ 1.936692] RBP: ffff8f39c188c240 R08: ffffffff96988e88 R09: 00000000ffffdfff\n[ 1.936835] R10: ffffffff96878ea0 R11: 0000000000000187 R12: 0000000000000000\n[ 1.936970] R13: ffff8f39c0cef0c8 R14: ffff8f39c1ac01c0 R15: 0000000000000000\n[ 1.937114] FS: 0000000000000000(0000) GS:ffff8f3ba08b4000(0000) knlGS:0000000000000000\n[ 1.937273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.937382] CR2: ffff8f3b3ffff000 CR3: 0000000172642001 CR4: 0000000000372ef0\n[ 1.937540] Call Trace:\n[ 1.937619] \u003cTASK\u003e\n[ 1.937698] xpcs_destroy_pcs+0x25/0x40\n[ 1.937783] fbnic_netdev_alloc+0x1e5/0x200\n[ 1.937859] fbnic_probe+0x230/0x370\n[ 1.937939] local_pci_probe+0x3e/0x90\n[ 1.938013] pci_device_probe+0xbb/0x1e0\n[ 1.938091] ? sysfs_do_create_link_sd+0x6d/0xe0\n[ 1.938188] really_probe+0xc1/0x2b0\n[ 1.938282] __driver_probe_device+0x73/0x120\n[ 1.938371] driver_probe_device+0x1e/0xe0\n[ 1.938466] __driver_attach+0x8d/0x190\n[ 1.938560] ? __pfx___driver_attach+0x10/0x10\n[ 1.938663] bus_for_each_dev+0x7b/0xd0\n[ 1.938758] bus_add_driver+0xe8/0x210\n[ 1.938854] driver_register+0x60/0x120\n[ 1.938929] ? __pfx_fbnic_init_module+0x10/0x10\n[ 1.939026] fbnic_init_module+0x25/0x60\n[ 1.939109] do_one_initcall+0x49/0x220\n[ 1.939202] ? rdinit_setup+0x20/0x40\n[ 1.939304] kernel_init_freeable+0x1b0/0x310\n[ 1.939449] ? __pfx_kernel_init+0x10/0x10\n[ 1.939560] kernel_init+0x1a/0x1c0\n[ 1.939640] ret_from_fork+0x1ed/0x240\n[ 1.939730] ? __pfx_kernel_init+0x10/0x10\n[ 1.939805] ret_from_fork_asm+0x1a/0x30\n[ 1.939886] \u003c/TASK\u003e\n[ 1.939927] ---[ end trace 0000000000000000 ]---\n[ 1.940184] fbnic 0000:01:00.0: Netdev allocation failed\n\nInstead of calling fbnic_phylink_destroy(), the prior initialization of\nnetdev should just be unrolled with free_netdev() and clearing\nfbd-\u003enetdev.\n\nClearing fbd-\u003enetdev to NULL avoids UAF in init_failure_mode where\ncallers guard by checking !fbd-\u003enetdev, such as fbnic_mdio_read_pmd().\nThese callers remain active even after a failed probe, so fdb-\u003enetdev\nstill needs to be cleared.\n\nFixes: d0fe7104c795 (\"fbnic: Replace use of internal PCS w/ Designware XPCS\")\nSigned-off-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260504-fbnic-pcs-fix-v2-1-de45192821d9@meta.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3051cd060fa496df42954291fa2306ed2eab4ecc", "tree": "77825aacd099acc9b8a7e910e367c82dfd2b7fec", "parents": [ "360f61bc29085d65a24dbaaf707c802553a239fd" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed May 06 01:55:11 2026 +0800" }, "committer": { "name": "Wolfram Sang", "email": "wsa+renesas@sang-engineering.com", "time": "Thu May 07 10:59:07 2026 +0200" }, "message": "i2c: smbus: reject oversized block transfers in the common path\n\nThe SMBus block transfer length data-\u003eblock[0] is validated in\ni2c_smbus_xfer_emulated() but that check runs too late for tracepoints\nand is skipped entirely when the adapter provides a native smbus_xfer\nimplementation. This allows user-controlled oversized block lengths to\nreach tracepoint memcpy calls and driver callbacks unchecked.\n\nAdd an early validation in __i2c_smbus_xfer() that rejects block\ntransfers whose caller-supplied length is zero or exceeds\nI2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback\nruns. data-\u003eblock[0] is filled in by the device on SMBus block reads,\nso the check is scoped to operations where the length is actually\nsupplied by the caller. This is consistent with the existing -EINVAL\nconvention in the emulated path and protects all downstream consumers\nat once: the smbus_write tracepoint, all native smbus_xfer driver\nimplementations, and the emulated path.\n\nTwo distinct bugs are fixed by this change:\n\nBug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h)\n trace_smbus_write() fires before any validation and copies\n data-\u003eblock[0]+1 bytes into a 34-byte event buffer. With\n block[0]\u003d0xfe the tracepoint copies 255 bytes, overflowing by 221.\n\n BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530\n Read of size 255 at addr ffff88800d98fcf8 by task poc_smbus/91\n Call Trace:\n \u003cTASK\u003e\n __asan_memcpy+0x23/0x80\n trace_event_raw_event_smbus_write+0x27c/0x530\n __i2c_smbus_xfer+0x43a/0xa40\n i2c_smbus_xfer+0x19e/0x340\n i2cdev_ioctl_smbus+0x38f/0x7f0\n i2cdev_ioctl+0x35e/0x680\n __x64_sys_ioctl+0x147/0x1e0\n do_syscall_64+0xcf/0x15a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n\nBug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c)\n stub_xfer() implements .smbus_xfer directly and only clamps\n block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With\n block[0]\u003d0xff and command\u003d0 the loop accesses block[1+i] for\n i up to 254, far past the 34-byte union.\n\n UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44\n index 34 is out of range for type \u0027__u8 [34]\u0027\n Call Trace:\n \u003cTASK\u003e\n __ubsan_handle_out_of_bounds+0xd7/0x120\n stub_xfer+0x1971/0x198f [i2c_stub]\n __i2c_smbus_xfer+0x306/0xa40\n i2c_smbus_xfer+0x19e/0x340\n i2cdev_ioctl_smbus+0x38f/0x7f0\n i2cdev_ioctl+0x35e/0x680\n __x64_sys_ioctl+0x147/0x1e0\n do_syscall_64+0xcf/0x15a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n\nBoth traces reproduced on v7.0-rc6+i2c/for-current with KASAN+UBSAN.\n\nFixes: 8a325997d95d (\"i2c: Add message transfer tracepoints for SMBUS [ver #2]\")\nFixes: 4710317891e4 (\"i2c-stub: Implement I2C block support\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\n" }, { "commit": "b15838b03cd0c6cf35651cfde62d17f14bb1d566", "tree": "4e9428f4ea3c460120417bb8c036e6be7a4908bf", "parents": [ "26f6654a9a60eb4d241f42a0ec85412e8821480b" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Fri Apr 24 21:34:28 2026 +0900" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Thu May 07 10:51:18 2026 +0200" }, "message": "drm/bochs: Drop manual put on probe error path\n\nbochs_pci_probe() allocates the DRM device with devm_drm_dev_alloc(),\nwhich registers a devres action to drop the initial DRM device reference\non driver detach or probe failure.\n\nThe error path currently calls drm_dev_put() manually. If probe then\nreturns an error, devres will run the registered release action and put\nthe same device again, after the first put may already have released it.\n\nReturn the probe error directly and let devres own the final put.\n\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nFixes: 04826f588682 (\"drm/bochs: Allocate DRM device in struct bochs_device\")\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260424123506.32275-1-mhun512@gmail.com\n" }, { "commit": "5772f6535227ebd104065d80afa8ed3478d34c5c", "tree": "b1c8533a7eca2f93ed953564c41c44ee142ff8ae", "parents": [ "5f8719945244dd65b5fa06195f4600db62581610" ], "author": { "name": "David Gow", "email": "david@davidgow.net", "time": "Thu Apr 16 14:57:43 2026 +0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu May 07 10:04:54 2026 +0200" }, "message": "x86/boot/e820: Re-enable BIOS fallback if e820 table is empty\n\nIn commit:\n\n 157266edcc56 (\"x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables\")\n\nthe check on the number of entries in the e820 table was removed. The intention\nwas to support single-entry maps, but by removing the check entirely, we also\nskip the fallback (to, e.g., the BIOS 88h function).\n\nThis means that if no E820 map is passed in from the bootloader (which is the\ncase on some bootloaders, like linld), we end up with an empty memory map, and\nthe kernel fails to boot (either by deadlocking on OOM, or by failing to\nallocate the real mode trampoline, or similar).\n\nRe-instate the check in append_e820_table(), but only check that nr_entries is\nnon-zero. This allows e820__memory_setup_default() to fall back to other memory\nsize sources, and doesn\u0027t affect e820__memory_setup_extended(), as the latter\nignores the return value from append_e820_table().\n\nIn doing so, we also update the return values to be proper error codes, with\n-ENOENT for this case (there are no entries), and -EINVAL for the case where an\nentry appears invalid. Given none of the callers check the actual value -- just\nwhether it\u0027s nonzero -- this is largely aesthetic in practice.\n\nTested against linld, and the kernel boots again fine.\n\n[ mingo: Readability edits to the comment and the changelog. ]\n\nFixes: 157266edcc56 (\"x86/boot/e820: Simplify append_e820_table() and remove restriction on single-entry tables\")\nSigned-off-by: David Gow \u003cdavid@davidgow.net\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@intel.com\u003e\nCc: stable@vger.kernel.org\nCc: Arnd Bergmann \u003carnd@kernel.org\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nLink: https://patch.msgid.link/20260416065746.1896647-1-david@davidgow.net\n" }, { "commit": "8ab992f815d6736b5c7a6f5fd7bfe7bc106bb3dc", "tree": "52c66a9d4530ea90af3e1a5fdc1e219f2e48b9c8", "parents": [ "b625e47f04274538e32e99fe6d3dc01edc93d280", "996454bc0da84d5a1dedb1a7861823087e01a7ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 22:02:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 22:02:28 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix memory leak in connection free\n\n - Fix inherited ACL ACE validation\n\n - Minor cleanup\n\n - Fix for share config\n\n - Fix durable handle cleanup race\n\n - Fix close_file_table_ids in session teardown\n\n - smbdirect fixes:\n - Fix memory region registration\n - Two fixes for out-of-tree builds\n\n* tag \u0027v7.1-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: validate inherited ACE SID length\n ksmbd: fix kernel-doc warnings from ksmbd_conn_get/put()\n ksmbd: fail share config requests when path allocation fails\n ksmbd: close durable scavenger races against m_fp_list lookups\n ksmbd: harden file lifetime during session teardown\n ksmbd: centralize ksmbd_conn final release to plug transport leak\n smb: smbdirect: fix MR registration for coalesced SG lists\n smb: smbdirect: introduce and use include/linux/smbdirect.h\n smb: smbdirect: make use of DEFAULT_SYMBOL_NAMESPACE and EXPORT_SYMBOL_GPL\n" }, { "commit": "b625e47f04274538e32e99fe6d3dc01edc93d280", "tree": "191d8d8bb209685ab792053cfe3e2f30282902e5", "parents": [ "5862221fddede6bb15566ab3c1f23a3c353da5e1", "525cb7ba6661074c1c5cc3772bccc6afab6791ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 20:44:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 06 20:44:03 2026 -0700" }, "message": "Merge tag \u0027chrome-platform-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux\n\nPull chrome-platform fix from Tzung-Bi Shih:\n\n - Fix a NULL dereference in cros_ec_typec\n\n* tag \u0027chrome-platform-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:\n platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration\n" }, { "commit": "b266bacba796ff5c4dcd2ae2fc08aacf7ab39153", "tree": "81d8b06d4509d00465b01170b2daaae6b22f173c", "parents": [ "2b1f48cc0f31abd1115a8c4b74b6425aba46eae4" ], "author": { "name": "Andreas Haarmann-Thiemann", "email": "eitschman@nebelreich.de", "time": "Tue May 05 23:52:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:43:41 2026 -0700" }, "message": "net: ethernet: cortina: Drop half-assembled SKB\n\nIn gmac_rx() (drivers/net/ethernet/cortina/gemini.c), when\ngmac_get_queue_page() returns NULL for the second page of a multi-page\nfragment, the driver logs an error and continues — but does not free the\npartially assembled skb that was being assembled via napi_build_skb() /\nnapi_get_frags().\n\nFree the in-progress partially assembled skb via napi_free_frags()\nand increase the number of dropped frames appropriately\nand assign the skb pointer NULL to make sure it is not lingering\naround, matching the pattern already used elsewhere in the driver.\n\nFixes: 4d5ae32f5e1e (\"net: ethernet: Add a driver for Gemini gigabit ethernet\")\nSigned-off-by: Andreas Haarmann-Thiemann \u003ceitschman@nebelreich.de\u003e\nSigned-off-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nLink: https://patch.msgid.link/20260505-gemini-ethernet-fix-v2-1-997c31d06079@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b1f48cc0f31abd1115a8c4b74b6425aba46eae4", "tree": "5aa3af72025501df785192808a303899c3f9db99", "parents": [ "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5", "53705ddfa18408f8e1f064331b6387509fa19f7f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:50 2026 -0700" }, "message": "Merge branch \u0027mptcp-pm-misc-fixes-for-v7-1-rc3\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: pm: misc. fixes for v7.1-rc3\n\nHere are various fixes, mainly related to ADD_ADDRs:\n\n- Patch 1: save ADD_ADDR for rtx with ID0 when needed. A fix for v6.1.\n\n- Patch 2: remove unneeded exception for ID 0. A fix for v5.10.\n\n- Patches 3-5: fix potential data-race and leaks during ADD_ADDR rtx. A\n fix for v5.10.\n\n- Patch 6: resched blocked ADD_ADDR rtx after a more appropriated\n timeout, not after 15 seconds. A fix for v5.10.\n\n- Patch 7: skip inactive subflows when when looking at the max RTO. A\n fix for v6.18.\n\n- Patch 8: avoid iterating over all subflows when there is no need to. A\n fix for v6.18.\n\n- Patch 9: skip closed subflows when looking at sending MP_PRIO. A fix\n for v5.17.\n\n- Patch 10: properly catch errors when using check_output() in the\n selftests. A fix for v6.9.\n\n- Patch 11: skip the \u0027unknown\u0027 flag test when \u0027ip mptcp\u0027 is used. A fix\n for v6.10.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-0-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "53705ddfa18408f8e1f064331b6387509fa19f7f", "tree": "5aa3af72025501df785192808a303899c3f9db99", "parents": [ "65db7b27b90e2ea8d4966935aa9a50b6a60c31ac" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:59 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "selftests: mptcp: pm: restrict \u0027unknown\u0027 check to pm_nl_ctl\n\nWhen pm_netlink.sh is executed with \u0027-i\u0027, \u0027ip mptcp\u0027 is used instead of\n\u0027pm_nl_ctl\u0027. IPRoute2 doesn\u0027t support the \u0027unknown\u0027 flag, which has only\nbeen added to \u0027pm_nl_ctl\u0027 for this specific check: to ensure that the\nkernel ignores such unsupported flag.\n\nNo reason to add this flag to \u0027ip mptcp\u0027. Then, this check should be\nskipped when \u0027ip mptcp\u0027 is used.\n\nFixes: 0cef6fcac24d (\"selftests: mptcp: ip_mptcp option for more scripts\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-11-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65db7b27b90e2ea8d4966935aa9a50b6a60c31ac", "tree": "a8dd2ff2e188abbecb8a2dffaa0709da5b511a08", "parents": [ "166b78344031bf7ac9f55cb5282776cfd85f220e" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "selftests: mptcp: check output: catch cmd errors\n\nUsing \u0027${?}\u0027 inside the if-statement to check the returned value from\nthe command that was evaluated as part of the if-statement is not\ncorrect: here, \u0027${?}\u0027 will be linked to the previous instruction, not\nthe one that is expected here (${cmd}).\n\nInstead, simply mark the error, except if an error is expected. If\nthat\u0027s the case, 1 can be passed as the 4th argument of this helper.\nThree checks from pm_netlink.sh expect an error.\n\nWhile at it, improve the error message when the command unexpectedly\nfails or succeeds.\n\nNote that we could expect a specific returned value, but the checks\ncurrently expecting an error can be used with \u0027ip mptcp\u0027 or \u0027pm_nl_ctl\u0027,\nand these two tools don\u0027t return the same error code.\n\nFixes: 2d0c1d27ea4e (\"selftests: mptcp: add mptcp_lib_check_output helper\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-10-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "166b78344031bf7ac9f55cb5282776cfd85f220e", "tree": "a7e938e19f4b039c4959103e80680a8be597b44b", "parents": [ "62a9b19dce77e72426f049fb99b9d1d032b9a8ea" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: prio: skip closed subflows\n\nWhen sending an MP_PRIO, closed subflows need to be skipped.\n\nThis fixes the case where the initial subflow got closed, re-opened\nlater, then an MP_PRIO is needed for the same local address.\n\nNote that explicit MP_PRIO cannot be sent during the 3WHS, so it is fine\nto use __mptcp_subflow_active().\n\nFixes: 067065422fcd (\"mptcp: add the outgoing MP_PRIO support\")\nCc: stable@vger.kernel.org\nFixes: b29fcfb54cd7 (\"mptcp: full disconnect implementation\")\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-9-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "62a9b19dce77e72426f049fb99b9d1d032b9a8ea", "tree": "2451d51f9f35a6715bb2ffb6bf210d6b84d1d2f9", "parents": [ "c6d395e2de1306b5fef0344a3c3835fbbfaa18be" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:56 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: return early if no retrans\n\nNo need to iterate over all subflows if there is no retransmission\nneeded.\n\nExit early in this case then.\n\nFixes: 30549eebc4d8 (\"mptcp: make ADD_ADDR retransmission timeout adaptive\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-8-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c6d395e2de1306b5fef0344a3c3835fbbfaa18be", "tree": "018c6723e3b0a22c0b5753c67d808eebd09b4b14", "parents": [ "3cf12492891c4b5ff54dda404a2de4ec54c9e1b5" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: skip inactive subflows\n\nWhen looking at the maximum RTO amongst the subflows, inactive subflows\nwere taken into account: that includes stale ones, and the initial one\nif it has been already been closed.\n\nUnusable subflows are now simply skipped. Stale ones are used as an\nalternative: if there are only stale ones, to take their maximum RTO and\navoid to eventually fallback to net.mptcp.add_addr_timeout, which is set\nto 2 minutes by default.\n\nFixes: 30549eebc4d8 (\"mptcp: make ADD_ADDR retransmission timeout adaptive\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-7-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3cf12492891c4b5ff54dda404a2de4ec54c9e1b5", "tree": "491e4a06ac34538778a0fb3b704f569fb6d1a82d", "parents": [ "b7b9a461569734d33d3259d58d2507adfac107ed" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:54 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:45 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker\n\nWhen an ADD_ADDR needs to be retransmitted and another one has already\nbeen prepared -- e.g. multiple ADD_ADDRs have been sent in a row and\nneed to be retransmitted later -- this additional retransmission will\nneed to wait.\n\nIn this case, the timer was reset to TCP_RTO_MAX / 8, which is ~15\nseconds. This delay is unnecessary long: it should just be rescheduled\nat the next opportunity, e.g. after the retransmission timeout.\n\nWithout this modification, some issues can be seen from time to time in\nthe selftests when multiple ADD_ADDRs are sent, and the host takes time\nto process them, e.g. the \"signal addresses, ADD_ADDR timeout\" MPTCP\nJoin selftest, especially with a debug kernel config.\n\nNote that on older kernels, \u0027timeout\u0027 is not available. It should be\nenough to replace it by one second (HZ).\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-6-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7b9a461569734d33d3259d58d2507adfac107ed", "tree": "64a46f9b0c0787c4c5a7a41f64fab2ad0ba8b7ca", "parents": [ "9634cb35af17019baec21ca648516ce376fa10e6" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:53 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: free sk if last\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer(),\nand released at the end.\n\nIf at that moment, it was the last reference being held, the sk would\nnot be freed. sock_put() should then be called instead of __sock_put().\n\nBut that\u0027s not enough: if it is the last reference, sock_put() will call\nsk_free(), which will end up calling sk_stop_timer_sync() on the same\ntimer, and waiting indefinitely to finish. So it is needed to mark that\nthe timer is done at the end of the timer handler when it has not been\nrescheduled, not to call sk_stop_timer_sync() on \"itself\".\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-5-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9634cb35af17019baec21ca648516ce376fa10e6", "tree": "550d609a82ffe93c7776ab55392d4607cc52a33f", "parents": [ "5cd6e0ad79d2615264f63929f8b457ad97ae550d" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:52 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: always decrease sk refcount\n\nWhen an ADD_ADDR is retransmitted, the sk is held in sk_reset_timer().\nIt should then be released in all cases at the end.\n\nSome (unlikely) checks were returning directly instead of calling\nsock_put() to decrease the refcount. Jump to a new \u0027exit\u0027 label to call\n__sock_put() (which will become sock_put() in the next commit) to fix\nthis potential leak.\n\nWhile at it, drop the \u0027!msk\u0027 check which cannot happen because it is\nnever reset, and explicitly mark the remaining one as \"unlikely\".\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-4-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5cd6e0ad79d2615264f63929f8b457ad97ae550d", "tree": "2377b3a62992b0e5e779e012e8f7f893090931f6", "parents": [ "03f324f3f1f7619a47b9c91282cb12775ab0a2f1" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:51 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: fix potential data-race\n\nThis mptcp_pm_add_timer() helper is executed as a timer callback in\nsoftirq context. To avoid any data races, the socket lock needs to be\nheld with bh_lock_sock().\n\nIf the socket is in use, retry again soon after, similar to what is done\nwith the keepalive timer.\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-3-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "03f324f3f1f7619a47b9c91282cb12775ab0a2f1", "tree": "225eda8e8e24dc7f53dc9118dd816c1b042965dd", "parents": [ "b12014d2d36eaed4e4bec5f1ac7e91110eeb100d" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:50 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: ADD_ADDR rtx: allow ID 0\n\nADD_ADDR can be sent for the ID 0, which corresponds to the local\naddress and port linked to the initial subflow.\n\nIndeed, this address could be removed, and re-added later on, e.g. what\nis done in the \"delete re-add signal\" MPTCP Join selftests. So no reason\nto ignore it.\n\nFixes: 00cfd77b9063 (\"mptcp: retransmit ADD_ADDR when timeout\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-2-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b12014d2d36eaed4e4bec5f1ac7e91110eeb100d", "tree": "dec7b7d2d8b8e2e1c02d87d0d9807237c1dcb05d", "parents": [ "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue May 05 17:00:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:16:44 2026 -0700" }, "message": "mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0\n\nWhen adding the ADD_ADDR to the list, the address including the IP, port\nand ID are copied. On the other hand, when the endpoint corresponds to\nthe one from the initial subflow, the ID is set to 0, as specified by\nthe MPTCP protocol.\n\nThe issue is that the ID was reset after having copied the ID in the\nADD_ADDR entry. So the retransmission was done, but using a different ID\nthan the initial one.\n\nFixes: 8b8ed1b429f8 (\"mptcp: pm: reuse ID 0 after delete and re-add\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260505-net-mptcp-pm-fixes-7-1-rc3-v1-1-fca8091060a4@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5", "tree": "410de56141b25893ef9a03f0c23982d512c9eabd", "parents": [ "770b136ff9bf3e319d19875da59c4f7f4853da3a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 15:39:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 18:11:33 2026 -0700" }, "message": "tcp: tcp_child_process() related UAF\n\ntcp_child_process( .. child ...) currently calls sock_put(child).\n\nUnfortunately @child (named @nsk in callers) can be used after\nthis point to send a RST packet.\n\nTo fix this UAF, I remove the sock_put() from tcp_child_process()\nand let the callers handle this after it is safe.\n\nRemove @rsk variable in tcp_v4_do_rcv() and change tcp_v6_do_rcv()\nso that both functions look the same.\n\nFixes: cfb6eeb4c860 (\"[TCP]: MD5 Signature Option (RFC2385) support.\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260505153927.3435532-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "770b136ff9bf3e319d19875da59c4f7f4853da3a", "tree": "a6b1b39ef131d5b234aba3d9245c469e913cd64a", "parents": [ "67ef49047d312be692c8c439145f4514174e517f" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 09:11:33 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:46:05 2026 -0700" }, "message": "net/sched: sch_sfq: annotate data-races from sfq_dump_class_stats()\n\nsfq_dump_class_stats() runs locklessly, add needed READ_ONCE()\nand WRITE_ONCE() annotations.\n\nFixes: edb09eb17ed8 (\"net: sched: do not acquire qdisc spinlock in qdisc/class stats dump\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260505091133.2452510-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "67ef49047d312be692c8c439145f4514174e517f", "tree": "a65655486018a571d0e1345b0986ac1693f3538c", "parents": [ "701ea57feaabdea403cf299ee5cd0445083bc0ac" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 13:32:33 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:44:13 2026 -0700" }, "message": "inetpeer: add a missing read_seqretry() in inet_getpeer()\n\nWhen performing a lockless lookup over the inet_peer rbtree,\nif a matching node is found, inet_getpeer() returns it immediately\nwithout validating the seqlock sequence.\n\nThis missing check introduces a race condition:\n\nTrigger Path: When a host receives an incoming fragmented IPv4 packet,\nip4_frag_init() (in net/ipv4/ip_fragment.c) calls inet_getpeer_v4()\nto track the peer.\n\nThe Race: If the packet is from a new source IP, CPU A acquires the\nwrite_seqlock, allocates a new inet_peer node (p), sets its IP address\n(daddr), and links it to the rbtree (rb_link_node).\n\nUninitialized Access: Due to the lack of memory barriers between\nrb_link_node and the initialization of the rest of the struct\n(like refcount_set(\u0026p-\u003erefcnt, 1)), CPU A can make the node visible\nto readers before its refcnt is initialized.\nThis is especially true on weakly-ordered architectures like ARM64\nwhere the CPU can reorder the memory stores.\n\nLockless Reader: Concurrently, CPU B processes a second fragmented packet\nfrom the same source IP. CPU B does a lockless lookup, finds the newly\ninserted node, and returns it immediately.\n\nUse-After-Free (UAF): CPU B reads p-\u003erefcnt as uninitialized garbage\n(left over from previous kmalloc-128/192 allocations).\nIf the garbage is \u003e 0, refcount_inc_not_zero(\u0026p-\u003erefcnt) succeeds.\nCPU A then executes refcount_set(\u0026p-\u003erefcnt, 1), overwriting CPU B\u0027s increment.\nWhen CPU B finishes with the fragment queue, it calls inet_putpeer(),\nwhich drops the refcount to 0 and frees the node via RCU.\nThe node is now freed but remains linked in the rbtree,\nresulting in a Use-After-Free in the rbtree.\n\nFixes: b145425f269a (\"inetpeer: remove AVL implementation in favor of RB tree\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260505133233.3039575-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "701ea57feaabdea403cf299ee5cd0445083bc0ac", "tree": "603afe28b3c73cb4adbe3ed3d98e82b243abdc12", "parents": [ "e4182739363b32c33012daf3b77a8cab3cd160be" ], "author": { "name": "Shitalkumar Gandhi", "email": "shital.gandhi45@gmail.com", "time": "Tue May 05 18:02:36 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:42:50 2026 -0700" }, "message": "net: rtsn: fix mdio_node leak in rtsn_mdio_alloc()\n\nof_get_child_by_name() takes a reference. The rtsn_reset() and\nrtsn_change_mode() failure paths jump to out_free_bus and leak\nmdio_node.\n\nAdd out_put_node to drop it before falling through.\n\nFixes: b0d3969d2b4d (\"net: ethernet: rtsn: Add support for Renesas Ethernet-TSN\")\nSigned-off-by: Shitalkumar Gandhi \u003cshitalkumar.gandhi@cambiumnetworks.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nLink: https://patch.msgid.link/20260505123236.406000-1-shitalkumar.gandhi@cambiumnetworks.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e4182739363b32c33012daf3b77a8cab3cd160be", "tree": "a256a46bc8fc92a5ee81952c40f6582e8c61a09d", "parents": [ "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1", "07bdec3fc737aac7f4c273aafa803d353174c43e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:22 2026 -0700" }, "message": "Merge branch \u0027netdevsim-psp-fix-init-and-uninit-bugs\u0027\n\nDaniel Zahka says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetdevsim: psp: fix init and uninit bugs\n\nThis series has three fixes. The first is a straightforward NULL\npointer dereference that is reachable by creating and destroying some\nvfs on a kernel with INET_PSP enabled.\n\nThe last two patches deal with nsim_psp_rereg_write(), which is a\ndebugfs handler that reregisters netdevsim\u0027s psp_dev without\naquiescing and disabling tx/rx processing. This was added to enable\nsome tests in psp.py where a psp device is unregistered while it still\nreferenced by tcp socket state.\n\nThere are two issues with this code:\n1. Calls to nsim_psp_uninit() are not properly serialized\n2. netdevsim\u0027s psp_dev refcount can be released while nsim_do_psp() is\n reading from it.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-0-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "07bdec3fc737aac7f4c273aafa803d353174c43e", "tree": "a256a46bc8fc92a5ee81952c40f6582e8c61a09d", "parents": [ "24c96a42006ee27a078ec8c631c906dea8a3ca6d" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: rcu protect psp_dev reference\n\nThere are two issues with the way psp_dev is used in nsim_do_psp():\n\n1. There is no check for IS_ERR() on the peers psp_dev, before\n dereferencing.\n2. The refcount on this psp_dev can be dropped by\n nsim_psp_rereg_write()\n\nTo fix this, we can make netdevsim\u0027s reference to its psp_dev an rcu\nreference, and then nsim_do_psp() can read the fields it needs from an\nrcu critical section.\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-3-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "24c96a42006ee27a078ec8c631c906dea8a3ca6d", "tree": "249ea6ab2da44c302fef8073e406377688543070", "parents": [ "7ce3f1bedaac88880594720ba0f687da3bd7fc8a" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: serialize calls to nsim_psp_uninit()\n\nThe debugfs write handler, nsim_psp_rereg_write(), can race against\nnsim_destroy() and against itself, causing nsim_psp_uninit() to run\nmore than once concurrently. Two complementary changes serialize all\ncallers:\n\n1. Delete the psp_rereg debugfs file from nsim_psp_uninit() before\n doing the actual teardown. debugfs_remove() drains any in-flight\n writers and prevents new ones from starting.\n\n2. Add a mutex around the body of nsim_psp_rereg_write() so that two\n concurrent userspace writers cannot both enter the teardown path\n at once.\n\nThe teardown work itself is moved into a new __nsim_psp_uninit() that\nthe rereg handler calls under the mutex, while the public\nnsim_psp_uninit() wraps it with the debugfs_remove()/mutex_destroy()\npair so nsim_destroy() doesn\u0027t have to know about the psp internals.\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-2-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7ce3f1bedaac88880594720ba0f687da3bd7fc8a", "tree": "6ac156d24a69336812d79baf1f065b5aa1b99a90", "parents": [ "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Tue May 05 03:42:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:39:20 2026 -0700" }, "message": "netdevsim: psp: only call nsim_psp_uninit() on PFs\n\nVFs go through nsim_init_netdevsim_vf() which never calls\nnsim_psp_init(), so ns-\u003epsp.dev stays NULL. nsim_psp_uninit() guards\nwith !IS_ERR(ns-\u003epsp.dev), so destroying a VF reaches\npsp_dev_unregister(NULL) and dereferences NULL on the first\nmutex_lock(\u0026psd-\u003elock):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:mutex_lock+0x1c/0x30\n Call Trace:\n psp_dev_unregister+0x2a/0x1a0\n nsim_psp_uninit+0x1f/0x40 [netdevsim]\n nsim_destroy+0x61/0x1e0 [netdevsim]\n __nsim_dev_port_del+0x47/0x90 [netdevsim]\n nsim_drv_configure_vfs+0xc9/0x130 [netdevsim]\n nsim_bus_dev_numvfs_store+0x79/0xb0 [netdevsim]\n\nGate nsim_psp_uninit() on nsim_dev_port_is_pf(), matching the pattern\nalready used for nsim_exit_netdevsim() and the bpf/ipsec/macsec/queue\nteardowns.\n\nReproducer:\n modprobe netdevsim\n echo \"10 1\" \u003e /sys/bus/netdevsim/new_device\n echo 1 \u003e /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\n devlink dev eswitch set netdevsim/netdevsim10 mode switchdev\n echo 0 \u003e /sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\n\nFixes: f857478d6206 (\"netdevsim: a basic test PSP implementation\")\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260505-psd-rcu-v1-1-a8f69ec1ab96@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1", "tree": "a32967d41a88fefdc7f1694b3d5ed4b6f636dbc5", "parents": [ "0e1368a28dd5231ae0dbe240dfe0ff2657de5647" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue May 05 13:00:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:29:23 2026 -0700" }, "message": "ipv6: fix potential UAF caused by ip6_forward_proxy_check()\n\nip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate\nskb-\u003ehead.\n\nReload ipv6_hdr() after the pskb_may_pull() call to avoid using\nthe freed memory.\n\nFixes: e21e0b5f19ac (\"[IPV6] NDISC: Handle NDP messages to proxied addresses.\")\nReported-by: Damiano Melotti \u003cmelotti@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0e1368a28dd5231ae0dbe240dfe0ff2657de5647", "tree": "09f8c9c799205299a8ba45b01507bee96c663f95", "parents": [ "dc61989e37726e0ff3d669e6ad94e62b97149329" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:22:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 06 17:22:24 2026 -0700" }, "message": "selftests: drv-net: fix sort order of makefile and config\n\nRecent changes added configs and tests in the wrong spot.\n\nLink: https://lore.kernel.org/20260506170435.34984dfc@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "dc61989e37726e0ff3d669e6ad94e62b97149329" }