)]}' { "log": [ { "commit": "8bc67e4db64aa72732c474b44ea8622062c903f0", "tree": "1f935f244ad406f31d238ec39e69266aa7d545be", "parents": [ "df685633c3dbc67441cc86f1c3fee58de4652ba2", "79b09c54c6563df9846ca3094bcfd72082c3e1d7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 20 13:19:58 2026 -0500" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 20 13:19:58 2026 -0500" }, "message": "Merge tag \u0027erofs-for-7.1-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs fixes from Gao Xiang:\n\n - Fix a kernel crash related to unaligned zstd extents\n\n - Fix metabuf reference leak in shared xattr initialization\n\n* tag \u0027erofs-for-7.1-rc5-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: fix metabuf leak in inode xattr initialization\n erofs: fix managed cache race for unaligned extents\n" }, { "commit": "df685633c3dbc67441cc86f1c3fee58de4652ba2", "tree": "099f075d1cdb4c3443842f697a564f971d2bafc5", "parents": [ "e312f536f647156ac55e2f12d021cf887af274aa", "593889c401426004bd0ea0f6d4fcece728b03420" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 20 10:15:30 2026 -0500" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 20 10:15:30 2026 -0500" }, "message": "Merge tag \u0027rcu-fixes.v7.1-20260519a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux\n\nPull RCU fixes from Boqun Feng:\n \"Fix a regression introduced by commit 61bbcfb50514 (\"srcu: Push\n srcu_node allocation to GP when non-preemptible\").\n\n SRCU may queue works on CPUs that are \"possible\" but never have been\n online. In such a case, the work callbacks may not be executed until\n the corresponding CPU gets online, and as the callbacks accumulates,\n workqueue lockups will fire.\n\n Fix this by avoiding queuing works on CPUs that have never been\n online\"\n\n* tag \u0027rcu-fixes.v7.1-20260519a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:\n srcu: Don\u0027t queue workqueue handlers to never-online CPUs\n" }, { "commit": "79b09c54c6563df9846ca3094bcfd72082c3e1d7", "tree": "43a5298c6b875e1aee1dd14653cc44acd1abfe76", "parents": [ "649932fc3815eda2f24eb4de4b3a5e94886ee0b9" ], "author": { "name": "Jia Zhu", "email": "zhujia.zj@bytedance.com", "time": "Wed May 20 12:46:07 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Wed May 20 14:53:14 2026 +0800" }, "message": "erofs: fix metabuf leak in inode xattr initialization\n\ncommit bb88e8da0025 (\"erofs: use meta buffers for xattr operations\")\nconverted xattr operations to use on-stack erofs_buf instances.\nerofs_init_inode_xattrs() uses such a metabuf while reading the inline\nxattr header and shared xattr id array.\n\nSome error paths after erofs_read_metabuf() leave through out_unlock\nwithout dropping the metabuf, so the folio reference can leak.\n\nConsolidate the cleanup at out_unlock. erofs_put_metabuf() is a\nno-op if no folio has been acquired, and this keeps all paths after\ntaking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.\n\nFixes: bb88e8da0025 (\"erofs: use meta buffers for xattr operations\")\nSigned-off-by: Jia Zhu \u003czhujia.zj@bytedance.com\u003e\nReviewed-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\nFixes: bb88e8da0025 (\"erofs: use meta buffers for xattr operations\")\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "649932fc3815eda2f24eb4de4b3a5e94886ee0b9", "tree": "9511325c36b35a8dad2fa90355c959e8ff8f23a2", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Tue Apr 28 12:34:31 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "hsiangkao@linux.alibaba.com", "time": "Wed May 20 14:52:52 2026 +0800" }, "message": "erofs: fix managed cache race for unaligned extents\n\nAfter unaligned compressed extents were introduced, the following race\ncould occur:\n\n[Thread 1] [Thread 2]\n(z_erofs_fill_bio_vec)\n\u003chandle a Z_EROFS_PREALLOCATED_FOLIO folio\u003e\n...\nfilemap_add_folio (1)\n (z_erofs_bind_cache)\n \u003cthe same folio is found..\u003e\n ..\n ..\nfolio_attach_private (2)\n filemap_add_folio (3) again\n\nSince (1) is executed but (2) hasn\u0027t been executed yet, it\u0027s possible\nthat another thread finds the same managed folio in z_erofs_bind_cache()\nfor a different pcluster and calls filemap_add_folio() again since\nfolio-\u003eprivate is still Z_EROFS_PREALLOCATED_FOLIO.\n\nFix this by explicitly clearing folio-\u003eprivate before making the folio\nvisible in the managed cache so that another pcluster can simply wait\non the locked managed folio as what we did for other shared cases [1].\n\nThis only impacts unaligned data compression (`-E48bit` with zstd,\nfor example).\n\n[1] Commit 9e2f9d34dd12 (\"erofs: handle overlapped pclusters out of\n crafted images properly\") was originally introduced to handle crafted\n overlapped extents, but it addresses unaligned extents as well.\n\nFixes: 7361d1e3763b (\"erofs: support unaligned encoded data\")\nReported-by: Arseniy Krasnov \u003cavkrasnov@salutedevices.com\u003e\nCloses: https://lore.kernel.org/r/4a2f3801-fac1-42fe-ae75-da315822e088@salutedevices.com\nTested-by: Arseniy Krasnov \u003cavkrasnov@salutedevices.com\u003e\nSigned-off-by: Gao Xiang \u003chsiangkao@linux.alibaba.com\u003e\n" }, { "commit": "e312f536f647156ac55e2f12d021cf887af274aa", "tree": "cb66bd06492459f9e291ef045effef4927b24744", "parents": [ "27fa82620cbaa89a7fc11ac3057701d598813e87", "4a9b16541ad3faf8bccb398532bf3f8b6bbf1188" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 15:31:35 2026 -0500" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 15:31:35 2026 -0500" }, "message": "Merge tag \u0027lsm-pr-20260519\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm\n\nPull lsm fix from Paul Moore:\n \"A single LSM patch to add a missing credential mutex lock to the\n lsm_set_self_attr(2) syscall so it behaves similar to the associated\n procfs API and avoids issues with ptrace\"\n\n* tag \u0027lsm-pr-20260519\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:\n lsm: hold cred_guard_mutex for lsm_set_self_attr()\n" }, { "commit": "27fa82620cbaa89a7fc11ac3057701d598813e87", "tree": "782dd20139ae68b5538e11cbf0f11355e20d7da6", "parents": [ "1a2ab0feaa23147e347b4d4cb79cb3fc392118eb", "759e8756da00aa115d504a18155b1d1ee1cc12e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 14:00:48 2026 -0500" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 14:00:48 2026 -0500" }, "message": "Merge tag \u0027ata-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Make sure that the issuing of a deferred non-NCQ command via\n workqueue feature is only used when mixing NCQ and non-NCQ commands\n to the same link (i.e. return value ATA_DEFER_LINK), and nothing\n else. This way we will not incorrectly try to use the feature for\n e.g. PATA drivers\n\n - The deferred non-NCQ command was stored in a per-port struct. When\n using Port Multipliers with FIS-Based Switching, we would thus\n needlessly defer commands to all other links. Store the deferred QC\n in a per-link struct, such that Port Multipliers with FBS will get\n the same performance as before\n\n - The issuing of a deferred non-NCQ command via workqueue feature broke\n support for Port Multipliers using Command-Based Switching. The\n issuing of a deferred non-NCQ command via workqueue feature is not\n compatible with the use of ap-\u003eexcl_link, which PMPs with CBS use for\n fairness (using implicit round robin)\n\n* tag \u0027ata-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: do not needlessly defer commands when using PMP with FBS\n ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS\n ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT\n ata: libata-scsi: improve readability of ata_scsi_qc_issue()\n" }, { "commit": "1a2ab0feaa23147e347b4d4cb79cb3fc392118eb", "tree": "5274d8e48a702e4910b42aa6848b493648b032a6", "parents": [ "0c0b282d502b1fc5a67740ea1d88b90c042d5727", "4b83cbc4c15f09b000cc06f033f64b0824b6dc87" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:49:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:49:32 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc4-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix two null pointer dereferences and a memory leak\n\n* tag \u0027v7.1-rc4-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: fix null pointer dereference in compare_guid_key()\n ksmbd: fix null pointer dereference in proc_show_files()\n ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow\n" }, { "commit": "0c0b282d502b1fc5a67740ea1d88b90c042d5727", "tree": "c0a59a3b821e928831171b41b2eecc3b8335a137", "parents": [ "650d21334c4fbbdbf085b9f542cc530a7d5cd4fd", "2beaa98b46c4cc90ed8a674f27a586d7f547bbe5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:47:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:47:23 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Check the index depth limit via ntfs_icx_parent_inc(), avoiding\n context corruption from excessively deep child chains\n\n - Switch security descriptor allocation to kzalloc() to avoid leaking\n uninitialized memory\n\n - Prevent an inconsistent state where vol-\u003evolume_label becomes NULL on\n allocation failure\n\n - Validate MFT records by verifying that attrs_offset sits within\n bytes_in_use\n\n - Fix an off-by-one boundary comparison, correctly catching the\n out-of-range MFT record number\n\n - Validate the attribute name offset and length bounds prior to\n AT_UNUSED enumeration\n\n - Check for a valid left neighbor before runlist merges to prevent an\n 8byte out-of-bounds write on crafted volumes\n\n - Add the missing record comparison against $MFTMirr during mount\n\n - Fix wrong inode lookup when writing extent MFT records\n\n - Redirty folio on memory allocation failure in ntfs_write_mft_block()\n\n - Capture and propagate $MFTMirr sync errors during writeback\n\n - Ensure MFT mirror and synchronous writes wait for I/O completion\n\n - Fix buffer overflow/heap over-read in ntfs_bdev_write() when cluster\n size is smaller than PAGE_SIZE\n\n - Fix use-after-free in ntfs_inode_sync_filename() when parent index\n inode is evicted while still holding its mrec_lock\n\n - Update resident attribute length validation to match $AttrDef\n\n - Fix refcount underflow and UAF of the global upcase table\n\n - Fix two smatch warnings\n\n* tag \u0027ntfs-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: restore $MFT mirror contents check\n ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()\n ntfs: validate attribute name bounds before returning it\n ntfs: fix MFT bitmap scan 2^32 boundary check\n ntfs: validate MFT attrs_offset against bytes_in_use\n ntfs: fix missing kstrdup() error check in ntfs_write_volume_label()\n ntfs: avoid leaking uninitialised bytes in new security descriptors\n ntfs: fix out-of-bounds write in ntfs_index_walk_down()\n ntfs: fix out-of-bounds write in ntfs_rl_collapse_range() merge path\n ntfs: fix variable dereferenced before check ni in ntfs_attr_open()\n ntfs: fix default_upcase refcount underflow and UAF on fs_context teardown\n ntfs: match ntfs_resident_attr_min_value_length with $AttrDef\n ntfs: avoid use-after-free of index inode in ntfs_inode_sync_filename()\n ntfs: fix copy length in ntfs_bdev_write() for non-page-aligned start\n ntfs: wait for sync mft writes to complete\n ntfs: capture mft mirror sync errors in ntfs_write_mft_block()\n ntfs: redirty folio when ntfs_write_mft_block() runs out of memory\n ntfs: use base mft_no when looking up base inode for extent record\n ntfs: fix variable dereferenced before check ni and attr in ntfs_attrlist_entry_add()\n" }, { "commit": "650d21334c4fbbdbf085b9f542cc530a7d5cd4fd", "tree": "534db39a17105a4cb5d508b4099df0652c3621f2", "parents": [ "c6e99c10fd9855082568cbd71bb2cc5dc90eda53", "202550713128da20d9381d6d2dc0f6b73839f434" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:43:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 09:43:24 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nicolas Schier:\n\n - modpost: prevent stack buffer overflow in do_input_entry() and\n do_dmi_entry()\n\n Defensively replace unbound sprintf() calls in file2alias to prevent\n silent stack overflows and detect alias name overflows with proper\n error message.\n\n - kbuild: pacman-pkg: make \"rc\" releases adhere to pacman versioning\n scheme\n\n Enable smooth upgrades from \"rc\" releases w/ pacman packages.\n\n* tag \u0027kbuild-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n kbuild: pacman-pkg: make \"rc\" releases adhere to pacman versioning scheme\n modpost: prevent stack buffer overflow in do_input_entry() and do_dmi_entry()\n" }, { "commit": "c6e99c10fd9855082568cbd71bb2cc5dc90eda53", "tree": "8dc8116ae7acb79e3e002fbe5e38605c8a614f87", "parents": [ "ab5fce87a778cb780a05984a2ca448f2b41aafbf", "be3f38d05cc5a7c3f13e51994c5dd043ab604d28" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 07:49:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 19 07:49:33 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-05-18-21-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"14 hotfixes. 9 are for MM. 10 are cc:stable and the remainder are for\n post-7.1 issues or aren\u0027t deemed suitable for backporting.\n\n There\u0027s a two-patch MAINTAINERS series from Mike Rapoport which\n updates us for the new KEXEC/KDUMP/crash/LUO/etc arrangements. And\n another two-patch series from Muchun Song to fix a couple of\n memory-hotplug issues. Otherwise singletons, please see the changelogs\n for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-05-18-21-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/memory: fix spurious warning when unmapping device-private/exclusive pages\n mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()\n drivers/base/memory: fix memory block reference leak in poison accounting\n mm/memory_hotplug: fix memory block reference leak on remove\n lib: kunit_iov_iter: fix test fail on powerpc\n mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free\n MAINTAINERS: add kexec@ list to LIVE UPDATE ENTRY\n MAINTAINERS: add tree for KDUMP and KEXEC\n selftests/mm: run_vmtests.sh: fix destructive tests invocation\n scripts/gdb: slab: update field names of struct kmem_cache\n scripts/gdb: mm: cast untyped symbols in x86_page_ops\n mm/damon: fix damos_stat tracepoint format for sz_applied\n mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()\n mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page\n" }, { "commit": "202550713128da20d9381d6d2dc0f6b73839f434", "tree": "9ae71932d935499daee3060dc358f49b3ac24976", "parents": [ "49f8fcde68898f5033082e8155cd344dd54ef232" ], "author": { "name": "Viktor Jägersküpper", "email": "viktor_jaegerskuepper@freenet.de", "time": "Fri May 15 23:58:45 2026 +0200" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Tue May 19 12:29:19 2026 +0200" }, "message": "kbuild: pacman-pkg: make \"rc\" releases adhere to pacman versioning scheme\n\nThe package versioning scheme does not enable smooth upgrades from \"rc\"\nreleases to the corresponding stable releases (e.g. 7.0.0-rc7 -\u003e 7.0.0)\nbecause pacman considers that a downgrade due to the underscore in\npkgver (e.g. 7.0.0_rc7), see e.g. vercmp(8) for an explanation of the\npackage version comparison used by pacman. Package versions which are\nderived from said releases (e.g. built from git revisions) are\nsimilarly affected. Fix this by modifying pkgver in order to remove the\nhyphen from kernel versions containing \"-rcN\", where N is a\nnon-negative integer.\n\nAcked-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nSigned-off-by: Viktor Jägersküpper \u003cviktor_jaegerskuepper@freenet.de\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nTested-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260515215913.92481-1-viktor_jaegerskuepper@freenet.de\nFixes: c8578539deba (\"kbuild: add script and target to generate pacman package\")\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "49f8fcde68898f5033082e8155cd344dd54ef232", "tree": "37fed61319debc80e00c18c0d9d6bbac8b3b0631", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8" ], "author": { "name": "Hasan Basbunar", "email": "basbunarhasan@gmail.com", "time": "Tue May 05 18:11:02 2026 +0200" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Tue May 19 12:29:18 2026 +0200" }, "message": "modpost: prevent stack buffer overflow in do_input_entry() and do_dmi_entry()\n\nSeveral functions in scripts/mod/file2alias.c build the module alias\nstring by repeatedly appending into a fixed-size on-stack buffer:\n\n\tchar alias[256] \u003d {};\n\t...\n\tsprintf(alias + strlen(alias), \"%X,*\", i);\n\nThis pattern is unbounded and silently corrupts the stack when the\nformatted output exceeds the destination size. Two functions in this\nfile are realistically reachable with input that overflows their\nbuffer:\n\n1. do_input_entry() appends across nine bitmap classes\n (evbit/keybit/relbit/absbit/mscbit/ledbit/sndbit/ffbit/swbit). The\n keybit case alone scans bits from INPUT_DEVICE_ID_KEY_MIN_INTERESTING\n (0x71) to INPUT_DEVICE_ID_KEY_MAX (0x2ff), 655 iterations; if a\n MODULE_DEVICE_TABLE(input, ...) populates keybit[] densely, the\n emission reaches ~3132 bytes — overflowing the 256-byte buffer by\n about 12x. include/linux/mod_devicetable.h declares storage for the\n full bit range (\"keybit[INPUT_DEVICE_ID_KEY_MAX / BITS_PER_LONG + 1]\"),\n so the worst case is reachable per the ABI.\n\n2. do_dmi_entry() emits one \":\u003cprefix\u003e*\u003cfiltered_substr\u003e*\" segment per\n matched DMI field, up to 4 matches per dmi_system_id. Each substr\n is sized as char[79] in struct dmi_strmatch (mod_devicetable.h:584),\n and dmi_ascii_filter() copies it verbatim into the alias buffer\n without bounds. Worst case: 4 × (1 + 3 + 1 + 79 + 1) \u003d 336 bytes\n into alias[256], an 80-byte overflow.\n\nNo driver in the current tree triggers either case — every in-tree\nINPUT_DEVICE_ID_MATCH_KEYBIT user populates keybit[] very sparsely\n(1-3 bits), and no in-tree dmi_system_id has four maximally-long\nmatches. The concern is defense-in-depth: both unbounded sprintf\nchains are silent stack-corruption primitives in a host build tool,\nand the buffer sizes have not been revisited since the corresponding\ncode was first introduced.\n\nThe other do_*_entry() handlers in this file (do_usb_entry,\ndo_cpu_entry, do_typec_entry, ...) were audited and are bounded by\ntheir input field sizes (uint16 IDs, fixed-length keys); their alias\nbuffers do not need this treatment.\n\nReproduced under AddressSanitizer with a stand-alone harness mirroring\ndo_input on a fully-populated keybit:\n\n \u003d\u003d18319\u003d\u003dERROR: AddressSanitizer: stack-buffer-overflow\n WRITE of size 2 at offset 288 in frame [32, 288) \u0027alias\u0027\n #6 do_input poc.c:44\n\n Stack-canary build:\n Abort trap: 6 (strlen(alias)\u003d3134, cap was 256-1)\n\nAdd a small alias_append() helper around vsnprintf with a remaining-\nspace check and call fatal() on overflow, matching the modpost style\nfor unrecoverable build conditions. do_input() takes the buffer size\nas a new parameter; do_input_entry() and do_dmi_entry() pass\nsizeof(alias) at every call site. dmi_ascii_filter() takes the\nremaining buffer size as well and aborts on truncation. This bounds\nevery write into the on-stack buffers and turns the latent overflow\ninto a clean build error if it is ever reached.\n\nFixes: 1d8f430c15b3 (\"[PATCH] Input: add modalias support\")\nReviewed-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nTested-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nSigned-off-by: Hasan Basbunar \u003cbasbunarhasan@gmail.com\u003e\nLink: https://patch.msgid.link/20260505161102.44087-1-basbunarhasan@gmail.com\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "ab5fce87a778cb780a05984a2ca448f2b41aafbf", "tree": "31a836f042bfef21e320e4e6d4359dfaf43f4ca9", "parents": [ "8cf8b5ae8e093132b0dce0a932af10c9ef077936", "9a424b62f771a759b040b9be2f3762bad0da283f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 17:55:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 17:55:42 2026 -0700" }, "message": "Merge tag \u0027perf-tools-fixes-for-v7.1-2026-05-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\n\nPull perf-tools fixes\n \"An usual sync-up for the header files and related code:\n\n - copy headers that are used for perf trace syscall beautifier\n\n - update the beautifier scripts according to the changes\n\n - don\u0027t show differences in the headers by default\"\n\n* tag \u0027perf-tools-fixes-for-v7.1-2026-05-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:\n perf trace: Update beautifier script for clone flags\n perf trace: Add beautifier script for fsmount flags\n perf build: Add make check-headers target\n perf trace: Sync uapi/linux/sched.h with the kernel source\n perf trace: Sync uapi/linux/mount.h with the kernel source\n perf trace: Sync uapi/linux/fs.h with the kernel source\n perf trace: Sync linux/socket.h with the kernel source\n" }, { "commit": "8cf8b5ae8e093132b0dce0a932af10c9ef077936", "tree": "a10ca92638ec56e48ef0f51d42553ce45bc5cd16", "parents": [ "4d3a2a466b8d68d852a1f3bbf11204b718428dc4" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Mon May 18 22:13:09 2026 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 17:50:06 2026 -0700" }, "message": "cifs: Fix undefined variables\n\nFix a couple of undefined variables introduced by the patch to fix tearing\non -\u003eremote_i_size and -\u003ezero_point. For some reason, make W\u003d1 with gcc\ndoesn\u0027t give undefined variable warnings (but clang does).\n\nFixes: 2c8f4742bb76 (\"netfs: Fix potential for tearing in -\u003eremote_i_size and -\u003ezero_point\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605031459.eX5UbO3K-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202605021450.ca5QGqLH-lkp@intel.com/\ncc: Steve French \u003csfrench@samba.org\u003e\ncc: Paulo Alcantara \u003cpc@manguebit.org\u003e\ncc: Matthew Wilcox \u003cwilly@infradead.org\u003e\ncc: Christian Brauner \u003cbrauner@kernel.org\u003e\ncc: linux-cifs@vger.kernel.org\ncc: netfs@lists.linux.dev\ncc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4d3a2a466b8d68d852a1f3bbf11204b718428dc4", "tree": "f4536037d8711d8b00b4e56c75157cf4a7076991", "parents": [ "4bf5d3da79c48e1df4bab82c9680c53adeff7820" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Sun May 17 13:51:01 2026 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 13:05:41 2026 -0700" }, "message": "HID: core: Fix size_t specifier in hid_report_raw_event()\n\nWhen building for 32-bit platforms, for which \u0027size_t\u0027 is\n\u0027unsigned int\u0027, there are warnings around using the incorrect format\nspecifier to print bsize in hid_report_raw_event():\n\n drivers/hid/hid-core.c:2054:29: error: format specifies type \u0027long\u0027 but the argument has type \u0027size_t\u0027 (aka \u0027unsigned int\u0027) [-Werror,-Wformat]\n 2053 | hid_warn_ratelimited(hid, \"Event data for report %d is incorrect (%d vs %ld)\\n\",\n | ~~~\n | %zu\n 2054 | report-\u003eid, csize, bsize);\n | ^~~~~\n drivers/hid/hid-core.c:2076:29: error: format specifies type \u0027long\u0027 but the argument has type \u0027size_t\u0027 (aka \u0027unsigned int\u0027) [-Werror,-Wformat]\n 2075 | hid_warn_ratelimited(hid, \"Event data for report %d was too short (%d vs %ld)\\n\",\n | ~~~\n | %zu\n 2076 | report-\u003eid, rsize, bsize);\n | ^~~~~\n\nUse the proper \u0027size_t\u0027 format specifier, \u0027%zu\u0027, to clear up the\nwarnings.\n\nCc: stable@vger.kernel.org\nFixes: 2c85c61d1332 (\"HID: pass the buffer size to hid_report_raw_event\")\nReported-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nCloses: https://lore.kernel.org/20260516020430.110135-1-ojeda@kernel.org/\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9a424b62f771a759b040b9be2f3762bad0da283f", "tree": "28a40a5c92f0c57826e2bae291fc147f561b07a0", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "5a433107fab621f4e7379ccba6e52b5b1601046c" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Mon May 18 12:41:38 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Mon May 18 12:41:38 2026 -0700" }, "message": "Merge branch \u0027perf-upstream\u0027\n" }, { "commit": "593889c401426004bd0ea0f6d4fcece728b03420", "tree": "8d7b74734f4c2e5d5597744df669f97f3d35b4c9", "parents": [ "7fd2df204f342fc17d1a0bfcd474b24232fb0f32" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Mon May 11 19:54:41 2026 +0200" }, "committer": { "name": "Boqun Feng", "email": "boqun@kernel.org", "time": "Mon May 18 12:27:18 2026 -0700" }, "message": "srcu: Don\u0027t queue workqueue handlers to never-online CPUs\n\nWhile an srcu_struct structure is in the midst of switching from CPU-0\nto all-CPUs state, it can attempt to invoke callbacks for CPUs that\nhave never been online. Worse yet, it can attempt in invoke callbacks\nfor CPUs that never will be online, even including imaginary CPUs not in\ncpu_possible_mask. This can cause hangs on s390, which is not set up to\ndeal with workqueue handlers being scheduled on such CPUs. This commit\ntherefore causes Tree SRCU to refrain from queueing workqueue handlers\non CPUs that have not yet (and might never) come online.\n\nBecause callbacks are not invoked on CPUs that have not been\nonline, it is an error to invoke call_srcu(), synchronize_srcu(), or\nsynchronize_srcu_expedited() on a CPU that is not yet fully online.\nHowever, it turns out to be less code to redirect the callbacks\nfrom too-early invocations of call_srcu() than to warn about such\ninvocations. This commit therefore also redirects callbacks queued on\nnot-yet-fully-online CPUs to the boot CPU.\n\nReported-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nFixes: 61bbcfb50514 (\"srcu: Push srcu_node allocation to GP when non-preemptible\")\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nTested-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nTested-by: Samir \u003csamir@linux.ibm.com\u003e\nReviewed-by: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Uladzislau Rezki (Sony) \u003curezki@gmail.com\u003e\nSigned-off-by: Boqun Feng \u003cboqun@kernel.org\u003e\n" }, { "commit": "4bf5d3da79c48e1df4bab82c9680c53adeff7820", "tree": "c748573ef3f892f67c2ea94c202ea867c8936103", "parents": [ "5dfa01ef37a8b944773aef8dee747cd76dec4234", "646ebdd3105809d84ed04aa9e92e47e89cc44502" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 08:45:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 08:45:32 2026 -0700" }, "message": "Merge tag \u0027media/v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fix from Mauro Carvalho Chehab:\n \"Fix inverted error logic in ttusbir driver\"\n\n* tag \u0027media/v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: rc: ttusbir: fix inverted error logic\n" }, { "commit": "5dfa01ef37a8b944773aef8dee747cd76dec4234", "tree": "6bb130af80a0e43b8bc3fd832ecbea1919ce6dc8", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "8a220d1c312c66194f4a33dd52d1fba42bc2b341" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 07:30:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 18 07:30:31 2026 -0700" }, "message": "Merge tag \u0027vfs-7.1-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n \"This contains a fixes for the current development cycle. Note that AI\n related review sometimes delays fixes a bit because we find more fixes\n for the fixes. I might try and send smaller but more fixes PRs if this\n trend keeps up.\n\n - Fix various netfslib bugs\n\n - Fix an out-of-bounds write when listing idmappings\n\n - Fix the return values in jfs_mkdir() and orangefs_mkdir()\n\n - Fix a writeback writeback array overflow in fuse\n\n - Fix a forced iversion increment on lazytime timestamp updates\n\n - Reject a negative timeval component in kern_select()\n\n - Fix error return when vfs_mkdir() fails in the cachefiles code\n\n - Fix wrong error code returned for pidns ioctls\"\n\n* tag \u0027vfs-7.1-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (31 commits)\n cachefiles: Fix error return when vfs_mkdir() fails\n afs: Fix the locking used by afs_get_link()\n netfs, afs: Fix write skipping in dir/link writepages\n netfs: Fix netfs_read_folio() to wait on writeback\n netfs: Fix folio-\u003eprivate handling in netfs_perform_write()\n netfs: Fix partial invalidation of streaming-write folio\n netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()\n netfs: Fix leak of request in netfs_write_begin() error handling\n netfs: Fix early put of sink folio in netfs_read_gaps()\n netfs: Fix write streaming disablement if fd open O_RDWR\n netfs: Fix read-gaps to remove netfs_folio from filled folio\n netfs: Fix potential deadlock in write-through mode\n netfs: Fix streaming write being overwritten\n netfs: Defer the emission of trace_netfs_folio()\n netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone\n netfs: Fix overrun check in netfs_extract_user_iter()\n netfs: fix error handling in netfs_extract_user_iter()\n netfs: Fix potential uninitialised var in netfs_extract_user_iter()\n netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call\n netfs: Fix zeropoint update where i_size \u003e remote_i_size\n ...\n" }, { "commit": "759e8756da00aa115d504a18155b1d1ee1cc12e8", "tree": "e2538e1930408251bcf26b71deb9c442c78eb1a9", "parents": [ "f233124fb36cd57ef09f96d517a38ab4b902e15e" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu May 14 09:39:02 2026 +0200" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Mon May 18 12:26:51 2026 +0200" }, "message": "ata: libata-scsi: do not needlessly defer commands when using PMP with FBS\n\nThe ACS specification does not allow a non-NCQ command to be issued while\nan NCQ command is outstanding.\n\nCommit 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nintroduced a feature where a deferred non-NCQ command gets issued from a\nworkqueue. The design stores a single non-NCQ command per port.\n\nHowever, when using Port Multipliers (PMPs), specifically PMPs that\nsupport FIS-Based Switching (FBS), non-NCQ and NCQ commands can be mixed\non the same port, just not for the same link, see e.g. ata_std_qc_defer()\nwhich is, and always has operated on a per-link basis.\n\nTherefore, move the deferred_qc from struct ata_port to struct ata_link.\nThis way, when using a PMP with FBS, we will not needlessly defer commands\nto all other links, just because one link issued a non-NCQ command while\nhaving an NCQ command outstanding. Only commands for that specific link\nwill be deferred. This is in line with how PMPs with FBS worked before\ncommit 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\").\n\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nTested-by: Tommy Kelly \u003clinux@tkel.ly\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "f233124fb36cd57ef09f96d517a38ab4b902e15e", "tree": "2528e5198bad20e71b52a99f7ff73b15f19ae583", "parents": [ "ce4548807d2e4ae48fd0dbe38865467369877913" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu May 14 09:39:01 2026 +0200" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Mon May 18 12:25:28 2026 +0200" }, "message": "ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS\n\nWhen using Port Multipliers (PMPs) with Command-Based Switching (CBS), you\ncan only issue commands to one link at a time. For PMPs with CBS, there is\nalready code to handle commands being sent to different links in\nsata_pmp_qc_defer_cmd_switch() using ap-\u003eexcl_link. sata_sil24 also makes\nuse of ap-\u003eexcl_link.\n\nA user on the list reported that commit 0ea84089dbf6 (\"ata: libata-scsi:\navoid Non-NCQ command starvation\") broke PMPs with CBS. The commit\nintroduced code that stores a deferred qc in ap-\u003edeferred_qc, to later be\nissued via a workqueue. It turns out that this change is incompatible with\nthe existing ap-\u003eexcl_link handling used by PMPs with CBS.\n\nThus, modify sata_pmp_qc_defer_cmd_switch() and sil24_qc_defer() to return\nATA_DEFER_LINK_EXCL, and make sure that the deferred QC handling via\nworkqueue is not used for this return value.\n\nThis way, PMPs with CBS will work once again. Note that the starvation\nreferenced in commit 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ\ncommand starvation\") can only happen on libsas ports, and libsas does not\nsupport Port Multipliers, thus there is no harm of reverting back to the\nprevious way of deferring commands for PMPs with CBS.\n\nNon-libsas ports connected to anything but a PMP with CBS (e.g. a normal\ndrive or a PMP with FBS) will continue using the deferred workqueue, since\nit does result in lower completion latencies for non-NCQ commands, even\nthough the workqueue is not strictly needed to avoid starvation for\nnon-libsas ports.\n\nIf we want to modify the scope of the workqueue issuing to also handle\nPMPs with CBS, then we should ensure that we can save both NCQ and non-NCQ\ncommands in ap-\u003edeferred_qc, while also removing the existing PMP CBS\nhandling using ap-\u003eexcl_link, such that we don\u0027t duplicate features.\n\nWhile at it, also add a comment explaining how the ap-\u003eexcl_link mechanism\nworks.\n\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nTested-by: Tommy Kelly \u003clinux@tkel.ly\u003e\nReported-by: Tommy Kelly \u003clinux@tkel.ly\u003e\nCloses: https://lore.kernel.org/linux-ide/ce09cc21-a8e9-4845-b205-35411e22fba9@tkel.ly/\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "ce4548807d2e4ae48fd0dbe38865467369877913", "tree": "5c128ef53894c413d6f7804869504d3864f77fa7", "parents": [ "360190bd965f93794d5f5685a6de22ce6da2b672" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu May 14 09:39:00 2026 +0200" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Mon May 18 12:11:46 2026 +0200" }, "message": "ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT\n\nThe deferred QC feature was meant to handle mixed NCQ and non-NCQ commands,\ni.e. for return value ATA_DEFER_LINK.\n\nATA_DEFER_PORT is returned by PATA drivers, but also certain SATA drivers\nlike sata_mv and sata_sil24 that uses ap-\u003eexcl_link to workaround hardware\nbugs in these HBAs. Regardless of the reason, using the deferred QC feature\nfor ATA_DEFER_PORT is always wrong, and will break the ap-\u003eexcl_link usage\nof the SATA drivers that rely on that feature.\n\nModify ata_scsi_qc_issue() to only use the deferred QC feature when mixing\nNCQ and non-NCQ commands, i.e. ATA_DEFER_LINK.\n\nFixes: 0ea84089dbf6 (\"ata: libata-scsi: avoid Non-NCQ command starvation\")\nTested-by: Tommy Kelly \u003clinux@tkel.ly\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "360190bd965f93794d5f5685a6de22ce6da2b672", "tree": "6566c66390ce7de594faad66aa65486425fe894d", "parents": [ "163f6494233e1679ec6fa6a4803f74ae7b1c94db" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu May 14 09:38:59 2026 +0200" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Mon May 18 12:10:34 2026 +0200" }, "message": "ata: libata-scsi: improve readability of ata_scsi_qc_issue()\n\nImprove readability of ata_scsi_qc_issue().\n\nNo functional changes.\n\nTested-by: Tommy Kelly \u003clinux@tkel.ly\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "tree": "3e6f6fc02705146ac1151cfb68029510396c3afd", "parents": [ "e5d505e3664bb31f59776b7b3873965228fe944f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 13:59:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 13:59:58 2026 -0700" }, "message": "Linux 7.1-rc4\n" }, { "commit": "e5d505e3664bb31f59776b7b3873965228fe944f", "tree": "7ef201030bfb993625582e10b16a881b2cea206a", "parents": [ "23e6a1ca04ae44806439a5a446e62e4d42e80bb4", "55a0005518195fdea1fd2991b07644f8dc97ea8e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 12:02:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 12:02:31 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Add more functions to the remote allowed list\n\n randconfig found more functions that are allowed for the remote code\n for s390 and arm. Add them to the allowed list.\n\n - Fix remote_test error path\n\n If one of the simple ring buffers fails to load, the code is supposed\n to rollback its initialized buffers. Instead of rolling back the\n buffers for the failed load, it uses the global variable and rolls\n back all the successfully loaded buffers.\n\n* tag \u0027trace-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix desc in error path for the trace remote test module\n ring-buffer remote: Avoid unexpected symbol warnings (arm, s390)\n" }, { "commit": "23e6a1ca04ae44806439a5a446e62e4d42e80bb4", "tree": "5a56958c66555bc3d55a4689f41082c0ac4aa319", "parents": [ "e7f24a388e703e505a7f8d014a428308b35e8f94" ], "author": { "name": "Carlos López", "email": "clopez@suse.de", "time": "Tue May 12 12:00:41 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:45:07 2026 -0700" }, "message": "virt: sev-guest: Do not use host-controlled page order in cleanup path\n\nWhen issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),\nget_ext_report() allocates a buffer to retrieve a certificate blob from the\nhost, keeping track of its size in report_req-\u003ecerts_len.\n\nHowever, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating\nan invalid buffer size, as well as the expected length of such buffer.\nget_ext_report() subsequently updates report_req-\u003ecerts_len with the\nhost-controlled value, and cleans up the buffer by computing a page order\nfrom such value. This is incorrect, as the host-provided length may not\nmatch the page order of the original allocation, potentially resulting\nin corruption in the page allocator.\n\nFix this by using alloc_pages_exact() instead, and reusing @npages to\ncompute the size passed to free_pages_exact(). For consistency, also\nuse @npages to compute the size when allocating the pages, even though\nthis last change has no functional effect.\n\nFixes: 3e385c0d6ce8 (\"virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex\")\nSigned-off-by: Carlos López \u003cclopez@suse.de\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nTested-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e7f24a388e703e505a7f8d014a428308b35e8f94", "tree": "4bea6bab9b976c75bc8e156af145e52d756311f3", "parents": [ "46cd5b22e58805b5651dfc732cd23615e940ac8d", "786a45757dcdf8f2beb9d4a6db605db16c18b2b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:40:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:40:18 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Fix x86 boot crash for non-kjump kexecs (David Woodhouse)\n\n* tag \u0027x86-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/kexec: Push kjump return address even for non-kjump kexec\n" }, { "commit": "46cd5b22e58805b5651dfc732cd23615e940ac8d", "tree": "df4529fa17faa92a55b5d7b725519a549d7792ad", "parents": [ "c97481ab7973ef21084e71b8e965b51e69b574df", "602d60ebae0f10bfbc7ba90eee026fdbd0203df3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:07:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:07:09 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix potential garbage reads in the vDSO gettimeofday code\n (Thomas Weißschuh)\n\n* tag \u0027timers-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n vdso/gettimeofday: Reload sequence counter after switch to time page in do_aux()\n" }, { "commit": "c97481ab7973ef21084e71b8e965b51e69b574df", "tree": "f53d8b6a3527bda6f877c8faf21fb735aeb7f091", "parents": [ "daa3de23f9e8a60cc817b0b714f6ba3b70799de2", "411c1cf430392c905e39f12bc305dd994da0b426" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:59:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:59:32 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n\n - Fix ARM64-specific rseq regressions (Mark Rutland)\n\n* tag \u0027sched-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n arm64/entry: Fix arm64-specific rseq brokenness\n" }, { "commit": "daa3de23f9e8a60cc817b0b714f6ba3b70799de2", "tree": "049443438ba7aa514941dba31a77a832cf48dba5", "parents": [ "ec296ebf6d6dffef27ab1f01b7fd8bdd9d097a4f", "ea324444ece9f301b5c4ff71b258cc68990c4d61" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:50:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:50:13 2026 -0700" }, "message": "Merge tag \u0027ras-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull MCE fix from Ingo Molnar:\n\n - Fix an MCE polling interval adjustment regression (Borislav Petkov)\n\n* tag \u0027ras-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mce: Restore MCA polling interval halving\n" }, { "commit": "ec296ebf6d6dffef27ab1f01b7fd8bdd9d097a4f", "tree": "3761ce2daa948da1edefb4d66659edb0fdadb8ea", "parents": [ "f7c79949bef47ff93167c8ae85a07ac006ed7139", "91840be8f710370607f949a627e070896faeddb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:34:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:34:15 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull IRQ fixes from Ingo Molnar:\n\n - Fix use-after-free in irq_work_single() on PREEMPT_RT (Jiayuan Chen)\n\n - Don\u0027t call add_interrupt_randomness() for NMIs in\n handle_percpu_devid_irq() (Mark Rutland)\n\n - Remove unused function in the ath79-cpu irqchip driver causing LKP\n CI build warnings (Rosen Penev)\n\n - Fix IRQ allocation/teardown leakage regressions in the GICv5 irqchip\n driver (Sascha Bischoff)\n\n - Fix an IRQ trigger type regression in the Meson S4 SoC irqchip driver\n (Xianwei Zhao)\n\n - Fix CPU offlining regression in the RiscV IMSIC irqchip driver\n (Yong-Xuan Wang)\n\n* tag \u0027irq-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\n irqchip/riscv-imsic: Clear interrupt move state during CPU offlining\n irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()\n irqchip/ath79-cpu: Remove unused function\n genirq/chip: Don\u0027t call add_interrupt_randomness() for NMIs\n irqchip/gic-v5: Allocate ITS parent LPIs as a range\n irqchip/gic-v5: Support range allocation for LPIs\n irqchip/gic-v5: Move LPI allocation into the LPI domain\n" }, { "commit": "f7c79949bef47ff93167c8ae85a07ac006ed7139", "tree": "48915021634358f3027164c8acbfd4c1a17322aa", "parents": [ "1405a07192a3c5420c5fd7437f7945ebe1e71ad7", "b69bcb13ed7024a84d6cd8ad330f1e32782fcf28" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:33:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:33:49 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Relatively low-impact fixes. Probably the most notable one is that we\n no longer ask the monitor-mode firmware to delegate misaligned access\n handling to the kernel by default, since the kernel code needs\n significant improvement to match the functionality of the firmware.\n This change avoids functional problems at some cost in performance,\n but shouldn\u0027t affect any system with misaligned access handling in\n hardware.\n\n - Disable satp register probing when no5lvl is specified on the\n kernel command line\n\n - Fix a CFI-related issue with the misaligned access speed\n measurement code\n\n - Reduce the CFI shadow stack size limit from 4GB to 2GB (following\n ARM64 GCS)\n\n - Prevent the kernel from requesting delegation of misaligned access\n faults unless a new Kconfig option, RISCV_SBI_FWFT_DELEGATE_MISALIGNED,\n is enabled. This will depend on CONFIG_NONPORTABLE until the\n deficiencies of the kernel misaligned access fixup code are fixed\n\n - Fix some potential uninitialized memory accesses in error paths in\n compat_riscv_gpr_set() and compat_restore_sigcontext()\n\n - Fix a bug in the RISC-V MIPS vendor errata patching code where a\n logical-and was used in place of a bitwise-and\n\n - Drop some unnecessary code in riscv_fill_hwcap_from_isa_string()\n\n - Use macros for isa2hwcap indices in riscv_fill_hwcap(), rather than\n open-coding them\n\n - Fix some documentation typos (one affecting \u0027make htmldocs\u0027)\"\n\n* tag \u0027riscv-for-linus-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: misaligned: Make enabling delegation depend on NONPORTABLE\n riscv: Docs: fix unmatched quote warning\n riscv: cfi: reduce shadow stack size limit from 4GB to 2GB\n riscv: cpufeature: Use pre-defined ISA ext macros to index isa2hwcap\n riscv: mm: Fixup no5lvl failure when vaddr is invalid\n riscv: Fix register corruption from uninitialized cregs on error\n riscv: errata: Fix bitwise vs logical AND in MIPS errata patching\n Documentation: riscv: cmodx: fix typos\n riscv: cpufeature: Drop this_hwcap clear in T-Head vector workaround\n riscv: Define __riscv_copy_{,vec_}{words,bytes}_unaligned() using SYM_TYPED_FUNC_START\n" }, { "commit": "1405a07192a3c5420c5fd7437f7945ebe1e71ad7", "tree": "6dbce05e49a466650da16355b4b9c63484b78510", "parents": [ "fe6f8e913df9319db03fd107671ff02f104ca38c", "873e919e3101063a7a75989510ccfc125a4391cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:23:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:23:28 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - asus_atk0110, acpi_power_meter: Add missing NULL pointer checks\n\n - lm90: Fix locking and UAF issues\n\n - sy7636a: Fix sysfs attribute name in documentation\n\n* tag \u0027hwmon-for-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (lm90) Add lock protection to lm90_alert\n hwmon: (lm90) Stop work before releasing hwmon device\n docs: hwmon: sy7636a: fix temperature sysfs attribute name\n hwmon: (asus_atk0110) Check ACPI_COMPANION() against NULL\n hwmon: (acpi_power_meter) Check ACPI_COMPANION() against NULL\n" }, { "commit": "55a0005518195fdea1fd2991b07644f8dc97ea8e", "tree": "2ec0f9f1024e3977336636259651beea1886a505", "parents": [ "96350db80e0acd733e9b9ef61c0d910790b27289" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri May 15 21:16:16 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat May 16 16:11:04 2026 -0400" }, "message": "tracing: Fix desc in error path for the trace remote test module\n\nDuring initialisation in remote_test_load(), if one of the\nsimple_ring_buffer fails to initialise, the error path attempts to\nrollback initialised buffers. However, the rollback incorrectly uses the\nglobal pointer to the trace descriptor, which is only set upon\nsuccessful load completion. Fix the error path by using the local\npointer to the descriptor.\n\nLink: https://patch.msgid.link/20260515201616.337469-1-vdonnefort@google.com\nFixes: ea908a2b79c8 (\"tracing: Add a trace remote module for testing\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\n\nbase-commit: 5d6919055dec134de3c40167a490f33c74c12581\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "fe6f8e913df9319db03fd107671ff02f104ca38c", "tree": "4395f89beaf01f11c567bad5e08696546a25e4fb", "parents": [ "b6a08b017f8c7723c7e4c3fc460a3a7bf5870b2c", "31467b23823ffec1f6fff407f8e3ca9af8b7491a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:53:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:53:14 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - Fix preempt count leak in sysfs show paths\n\n - Fix error handling in pika_dtm_thread\n\n - Remove pmac_low_i2c_{lock,unlock}()\n\n - Enable all windfarms by default\n\n - Fix dead default for GUEST_STATE_BUFFER_TEST\n\n - Remove redundant preempt_disable|enable() calls from\n arch_irq_work_raise()\n\nThanks to Aboorva Devarajan, Ally Heev, Amit Machhiwal, Bart Van Assche,\nChristophe Leroy, Christophe Leroy (CS GROUP), Dan Carpenter, Gautam\nMenghani, Harsh Prateek Bora, Julian Braha, Krzysztof Kozlowski, Linus\nWalleij, Ma Ke, Ritesh Harjani (IBM), and Sayali Patil\n\n* tag \u0027powerpc-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n powerpc/hv-gpci: fix preempt count leak in sysfs show paths\n powerpc: fix dead default for GUEST_STATE_BUFFER_TEST\n powerpc/powermac: Remove pmac_low_i2c_{lock,unlock}()\n powerpc/warp: Fix error handling in pika_dtm_thread\n powerpc: 82xx: fix uninitialized pointers with free attribute\n powerpc/g5: Enable all windfarms by default\n" }, { "commit": "b6a08b017f8c7723c7e4c3fc460a3a7bf5870b2c", "tree": "88e9377bf22c941fa795430b4259da754c767d9f", "parents": [ "6916d5703ddf9a38f1f6c2cc793381a24ee914c6", "6fd9f6e870ea285f05102e8e00e6a7f4495a9a02" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:32:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:32:30 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes. All device-specific small changes:\n\n HD-audio:\n - Fix NULL pointer dereference in snd_hda_ctl_add()\n - ACPI and Kconfig fixes for Cirrus drivers\n - A regression fix CA0132 codec\n - Various device-specific quirks for HP, Lenovo, Samsung, Framework etc\n - Documentation path fix\n\n USB-audio:\n - Boundary checks for MIDI endpoint descriptors\n - Offload mapping error handling for Qualcomm\n - A new device quirk for TTGK Technology USB-C Audio\n - A fix for Focusrite Scarlett2 mixer\"\n\n* tag \u0027sound-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/ca0132: Disable auto-detect on manual output select\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx\n ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio\n ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()\n ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone\n ALSA: hda/cs35l56: Drop malformed default N from Kconfig\n ALSA: hda/realtek: fix mic boost on Framework PTL\n ALSA: hda/realtek: Limit mic boost on Positivo DN50E\n ALSA: doc: cs35l56: Update path to HDA driver source\n ALSA: usb-audio: qcom: Check offload mapping failures\n ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding\n ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio\n ALSA: scarlett2: Add missing error check when initialise Autogain Status\n ALSA: hda: cs35l41: Put ACPI device on missing physical node\n ALSA: hda: cs35l56: Put ACPI device after setting companion\n ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans\n ALSA: usb-audio: Bound MIDI endpoint descriptor scans\n ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 (17aa:38d5)\n" }, { "commit": "873e919e3101063a7a75989510ccfc125a4391cf", "tree": "9d8b479869595016bdd607103e305cb5098b7027", "parents": [ "b09a45601094c7f4ec4db8090b825fa61e169d93" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 14:41:00 2026 -0700" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Sat May 16 08:10:33 2026 -0700" }, "message": "hwmon: (lm90) Add lock protection to lm90_alert\n\nSashiko reports:\n\nlm90_alert() executes in the smbus alert context and calls\nlm90_update_confreg() to disable the hardware alert line, without\nacquiring hwmon_lock.\n\nConcurrently, sysfs write operations (such as lm90_write_convrate) hold\nthe hwmon_lock, temporarily modify data-\u003econfig, and then restore it.\n\nIf an alert interrupt occurs concurrently with a sysfs write, the sysfs\npath will overwrite the alert handler\u0027s modifications to data-\u003econfig\nand the hardware register.\n\nThis unintentionally re-enables the hardware alert line while the alarm is\nstill active, causing an interrupt storm.\n\nAdd the missing lock to lm90_alert() to solve the problem.\n\nFixes: 7a1d220ccb0cc (\"hwmon: (lm90) Introduce function to update configuration register\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "b09a45601094c7f4ec4db8090b825fa61e169d93", "tree": "07b6c47b639461cfabaf34117b00fd9f2662c51b", "parents": [ "51f57607e30bee282a1d40845f89a311cbb26481" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 14:31:49 2026 -0700" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Sat May 16 08:09:55 2026 -0700" }, "message": "hwmon: (lm90) Stop work before releasing hwmon device\n\nSashiko reports:\n\nIn lm90_probe(), the devm action to cancel the alert_work and report_work\n(lm90_restore_conf) is registered in lm90_init_client() before\ndevm_hwmon_device_register_with_info() is called.\n\nBecause devm executes cleanup actions in reverse order during module\nunbind or probe failure, the hwmon device is unregistered and freed first.\n\nIf lm90_alert_work() or lm90_report_alarms() runs in the window between\nthe hwmon device being freed and the delayed works being cancelled,\nlm90_update_alarms() will dereference the freed data-\u003ehwmon_dev here.\n\nFix the problem by canceling the workers separately after registering\nthe hwmon device and before registering the interrupt handler. This ensures\nthat the workers are canceled after interrupts are disabled and before\nthe hwmon device is released. Add \"shutdown\" flag to indicate that device\nshutdown is in progress to prevent workers from being re-armed.\n\nFixes: f6d0775119fb9 (\"hwmon: (lm90) Rework alarm/status handling\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "6916d5703ddf9a38f1f6c2cc793381a24ee914c6", "tree": "1fb4d4a4203c08f683ab24ad56c4e405ce74e90d", "parents": [ "36343a8ff328efd3eb5604e3567d63e6c7906deb", "dc366607c41c45fd0ae6f3db090f31dd611b644a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 17:00:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 17:00:45 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-16\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull, small and all over fixes, mostly xe and amdgpu,\n with some ttm and a core fix for the handle change pain.\n\n core:\n - fix for the fix for the handle change race\n\n ttm:\n - avoid infinite loop in swap out\n - avoid infinite loop in BO shrinking\n - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n\n bridge:\n - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n\n i915:\n - Skip __i915_request_skip() for already signaled requests\n - Fix VSC dynamic range signaling for RGB formats [dp]\n\n xe:\n - Madvise fix around purgeability tracking\n - Restore engine mask for specific blitter style\n - Couple UAF fixes\n - Drop unused ggtt_balloon field\n\n amdgpu:\n - Userq fixes\n - DCN 3.2 fix\n - RAS fix\n - GC 12 fix\n\n gma500:\n - oaktrail_lvds: fix i2c handling\n\n loongson:\n - use managed cleanup for connector polling\n\n panfrost:\n - handle results from reservation locking correctly\n\n qaic:\n - check for integer overflows in mmap logic\n\n rocket:\n - handle results from reservation locking correctly\"\n\n* tag \u0027drm-fixes-2026-05-16\u0027 of https://gitlab.freedesktop.org/drm/kernel: (26 commits)\n drm: Replace old pointer to new idr\n drm/loongson: Use managed KMS polling\n drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure\n drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init\n drm/gma500/oaktrail_lvds: fix hang on init failure\n drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup\n drm/xe: Drop unused ggtt_balloon field\n accel/qaic: Add overflow check to remap_pfn_range during mmap\n drm/i915/dp: Fix VSC dynamic range signaling for RGB formats\n drm/i915: skip __i915_request_skip() for already signaled requests\n drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12\n drm/amd/ras: Fix CPER ring debugfs read overflow\n drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n drm/amdgpu: fix userq hang detection and reset\n drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues\n drm/amdgpu: rework amdgpu_userq_signal_ioctl v3\n drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset\n drm/xe/dma-buf: fix UAF with retry loop\n ...\n" }, { "commit": "dc366607c41c45fd0ae6f3db090f31dd611b644a", "tree": "d5e6bb97b8533f124fab699170844134dc34f832", "parents": [ "396db75a1f7fb7b34b0b6101e3802bc418c4e868" ], "author": { "name": "Edward Adam Davis", "email": "eadavis@qq.com", "time": "Wed May 13 12:30:50 2026 +0800" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 09:32:43 2026 +1000" }, "message": "drm: Replace old pointer to new idr\n\nCommit 5e28b7b94408 introduced a logical error by failing to replace the\nnewly generated IDR pointer to old id\u0027s pointer at the correct location\nwithin the \"change handle\" logic; this resulted in the issue reported by\nsyzbot [1].\n\nSpecifically, the new IDR object pointer is intended to replace the original\nid\u0027s pointer during the normal execution flow.\n\nAdditionally, an unnecessary conditional check for the ret exit path has\nbeen removed.\n\n[1]\n!RB_EMPTY_ROOT(\u0026prime_fpriv-\u003edmabufs)\nWARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833\nCall Trace:\n drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269\n drm_file_free drivers/gpu/drm/drm_file.c:237 [inline]\n drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290\n drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438\n\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nReported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dd7c9eed171647e421013\nCc: stable@vger.kernel.org\nTested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/tencent_C267296443AAA4567771176886DFF364A305@qq.com\n" }, { "commit": "36343a8ff328efd3eb5604e3567d63e6c7906deb", "tree": "2fe5960dd65f153476b9ef155ab6bb751499a915", "parents": [ "30e0ff6d6a83586486674c343db5e9d933bd92e0", "6ccbb613b42a1f1ba7bfd547a148f644a902a25c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:40:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:40:25 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 MPAM fixes from Catalin Marinas:\n\n - Fix NULL dereference and a false-positive warning when the driver\n probes hardware with surprising version numbers\n\n - Fix writing values to the wrong registers when probing\n cache-utilisation counters. Replace \u0027NRDY\u0027 probing with a version\n that is robust for platforms where the bit is writeable by both\n hardware and software\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm_mpam: Check whether the config array is allocated before destroying it\n arm_mpam: Fix false positive assert failure during mpam_disable()\n arm_mpam: Improve check for whether or not NRDY is hardware managed\n arm_mpam: Pretend that NRDY is always hardware managed\n arm_mpam: Fix monitor instance selection when checking for hardware NRDY\n" }, { "commit": "30e0ff6d6a83586486674c343db5e9d933bd92e0", "tree": "3f693f74f843af955fc6b7aa5cfe206f69789f22", "parents": [ "3bf83e47b497d2630d2dcb408ec14ad95050cead", "1bb54043ff309795c90ccadd8a6e6b13ac40ec4e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:22:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:22:26 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"This is probably the largest fixes pull-request ever sent for IOMMU. I\n partially blame it on AI code review which found some issues but there\n is also some rework in here to fix issues in the iommu parts of PCI\n device reset.\n\n AMD-Vi:\n - Add bounds checks to debugfs and table lookups\n\n Intel VT-d:\n - Apply an existing quirk for Q35 graphic device\n - Skip dev_pasid teardown for the blocked domain to avoid\n out-of-bounds access\n - Return early if dev_pasid is missing to prevent NULL dereference\n or UAF\n\n Core:\n - Fix bugs and corner cases in pci_dev_reset_iommu_prepare/done()\n - Fix various issues found by AI in iommupt code\n\n MAINTAINERS email address update for RISCV IOMMU\"\n\n* tag \u0027iommu-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n MAINTAINERS: update Tomasz Jeznach\u0027s email address\n iommupt: Fix the end_index calculation in __map_range_leaf()\n iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n iommu: Handle unmap error when iommu_debug is enabled\n iommu: Fix up map/unmap debugging for iommupt domains\n iommu: Fix loss of errno on map failure for classic ops\n iommu/vt-d: Avoid NULL pointer dereference or refcount corruption\n iommu/vt-d: Fix oops due to out of scope access\n iommu/vt-d: Disable DMAR for Intel Q35 IGFX\n iommu: Warn on premature unblock during DMA aliased sibling reset\n iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset\n iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()\n iommu: Fix nested pci_dev_reset_iommu_prepare/done()\n iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()\n iommu: Replace per-group resetting_domain with per-gdev blocked flag\n iommu: Fix kdocs of pci_dev_reset_iommu_done()\n iommu: Fix NULL group-\u003edomain dereference in pci_dev_reset_iommu_done()\n iommu/amd: Bounds-check devid in __rlookup_amd_iommu()\n iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs\n" }, { "commit": "3bf83e47b497d2630d2dcb408ec14ad95050cead", "tree": "d9fb350f33550a2e95dc81f44f4783ce5b0a3e69", "parents": [ "b0662be9131d87d8858d34d6134500e109dff958", "702809dabdecca807bdd50cfdcc1c980feb2ba62" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:13:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:13:02 2026 -0700" }, "message": "Merge tag \u0027vfio-v7.1-rc4\u0027 of https://github.com/awilliam/linux-vfio\n\nPull VFIO fixes from Alex Williamson:\n\n - Convert vfio-pci BAR resource requests and iomaps initialization\n from a lazy, on-demand model to an eager pre-allocation model to\n avoid races while preserving legacy error behavior. Fix unchecked\n barmap access in dma-buf export path (Matt Evans)\n\n - Introduce an implicit unsigned cast in converting vfio-pci device\n offsets to region indexes, closing a potential out-of-bounds\n access through the vfio_pci_ioeventfd() interface (Matt Evans)\n\n - Fix a dma-buf kref underflow and stuck wait_for_completion() when\n closing a previously revoked dma-buf (Alex Williamson)\n\n* tag \u0027vfio-v7.1-rc4\u0027 of https://github.com/awilliam/linux-vfio:\n vfio/pci: Check BAR resources before exporting a DMABUF\n vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()\n vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned\n vfio/pci: fix dma-buf kref underflow after revoke\n" }, { "commit": "396db75a1f7fb7b34b0b6101e3802bc418c4e868", "tree": "294fa960e301e419c54713654634a10a077dba98", "parents": [ "96f34d185cce4dd0967acce8830775374821f9bc", "0a9c56dd387605d17dabeedd9fdd2c4c1d0bab7b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:55:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:56:32 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-15\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nbridge:\n- imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n\ngma500:\n- oaktrail_lvds: fix i2c handling\n\nloongson:\n- use managed cleanup for connector polling\n\npanfrost:\n- handle results from reservation locking correctly\n\nqaic:\n- check for integer overflows in mmap logic\n\nrocket:\n- handle results from reservation locking correctly\n\nttm:\n- avoid infinite loop in swap out\n- avoid infinite loop in BO shrinking\n- convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260515070816.GA88575@2a02-2455-9062-2500-7dec-552d-233d-9fe0.dyn6.pyur.net\n" }, { "commit": "b0662be9131d87d8858d34d6134500e109dff958", "tree": "c7c43b4a9c96c309c924a8d7a3cc9270be6daefe", "parents": [ "fcbf68d32ff732b78122690e862d260b000e19e2", "c207f1d785044667f87cc8c72355e33f3981f2d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:52:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:52:17 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix integer overflow in read\n\n - Fix smbdirect error cleanup\n\n - Multichannel reconnect fix\n\n - Add some missing defines and correct some references to protocol spec\n\n - Fix oob symlink read\n\n* tag \u0027v7.1-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter()\n smb: client: avoid integer overflow in SMB2 READ length check\n cifs: client: stage smb3_reconfigure() updates and restore ctx on failure\n smb/client: fix possible infinite loop and oob read in symlink_data()\n SMB3.1.1: add missing QUERY_DIR info levels\n" }, { "commit": "fcbf68d32ff732b78122690e862d260b000e19e2", "tree": "6097e6e296bc13edb9133ec04cd5977d24607e84", "parents": [ "a8b0b72255d09bb12ada5620cd6ced91adde5ac8", "28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:48:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:48:09 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc4\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"An important patch from Hristo that squashes a folio reference leak\n that could lead to OOM kills in CephFS and a number of miscellaneous\n fixes from Raphael and Slava.\n\n All but two are marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc4\u0027 of https://github.com/ceph/ceph-client:\n libceph: Fix potential null-ptr-deref in decode_choose_args()\n libceph: handle rbtree insertion error in decode_choose_args()\n libceph: Fix potential out-of-bounds access in osdmap_decode()\n ceph: put folios not suitable for writeback\n ceph: add ceph_has_realms_with_quotas() check to ceph_quota_update_statfs()\n libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size\n ceph: fix a buffer leak in __ceph_setxattr()\n libceph: Fix unnecessarily high ceph_decode_need() for uniform bucket\n libceph: Fix potential out-of-bounds access in crush_decode()\n" }, { "commit": "96f34d185cce4dd0967acce8830775374821f9bc", "tree": "6bdad78178c7abd85789fac15b9c6043ddc0c332", "parents": [ "68055b285428a09f098861a702024e9d8f1370c8", "8fb70afe671cc8c1f6237a39aabd50714fcd1189" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:47:06 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:48:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-14\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Madvise fix around purgeability tracking (Arvind)\n- Restore engine mask for specific blitter style (Roper)\n- Couple UAF fixes (Auld)\n- Drop unused ggtt_balloon field (Wajdeczko)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/agXWkM3Y98bqt6TG@intel.com\n" }, { "commit": "a8b0b72255d09bb12ada5620cd6ced91adde5ac8", "tree": "8c52d11b3767e123c14783d94cf857a9ef6a5b7a", "parents": [ "663ea69540c8d7ba332c9a3129d7f3cf5de50d9b", "c562ba61fc5e11798720acc1b172862158f1fa0b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:22:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:22:07 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fixup warning when allocating memory for readahead, __GFP_NOWARN was\n accidentally dropped when setting mapping constraints\n\n - in tracepoint of file sync, fix sleeping in atomic context when\n handling dentries\n\n - harden initial loading of block group on crafted/fuzzed images,\n iterate all chunk mapping entries unconditionally\n\n - fix freeing pages of submitted io after checking for errors\n\n - fix incorrect inode size after remount when using fallocate KEEP_SIZE\n mode (also requires disabled \u0027no-holes\u0027 feature)\n\n* tag \u0027for-7.1-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix incorrect i_size after remount caused by KEEP_SIZE prealloc gap\n btrfs: only release the dirty pages io tree after successful writes\n btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()\n btrfs: always pass __GFP_NOWARN from add_ra_bio_pages()\n btrfs: fix check_chunk_block_group_mappings() to iterate all chunk maps\n" }, { "commit": "663ea69540c8d7ba332c9a3129d7f3cf5de50d9b", "tree": "89a20c56660885e1af613418e77ffc4914838b4f", "parents": [ "56ec2b646de6349c8c8c05c8df17b4d8998c467a", "509fdeb3326be0db055e88d0f689a3888f147f90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:17:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:17:46 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"A few bug fixes, nothing really special stands out\"\n\n* tag \u0027xfs-fixes-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: Fix typo in comment\n xfs: fix the \"limiting open zones\" message\n xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate\n xfs: check da node block pad field during scrub\n xfs: fix memory leak for data allocated by xfs_zone_gc_data_alloc()\n xfs: fix memory leak on error in xfs_alloc_zone_info()\n xfs: check directory data block header padding in scrub\n xfs: zero directory data block padding on write verification\n xfs: zero entire directory data block header region at init\n xfs: remove the meaningless XFS_ALLOC_FLAG_FREEING\n" }, { "commit": "56ec2b646de6349c8c8c05c8df17b4d8998c467a", "tree": "0fb30cfedd511450d45bf374176b20cac3bd7c9d", "parents": [ "d458a240344c4369bf6f3da203f2779515177738", "4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:11:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:11:41 2026 -0700" }, "message": "Merge tag \u0027nfsd-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fixes from Chuck Lever:\n \"Fixes for this release:\n - Correctness fix for the new sunrpc cache netlink protocol\n\n Marked for stable:\n - Correctness fixes for delegated attributes\n - Prevent an infinite loop when revoking layouts\"\n\n* tag \u0027nfsd-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n NFSD: Fix infinite loop in layout state revocation\n sunrpc: start cache request seqno at 1 to fix netlink GET_REQS\n nfsd: update mtime/ctime on COPY in presence of delegated attributes\n nfsd: update mtime/ctime on CLONE in presense of delegated attributes\n nfsd: fix file change detection in CB_GETATTR\n nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled\n" }, { "commit": "d458a240344c4369bf6f3da203f2779515177738", "tree": "eae2d12d85f7290dbf5d4cbe7666cb070762266e", "parents": [ "ee7226b2ae3beff5d8feffa94e5fd06af6965e52", "4141f46daa4cf1f8caa14129f8b6db86f17452f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:47:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:47:00 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe merge request via Keith:\n - Fix memory leak on a passthrough integrity mapping failure (Keith)\n - Hide secrets behind debug option (Hannes)\n - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)\n - Fix tcp taregt use-after-free for data digest (Sagi)\n - Revert a mistaken quirk (Alan Cui)\n - Fix uevent and controller state race condition (Maurizio)\n - Fix apple submission queue re-initialization (Nick Chan)\n\n - Three fixes for blk-integrity, fixing an issue with the user data\n mapping and two problems with recomputing number of segments\n\n - Two fixes for the iov_iter bounce buffering\n\n - Fix for the handling of dead zoned write plugs\n\n - ublk max_sectors validation fix, with associated selftest addition\n\n* tag \u0027block-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n nvme-apple: Reset q-\u003esq_tail during queue init\n block: align down bounces bios\n block: pass a minsize argument to bio_iov_iter_bounce\n selftests: ublk: cap nthreads to kernel\u0027s actual nr_hw_queues\n block: fix handling of dead zone write plugs\n block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()\n block: recompute nr_integrity_segments in blk_insert_cloned_request\n block: don\u0027t overwrite bip_vcnt in bio_integrity_copy_user()\n nvme: fix race condition between connected uevent and STARTED_ONCE flag\n Revert \"nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808\"\n nvmet-tcp: Fix potential UAF when ddgst mismatch\n nvme-pci: fix use-after-free in nvme_free_host_mem()\n nvmet-auth: Do not print DH-HMAC-CHAP secrets\n nvme: fix bio leak on mapping failure\n nvme: make prp passthrough usage less scary\n ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation\n" }, { "commit": "ee7226b2ae3beff5d8feffa94e5fd06af6965e52", "tree": "879de35d9f4e791daae5f8588775d553888601c3", "parents": [ "78e8370033bfe08481212ceead113ccb668b83cb", "f44d38a31f1802b7222adaea9ee69f9d280f698a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:34:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:34:02 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Small series sanitizing the locking done for either modifying or\n reading a chain of requests\n\n - If the application has a pid namespace, ensure that the sqthread pid\n is correctly printed in fdinfo\n\n - Fix for a hashing issue in the io-wq thread pool, which could lead to\n a use-after-free\n\n - Kill dead argument from io_prep_rw_pi()\n\n - Fix for a missed validation of the CQ ring head, affecting CQE refill\n\n* tag \u0027io_uring-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: validate user-controlled cq.head in io_cqe_cache_refill()\n io-wq: check that the predecessor is hashed in io_wq_remove_pending()\n io_uring/rw: drop unused attr_type_mask from io_prep_rw_pi()\n io_uring: hold uring_lock across io_kill_timeouts() in cancel path\n io_uring: defer linked-timeout chain splice out of hrtimer context\n io_uring: hold uring_lock when walking link chain in io_wq_free_work()\n io_uring/fdinfo: translate SqThread PID through caller\u0027s pid_ns\n" }, { "commit": "78e8370033bfe08481212ceead113ccb668b83cb", "tree": "81b31f56c39b441af5dabc33d11d588c0f9e3582", "parents": [ "36d49bba19f2c19c933d13b25dcf4eb607a030b3", "905c559e51497b8bfdbb68df8be56d2f70f0de8e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:27:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:27:03 2026 -0700" }, "message": "Merge tag \u0027hardening-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening fix from Kees Cook:\n\n - gcc-plugins: Fix GCC 16 removal of CONST_CAST macros\n\n* tag \u0027hardening-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE\n" }, { "commit": "36d49bba19f2c19c933d13b25dcf4eb607a030b3", "tree": "a5ba0f9ca1515dea250e8b558012e0013d120d1c", "parents": [ "4844e7c4c2697afe63f2b925e2384e0c724cb2be", "f2e65e4e5b4b4b9ecf43f03c3fdbe8c9a8a43a9e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:24:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:24:09 2026 -0700" }, "message": "Merge tag \u0027docs-7.1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux\n\nPull documentation fixes from Jonathan Corbet:\n \"This is Willy Tarreau\u0027s new document clarifying the definition and\n handling of security-related bugs, which we\u0027re trying to get out there\n quickly on the theory that some of the bug reporters might actually\n read and pay attention to it\"\n\n* tag \u0027docs-7.1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:\n docs: threat-model: don\u0027t limit root capabilities to CAP_SYS_ADMIN\n docs: security-bugs: add a link to the threat-model documentation\n Documentation: security-bugs: clarify requirements for AI-assisted reports\n Documentation: security-bugs: explain what is and is not a security bug\n Documentation: security-bugs: do not systematically Cc the security team\n" }, { "commit": "96350db80e0acd733e9b9ef61c0d910790b27289", "tree": "a4dc1133932e48b8ac4e576e6eeb01c0bc274051", "parents": [ "5d6919055dec134de3c40167a490f33c74c12581" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri May 15 12:57:09 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri May 15 14:59:30 2026 -0400" }, "message": "ring-buffer remote: Avoid unexpected symbol warnings (arm, s390)\n\nThe now more verbose check found more architecture specific symbol\nmissing from the whitelist, during randconfig testing on s390\nand 32-bit arm:\n\nUnexpected symbols in kernel/trace/simple_ring_buffer.o:\n U __aeabi_unwind_cpp_pr1\n\nUnexpected symbols in kernel/trace/simple_ring_buffer.o:\n U __s390_indirect_jump_r1\n U __s390_indirect_jump_r10\n U __s390_indirect_jump_r14\n U __s390_indirect_jump_r2\n U __s390_indirect_jump_r5\n U __s390_indirect_jump_r7\n U __s390_indirect_jump_r8\n U __s390_indirect_jump_r9\nmake[6]: *** [/home/arnd/arm-soc/kernel/trace/Makefile:160: kernel/trace/simple_ring_buffer.o.checked] Error 1\n\nAdd these to the list and keep it roughly sorted into sanitizer\nand architecture symbols.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: Nathan Chancellor \u003cnathan@kernel.org\u003e\nCc: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nLink: https://patch.msgid.link/20260515105717.1023007-1-arnd@kernel.org\nFixes: 1211907ac0b5 (\"tracing: Generate undef symbols allowlist for simple_ring_buffer\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "4844e7c4c2697afe63f2b925e2384e0c724cb2be", "tree": "f4e79ccbe0d67371408955da746f8464e6ff8555", "parents": [ "4c2cd91bff6371b58e672e8791c3bfa70c1b821f", "4594437880ce347ac8438758fd91543f70da1aa9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:24:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:24:51 2026 -0700" }, "message": "Merge tag \u0027for-linus-7.1b-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n\n - one simple cleanup\n\n - a fix for a corner case when running as Xen PV dom0\n\n - a fix of a regression for Xen PV guests, introduced in 7.0\n\n* tag \u0027for-linus-7.1b-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving\n x86/xen: Fix xen_e820_swap_entry_with_ram()\n xen/arm: Replace __ASSEMBLY__ with __ASSEMBLER__ in interface.h\n" }, { "commit": "4c2cd91bff6371b58e672e8791c3bfa70c1b821f", "tree": "ca8d13e9a0d70c0ccb684e3b0ff5d583c482c0a8", "parents": [ "fd6b56615696c2addca7b43c862b21a9a386c116", "2997606dd17729404cef9821ce66dd037b6019eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:12:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:12:54 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - asus-nb-wmi:\n - Use existing keyboard quirk for ASUS Zenbook Duo UX8407AA\n\n - hp-wmi:\n - Add support for Victus 16-r0xxx (8BC2)\n\n - intel/vsec_tpmi:\n - Move debugfs register before creating devices\n - Prevent fault during unbind\n\n - lenovo-wmi-*:\n - Fix memory leak in lwmi_dev_evaluate_int()\n - Balance IDA id allocation and free\n - Balance component bind and unbind\n - Prevent sending uninitialized WMI arguments to the device\n - Decouple lenovo-wmi-gamezone and lenovo-wmi-other to simplify\n module dependency graph\n - Limit adding attributes to supported devices\n\n - samsung-galaxybook:\n - Handle kbd backlight, mic mute and camera block hotkeys\n\n* tag \u0027platform-drivers-x86-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8407AA\n platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices\n platform/x86: lenovo-wmi-other: Add Attribute ID helper functions\n platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers\n platform/x86: lenovo: Decouple lenovo-wmi-gamezone and lenovo-wmi-other\n platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members\n platform/x86: lenovo-wmi-other: Zero initialize WMI arguments\n platform/x86: lenovo-wmi-other: Balance component bind and unbind\n platform/x86: lenovo-wmi-other: Balance IDA id allocation and free\n platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()\n platform/x86: hp-wmi: Add support for Victus 16-r0xxx (8BC2)\n platform/x86/intel/tpmi/plr: Prevent fault during unbind\n platform/x86: intel: Add notifiers support\n platform/x86: intel: Move debugfs register before creating devices\n platform/x86: samsung-galaxybook: Handle ACPI hotkey notifications\n platform/x86: samsung-galaxybook: Refactor camera lens cover input device\n" }, { "commit": "fd6b56615696c2addca7b43c862b21a9a386c116", "tree": "e3cceceed21b32d89f2f1d3ae903d66b88c60c4f", "parents": [ "70eda68668d1476b459b64e69b8f36659fa9dfa8", "d1fa83ecac31093a550534a79a33bc7f4ba8fc10" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 10:38:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 10:38:37 2026 -0700" }, "message": "Merge tag \u0027v7.1-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Fix potential dead-lock in rhashtable when used by xattr\n\n - Avoid calling kvfree on atomic path in rhashtable\n\n* tag \u0027v7.1-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n rhashtable: Add bucket_table_free_atomic() helper\n mm/slab: Add kvfree_atomic() helper\n rhashtable: drop ht-\u003emutex in rhashtable_free_and_destroy()\n" }, { "commit": "8a220d1c312c66194f4a33dd52d1fba42bc2b341", "tree": "654edcc2f80d9b3438d9ec464f79e82afce6aff6", "parents": [ "45205929a3a3310e4978f4097d8ed4fca36b2c32" ], "author": { "name": "Hongling Zeng", "email": "zenghongling@kylinos.cn", "time": "Wed May 13 18:34:06 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri May 15 15:32:43 2026 +0200" }, "message": "cachefiles: Fix error return when vfs_mkdir() fails\n\nWhen vfs_mkdir() fails, the error code is not extracted from the\nreturned error pointer. This causes mkdir_error to be reached with\nret\u003d0, which leads to returning ERR_PTR(0) (NULL) instead of a\nproper error pointer.\n\nFix this by extracting the error code from the error pointer when\nvfs_mkdir() fails.\n\nFixes: 406fad7698f5 (\"cachefiles: Fix oops in vfs_mkdir from cachefiles_get_directory\")\nSigned-off-by: Hongling Zeng \u003czenghongling@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260513103406.202320-1-zenghongling@kylinos.cn\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "6fd9f6e870ea285f05102e8e00e6a7f4495a9a02", "tree": "2a2039b23f00ece6b4e609899257e2fcdce228ba", "parents": [ "7d1051ad68df3d584b5f24bfa1fb19f3a24db278" ], "author": { "name": "Matt DeVillier", "email": "matt.devillier@gmail.com", "time": "Thu May 07 09:58:41 2026 -0500" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 11:19:48 2026 +0200" }, "message": "ALSA: hda/ca0132: Disable auto-detect on manual output select\n\nCommit 778031e1658d (\"ALSA: hda/ca0132: Set HP/Speaker\nauto-detect default from headphone pin verb\") enables HP/Speaker\nauto-detect by default when the headphone pin supports presence detect.\n\nWith auto-detect enabled, ca0132_select_out() and ca0132_alt_select_out()\nchoose the output from jack presence instead of the manual HP/Speaker\nselection. This means selecting speaker output while headphones are\nplugged in updates the control state, but audio still routes to the\nheadphones.\n\nTreat an explicit manual output selection as a request to leave\nauto-detect mode. Clear the HP/Speaker auto-detect switch before applying\nthe manual selection, and notify userspace so the auto-detect control\nstate is updated in mixers. Do this for both the normal HP/Speaker\nPlayback Switch and the alternate Output Select control used by desktop\ncards.\n\nThis keeps auto-detect enabled by default for devices with jack presence\ndetection, while preserving the expected behavior that a manual output\nchoice takes effect immediately.\n\nFixes: 778031e1658d (\"ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb\")\nSigned-off-by: Matt DeVillier \u003cmatt.devillier@gmail.com\u003e\nLink: https://lore.kernel.org/CAFTm+6AfeXKf\u003db2frG4xC5yC4jjM9TkD6c8+dOWWFw6BDjDESw@mail.gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "7d1051ad68df3d584b5f24bfa1fb19f3a24db278", "tree": "11c750dd871645bf4e3f31ba589e0584797e560a", "parents": [ "83dca2530fb3ba63f47bad339d890bc30aa06ab5" ], "author": { "name": "Adrien Burnett", "email": "an.arctic.pigeon@gmail.com", "time": "Thu May 14 18:59:05 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:11:04 2026 +0200" }, "message": "ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx\n\nAdd a SND_PCI_QUIRK entry for the HP Pavilion Laptop 16-ag0xxx\n(subsystem 0x103c:0x8cbc, Realtek ALC245). The\nALC245_FIXUP_HP_X360_MUTE_LEDS fixup is already used by the\nneighbouring HP Pavilion Aero Laptop 13-bg0xxx (0x103c:0x8cbd);\nit chains the master-mute COEF handler with the GPIO mic-mute\nLED handler, which is what this machine needs.\n\nTested on the affected hardware: both the mute and mic-mute key\nLEDs respond correctly to the keyboard hotkeys after this change.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Adrien Burnett \u003can.arctic.pigeon@gmail.com\u003e\nLink: https://patch.msgid.link/20260514165905.21175-1-an.arctic.pigeon@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "83dca2530fb3ba63f47bad339d890bc30aa06ab5", "tree": "94242307e4c954ab7fbbe35e3396e3bdcb22d4e9", "parents": [ "9921941929ab014038c357b30567d93d20393a94" ], "author": { "name": "Jackie Dong", "email": "xy-jackie@139.com", "time": "Thu May 14 23:39:40 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:09:57 2026 +0200" }, "message": "ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio\n\nVolume control for the speakers on the Lenovo Yoga Pro 7 15ASH11 laptop\ndoesn\u0027t work.\nThe DAC routing is the same as on the ThinkPad X1 Gen7 function, so reuse\nthe alc285_fixup_thinkpad_x1_gen7 to get it working.\n\nSigned-off-by: Jackie Dong \u003cxy-jackie@139.com\u003e\nLink: https://patch.msgid.link/20260514153940.7320-1-xy-jackie@139.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "9921941929ab014038c357b30567d93d20393a94", "tree": "3f8997aa0a5344207920f87d8ed9c48307c0fd3b", "parents": [ "fd87b510f5f543125ecf51e7c706a9f4bc3352be" ], "author": { "name": "Quan Sun", "email": "2022090917019@std.uestc.edu.cn", "time": "Thu May 14 21:22:45 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:09:07 2026 +0200" }, "message": "ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()\n\nsnd_hda_ctl_add() dereferences kctl-\u003eid.subdevice without checking\nwhether kctl is NULL. Multiple callers in sound/hda/codecs/ca0132.c\npass the return value of snd_ctl_new1() directly to snd_hda_ctl_add()\nwithout a NULL check:\n\n return snd_hda_ctl_add(codec, nid, snd_ctl_new1(\u0026knew, codec));\n\nsnd_ctl_new1() returns NULL when the underlying snd_ctl_new() fails\non memory allocation (kzalloc_flex),which can occur under memory\npressure or via fault injection.\n\nAdd a NULL check at the entry of snd_hda_ctl_add(), matching the\npattern already used by snd_ctl_add_replace() at the same call\npath (sound/core/control.c:515). Return -EINVAL to let callers\nhandle the error gracefully.\n\nFixes: 44f0c9782cc6 (\"ALSA: hda/ca0132: Add tuning controls\")\nSigned-off-by: Quan Sun \u003c2022090917019@std.uestc.edu.cn\u003e\nLink: https://patch.msgid.link/20260514132245.3062884-1-2022090917019@std.uestc.edu.cn\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "fd87b510f5f543125ecf51e7c706a9f4bc3352be", "tree": "7014531ab4084a5b7d19f3c423a872a098048c0a", "parents": [ "2891bb13ef158281736b6314b1ceaef6d08d57f4" ], "author": { "name": "Markus Kramer", "email": "linux@markus-kramer.de", "time": "Thu May 14 00:28:18 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:08:41 2026 +0200" }, "message": "ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone\n\nThe Samsung Galaxy Book5 360 (NP750QHA, PCI subsystem ID 0x144d:0xc902)\nhas severe audio distortion on the 3.5mm headphone jack. Applying\nALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET corrects the output path\nconfiguration, consistent with fixes already applied to other Samsung\nGalaxy Book models using the same ALC256 codec.\n\nCc: stable@vger.kernel.org\nLink: https://github.com/thesofproject/linux/issues/5648\nSigned-off-by: Markus Kramer \u003clinux@markus-kramer.de\u003e\nLink: https://patch.msgid.link/20260513222818.14351-1-linux@markus-kramer.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2891bb13ef158281736b6314b1ceaef6d08d57f4", "tree": "acab10b851c512db4ebe6a4c5d368bc11b03196d", "parents": [ "67c73815220784074ff13ec07df955911caf1b73" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Wed May 13 18:27:58 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:08:04 2026 +0200" }, "message": "ALSA: hda/cs35l56: Drop malformed default N from Kconfig\n\nFirst of all, it has to be \u0027default n\u0027 (small letter n), otherwise\nit looks for CONFIG_N which is absent and in case of appearance\nwill enable something unrelated. Second and most important is that\n\u0027n\u0027 *is* the default \u0027default\u0027 already. Hence just drop malformed\nline.\n\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260513162758.365972-1-andriy.shevchenko@linux.intel.com\n" }, { "commit": "67c73815220784074ff13ec07df955911caf1b73", "tree": "3af3125ded8bb496c29c160ebd0e1bf44bd2a003", "parents": [ "d02d2d51a50d1bbf44a50eda094aa2b10fecf023" ], "author": { "name": "Daniel Schaefer", "email": "dhs@frame.work", "time": "Wed May 13 23:55:13 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:07:24 2026 +0200" }, "message": "ALSA: hda/realtek: fix mic boost on Framework PTL\n\nIn addition to the mic jack fix, also need to avoid boosting the\ninternal mic too much, otherwise \u003e50% input volume clips a lot.\n\nAlso add a second SSID. We have one for the classic chassis/speaker and\none for the new Pro chassis/speaker.\n\nTo: Jaroslav Kysela \u003cperex@perex.cz\u003e\nTo: Takashi Iwai \u003ctiwai@suse.com\u003e\nTo: linux-sound@vger.kernel.org\nCc: Dustin L. Howett \u003cdustin@howett.net\u003e\nCc: linux@frame.work\nSigned-off-by: Daniel Schaefer \u003cdhs@frame.work\u003e\nLink: https://patch.msgid.link/20260513155513.11683-1-dhs@frame.work\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "d02d2d51a50d1bbf44a50eda094aa2b10fecf023", "tree": "8f4580fbde98d30ca64be0f417e74280073e24cd", "parents": [ "74e8409821ac8cda70bf23eb593f2c7f6e3b5a2f" ], "author": { "name": "Edson Juliano Drosdeck", "email": "edson.drosdeck@gmail.com", "time": "Mon May 11 15:15:58 2026 -0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:54:15 2026 +0200" }, "message": "ALSA: hda/realtek: Limit mic boost on Positivo DN50E\n\nThe internal mic boost on the Positivo DN50E is too high.\nFix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine\nto limit the gain.\n\nSigned-off-by: Edson Juliano Drosdeck \u003cedson.drosdeck@gmail.com\u003e\nLink: https://patch.msgid.link/20260511181558.670563-1-edson.drosdeck@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "74e8409821ac8cda70bf23eb593f2c7f6e3b5a2f", "tree": "bc6048ae957e0194c74f726779765fe15ee15148", "parents": [ "814b2c9b30e56074e11fc0a6e5419b3fee0639bc" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Mon May 11 11:41:48 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:53:34 2026 +0200" }, "message": "ALSA: doc: cs35l56: Update path to HDA driver source\n\nThe HDA drivers were moved to sound/hda/... so update a Documentation\nreference that still pointed to the old location.\n\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260511104148.36382-1-rf@opensource.cirrus.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "814b2c9b30e56074e11fc0a6e5419b3fee0639bc", "tree": "02625ee8ad4b983b26d4832b6dfe64db32c7449d", "parents": [ "dd074f04e04648d89d9d10ae9846cd057c97b385" ], "author": { "name": "Cássio Gabriel", "email": "cassiogabrielcontato@gmail.com", "time": "Mon May 11 01:36:37 2026 -0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:51:46 2026 +0200" }, "message": "ALSA: usb-audio: qcom: Check offload mapping failures\n\nuaudio_transfer_buffer_setup() calls dma_get_sgtable() and then passes\nthe sg_table to uaudio_iommu_map_xfer_buf() without checking whether sg\ntable construction succeeded. If dma_get_sgtable() fails, the sg_table\ncontents are not valid.\n\nuaudio_iommu_map_pa() also ignores iommu_map() failures for the event and\ntransfer rings and still returns the allocated IOVA to the QMI response.\nThat can expose an unmapped IOVA to the audio DSP. For transfer rings,\nthe failed mapping also leaves the IOVA allocator state marked in use.\n\nCheck both operations. Free the coherent transfer buffer when sg table\nconstruction fails, free the sg table when transfer-buffer IOMMU mapping\nfails, and release the transfer-ring IOVA if iommu_map() fails. Also\nreturn the existing event-ring IOVA when the event ring is already mapped,\nmatching the pre-split helper behavior.\n\nFixes: 326bbc348298 (\"ALSA: usb-audio: qcom: Introduce QC USB SND offloading support\")\nFixes: 44499ecb4f28 (\"ALSA: usb: qcom: Fix false-positive address space check\")\nCc: stable@vger.kernel.org\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260511-alsa-usb-qcom-offload-map-errors-v1-1-6502695e58bc@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "0a9c56dd387605d17dabeedd9fdd2c4c1d0bab7b", "tree": "fcc858dc1da068c7a87b5641850f7db976c6a9f2", "parents": [ "1d59f36e95f7f7134db0e313c9d787cb0adb2153" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Wed May 13 15:57:00 2026 +0900" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Fri May 15 08:50:54 2026 +0200" }, "message": "drm/loongson: Use managed KMS polling\n\nlsdc_pci_probe() initializes KMS polling before setting up vblank support,\nrequesting the IRQ and registering the DRM device. If any of those later\nsteps fails, probe returns without finalizing polling. The driver also\nnever finalizes polling on regular removal.\n\nUse drmm_kms_helper_poll_init() so polling is tied to the DRM device\nlifetime and automatically finalized on probe failure and device removal.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.\n\nFixes: f39db26c5428 (\"drm: Add kms driver for loongson display controller\")\nCc: stable@vger.kernel.org\nCo-developed-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Ijae Kim \u003cae878000@gmail.com\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nAcked-by: Jianmin Lv \u003clvjianmin@loongson.cn\u003e\nReviewed-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260513065706.23803-1-mhun512@gmail.com\n" }, { "commit": "dd074f04e04648d89d9d10ae9846cd057c97b385", "tree": "06b26f8beeec9f4308299ee6a91c9a249100389a", "parents": [ "2149c011510cbdcf183a13b26756e4a02071f0f2" ], "author": { "name": "Nicholas Bonello", "email": "hadobedo@gmail.com", "time": "Fri May 08 18:55:07 2026 -0400" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:37:33 2026 +0200" }, "message": "ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding\n\nThe Lenovo Legion 7 16ITHG6 uses codec SSID 17aa:3855, but its PCI\nSSID is 17aa:3811. The latter is now also used by the Legion S7 15IMH05\nquirk, which is matched before codec SSID fallback and incorrectly\nroutes Legion 7 16ITHG6 machines to ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS.\n\nThat fixup does not bind the CLSA0101 CS35L41 companion amplifiers,\nmaking the built-in speakers silent even though playback appears to be\nactive.\n\nAdd a codec SSID quirk for 17aa:3855 before the conflicting PCI SSID\nquirk so that the Legion 7 16ITHG6 uses ALC287_FIXUP_LEGION_16ITHG6.\nThis restores CS35L41 firmware loading and binds both speaker\namplifiers.\n\nFixes: 67f4c61a73e9 (\"ALSA: hda/realtek: Add quirk for Legion S7 15IMH\")\nCc: stable@vger.kernel.org\nTested-by: Nicholas Bonello \u003chadobedo@gmail.com\u003e\nAssisted-by: Codex:GPT-5\nSigned-off-by: Nicholas Bonello \u003chadobedo@gmail.com\u003e\nLink: https://patch.msgid.link/20260508225507.47667-1-hadobedo@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2149c011510cbdcf183a13b26756e4a02071f0f2", "tree": "a2ca81bcfe0e28b7dfe4ba54668445c1606654e9", "parents": [ "c0e4fffc0f474b7ed10adee4ab2bc1a66d36fc72" ], "author": { "name": "Lianqin Hu", "email": "hulianqin@vivo.com", "time": "Fri May 08 12:49:34 2026 +0000" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:34:37 2026 +0200" }, "message": "ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: new full-speed USB device number 2 using xhci-hcd\nusb 1-1: New USB device found, idVendor\u003d3302, idProduct\u003d17c2\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: USB-C Audio\nusb 1-1: Manufacturer: TTGK Technology\nusb 1-1: SerialNumber: 170120210706\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/TYUPR06MB621720E4E8F99A42E162FD51D23D2@TYUPR06MB6217.apcprd06.prod.outlook.com\n" }, { "commit": "c0e4fffc0f474b7ed10adee4ab2bc1a66d36fc72", "tree": "a617644280c8c0e565a9bf1852c17dc060eb09b3", "parents": [ "fca7401fe37f7abc6e54147ea560f37279231137" ], "author": { "name": "Robertus Diawan Chris", "email": "robertusdchris@gmail.com", "time": "Fri May 08 10:39:14 2026 +0700" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:33:12 2026 +0200" }, "message": "ALSA: scarlett2: Add missing error check when initialise Autogain Status\n\nWhen initialise new control with scarlett2_add_new_ctl() function for\nAutogain Status, scarlett2_add_new_ctl() might throw an error. So, add\nerror check after initialise new control for Autogain Status.\n\nThis is reported by Coverity Scan with CID 1598781 as UNUSED_VALUE.\n\nFixes: 0a995e38dc44 (\"ALSA: scarlett2: Add support for software-controllable input gain\")\nSigned-off-by: Robertus Diawan Chris \u003crobertusdchris@gmail.com\u003e\nLink: https://patch.msgid.link/20260508033914.111596-1-robertusdchris@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "1bb54043ff309795c90ccadd8a6e6b13ac40ec4e", "tree": "c3e8da629248d4fb01066dcfca8e79234d744bea", "parents": [ "58829512ad461af8f35941069c209941e3a97b65" ], "author": { "name": "Tomasz Jeznach", "email": "tomasz.jeznach@linux.dev", "time": "Tue May 12 10:37:44 2026 -0700" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:30:28 2026 +0200" }, "message": "MAINTAINERS: update Tomasz Jeznach\u0027s email address\n\nSwitch from the previous work address to a linux.dev account,\nas the work address is no longer actively monitored.\n\nSigned-off-by: Tomasz Jeznach \u003ctomasz.jeznach@linux.dev\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "58829512ad461af8f35941069c209941e3a97b65", "tree": "b821e62afb5ebd5b8d7a711eac69f26cbc025175", "parents": [ "8ef3f77c440005c7f04229a75976bfc078364247" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:17 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommupt: Fix the end_index calculation in __map_range_leaf()\n\nSashiko noticed a mismatch of units in this math: num_leaves is\nactually the number of leaf *entries* (so a 16-item contiguous leaf\nis one num_leaves), while index is in items. The mismatch in maths\ncauses __map_range_leaf() to exit early instead of efficiently\nfilling a larger range of contiguous PTEs.\n\nThe early exit is caught by the functions above and then\n__map_range_leaf() is re-invoked, so there is no functional issue.\n\nCorrect the misuse of units by adjusting num_leaves with the leaf\nsize and avoid the performance cost of looping externally.\n\nThere are also some mismatched types for num_leaves; simplify\nthings to remove the duplicated calculations.\n\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewd-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "8ef3f77c440005c7f04229a75976bfc078364247", "tree": "cf30c786140a75162579b2384a220f73f5430c4c", "parents": [ "0735c54804c709d1b292f3b6947cfb560b2ce552" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:16 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n\nSashiko pointed out that the driver could drop PAGE_SIZE from the\npgsize_bitmap. That is technically allowed but nothing does it, and\nsuch an iommu_domain would not be used with the DMA API today.\n\nStill, it is against the design and it is trivial to fix up. Lift\nthe PT_WARN_ON to the if branch and just skip the fast path.\n\nFixes: dcd6a011a8d5 (\"iommupt: Add map_pages op\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "0735c54804c709d1b292f3b6947cfb560b2ce552", "tree": "0234d43ca5bb7d0b91744e7567a80ec90642183f", "parents": [ "b948a87228482235afbaf5f4d8037860b5c470fd" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:15 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommu: Handle unmap error when iommu_debug is enabled\n\nSashiko noticed a latent bug where the map error flow called iommu_unmap()\nwhich calls iommu_debug_unmap_begin()/iommu_debug_unmap_end() however\nsince this is an error path the map flow never actually established the\noriginal iommu_debug_map() it will malfunction.\n\nLift the unmap error handling into iommu_map_nosync() and reorder it so\nthe trace_map()/iommu_debug_map() records the partial mapping and then\nimmediately unmaps it. This avoid creating the unbalanced tracking and\nprovides saner tracing instead of a unmap unmatched to any map.\n\nFixes: ccc21213f013 (\"iommu: Add calls for IOMMU_DEBUG_PAGEALLOC\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b948a87228482235afbaf5f4d8037860b5c470fd", "tree": "4d47d3dd296cbf6000b2c35336d05ec0ae12b5a1", "parents": [ "6fc7e8a3b8115294f60f5c89de27330bf1b9c98e" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:14 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:15 2026 +0200" }, "message": "iommu: Fix up map/unmap debugging for iommupt domains\n\nSashiko noticed a few issues in this path, and a few more were\nfound on review. Tidy them up further. These are intertwined\nbecause the debug code depends on some of the WARN_ONs to function\nright:\n\nLift into iommu_map_nosync():\n- The might_sleep_if()\n- 0 pgsize_bitmap WARN_ON\n- Promote the illegal domain-\u003etype to a WARN_ON\n- WARN_ON for illegal gfp flags\n\nThen remove the return 0 since it is now safe to call\niommu_debug_map().\n\nLift into __iommu_unmap():\n- 0 pgsize_bitmap WARN_ON\n- Promote the illegal domain-\u003etype to a WARN_ON\n- iommu_debug_unmap_begin()\n\nThis now pairs with the unconditional iommu_debug_map() on the\nmapping side. Thus iommu debugging now works for iommupt along\nwith some of the other debugging features.\n\nFixes: 99fb8afa16ad (\"iommupt: Directly call iommupt\u0027s unmap_range()\")\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "6fc7e8a3b8115294f60f5c89de27330bf1b9c98e", "tree": "cba7a7fa221bf5abd079ce9bbf61ca144c98ee92", "parents": [ "79ea2feb917b05366b49d85573c9c5331f043b2c" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:13 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:15 2026 +0200" }, "message": "iommu: Fix loss of errno on map failure for classic ops\n\nA typo, likely from a rebase, inverted the condition and caused\nerrors to be lost. Fix it to be \"if (ret)\".\n\nThis was breaking iommu_create_device_direct_mappings() on drivers\nthat don\u0027t use iommupt and don\u0027t fully set up their domain in\nalloc_pages() (i.e., SMMUv2). In this case the first call of\niommu_create_device_direct_mappings() should fail due to the\nincompletely initialized domain. Since it wrongly returns success,\nthe second call to iommu_create_device_direct_mappings() doesn\u0027t\nhappen and IOMMU_RESV_DIRECT is never set up.\n\nCc: stable@vger.kernel.org\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nReported-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nCloses: https://lore.kernel.org/all/321c2e57-6a17-4aef-ba42-d2ebd577e472@solid-run.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "4141f46daa4cf1f8caa14129f8b6db86f17452f5", "tree": "4f3ec45337d58c36915f539f6fd6e00a7e4751f3", "parents": [ "e7b8b3c5b2a65595d506ffedafac66f0a11fbdc2", "a6ab75639e23169a741b0b2e12191fd8acb32c73" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 14 19:14:33 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 14 19:14:33 2026 -0600" }, "message": "Merge tag \u0027nvme-7.1-2026-05-14\u0027 of git://git.infradead.org/nvme into block-7.1\n\nPull NVMe fixes from Keith:\n\n\"- Fix memory leak on a passthrough integrity mapping failure (Keith)\n - Hide secrets behind debug option (Hannes)\n - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)\n - Fix tcp taregt use-after-free for data digest (Sagi)\n - Revert a mistaken quirk (Alan Cui)\n - Fix uevent and controller state race condition (Maurizio)\n - Fix apple submission queue re-initialization (Nick Chan)\"\n\n* tag \u0027nvme-7.1-2026-05-14\u0027 of git://git.infradead.org/nvme:\n nvme-apple: Reset q-\u003esq_tail during queue init\n nvme: fix race condition between connected uevent and STARTED_ONCE flag\n Revert \"nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808\"\n nvmet-tcp: Fix potential UAF when ddgst mismatch\n nvme-pci: fix use-after-free in nvme_free_host_mem()\n nvmet-auth: Do not print DH-HMAC-CHAP secrets\n nvme: fix bio leak on mapping failure\n nvme: make prp passthrough usage less scary\n" }, { "commit": "51f57607e30bee282a1d40845f89a311cbb26481", "tree": "a4bb1b211efea8e979f6b2dd540a6352656664b6", "parents": [ "f06035ab324e52a845079c2e5f2380fa3cebde9b" ], "author": { "name": "Chen-Shi-Hong", "email": "eric039eric@gmail.com", "time": "Thu May 14 23:39:13 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 15:48:57 2026 -0700" }, "message": "docs: hwmon: sy7636a: fix temperature sysfs attribute name\n\nThe hwmon sysfs naming convention uses\ntemp[1-*]_input for temperature channels.\n\nDocumentation/hwmon/sy7636a-hwmon.rst currently documents\ntemp0_input, while the driver uses the standard hwmon\ntemperature channel interface.\n\nUpdate the documentation to use temp1_input.\n\nSigned-off-by: Chen-Shi-Hong \u003ceric039eric@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260514154108.1937-1-eric039eric@gmail.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "5a433107fab621f4e7379ccba6e52b5b1601046c", "tree": "c54971b6e49c93ba3be33e792a7f20c6a063e50c", "parents": [ "552636b9317c8a843dd4496d77e56976ab48c76b" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:46 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Update beautifier script for clone flags\n\nAccording to the change in the sched.h, update the script to generate\nthe flags array like below. Note that \u0027+1\u0027 is needed to detect bitmask\npattern at index 0.\n\n $ cat tools/perf/trace/beauty/generated/clone_flags_array.c\n static const char *clone_flags[] \u003d {\n \t[ilog2(0x00000100) + 1] \u003d \"VM\",\n \t[ilog2(0x00000200) + 1] \u003d \"FS\",\n \t[ilog2(0x00000400) + 1] \u003d \"FILES\",\n \t[ilog2(0x00000800) + 1] \u003d \"SIGHAND\",\n \t[ilog2(0x00001000) + 1] \u003d \"PIDFD\",\n \t[ilog2(0x00002000) + 1] \u003d \"PTRACE\",\n \t[ilog2(0x00004000) + 1] \u003d \"VFORK\",\n \t[ilog2(0x00008000) + 1] \u003d \"PARENT\",\n \t[ilog2(0x00010000) + 1] \u003d \"THREAD\",\n \t[ilog2(0x00020000) + 1] \u003d \"NEWNS\",\n \t[ilog2(0x00040000) + 1] \u003d \"SYSVSEM\",\n \t[ilog2(0x00080000) + 1] \u003d \"SETTLS\",\n \t[ilog2(0x00100000) + 1] \u003d \"PARENT_SETTID\",\n \t[ilog2(0x00200000) + 1] \u003d \"CHILD_CLEARTID\",\n \t[ilog2(0x00400000) + 1] \u003d \"DETACHED\",\n \t[ilog2(0x00800000) + 1] \u003d \"UNTRACED\",\n \t[ilog2(0x01000000) + 1] \u003d \"CHILD_SETTID\",\n \t[ilog2(0x02000000) + 1] \u003d \"NEWCGROUP\",\n \t[ilog2(0x04000000) + 1] \u003d \"NEWUTS\",\n \t[ilog2(0x08000000) + 1] \u003d \"NEWIPC\",\n \t[ilog2(0x10000000) + 1] \u003d \"NEWUSER\",\n \t[ilog2(0x20000000) + 1] \u003d \"NEWPID\",\n \t[ilog2(0x40000000) + 1] \u003d \"NEWNET\",\n \t[ilog2(0x80000000) + 1] \u003d \"IO\",\n \t[ilog2(0x00000080) + 1] \u003d \"NEWTIME\",\n \t[32 + 1] \u003d \"CLEAR_SIGHAND\",\n \t[33 + 1] \u003d \"INTO_CGROUP\",\n \t[34 + 1] \u003d \"AUTOREAP\",\n \t[35 + 1] \u003d \"NNP\",\n \t[36 + 1] \u003d \"PIDFD_AUTOKILL\",\n \t[37 + 1] \u003d \"EMPTY_MNTNS\",\n };\n\nThis was found by Sashiko during review.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "552636b9317c8a843dd4496d77e56976ab48c76b", "tree": "d0a5fb4d516b8f65af49dd83fea17623aab636d2", "parents": [ "be81aed3f7492caa522493f7c67b9c4d3c8924a6" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:45 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Add beautifier script for fsmount flags\n\nAnd move the existing one to fsmount_attr.sh to be more precise.\nNow the fsmount_flags[] is generated from the mount.h like below.\nThe ilog2() + 1 is an existing pattern to handle bit flags.\n\n $ cat tools/perf/trace/beauty/generated/fsmount_arrays.c\n static const char *fsmount_flags[] \u003d {\n \t[ilog2(0x00000001) + 1] \u003d \"CLOEXEC\",\n \t[ilog2(0x00000002) + 1] \u003d \"NAMESPACE\",\n };\n\nIt was found by Sashiko during the review.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "be81aed3f7492caa522493f7c67b9c4d3c8924a6", "tree": "1fa01cfd4bfdccf75ab6f0deac7d08afdf5bb122", "parents": [ "ad2cd6f9def4899591a75a96f71752e3aadb7579" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:44 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf build: Add make check-headers target\n\nDon\u0027t print header differences during the perf build as it\u0027s noisy.\nMostly people won\u0027t care and find it annoying.\n\nAs it\u0027s to improve perf trace beautifier to catch up new changes mostly\nin UAPIs, we can make it a separate build target and call it\noccasionally. Make it and build-test related targets phony.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "ad2cd6f9def4899591a75a96f71752e3aadb7579", "tree": "a123848bd92c4c159721255a41f7031c95cfb36e", "parents": [ "ca706027b5bdb37337e1b99752134d592f42f0ea" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:43 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Sync uapi/linux/sched.h with the kernel source\n\nTo pick up changes from:\n\n 9d4e752a24f740b3 (\"namespace: allow creating empty mount namespaces\")\n c8134b5f13ae959d (\"pidfd: add CLONE_PIDFD_AUTOKILL\")\n 24baca56fafc33d4 (\"clone: add CLONE_NNP\")\n 12ae2c81b21cfaa1 (\"clone: add CLONE_AUTOREAP\")\n 2e7af192697ef2a7 (\"sched/deadline: Add reporting of runtime left \u0026 ...\")\n\nThis would be used to beautify scheduler syscall arguments and not to\naffect builds of other tools (e.g. objtool).\n\nPlease see tools/include/uapi/README.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "ca706027b5bdb37337e1b99752134d592f42f0ea", "tree": "5d6b09ba67c54d2b14915efc1469ad9f88d84811", "parents": [ "b30e1493e3e27b6795244a472f0bbd07d0dc58fd" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:42 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Sync uapi/linux/mount.h with the kernel source\n\nTo pick up changes from:\n\n 5e8969bd19271241 (\"mount: add FSMOUNT_NAMESPACE\")\n\nThis would be used to beautify mount syscall arguments and not to\naffect builds of other tools (e.g. objtool).\n\nPlease see tools/include/uapi/README.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nCc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "b30e1493e3e27b6795244a472f0bbd07d0dc58fd", "tree": "8c8096b07988fd2c8e21c482c0658caed01d2212", "parents": [ "aa13e4b120f9cf238ad141d8419851f3a7a3fb5f" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:41 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Sync uapi/linux/fs.h with the kernel source\n\nTo pick up changes from:\n\n 1f662195dbc07a66 (\"fs: add generic FS_IOC_SHUTDOWN definitions\")\n\nThis would be used to beautify filesystem syscall arguments and not to\naffect builds of other tools (e.g. objtool).\n\nPlease see tools/include/uapi/README.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nCc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "aa13e4b120f9cf238ad141d8419851f3a7a3fb5f", "tree": "168390f6176ff2d0a82fb4c66060bb18854acd7c", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Sun May 10 13:23:40 2026 -0700" }, "committer": { "name": "Namhyung Kim", "email": "namhyung@kernel.org", "time": "Thu May 14 14:48:32 2026 -0700" }, "message": "perf trace: Sync linux/socket.h with the kernel source\n\nTo pick up changes from:\n\n c66e0f453d1afa82 (\"net: use ktime_t in struct scm_timestamping_internal\")\n\nThis would be used to beautify networking syscall arguments and not to\naffect builds of other tools (e.g. objtool).\n\nPlease see tools/include/uapi/README.\n\nReviewed-by: Ian Rogers \u003cirogers@google.com\u003e\nCc: netdev@vger.kernel.org\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n" }, { "commit": "70eda68668d1476b459b64e69b8f36659fa9dfa8", "tree": "26fe996ae3fd74753bac73ea6f08e724b4f604a9", "parents": [ "48f76a12713253f3abaa39c4ff7606d6fed05a7e", "64ffa2e5e02ff54b23221d0282155f37283fabea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:30:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:30:01 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026051401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee\n Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz\n Pakuła)\n\n - more general sanitation of input data, dealing with potentially\n malicious hardware in hid-core (Benjamin Tissoires)\n\n - a few device-specific quirks and fixups\n\n* tag \u0027hid-for-linus-2026051401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits)\n HID: logitech-hidpp: Add support for newer Bluetooth keyboards\n HID: pidff: Fix integer overflow in pidff_rescale\n HID: i2c-hid: add reset quirk for BLTP7853 touchpad\n HID: core: introduce hid_safe_input_report()\n HID: pass the buffer size to hid_report_raw_event\n HID: google: hammer: stop hardware on devres action failure\n HID: appletb-kbd: run inactivity autodim from workqueues\n HID: appletb-kbd: fix UAF in inactivity-timer cleanup path\n HID: playstation: Clamp num_touch_reports\n HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID\n HID: mcp2221: fix OOB write in mcp2221_raw_event()\n HID: quirks: really enable the intended work around for appledisplay\n HID: hid-sjoy: race between init and usage\n HID: uclogic: Fix regression of input name assignment\n HID: intel-thc-hid: Intel-quickspi: Fix some error codes\n HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle\n HID: elan: Add support for ELAN SB974D touchpad\n HID: sony: add missing size validation for Rock Band 3 Pro instruments\n HID: sony: add missing size validation for SMK-Link remotes\n HID: sony: remove unneeded WARN_ON() in sony_leds_init()\n ...\n" }, { "commit": "48f76a12713253f3abaa39c4ff7606d6fed05a7e", "tree": "a08ad3f86cce228139b48afd9c89e3687f3ddb05", "parents": [ "66182ca873a4e87b3496eca79d57f86b76d7f52d", "af149b667b9472bf981591a6d27efdecd331005a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:06:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:06:31 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These fix several platform drivers that use the ACPI companion of the\n given platform device without checking its presence, which may lead to\n a NULL pointer dereference or other kind of malfunction if the driver\n is forced to match a device without an ACPI companion via driver\n override, and restore debug log level for some messages in the ACPI\n CPPC library:\n\n - Check ACPI_COMPANION() against NULL during probe in several core\n ACPI device drivers (Rafael Wysocki)\n\n - Restore log level of messages in amd_set_max_freq_ratio() (Mario\n Limonciello)\"\n\n* tag \u0027acpi-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: PAD: xen: Check ACPI_COMPANION() against NULL\n ACPI: driver: Check ACPI_COMPANION() against NULL during probe\n Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\"\n" }, { "commit": "4a9b16541ad3faf8bccb398532bf3f8b6bbf1188", "tree": "c8f110c5cb7f1e0acaba821b9fe23b4d50a84e16", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Stephen Smalley", "email": "stephen.smalley.work@gmail.com", "time": "Wed May 13 14:05:06 2026 -0400" }, "committer": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Thu May 14 16:47:59 2026 -0400" }, "message": "lsm: hold cred_guard_mutex for lsm_set_self_attr()\n\nJust as proc_pid_attr_write() already does before calling the LSM\nhook. This only matters for SELinux and AppArmor which check\nwhether the process is being ptraced and if so, whether to\nallow the transition.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Stephen Smalley \u003cstephen.smalley.work@gmail.com\u003e\nAcked-by: Casey Schaufler \u003ccasey@schaufler-ca.com\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n" }, { "commit": "af149b667b9472bf981591a6d27efdecd331005a", "tree": "1ae11e0cd72fabc406be2a77e0325b774ead66f9", "parents": [ "b7cdd59de5ae8062d2cb0121c429a271eb70daec", "db5dadb562cabb6da49959b473ed0d9645b6f2da" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu May 14 22:46:33 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu May 14 22:46:33 2026 +0200" }, "message": "Merge branch \u0027acpi-cppc\u0027\n\nMerge a revert of an ACPI CPPC commit that increased the log level of\nsome debug messages which turned out to be a bad idea:\n\n - Restore log level of messages in amd_set_max_freq_ratio() (Mario\n Limonciello)\n\n* acpi-cppc:\n Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\"\n" }, { "commit": "c207f1d785044667f87cc8c72355e33f3981f2d6", "tree": "d1ceb720445dfeebe1fa5194387f6efed8962e93", "parents": [ "81a874233c305d29e37fdb70b691ff4254294c0b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed May 13 19:50:02 2026 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 13:21:00 2026 -0500" }, "message": "smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter()\n\nFix smbdirect_map_sges_from_iter() to use pre-decrement, not post-decrement\nso that it cleans up the correct slots.\n\nFixes: e5fbdde43017 (\"cifs: Add a function to build an RDMA SGE list from an iterator\")\nCloses: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Stefan Metzmacher \u003cmetze@samba.org\u003e\ncc: Paulo Alcantara \u003cpc@manguebit.org\u003e\ncc: Tom Talpey \u003ctom@talpey.com\u003e\ncc: linux-cifs@vger.kernel.org\ncc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "702809dabdecca807bdd50cfdcc1c980feb2ba62", "tree": "dbbe83b2e8867cd6415020c4a7ab68960fb06a0f", "parents": [ "05f2a68b407a6817fe141dd64972c6ab8725312d" ], "author": { "name": "Matt Evans", "email": "mattev@meta.com", "time": "Mon May 11 07:58:24 2026 -0700" }, "committer": { "name": "Alex Williamson", "email": "alex@shazbot.org", "time": "Thu May 14 11:39:03 2026 -0600" }, "message": "vfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it\u0027s possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path.\n\nFixes: 5d74781ebc86c (\"vfio/pci: Add dma-buf export support for MMIO regions\")\nSigned-off-by: Matt Evans \u003cmattev@meta.com\u003e\nLink: https://lore.kernel.org/r/20260511145829.2993601-3-mattev@meta.com\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n" }, { "commit": "05f2a68b407a6817fe141dd64972c6ab8725312d", "tree": "b871dad49283bcdb17cc3bfa7f7df1ae75680c90", "parents": [ "df733ddc263dbe5f471e7c80c8b669532f56bf76" ], "author": { "name": "Matt Evans", "email": "mattev@meta.com", "time": "Mon May 11 07:58:23 2026 -0700" }, "committer": { "name": "Alex Williamson", "email": "alex@shazbot.org", "time": "Thu May 14 11:38:04 2026 -0600" }, "message": "vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()\n\nPreviously BAR resource requests and the corresponding pci_iomap()\nwere performed on-demand and without synchronisation, which was racy.\nRather than add synchronisation, it\u0027s simplest to address this by\ndoing both activities from vfio_pci_core_enable().\n\nThe resource allocation and/or pci_iomap() can still fail; their\nstatus is tracked and existing calls to vfio_pci_core_setup_barmap()\nwill fail in a similar way to before. This keeps the point of failure\nas observed by userspace the same, i.e. failures to request/map unused\nBARs are benign.\n\nFixes: 89e1f7d4c66d (\"vfio: Add PCI device driver\")\nSigned-off-by: Matt Evans \u003cmattev@meta.com\u003e\nLink: https://lore.kernel.org/r/20260511145829.2993601-2-mattev@meta.com\n[ERR_PTR -\u003e IOMEM_ERR_PTR per lkp report]\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n" }, { "commit": "4594437880ce347ac8438758fd91543f70da1aa9", "tree": "7ace2881e34f807aeacf76f91b3ca4ec215a1553", "parents": [ "28e03f78e69cf6628b81f24777799778528a84c1" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri May 08 16:39:33 2026 +0200" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu May 14 18:33:05 2026 +0200" }, "message": "x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving\n\nWith the support of nested lazy mmu sections it can happen that\narch_enter_lazy_mmu_mode() is being called twice without a call of\narch_leave_lazy_mmu_mode() in between, as the lazy_mmu_*() helpers\nare not disabling preemption when checking for nested lazy mmu\nsections.\n\nThis is a problem when running as a Xen PV guest, as\nxen_enter_lazy_mmu() and xen_leave_lazy_mmu() don\u0027t tolerate this\ncase.\n\nFix that in xen_enter_lazy_mmu() and xen_leave_lazy_mmu() in order\nnot to hurt all other lazy mmu mode users.\n\nFixes: 291b3abed657 (\"x86/xen: use lazy_mmu_state when context-switching\")\nTested-by: Marek Marczykowski-Górecki \u003cmarmarek@invisiblethingslab.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nMessage-ID: \u003c20260508143933.493013-1-jgross@suse.com\u003e\n" }, { "commit": "28e03f78e69cf6628b81f24777799778528a84c1", "tree": "29866430b9ca9024c7d46cb72c85417424e586f2", "parents": [ "11f152c0acaa924d93339000cb785d34e003aff5" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Tue May 05 12:24:17 2026 +0200" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu May 14 18:33:05 2026 +0200" }, "message": "x86/xen: Fix xen_e820_swap_entry_with_ram()\n\nWhen swapping a not page-aligned E820 map entry with RAM, the start\naddress of the modified entry is calculated wrong (the offset into the\npage is subtracted instead of being added to the page address).\n\nFixes: be35d91c8880 (\"xen: tolerate ACPI NVS memory overlapping with Xen allocated memory\")\nReported-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nMessage-ID: \u003c20260505102417.208138-1-jgross@suse.com\u003e\n" }, { "commit": "905c559e51497b8bfdbb68df8be56d2f70f0de8e", "tree": "780a054ea7e9ba6baaf748f37803c61ac6b1c72a", "parents": [ "7fd2df204f342fc17d1a0bfcd474b24232fb0f32" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Sat Mar 14 14:24:56 2026 +0100" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu May 14 09:24:32 2026 -0700" }, "message": "gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE\n\nFor gcc-16, the CONST_CAST macro family was removed. Add back what\nwe were using in gcc-common.h, as they are simple wrappers.\n\nSee GCC commits:\n c3d96ff9e916c02584aa081f03ab999292efbb50\n 458c7926d48959abcb2c1adaa22458e27459a551\n\nSuggested-by: Ingo Saitz \u003cingo@hannover.ccc.de\u003e\nLink: https://lore.kernel.org/lkml/ab6OKoay0OWkywjK@spatz.zoo\nFixes: 6b90bd4ba40b (\"GCC plugin infrastructure\")\nTested-by: Ivan Bulatovic \u003ccombuster@archlinux.us\u003e\nTested-by: Christopher Cradock \u003cchristopher@cradock.myzen.co.uk\u003e\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\n" }, { "commit": "66182ca873a4e87b3496eca79d57f86b76d7f52d", "tree": "de7036ccfa0347ce8a6476132497d401b1bbdf42", "parents": [ "eb5441518fba295bd97b59dc54914f89dfaa107d", "c78bdba7b9666020c0832150a4fc4c0aebc7c6ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:57:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:57:43 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Previous releases - regressions:\n\n - ethtool: fix NULL pointer dereference in phy_reply_size\n\n - netfilter:\n - allocate hook ops while under mutex\n - close dangling table module init race\n - restore nf_conntrack helper propagation via expectation\n\n - tcp:\n - fix potential UAF in reqsk_timer_handler().\n - fix out-of-bounds access for twsk in tcp_ao_established_key().\n\n - vsock: fix empty payload in tap skb for non-linear buffers\n\n - hsr: fix NULL pointer dereference in hsr_get_node_data()\n\n - eth:\n - cortina: fix RX drop accounting\n - ice: fix locking in ice_dcb_rebuild()\n\n Previous releases - always broken:\n\n - napi: avoid gro timer misfiring at end of busypoll\n\n - sched:\n - dualpi2: initialize timer earlier in dualpi2_init()\n - sch_cbs: Call qdisc_reset for child qdisc\n\n - shaper:\n - fix ordering issue in net_shaper_commit()\n - reject handle IDs exceeding internal bit-width\n\n - ipv6: flowlabel: enforce per-netns limit for unprivileged callers\n\n - tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\n - smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint\n\n - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\n - batman-adv:\n - reject new tp_meter sessions during teardown\n - purge non-released claims\n\n - eth:\n - i40e: cleanup PTP registration on probe failure\n - idpf: fix double free and use-after-free in aux device error paths\n - ena: fix potential use-after-free in get_timestamp\"\n\n* tag \u0027net-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits)\n net: phy: DP83TC811: add reading of abilities\n net: tls: prevent chain-after-chain in plain text SG\n net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot\n macsec: use rcu_work to defer TX SA crypto cleanup out of softirq\n macsec: use rcu_work to defer RX SA crypto cleanup out of softirq\n macsec: introduce dedicated workqueue for SA crypto cleanup\n net: net_failover: Fix the deadlock in slave register\n MAINTAINERS: update atlantic driver maintainer\n selftests/tc-testing: Add QFQ/CBS qlen underflow test\n net/sched: sch_cbs: Call qdisc_reset for child qdisc\n FDDI: defza: Sanitise the reset safety timer\n net: ethernet: ravb: Do not check URAM suspension when WoL is active\n ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics\n net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint\n net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS\n net: atm: fix skb leak in sigd_send() default branch\n net: ethtool: phy: avoid NULL deref when PHY driver is unbound\n net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled\n net: shaper: reject QUEUE scope handle with missing id\n ...\n" }, { "commit": "81a874233c305d29e37fdb70b691ff4254294c0b", "tree": "93641904d65f50d44d3ce0151c71f5a0cb398d66", "parents": [ "ab26dfeba278b0efbcea012f1698cf524d9b5695" ], "author": { "name": "Jeremy Erazo", "email": "mendozayt13@gmail.com", "time": "Thu May 14 12:03:34 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 10:55:28 2026 -0500" }, "message": "smb: client: avoid integer overflow in SMB2 READ length check\n\nSMB2 READ response validation in cifs_readv_receive() and\nhandle_read_data() checks data_offset + data_len against the received\nbuffer length. Both values are attacker-controlled fields from the\nserver response and are stored as unsigned int, so the addition can\nwrap before the bounds check:\n\n\tfs/smb/client/transport.c:1259\n\t\tif (!use_rdma_mr \u0026\u0026 (data_offset + data_len \u003e buflen))\n\n\tfs/smb/client/smb2ops.c:4839\n\t\telse if (buf_len \u003e\u003d data_offset + data_len)\n\nA malicious SMB server can use this to bypass validation. In the\nnon-encrypted receive path the client attempts an oversized socket\nread and stalls for the SMB response timeout (180 seconds) before\nreconnecting. In the SMB3 encrypted path, runtime testing shows the\nmalformed length can reach copy_to_iter() in handle_read_data() with\nattacker-controlled size, where usercopy hardening stops the oversized\ncopy before bytes reach userspace.\n\nGuard both call sites with check_add_overflow(), which is already\nused elsewhere in this subsystem (smb2pdu.c). On overflow, treat the\nresponse as malformed and reject with -EIO.\n\nSigned-off-by: Jeremy Erazo \u003cmendozayt13@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" } ], "next": "eb5441518fba295bd97b59dc54914f89dfaa107d" }