)]}' { "log": [ { "commit": "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681", "tree": "0c35deacb844b5fa46909f759acefd30ca58d9da", "parents": [ "fc9f248d8c591454e257edd54ac4085d84f11e6a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 16:56:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 16:56:54 2026 -0700" }, "message": "Linux 7.0-rc3\n" }, { "commit": "fc9f248d8c591454e257edd54ac4085d84f11e6a", "tree": "47ee5797f2cdea3e1d4151a0b3d381aac34d10a0", "parents": [ "014441d1e4b2f5be728433b761df3377dee7a487", "a4b0bf6a40f3c107c67a24fbc614510ef5719980" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 12:13:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 12:13:09 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"Fix for the x86 EFI workaround keeping boot services code and data\n regions reserved until after SetVirtualAddressMap() completes:\n deferred struct page initialization may result in some of this memory\n being lost permanently\"\n\n* tag \u0027efi-fixes-for-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n x86/efi: defer freeing of boot services memory\n" }, { "commit": "014441d1e4b2f5be728433b761df3377dee7a487", "tree": "7b97a45eee4f95d7fd76f185c05773b5f4199206", "parents": [ "c23719abc3308df7ed3ad35650ad211fb2d2003d", "cfc69c2e6c699c96949f7b0455195b0bfb7dc715" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 10:17:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 10:17:05 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fix from Wolfram Sang:\n \"A revert for the i801 driver restoring old locking behaviour\"\n\n* tag \u0027i2c-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"\n" }, { "commit": "c23719abc3308df7ed3ad35650ad211fb2d2003d", "tree": "22b3f400be548bd88c368bfe6e5afcf77334fd36", "parents": [ "6ff1020c2f7b5593b916afbc87a835371ab1d51b", "b5ef09a77d0b5213268300eedd8a7d28b4e92d47" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:12:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:12:06 2026 -0800" }, "message": "Merge tag \u0027x86-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix SEV guest boot failures in certain circumstances, due to\n very early code relying on a BSS-zeroed variable that isn\u0027t\n actually zeroed yet an may contain non-zero bootup values\n\n Move the variable into the .data section go gain even earlier\n zeroing\n\n - Expose \u0026 allow the IBPB-on-Entry feature on SNP guests, which\n was not properly exposed to guests due to initial implementational\n caution\n\n - Fix O\u003d build failure when CONFIG_EFI_SBAT_FILE is using relative\n file paths\n\n - Fix the various SNC (Sub-NUMA Clustering) topology enumeration\n bugs/artifacts (sched-domain build errors mostly).\n\n SNC enumeration data got more complicated with Granite Rapids X\n (GNR) and Clearwater Forest X (CWF), which exposed these bugs\n and made their effects more serious\n\n - Also use the now sane(r) SNC code to fix resctrl SNC detection bugs\n\n - Work around a historic libgcc unwinder bug in the vdso32 sigreturn\n code (again), which regressed during an overly aggressive recent\n cleanup of DWARF annotations\n\n* tag \u0027x86-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/entry/vdso32: Work around libgcc unwinder bug\n x86/resctrl: Fix SNC detection\n x86/topo: Fix SNC topology mess\n x86/topo: Replace x86_has_numa_in_package\n x86/topo: Add topology_num_nodes_per_package()\n x86/numa: Store extra copy of numa_nodes_parsed\n x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths\n x86/sev: Allow IBPB-on-Entry feature for SNP guests\n x86/boot/sev: Move SEV decompressor variables into the .data section\n" }, { "commit": "6ff1020c2f7b5593b916afbc87a835371ab1d51b", "tree": "f89f7c9c492defc6dc9e8dfaec8bb9d4d2d434a9", "parents": [ "b1b9a9d0b5c875decbc129c16c6e827fb50489a5", "e48a869957a70cc39b4090cd27c36a86f8db9b92" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:09:15 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:09:15 2026 -0800" }, "message": "Merge tag \u0027timers-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Make clock_adjtime() syscall timex validation slightly more permissive\n for auxiliary clocks, to not reject syscalls based on the status field\n that do not try to modify the status field.\n\n This makes the ABI behavior in clock_adjtime() consistent with\n CLOCK_REALTIME\"\n\n* tag \u0027timers-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timekeeping: Fix timex status validation for auxiliary clocks\n" }, { "commit": "b1b9a9d0b5c875decbc129c16c6e827fb50489a5", "tree": "d45ef819e05900f9e18f6e5a54d5171c1ecd171c", "parents": [ "1954c4f012206147c34acda8da04f827aa7d3ee3", "d658686a1331db3bb108ca079d76deb3208ed949" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:07:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:07:13 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n \"Fix a DL scheduler bug that may corrupt internal metrics during PI and\n setscheduler() syscalls, resulting in kernel warnings and misbehavior.\n\n Found during stress-testing\"\n\n* tag \u0027sched-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting\n" }, { "commit": "1954c4f012206147c34acda8da04f827aa7d3ee3", "tree": "49d682b2b3865d8758fa30926ed55d839e97f75d", "parents": [ "3b5d535c635cbf88dbb63231cbae265b22e6a5f5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Mar 07 20:07:15 2026 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 15:03:14 2026 -0800" }, "message": "eventpoll: Convert epoll_put_uevent() to scoped user access\n\nSaves two function calls, and one stac/clac pair.\n\nstac/clac is rather expensive on older cpus like Zen 2.\n\nA synthetic network stress test gives a ~1.5% increase of pps\non AMD Zen 2.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Christophe Leroy \u003cchristophe.leroy@csgroup.eu\u003e\nCc: Dave Hansen \u003cdave.hansen@intel.com\u003e\nCc: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3b5d535c635cbf88dbb63231cbae265b22e6a5f5", "tree": "caf5b6b23f400e3acb151a942c5ca999c40b8cf3", "parents": [ "fb07430e6f98ccff61f6f1a06d01d7f12e29c6d3", "14d4ac19d1895397532eec407433c5d74d9da53b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 14:04:50 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 14:04:50 2026 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Two core changes and the rest in drivers, one core change to quirk the\n behaviour of the Iomega Zip drive and one to fix a hang caused by tag\n reallocation problems, which has mostly been seen by the iscsi client.\n\n Note the latter fixes the problem but still has a slight sysfs memory\n leak, so will be amended in the next pull request (once we\u0027ve run the\n fix for the fix through our testing)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: Fix recursive locking in __configfs_open_file()\n scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP\n scsi: mpi3mr: Clear reset history on ready and recheck state after timeout\n scsi: core: Fix refcount leak for tagset_refcnt\n" }, { "commit": "fb07430e6f98ccff61f6f1a06d01d7f12e29c6d3", "tree": "8ebb39044b6255316582f0861f52a6e999fe4004", "parents": [ "6deccafcb45b53825b2039c475da0258c899418b", "e31a374a99f5026df6ebff2a1c49492276e776fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 13:21:43 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 13:21:43 2026 -0800" }, "message": "Merge tag \u0027fbdev-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev fix from Helge Deller:\n \"Silence build error in au1100fb driver found by kernel test robot\"\n\n* tag \u0027fbdev-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: au1100fb: Fix build on MIPS64\n" }, { "commit": "6deccafcb45b53825b2039c475da0258c899418b", "tree": "b027969651c64cee9ce2d205bb91d04d6bb54f7d", "parents": [ "8b7f4cd3ac300cad4446eeb4c9eb69d02ef52d6c", "8475d8fe21ec9c7eb2faca555fbc5b68cf0d2597" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 12:38:16 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 12:38:16 2026 -0800" }, "message": "Merge tag \u0027parisc-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fixes from Helge Deller:\n \"While testing Sasha Levin\u0027s \u0027kallsyms: embed source file:line info in\n kernel stack traces\u0027 patch series, which increases the typical kernel\n image size, I found some issues with the parisc initial kernel mapping\n which may prevent the kernel to boot.\n\n The three small patches here fix this\"\n\n* tag \u0027parisc-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n parisc: Fix initial page table creation for boot\n parisc: Check kernel mapping earlier at bootup\n parisc: Increase initial mapping to 64 MB with KALLSYMS\n" }, { "commit": "8b7f4cd3ac300cad4446eeb4c9eb69d02ef52d6c", "tree": "834cd5ba0cafbb41ace79526ec96e722e9e94814", "parents": [ "03dcad79eec3b2056c31031217cda9be70eabe11", "b0dcdcb9ae757c8a8ba2fb24d34f8d147bae707b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 12:20:37 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 12:20:37 2026 -0800" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix u32/s32 bounds when ranges cross min/max boundary (Eduard\n Zingerman)\n\n - Fix precision backtracking with linked registers (Eduard Zingerman)\n\n - Fix linker flags detection for resolve_btfids (Ihor Solodrai)\n\n - Fix race in update_ftrace_direct_add/del (Jiri Olsa)\n\n - Fix UAF in bpf_trampoline_link_cgroup_shim (Lang Xu)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n resolve_btfids: Fix linker flags detection\n selftests/bpf: add reproducer for spurious precision propagation through calls\n bpf: collect only live registers in linked regs\n Revert \"selftests/bpf: Update reg_bound range refinement logic\"\n selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary\n bpf: Fix u32/s32 bounds when ranges cross min/max boundary\n bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n ftrace: Add missing ftrace_lock to update_ftrace_direct_add/del\n" }, { "commit": "03dcad79eec3b2056c31031217cda9be70eabe11", "tree": "117c2bd79e5711d7e886a16c5c3809cf87f61208", "parents": [ "aed0af05a873445bed7f28f299da57d54765cc80", "78c2ce0fd6ddb6c87aaa56b0d49c70e17df21e6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 11:56:55 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 11:56:55 2026 -0800" }, "message": "Merge tag \u0027rcu-fixes.v7.0-20260307a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux\n\nPull RCU selftest fixes from Boqun Feng:\n \"Fix a regression in RCU torture test pre-defined scenarios caused by\n commit 7dadeaa6e851 (\"sched: Further restrict the preemption modes\")\n which limits PREEMPT_NONE to architectures that do not support\n preemption at all and PREEMPT_VOLUNTARY to those architectures that do\n not yet have PREEMPT_LAZY support.\n\n Since major architectures (e.g. x86 and arm64) no longer support\n CONFIG_PREEMPT_NONE and CONFIG_PREEMPT_VOLUNTARY, using them in\n rcutorture, rcuscale, refscale, and scftorture pre-defined scenarios\n causes config checking errors.\n\n Switch these kconfigs to PREEMPT_LAZY\"\n\n* tag \u0027rcu-fixes.v7.0-20260307a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:\n scftorture: Update due to x86 not supporting none/voluntary preemption\n refscale: Update due to x86 not supporting none/voluntary preemption\n rcuscale: Update due to x86 not supporting none/voluntary preemption\n rcutorture: Update due to x86 not supporting none/voluntary preemption\n" }, { "commit": "aed0af05a873445bed7f28f299da57d54765cc80", "tree": "9b1ca37cea09474a309b5158445bca196fc5ca00", "parents": [ "7b6e48df8892e1f128473e6971b3b8b24eb39f4b", "d008ba8be8984760e36d7dcd4adbd5a41a645708" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 09:50:54 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 09:50:54 2026 -0800" }, "message": "Merge tag \u0027trace-v7.0-rc2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix possible NULL pointer dereference in trace_data_alloc()\n\n On the trace_data_alloc() error path, it can call trigger_data_free()\n with a NULL pointer. This used to be a kfree() but was changed to\n trigger_data_free() to clean up any partial initialization. The issue\n is that trigger_data_free() does not expect a NULL pointer. Have\n trigger_data_free() return safely on NULL pointer.\n\n - Fix multiple events on the command line and bootconfig\n\n If multiple events are enabled on the command line separately and not\n grouped, only the last event gets enabled. That is:\n\n trace_event\u003dsched_switch trace_event\u003dsched_waking\n\n will only enable sched_waking whereas:\n\n trace_event\u003dsched_switch,sched_waking\n\n will enable both.\n\n The bootconfig makes it even worse as the second way is the more\n common method.\n\n The issue is that a temporary buffer is used to store the events to\n enable later in boot. Each time the cmdline callback is called, it\n overwrites what was previously there.\n\n Have the callback append the next value (delimited by a comma) if the\n temporary buffer already has content.\n\n - Fix command line trace_buffer_size if \u003e\u003d 2G\n\n The logic to allocate the trace buffer uses \"int\" for the size\n parameter in the command line code causing overflow issues if more\n that 2G is specified.\n\n* tag \u0027trace-v7.0-rc2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix trace_buf_size\u003d cmdline parameter with sizes \u003e\u003d 2G\n tracing: Fix enabling multiple events on the kernel command line and bootconfig\n tracing: Add NULL pointer check to trigger_data_free()\n" }, { "commit": "b0dcdcb9ae757c8a8ba2fb24d34f8d147bae707b", "tree": "d9a12fe3b9f35ec21c296342fcfdc94c1da4cca4", "parents": [ "325d1ba3cac4a1c0bf981f73f4edbb7411f0e4dc" ], "author": { "name": "Ihor Solodrai", "email": "ihor.solodrai@linux.dev", "time": "Wed Mar 04 17:47:30 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat Mar 07 08:51:51 2026 -0800" }, "message": "resolve_btfids: Fix linker flags detection\n\nThe \"|| echo -lzstd\" default makes zstd an unconditional link\ndependency of resolve_btfids. On systems where libzstd-dev is not\ninstalled and pkg-config fails, the linker fails:\n\n ld: cannot find -lzstd: No such file or directory\n\nlibzstd is a transitive dependency of libelf, so the -lzstd flag is\nstrictly necessary only for static builds [1].\n\nRemove ZSTD_LIBS variable, and instead set LIBELF_LIBS depending on\nwhether the build is static or not. Use $(HOSTPKG_CONFIG) as primary\nsource of the flags list.\n\nAlso add a default value for HOSTPKG_CONFIG in case it\u0027s not built via\nthe toplevel Makefile. Pass it from selftests/bpf too.\n\n[1] https://lore.kernel.org/bpf/4ff82800-2daa-4b9f-95a9-6f512859ee70@linux.dev/\n\nReported-by: BPF CI Bot (Claude Opus 4.6) \u003cbot+bpf-ci@kernel.org\u003e\nReported-by: Vitaly Chikunov \u003cvt@altlinux.org\u003e\nCloses: https://lore.kernel.org/bpf/aaWqMcK-2AQw5dx8@altlinux.org/\nFixes: 4021848a903e (\"selftests/bpf: Pass through build flags to bpftool and resolve_btfids\")\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nReviewed-by: Paul Chaignon \u003cpaul.chaignon@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260305014730.3123382-1-ihor.solodrai@linux.dev\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "7b6e48df8892e1f128473e6971b3b8b24eb39f4b", "tree": "dd13568c607a37cfe40099bceac2c7254f9c9d9d", "parents": [ "e33aafac04bdd8f03300651916386e296eb8020a", "25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 08:39:59 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 08:39:59 2026 -0800" }, "message": "Merge tag \u0027hwmon-for-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - Fix initialization commands for AHT20\n\n - Correct a malformed email address (emc1403)\n\n - Check the it87_lock() return value\n\n - Fix inverted polarity (max6639)\n\n - Fix overflows, underflows, sign extension, and other problems in\n macsmc\n\n - Fix stack overflow in debugfs read (pmbus/q54sj108a2)\n\n - Drop support for SMARC-sAM67 (discontinued and never released to\n market)\n\n* tag \u0027hwmon-for-v7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read\n hwmon: (max6639) fix inverted polarity\n dt-bindings: hwmon: sl28cpld: Drop sa67mcu compatible\n hwmon: (it87) Check the it87_lock() return value\n Revert \"hwmon: add SMARC-sAM67 support\"\n hwmon: (aht10) Fix initialization commands for AHT20\n hwmon: (emc1403) correct a malformed email address\n hwmon: (macsmc) Fix overflows, underflows, and sign extension\n hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver\n" }, { "commit": "e33aafac04bdd8f03300651916386e296eb8020a", "tree": "0e92f93317fcbf18f3aa766c42692aa1fe382d98", "parents": [ "0f912c8917e810a4aa81d122a8e7d0a918505ab9", "9de68394a61528d40f575c3e6719cc75c56f62c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 08:16:48 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 08:16:48 2026 -0800" }, "message": "Merge tag \u0027driver-core-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fix from Danilo Krummrich:\n\n - Revert \"driver core: enforce device_lock for driver_match_device()\":\n\n When a device is already present in the system and a driver is\n registered on the same bus, we iterate over all devices registered on\n this bus to see if one of them matches. If we come across an already\n bound one where the corresponding driver crashed while holding the\n device lock (e.g. in probe()) we can\u0027t make any progress anymore.\n\n Thus, revert and clarify that an implementer of struct bus_type must\n not expect match() to be called with the device lock held.\n\n* tag \u0027driver-core-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n Revert \"driver core: enforce device_lock for driver_match_device()\"\n" }, { "commit": "0f912c8917e810a4aa81d122a8e7d0a918505ab9", "tree": "44be0aba84e09f24215fdef67bb9842251182cc6", "parents": [ "4ae12d8bd9a830799db335ee661d6cbc6597f838", "e2dcf9065536ab4a1b00828ff0d19f7d282dfecc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 07:44:32 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 07:44:32 2026 -0800" }, "message": "Merge tag \u0027for-linus-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n\n - a cleanup of arch/x86/kernel/head_64.S removing the pre-built page\n tables for Xen guests\n\n - a small comment update\n\n - another cleanup for Xen PVH guests mode\n\n - fix an issue with Xen PV-devices backed by driver domains\n\n* tag \u0027for-linus-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen/xenbus: better handle backend crash\n xenbus: add xenbus_device parameter to xenbus_read_driver_state()\n x86/PVH: Use boot params to pass RSDP address in start_info page\n x86/xen: update outdated comment\n xen/acpi-processor: fix _CST detection using undersized evaluation buffer\n x86/xen: Build identity mapping page tables dynamically for XENPV\n" }, { "commit": "325d1ba3cac4a1c0bf981f73f4edbb7411f0e4dc", "tree": "5b66c9a17e2d54698bcf07c8205f2d4063c1c5f8", "parents": [ "6895e1d7c3171dc29097393749a6f4ebfb316860", "223ffb6a3d0582522455e83ccf7ad2d3a753e039" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:24:41 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 21:50:05 2026 -0800" }, "message": "Merge branch \u0027bpf-fix-precision-backtracking-bug-with-linked-registers\u0027\n\nEduard Zingerman says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix precision backtracking bug with linked registers\n\nEmil Tsalapatis reported a verifier bug hit by the scx_lavd sched_ext\nscheduler. The essential part of the verifier log looks as follows:\n\n 436: ...\n // checkpoint hit for 438: (1d) if r7 \u003d\u003d r8 goto ...\n frame 3: propagating r2,r7,r8\n frame 2: propagating r6\n mark_precise: frame3: last_idx ...\n mark_precise: frame3: regs\u003dr2,r7,r8 stack\u003d before 436: ...\n mark_precise: frame3: regs\u003dr2,r7 stack\u003d before 435: ...\n mark_precise: frame3: regs\u003dr2,r7 stack\u003d before 434: (85) call bpf_trace_vprintk#177\n verifier bug: backtracking call unexpected regs 84\n\nThe log complains that registers r2 and r7 are tracked as precise\nwhile processing the bpf_trace_vprintk() call in precision backtracking.\nThis can\u0027t be right, as r2 is reset by the call and there is nothing\nto backtrack it to. The precision propagation is triggered when\na checkpoint is hit at instruction 438, r2 is dead at that instruction.\n\nThis happens because of the following sequence of events:\n- Instruction 438 is first reached with registers r2 and r7 having\n the same id via a path that does not call bpf_trace_vprintk():\n - Checkpoint is created at 438.\n - The jump at 438 is predicted, hence r7 and registers linked to it\n (r2) are propagated as precise, marking r2 and r7 precise in the\n checkpoint.\n- Instruction 438 is reached a second time with r2 undefined and via\n a path that calls bpf_trace_vprintk():\n - Checkpoint is hit.\n - propagate_precision() picks registers r2 and r7 and propagates\n precision marks for those up to the helper call.\n\nThe root cause is the fact that states_equal() and\npropagate_precision() assume that the precision flag can\u0027t be set for a\ndead register (as computed by compute_live_registers()).\nHowever, this is not the case when linked registers are at play.\nFix this by accounting for live register flags in\ncollect_linked_regs().\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260306-linked-regs-and-propagate-precision-v1-0-18e859be570d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "223ffb6a3d0582522455e83ccf7ad2d3a753e039", "tree": "5b66c9a17e2d54698bcf07c8205f2d4063c1c5f8", "parents": [ "2658a1720a1944fbaeda937000ad2b3c3dfaf1bb" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Mar 06 16:02:48 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 21:50:05 2026 -0800" }, "message": "selftests/bpf: add reproducer for spurious precision propagation through calls\n\nAdd a test for the scenario described in the previous commit:\nan iterator loop with two paths where one ties r2/r7 via\nshared scalar id and skips a call, while the other goes\nthrough the call. Precision marks from the linked registers\nget spuriously propagated to the call path via\npropagate_precision(), hitting \"backtracking call unexpected\nregs\" in backtrack_insn().\n\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-2-18e859be570d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "2658a1720a1944fbaeda937000ad2b3c3dfaf1bb", "tree": "b31b73cd6edeb0e05e57cbf66431511275749c19", "parents": [ "6895e1d7c3171dc29097393749a6f4ebfb316860" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Mar 06 16:02:47 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 21:49:40 2026 -0800" }, "message": "bpf: collect only live registers in linked regs\n\nFix an inconsistency between func_states_equal() and\ncollect_linked_regs():\n- regsafe() uses check_ids() to verify that cached and current states\n have identical register id mapping.\n- func_states_equal() calls regsafe() only for registers computed as\n live by compute_live_registers().\n- clean_live_states() is supposed to remove dead registers from cached\n states, but it can skip states belonging to an iterator-based loop.\n- collect_linked_regs() collects all registers sharing the same id,\n ignoring the marks computed by compute_live_registers().\n Linked registers are stored in the state\u0027s jump history.\n- backtrack_insn() marks all linked registers for an instruction\n as precise whenever one of the linked registers is precise.\n\nThe above might lead to a scenario:\n- There is an instruction I with register rY known to be dead at I.\n- Instruction I is reached via two paths: first A, then B.\n- On path A:\n - There is an id link between registers rX and rY.\n - Checkpoint C is created at I.\n - Linked register set {rX, rY} is saved to the jump history.\n - rX is marked as precise at I, causing both rX and rY\n to be marked precise at C.\n- On path B:\n - There is no id link between registers rX and rY,\n otherwise register states are sub-states of those in C.\n - Because rY is dead at I, check_ids() returns true.\n - Current state is considered equal to checkpoint C,\n propagate_precision() propagates spurious precision\n mark for register rY along the path B.\n - Depending on a program, this might hit verifier_bug()\n in the backtrack_insn(), e.g. if rY ∈ [r1..r5]\n and backtrack_insn() spots a function call.\n\nThe reproducer program is in the next patch.\nThis was hit by sched_ext scx_lavd scheduler code.\n\nChanges in tests:\n- verifier_scalar_ids.c selftests need modification to preserve\n some registers as live for __msg() checks.\n- exceptions_assert.c adjusted to match changes in the verifier log,\n R0 is dead after conditional instruction and thus does not get\n range.\n- precise.c adjusted to match changes in the verifier log, register r9\n is dead after comparison and it\u0027s range is not important for test.\n\nReported-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nFixes: 0fb3cf6110a5 (\"bpf: use register liveness information for func_states_equal\")\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260306-linked-regs-and-propagate-precision-v1-1-18e859be570d@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "4ae12d8bd9a830799db335ee661d6cbc6597f838", "tree": "4953a138c5c81f389509db3cd3ef2174817317e2", "parents": [ "591d8796b26ff707e35aad00f1274049126feba5", "fdb12c8a24a453bdd6759979b6ef1e04ebd4beb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 20:27:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 20:27:13 2026 -0800" }, "message": "Merge tag \u0027kbuild-fixes-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nathan Chancellor:\n\n - Split out .modinfo section from ELF_DETAILS macro, as that macro may\n be used in other areas that expect to discard .modinfo, breaking\n certain image layouts\n\n - Adjust genksyms parser to handle optional attributes in certain\n declarations, necessary after commit 07919126ecfc (\"netfilter:\n annotate NAT helper hook pointers with __rcu\")\n\n - Include resolve_btfids in external module build created by\n scripts/package/install-extmod-build when it may be run on external\n modules\n\n - Avoid removing objtool binary with \u0027make clean\u0027, as it is required\n for external module builds\n\n* tag \u0027kbuild-fixes-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n kbuild: Leave objtool binary around with \u0027make clean\u0027\n kbuild: install-extmod-build: Package resolve_btfids if necessary\n genksyms: Fix parsing a declarator with a preceding attribute\n kbuild: Split .modinfo out from ELF_DETAILS\n" }, { "commit": "591d8796b26ff707e35aad00f1274049126feba5", "tree": "b554be64836e67bde99b6655f9f0213f4d187fe7", "parents": [ "4660e168c6fd0cd448315bd617c5df7bb21daaf1", "674c5ff0f440a051ebf299d29a4c013133d81a65" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 20:20:17 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 20:20:17 2026 -0800" }, "message": "Merge tag \u0027s390-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix stackleak and xor lib inline asm, constraints and clobbers to\n prevent miscompilations and incomplete stack poisoning\n\n* tag \u0027s390-7.0-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/stackleak: Fix __stackleak_poison() inline assembly constraint\n s390/xor: Improve inline assembly constraints\n s390/xor: Fix xor_xc_2() inline assembly constraints\n s390/xor: Fix xor_xc_5() inline assembly\n" }, { "commit": "4660e168c6fd0cd448315bd617c5df7bb21daaf1", "tree": "053110445edb1140ff48219a59595a44b73712b6", "parents": [ "e0c505cb764e73273b3ddce80b5944fa5b796bd9", "d87c828daa7ead9763416f75cc416496969cf1dc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 19:57:03 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 19:57:03 2026 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"The main changes are a fix to the way in which we manage the access\n flag setting for mappings using the contiguous bit and a fix for a\n hang on the kexec/hibernation path.\n\n Summary:\n\n - Fix kexec/hibernation hang due to bogus read-only mappings\n\n - Fix sparse warnings in our cmpxchg() implementation\n\n - Prevent runtime-const being used in modules, just like x86\n\n - Fix broken elision of access flag modifications for contiguous\n entries on systems without support for hardware updates\n\n - Fix a broken SVE selftest that was testing the wrong instruction\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftest/arm64: Fix sve2p1_sigill() to hwcap test\n arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults\n arm64: make runtime const not usable by modules\n arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation\n arm64: Silence sparse warnings caused by the type casting in (cmp)xchg\n" }, { "commit": "d008ba8be8984760e36d7dcd4adbd5a41a645708", "tree": "7d750a03480a14e5f2da40b54e9def19d741c2b7", "parents": [ "3b1679e086bb869ca02722f6bd29b3573a6a0e7e" ], "author": { "name": "Calvin Owens", "email": "calvin@wbinvd.org", "time": "Fri Mar 06 19:19:25 2026 -0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Fri Mar 06 22:25:53 2026 -0500" }, "message": "tracing: Fix trace_buf_size\u003d cmdline parameter with sizes \u003e\u003d 2G\n\nSome of the sizing logic through tracer_alloc_buffers() uses int\ninternally, causing unexpected behavior if the user passes a value that\ndoes not fit in an int (on my x86 machine, the result is uselessly tiny\nbuffers).\n\nFix by plumbing the parameter\u0027s real type (unsigned long) through to the\nring buffer allocation functions, which already use unsigned long.\n\nIt has always been possible to create larger ring buffers via the sysfs\ninterface: this only affects the cmdline parameter.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.1772852067.git.calvin@wbinvd.org\nFixes: 73c5162aa362 (\"tracing: keep ring buffer to minimum size till used\")\nSigned-off-by: Calvin Owens \u003ccalvin@wbinvd.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6895e1d7c3171dc29097393749a6f4ebfb316860", "tree": "a84f2b19739d91fe7d3d1430076a53af28a8a307", "parents": [ "56145d237385ca0e7ca9ff7b226aaf2eb8ef368b", "d87c9305a8841b312b14ca0c360a563ef60b2a5b" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:11:03 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:16:17 2026 -0800" }, "message": "Merge branch \u0027bpf-fix-u32-s32-bounds-when-ranges-cross-min-max-boundary\u0027\n\nEduard Zingerman says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix u32/s32 bounds when ranges cross min/max boundary\n\nCover the following cases in range refinement logic for 32-bit ranges:\n- s32 range crosses U32_MAX/0 boundary, positive part of the s32 range\n overlaps with u32 range.\n- s32 range crosses U32_MAX/0 boundary, negative part of the s32 range\n overlaps with u32 range.\n\nThese cases are already handled for 64-bit range refinement.\n\nWithout the fix the test in patch 2 is rejected by the verifier.\nThe test was reduced from sched-ext program.\n\nChangelog:\n- v2 -\u003e v3:\n - Reverted da653de268d3 (Paul)\n - Removed !BPF_F_TEST_REG_INVARIANTS flag from\n crossing_32_bit_signed_boundary_2() (Paul)\n- v1 -\u003e v2:\n - Extended commit message and comments (Emil)\n - Targeting \u0027bpf\u0027 tree instead of bpf-next (Alexei)\n\nv1: https://lore.kernel.org/bpf/9a23fbacdc6d33ec8fcb3f6988395b5129f75369.camel@gmail.com/T\nv2: https://lore.kernel.org/bpf/20260305-bpf-32-bit-range-overflow-v2-0-7169206a3041@gmail.com/\n---\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260306-bpf-32-bit-range-overflow-v3-0-f7f67e060a6b@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "d87c9305a8841b312b14ca0c360a563ef60b2a5b", "tree": "a84f2b19739d91fe7d3d1430076a53af28a8a307", "parents": [ "f81fdfd16771e266753146bd83f6dd23515ebee9" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Mar 06 16:54:26 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:16:17 2026 -0800" }, "message": "Revert \"selftests/bpf: Update reg_bound range refinement logic\"\n\nThis reverts commit da653de268d32a80e135c9eb960a8147c186f1bc.\nRemoved logic is now covered by range_refine_in_halves()\nwhich handles both 32-bit and 64-bit refinements.\n\nSuggested-by: Paul Chaignon \u003cpaul.chaignon@gmail.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-3-f7f67e060a6b@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "f81fdfd16771e266753146bd83f6dd23515ebee9", "tree": "d7c260ea56a4eea76280a8048d0ab93f5fe93c85", "parents": [ "fbc7aef517d8765e4c425d2792409bb9bf2e1f13" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Mar 06 16:54:25 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:16:17 2026 -0800" }, "message": "selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary\n\nTwo test cases for signed/unsigned 32-bit bounds refinement\nwhen s32 range crosses the sign boundary:\n- s32 range [S32_MIN..1] overlapping with u32 range [3..U32_MAX],\n s32 range tail before sign boundary overlaps with u32 range.\n- s32 range [-3..5] overlapping with u32 range [0..S32_MIN+3],\n s32 range head after the sign boundary overlaps with u32 range.\n\nThis covers both branches added in the __reg32_deduce_bounds().\n\nAlso, crossing_32_bit_signed_boundary_2() no longer triggers invariant\nviolations.\n\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nReviewed-by: Paul Chaignon \u003cpaul.chaignon@gmail.com\u003e\nAcked-by: Shung-Hsi Yu \u003cshung-hsi.yu@suse.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-2-f7f67e060a6b@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "fbc7aef517d8765e4c425d2792409bb9bf2e1f13", "tree": "47754cd0653d682dd4abe72395dfd7dde5622644", "parents": [ "56145d237385ca0e7ca9ff7b226aaf2eb8ef368b" ], "author": { "name": "Eduard Zingerman", "email": "eddyz87@gmail.com", "time": "Fri Mar 06 16:54:24 2026 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Mar 06 18:16:06 2026 -0800" }, "message": "bpf: Fix u32/s32 bounds when ranges cross min/max boundary\n\nSame as in __reg64_deduce_bounds(), refine s32/u32 ranges\nin __reg32_deduce_bounds() in the following situations:\n\n- s32 range crosses U32_MAX/0 boundary, positive part of the s32 range\n overlaps with u32 range:\n\n 0 U32_MAX\n | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] |\n |----------------------------|----------------------------|\n |xxxxx s32 range xxxxxxxxx] [xxxxxxx|\n 0 S32_MAX S32_MIN -1\n\n- s32 range crosses U32_MAX/0 boundary, negative part of the s32 range\n overlaps with u32 range:\n\n 0 U32_MAX\n | [xxxxxxxxxxxxxx u32 range xxxxxxxxxxxxxx] |\n |----------------------------|----------------------------|\n |xxxxxxxxx] [xxxxxxxxxxxx s32 range |\n 0 S32_MAX S32_MIN -1\n\n- No refinement if ranges overlap in two intervals.\n\nThis helps for e.g. consider the following program:\n\n call %[bpf_get_prandom_u32];\n w0 \u0026\u003d 0xffffffff;\n if w0 \u003c 0x3 goto 1f; // on fall-through u32 range [3..U32_MAX]\n if w0 s\u003e 0x1 goto 1f; // on fall-through s32 range [S32_MIN..1]\n if w0 s\u003c 0x0 goto 1f; // range can be narrowed to [S32_MIN..-1]\n r10 \u003d 0;\n1: ...;\n\nThe reg_bounds.c selftest is updated to incorporate identical logic,\nrefinement based on non-overflowing range halves:\n\n ((x ∩ [0, smax]) ∩ (y ∩ [0, smax])) ∪\n ((x ∩ [smin,-1]) ∩ (y ∩ [smin,-1]))\n\nReported-by: Andrea Righi \u003carighi@nvidia.com\u003e\nReported-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nCloses: https://lore.kernel.org/bpf/aakqucg4vcujVwif@gpd4/T/\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nAcked-by: Shung-Hsi Yu \u003cshung-hsi.yu@suse.com\u003e\nSigned-off-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260306-bpf-32-bit-range-overflow-v3-1-f7f67e060a6b@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "e0c505cb764e73273b3ddce80b5944fa5b796bd9", "tree": "1e310518244f1e800c68a1e7c213bfbcf46969a9", "parents": [ "325a118c12045239076b7ea9e66391dd6f56f72e", "048efe129a297256d3c2088cf8d79515ff5ec864" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 16:07:22 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 16:07:22 2026 -0800" }, "message": "Merge tag \u0027v7.0-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix potential oops on open failure\n\n - Fix unmount to better free deferred closes\n\n - Use proper constant-time MAC comparison function\n\n - Two buffer allocation size fixes\n\n - Two minor cleanups\n\n - make SMB2 kunit tests a distinct module\n\n* tag \u0027v7.0-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: fix oops due to uninitialised var in smb2_unlink()\n cifs: open files should not hold ref on superblock\n smb: client: Compare MACs in constant time\n smb/client: remove unused SMB311_posix_query_info()\n smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()\n smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()\n smb: update some doc references\n smb/client: make SMB2 maperror KUnit tests a separate module\n" }, { "commit": "3b1679e086bb869ca02722f6bd29b3573a6a0e7e", "tree": "558cce6603c61b4acb4c15106d7729b46c102781", "parents": [ "457965c13f0837a289c9164b842d0860133f6274" ], "author": { "name": "Andrei-Alexandru Tachici", "email": "andrei-alexandru.tachici@oss.qualcomm.com", "time": "Mon Mar 02 11:27:34 2026 +0100" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Fri Mar 06 16:54:34 2026 -0500" }, "message": "tracing: Fix enabling multiple events on the kernel command line and bootconfig\n\nMultiple events can be enabled on the kernel command line via a comma\nseparator. But if the are specified one at a time, then only the last\nevent is enabled. This is because the event names are saved in a temporary\nbuffer, and each call by the init cmdline code will reset that buffer.\n\nThis also affects names in the boot config file, as it may call the\ncallback multiple times with an example of:\n\n kernel.trace_event \u003d \":mod:rproc_qcom_common\", \":mod:qrtr\", \":mod:qcom_aoss\"\n\nChange the cmdline callback function to append a comma and the next value\nif the temporary buffer already has content.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260302-trace-events-allow-multiple-modules-v1-1-ce4436e37fb8@oss.qualcomm.com\nSigned-off-by: Andrei-Alexandru Tachici \u003candrei-alexandru.tachici@oss.qualcomm.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "325a118c12045239076b7ea9e66391dd6f56f72e", "tree": "fb8f892575546535f6c1fd27c9a2e0b9d2dbf2bf", "parents": [ "dfb31428444b00824b161d8c0741d4868552813a", "9f2c7349b2810c671badfc1adc804f711a83e420" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 13:37:52 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 13:37:52 2026 -0800" }, "message": "Merge tag \u0027pci-v7.0-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fixes from Bjorn Helgaas:\n\n - Initialize msi_addr_mask for OF-created PCI devices to fix sparc and\n powerpc probe regressions (Nilay Shroff)\n\n - Orphan the Altera PCIe controller driver (Dave Hansen)\n\n* tag \u0027pci-v7.0-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n MAINTAINERS: Orphan Altera PCIe controller driver\n sparc/PCI: Initialize msi_addr_mask for OF-created PCI devices\n powerpc/pci: Initialize msi_addr_mask for OF-created PCI devices\n" }, { "commit": "dfb31428444b00824b161d8c0741d4868552813a", "tree": "90b4b85f3c9cb8190d6acbe54f02b94637d621b9", "parents": [ "3593e678f5e8b21b8f54b4267027bd55b19cb7b8", "96bfe9ff7e88f0541002640acbcb3ec63c9d0130" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 13:29:12 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 13:29:12 2026 -0800" }, "message": "Merge tag \u0027drm-fixes-2026-03-07\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull.\n\n There is one mm fix in here for a HMM livelock triggered by the xe\n driver tests. Otherwise it\u0027s a pretty wide range of fixes across the\n board, ttm UAF regression fix, amdgpu fixes, nouveau doesn\u0027t crash my\n laptop anymore fix, and a fair bit of misc.\n\n Seems about right for rc3.\n\n mm:\n - mm: Fix a hmm_range_fault() livelock / starvation problem\n\n pagemap:\n - Revert \"drm/pagemap: Disable device-to-device migration\"\n\n ttm:\n - fix function return breaking reclaim\n - fix build failure on PREEMPT_RT\n - fix bo-\u003eresource UAF\n\n dma-buf:\n - include ioctl.h in uapi header\n\n sched:\n - fix kernel doc warning\n\n amdgpu:\n - LUT fixes\n - VCN5 fix\n - Dispclk fix\n - SMU 13.x fix\n - Fix race in VM acquire\n - PSP 15.x fix\n - UserQ fix\n\n amdxdna:\n - fix invalid payload for failed command\n - fix NULL ptr dereference\n - fix major fw version check\n - avoid inconsistent fw state on error\n\n i915/display:\n - Fix for Lenovo T14 G7 display not refreshing\n\n xe:\n - Do not preempt fence signaling CS instructions\n - Some leak and finalization fixes\n - Workaround fix\n\n nouveau:\n - avoid runtime suspend oops when using dp aux\n\n panthor:\n - fix gem_sync argument ordering\n\n solomon:\n - fix incorrect display output\n\n renesas:\n - fix DSI divider programming\n\n ethosu:\n - fix job submit error clean-up refcount\n - fix NPU_OP_ELEMENTWISE validation\n - handle possible underflows in IFM size calcs\"\n\n* tag \u0027drm-fixes-2026-03-07\u0027 of https://gitlab.freedesktop.org/drm/kernel: (38 commits)\n accel: ethosu: Handle possible underflow in IFM size calculations\n accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar\n accel: ethosu: Fix job submit error clean-up refcount underflows\n accel/amdxdna: Split mailbox channel create function\n drm/panthor: Correct the order of arguments passed to gem_sync\n Revert \"drm/syncobj: Fix handle \u003c-\u003e fd ioctls with dirty stack\"\n drm/ttm: Fix bo resource use-after-free\n nouveau/dpcd: return EBUSY for aux xfer if the device is asleep\n accel/amdxdna: Fix major version check on NPU1 platform\n drm/amdgpu/userq: refcount userqueues to avoid any race conditions\n drm/amdgpu/userq: Consolidate wait ioctl exit path\n drm/amdgpu/psp: Use Indirect access address for GFX to PSP mailbox\n drm/amdgpu: Fix use-after-free race in VM acquire\n drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x\n drm/xe: Fix memory leak in xe_vm_madvise_ioctl\n drm/xe/reg_sr: Fix leak on xa_store failure\n drm/xe/xe2_hpg: Correct implementation of Wa_16025250150\n drm/xe/gsc: Fix GSC proxy cleanup on early initialization failure\n Revert \"drm/pagemap: Disable device-to-device migration\"\n drm/i915/psr: Fix for Panel Replay X granularity DPCD register handling\n ...\n" }, { "commit": "3593e678f5e8b21b8f54b4267027bd55b19cb7b8", "tree": "20e8a1b3a6ffa679649b6c5ef3a8920376a53bae", "parents": [ "651690480a965ca196ce42d4562543f3e61cb226", "b11b9b6751b2cd74960dccd91667c5117fce743c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 12:34:49 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 12:34:49 2026 -0800" }, "message": "Merge tag \u0027linux_kselftest-kunit-fixes-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kunit fixes from Shuah Khan:\n\n - Fix rust warnings when CONFIG_PRINTK is disabled\n\n - Reduce stack usage in kunit_run_tests() to fix warnings when\n CONFIG_FRAME_WARN is set to a relatively low value\n\n - Update email address for David Gow\n\n - Copy caller args in kunit tool in run_kernel to prevent mutation\n\n* tag \u0027linux_kselftest-kunit-fixes-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n kunit: reduce stack usage in kunit_run_tests()\n kunit: tool: copy caller args in run_kernel to prevent mutation\n rust: kunit: fix warning when !CONFIG_PRINTK\n MAINTAINERS: Update email address for David Gow\n" }, { "commit": "651690480a965ca196ce42d4562543f3e61cb226", "tree": "740bd31aeff1056c3f1adb6b9bfc4dbe245aabf6", "parents": [ "5abeba615cb9b2eca3069daa7ae2c899f2efa167", "3b46d61890632c8f8b117147b6923bff4b42ccb7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:33:32 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:33:32 2026 -0800" }, "message": "Merge tag \u0027spi-fix-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fix from Mark Brown:\n \"One device specific fix here, it was possible we might end up trying\n to dereference an invalid pointer while reporting a transfer timeout\n on DesignWare controllers\"\n\n* tag \u0027spi-fix-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: spi-dw-dma: fix print error log when wait finish transaction\n" }, { "commit": "5abeba615cb9b2eca3069daa7ae2c899f2efa167", "tree": "69c8fb4555a623499ccda83bb7961b3d77bdf9ba", "parents": [ "d249037ac4701c32d99bc062834d592a57cfed00", "2d85ecd6fb0eb2fee0ffa040ec1ddea57b09bc38" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:27:45 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:27:45 2026 -0800" }, "message": "Merge tag \u0027regulator-fix-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of small, driver specific fixes which might not even have\n much impact if you have the affected devices depending on your setup\"\n\n* tag \u0027regulator-fix-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: pf9453: Respect IRQ trigger settings from firmware\n regulator: mt6363: Fix incorrect and redundant IRQ disposal in probe\n" }, { "commit": "d249037ac4701c32d99bc062834d592a57cfed00", "tree": "e30342e4397e3f76f8207e320d82aa3b76e96bfd", "parents": [ "48976c0eba2ff3a3b893c35853bdf27369b16655", "8457669db968c98edb781892d73fa559e1efcbd4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:06:04 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:06:04 2026 -0800" }, "message": "Merge tag \u0027sound-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Again a collection of device-specific fixes. Most of changes are\n fairly small device-specific quirks of fixes for HD- and USB-audio,\n ASoC Intel, AMD, fsl, Cirrus and co.\n\n The only large LOC is for plumbing ASoC ACP driver to add the Cirrus\n Logic codec support, so this one is also just adding some tables\"\n\n* tag \u0027sound-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits)\n ALSA: us122l: drop redundant interface references\n ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA\n ASoC: dt-bindings: renesas,rz-ssi: Document RZ/G3L SoC\n ASoC: SDCA: Add allocation failure check for Entity name\n ALSA: hda/senary: Ensure EAPD is enabled during init\n ALSA: hda/senary: Use codec-\u003ecore.afg for GPIO access\n ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_SKIP_IFACE_SETUP\n ASoC: dt-bindings: tegra: Add compatible for Tegra238 sound card\n ALSA: hda/hdmi: Add Tegra238 HDA codec device ID\n ASoC: cs35l56: Suppress pointless warning about number of GPIO pulls\n ASoC: amd: acp: Add ACP6.3 match entries for Cirrus Logic parts\n ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCD SKU\n ASoC: rt1321: fix DMIC ch2/3 mask issue\n ASoC: cs35l56: Only patch ASP registers if the DAI is part of a DAIlink\n ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg()\n ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits()\n ALSA: firewire: dice: Fix printf warning with W\u003d1\n ALSA: hda/tas2781: A workaround solution to lower-vol issue among lower calibrated-impedance micro-speaker on TAS2781\n ALSA: hda/realtek: Add quirk for HP Pavilion 15-eh1xxx to enable mute LED\n ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio\n ...\n" }, { "commit": "457965c13f0837a289c9164b842d0860133f6274", "tree": "a365a81a593c079439ba9dcb3d1a134ca106707c", "parents": [ "f26b098d937488e8f5c617d465760a10bfcc7f13" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Mar 05 11:33:39 2026 -0800" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Fri Mar 06 13:04:30 2026 -0500" }, "message": "tracing: Add NULL pointer check to trigger_data_free()\n\nIf trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse()\njumps to the out_free error path. While kfree() safely handles a NULL\npointer, trigger_data_free() does not. This causes a NULL pointer\ndereference in trigger_data_free() when evaluating\ndata-\u003ecmd_ops-\u003eset_filter.\n\nFix the problem by adding a NULL pointer check to trigger_data_free().\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.\n\nCc: Miaoqian Lin \u003clinmq006@gmail.com\u003e\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nLink: https://patch.msgid.link/20260305193339.2810953-1-linux@roeck-us.net\nFixes: 0550069cc25f (\"tracing: Properly process error handling in event_hist_trigger_parse()\")\nAssisted-by: Gemini:gemini-3.1-pro\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "48976c0eba2ff3a3b893c35853bdf27369b16655", "tree": "cb637e08b25d5ccf4e35f83ce36bd16a01134b85", "parents": [ "54de8b835b5d3f78081ad17c964ffc7fcf771716", "e31b556c0ba21f20c298aa61181b96541140b7b9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:00:58 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 10:00:58 2026 -0800" }, "message": "Merge tag \u0027hid-for-linus-2026030601\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Benjamin Tissoires:\n\n - fix a few memory leaks (Günther Noack)\n\n - fix potential kernel crashes in cmedia, creative-sb0540 and zydacron\n (Greg Kroah-Hartman)\n\n - fix NULL pointer dereference in pidff (Tomasz Pakuła)\n\n - fix battery reporting for Apple Magic Trackpad 2 (Julius Lehmann)\n\n - mcp2221 proper handling of failed read operation (Romain Sioen)\n\n - various device quirks / device ID additions\n\n* tag \u0027hid-for-linus-2026030601\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n HID: mcp2221: cancel last I2C command on read error\n HID: asus: add xg mobile 2023 external hardware support\n HID: multitouch: Keep latency normal on deactivate for reactivation gesture\n HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list\n HID: intel-ish-hid: ipc: Add Nova Lake-H/S PCI device IDs\n selftests: hid: tests: test_wacom_generic: add tests for display devices and opaque devices\n HID: multitouch: new class MT_CLS_EGALAX_P80H84\n HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2\n HID: pidff: Fix condition effect bit clearing\n HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them\n HID: asus: avoid memory leak in asus_report_fixup()\n HID: magicmouse: avoid memory leak in magicmouse_report_fixup()\n HID: apple: avoid memory leak in apple_report_fixup()\n HID: Document memory allocation properties of report_fixup()\n" }, { "commit": "54de8b835b5d3f78081ad17c964ffc7fcf771716", "tree": "e9e7e79272f5290fa08a80709837f227210b731c", "parents": [ "9a881ea3da166b05ec0eb66df22a7228b90aa66c", "d1a196e0a6dcddd03748468a0e9e3100790fc85c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:48:50 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:48:50 2026 -0800" }, "message": "Merge tag \u0027platform-drivers-x86-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - alienware-wmi-wmax: Add G-Mode support to m18 laptops\n\n - asus-armoury: Add support for FA401UM, G733QS, GX650RX\n\n - dell-wmi-sysman: Don\u0027t hex dump plaintext password data\n\n - hp-bioscfg: Support large number of enumeration attributes\n\n - hp-wmi: Add support for Omen 14-fb1xxx, 16-xd0xxx, 16-wf0xxx, and\n Victus-d0xxx\n\n - int3472: Handle GPIO type 0x10 (DOVDD)\n\n - intel-hid:\n - Add Dell 14 \u0026 16 Plus 2-in-1 to dmi_vgbs_allow_list\n - Enable 5-button array on ThinkPad X1 Fold 16 Gen 1\n\n - mellanox: mlxreg: Fix kernel-doc warnings\n\n - oxpec: Add support for OneXPlayer X1 Air, X1z, APEX, and Aokzoe A2\n Pro\n\n - redmi-wmi: Add more Fn hotkey mappings\n\n - thinkpad_acpi: Fix errors reading battery thresholds\n\n - touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI\n S10\n\n - uniwill-laptop:\n - FN lock/super key lock attributes rename\n - Fix crash on unexpected battery event\n - A special key combination can alter FN lock status so mark it\n volatile\n - Handle FN lock event\n\n* tag \u0027platform-drivers-x86-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (27 commits)\n platform/x86: dell-wmi-sysman: Don\u0027t hex dump plaintext password data\n platform_data/mlxreg: mlxreg.h: fix all kernel-doc warnings\n platform/x86: asus-armoury: add support for FA401UM\n platform/x86: asus-armoury: add support for GX650RX\n platform/x86: hp-bioscfg: Support allocations of larger data\n platform/x86: oxpec: Add support for Aokzoe A2 Pro\n platform/x86: oxpec: Add support for OneXPlayer X1 Air\n platform/x86: oxpec: Add support for OneXPlayer X1z\n platform/x86: oxpec: Add support for OneXPlayer APEX\n platform/x86: uniwill-laptop: Handle FN lock event\n platform/x86: uniwill-laptop: Mark FN lock status as being volatile\n platform/x86: uniwill-laptop: Fix crash on unexpected battery event\n platform/x86: uniwill-laptop: Rename FN lock and super key lock attrs\n platform/x86: redmi-wmi: Add more hotkey mappings\n platform/x86: alienware-wmi-wmax: Add G-Mode support to m18 laptops\n platform/x86: hp-wmi: add Omen 14-fb1xxx (board 8E41) support\n platform/x86: dell-wmi: Add audio/mic mute key codes\n platform/x86: hp-wmi: Add Victus 16-d0xxx support\n platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1\n platform/x86: int3472: Handle GPIO type 0x10 (DOVDD)\n ...\n" }, { "commit": "9a881ea3da166b05ec0eb66df22a7228b90aa66c", "tree": "c31d4707395d535b12a2fec29f58551560430d9b", "parents": [ "345dfaaf9f8b8dd0fc563e6f48586922b38ed11c", "6432f15c818cb30eec7c4ca378ecdebd9796f741" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:22:51 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:22:51 2026 -0800" }, "message": "Merge tag \u0027slab-for-7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Fix for slab-\u003estride truncation on 64k page systems due to short\n type. It was not due to races and lack of barriers in the end. (Harry\n Yoo)\n\n - Fix for severe performance regression due to unnecessary sheaf refill\n restrictions exposed by mempool allocation strategy. (Vlastimil\n Babka)\n\n - Stable fix for potential silent percpu sheaf flushing failures on\n PREEMPT_RT. (Vlastimil Babka)\n\n* tag \u0027slab-for-7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slab: change stride type from unsigned short to unsigned int\n mm/slab: allow sheaf refill if blocking is not allowed\n slab: distinguish lock and trylock for sheaf_flush_main()\n" }, { "commit": "345dfaaf9f8b8dd0fc563e6f48586922b38ed11c", "tree": "73c0ba2c2ed2c502e7a42538298c2584eb1eba41", "parents": [ "0b2758f48f22b173963f39e553d0ecd05f3b4433", "0fb59eaca18f1254ecdce34354eec3cb1b3b5e10" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:16:39 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:16:39 2026 -0800" }, "message": "Merge tag \u0027pmdomain-v7.0-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - rockchip: Fix PD_VCODEC for RK3588\n\n - bcm: Fix broken reset status read for bcm2835\n\n* tag \u0027pmdomain-v7.0-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: rockchip: Fix PD_VCODEC for RK3588\n pmdomain: bcm: bcm2835-power: Fix broken reset status read\n" }, { "commit": "0b2758f48f22b173963f39e553d0ecd05f3b4433", "tree": "1a6ff0747b5277496e2722d5df7997554b2e3103", "parents": [ "617f5e9fad91ebddf0b39e5eb5063d22459557e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:10:36 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 09:10:36 2026 -0800" }, "message": "Require (reasonably) normal mappings for MADV_DOFORK\n\nThis came up as a result of the tracing fix pull request, and commit\ne39bb9e02b68 (\"tracing: Fix WARN_ON in tracing_buffers_mmap_close\") in\nparticular.\n\nThe use of MADV_DOFORK confused the ring buffer mapping reference\ncounting just because it was unexpected, since the mapping was\noriginally done with VM_DONTCOPY.\n\nThe tracing code may well be the only case of this (and fixed it all by\njust using the mmap open callback to unconfuse itself), but it\u0027s just\nstrange that we allow MADV_DOFORK on special mappings where the kernel\nhas set the \"don\u0027t copy this\" bit.\n\nThe code already disallowed it for VM_IO mappings (going back to the\noriginal commit f822566165dd: \"madvise MADV_DONTFORK/MADV_DOFORK\"), so\njust extend it to any of the VM_SPECIAL cases (which includes\nVM_DONTEXPAND | VM_PFNMAP | VM_MIXEDMAP in addition to VM_IO).\n\nWe could also allow MADV_DOFORK only on mappings that had been marked\nDONTFORK by the user. But that would require us to track that\n(presumably with another VM_xyz bit), so let\u0027s just do this trivial and\nstraightforward modifications.\n\nIf anybody notices, Lorenzo will be boarding Flying Pig Airlines.\n\nSuggested-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nLink: https://lore.kernel.org/all/a8907468-d7e9-4727-af28-66d905093230@kernel.org/\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "617f5e9fad91ebddf0b39e5eb5063d22459557e5", "tree": "7a3237b08332d95f910f5f50037e0831ed2718fb", "parents": [ "723b5c93aaffe05cd2cb6585c3b4bc9fd131df27", "d240b079a37e90af03fd7dfec94930eb6c83936e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:44:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:44:20 2026 -0800" }, "message": "Merge tag \u0027v7.0-p2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Fix use-after-free in ccp\n\n - Fix bug when SEV is disabled in ccp\n\n - Fix tfm_count leak in atmel-sha204a\n\n* tag \u0027v7.0-p2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: atmel-sha204a - Fix OOM -\u003etfm_count leak\n crypto: ccp - Fix use-after-free on error path\n crypto: ccp - allow callers to use HV-Fixed page API when SEV is disabled\n" }, { "commit": "723b5c93aaffe05cd2cb6585c3b4bc9fd131df27", "tree": "2ba97c2b61929f9a2bd67dd898e3e15cf6c7c127", "parents": [ "a028739a4330881a6a3b5aa4a39381bbcacf2f2f", "ee0e6e69a772d601e152e5368a1da25d656122a8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:41:20 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:41:20 2026 -0800" }, "message": "Merge tag \u0027ata-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Fix a problem where the deferred non-NCQ command would incorrectly\n get completed as a failed command, if there was another command that\n timed out. Found by Gemini (Guenter)\n\n - The deferred non-NCQ command work is only supposed to run after the\n last NCQ command finishes. However, because the work was never\n canceled on error (e.g. a timeout), the work could incorrectly run\n when commands were still in flight. Found by syzbot (me)\n\n - Add a quirk to make sure that QEMU harddrives can potentially use up\n to 32 MiB I/Os (Pedro)\n\n - Add a quirk to disable LPM on Seagate ST1000DM010-2EP102 (Maximilian)\n\n* tag \u0027ata-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-eh: Fix detection of deferred qc timeouts\n ata: libata-core: Add BRIDGE_OK quirk for QEMU drives\n ata: libata: cancel pending work after clearing deferred_qc\n ata: libata-core: Disable LPM on ST1000DM010-2EP102\n" }, { "commit": "a028739a4330881a6a3b5aa4a39381bbcacf2f2f", "tree": "9cdd7d378975ef6fa94d7c3050141eb7e613ce02", "parents": [ "3ad66a34cce2c5a6532ac0b979fdf58677193c67", "ce8ee8583ed83122405eabaa8fb351be4d9dc65c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:36:18 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:36:18 2026 -0800" }, "message": "Merge tag \u0027block-7.0-20260305\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n - Improve quirk visibility and configurability (Maurizio)\n - Fix runtime user modification to queue setup (Keith)\n - Fix multipath leak on try_module_get failure (Keith)\n - Ignore ambiguous spec definitions for better atomics support\n (John)\n - Fix admin queue leak on controller reset (Ming)\n - Fix large allocation in persistent reservation read keys\n (Sungwoo Kim)\n - Fix fcloop callback handling (Justin)\n - Securely free DHCHAP secrets (Daniel)\n - Various cleanups and typo fixes (John, Wilfred)\n\n - Avoid a circular lock dependency issue in the sysfs nr_requests or\n scheduler store handling\n\n - Fix a circular lock dependency with the pcpu mutex and the queue\n freeze lock\n\n - Cleanup for bio_copy_kern(), using __bio_add_page() rather than the\n bio_add_page(), as adding a page here cannot fail. The exiting code\n had broken cleanup for the error condition, so make it clear that the\n error condition cannot happen\n\n - Fix for a __this_cpu_read() in preemptible context splat\n\n* tag \u0027block-7.0-20260305\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: use trylock to avoid lockdep circular dependency in sysfs\n nvme: fix memory allocation in nvme_pr_read_keys()\n block: use __bio_add_page in bio_copy_kern\n block: break pcpu_alloc_mutex dependency on freeze_lock\n blktrace: fix __this_cpu_read/write in preemptible context\n nvme-multipath: fix leak on try_module_get failure\n nvmet-fcloop: Check remoteport port_state before calling done callback\n nvme-pci: do not try to add queue maps at runtime\n nvme-pci: cap queue creation to used queues\n nvme-pci: ensure we\u0027re polling a polled queue\n nvme: fix memory leak in quirks_param_set()\n nvme: correct comment about nvme_ns_remove()\n nvme: stop setting namespace gendisk device driver data\n nvme: add support for dynamic quirk configuration via module parameter\n nvme: fix admin queue leak on controller reset\n nvme-fabrics: use kfree_sensitive() for DHCHAP secrets\n nvme: stop using AWUPF\n nvme: expose active quirks in sysfs\n nvme/host: fixup some typos\n" }, { "commit": "3ad66a34cce2c5a6532ac0b979fdf58677193c67", "tree": "2db44b801c06926684e6a8d9985a97469e84ee30", "parents": [ "7fe44c4388146bdbb3c5932d81a26d9fa0fd3ec9", "531bb98a030cc1073bd7ed9a502c0a3a781e92ee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:31:36 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:31:36 2026 -0800" }, "message": "Merge tag \u0027io_uring-7.0-20260305\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a typo in the mock_file help text\n\n - Fix a comment regarding IORING_SETUP_TASKRUN_FLAG in the\n io_uring.h UAPI header\n\n - Use READ_ONCE() for reading refill queue entries\n\n - Reject SEND_VECTORIZED for fixed buffer sends, as it isn\u0027t\n implemented. Currently this flag is silently ignored\n\n This is in preparation for making these work, but first we\n need a fixup so that older kernels will correctly reject them\n\n - Ensure \"0\" means default for the rx page size\n\n* tag \u0027io_uring-7.0-20260305\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/zcrx: use READ_ONCE with user shared RQEs\n io_uring/mock: Fix typo in help text\n io_uring/net: reject SEND_VECTORIZED when unsupported\n io_uring: correct comment for IORING_SETUP_TASKRUN_FLAG\n io_uring/zcrx: don\u0027t set rx_page_size when not requested\n" }, { "commit": "7fe44c4388146bdbb3c5932d81a26d9fa0fd3ec9", "tree": "6a86770f363499c936e6256124cae8f0cb05ae87", "parents": [ "5ee8dbf54602dc340d6235b1d6aa17c0f283f48c" ], "author": { "name": "Christian Loehle", "email": "christian.loehle@arm.com", "time": "Fri Mar 06 10:49:18 2026 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 06 08:25:54 2026 -0800" }, "message": "bpf: drop kthread_exit from noreturn_deny\n\nkthread_exit became a macro to do_exit in commit 28aaa9c39945\n(\"kthread: consolidate kthread exit paths to prevent use-after-free\"),\nso there is no kthread_exit function BTF ID to resolve. Remove it from\nnoreturn_deny to avoid resolve_btfids unresolved symbol warnings.\n\nSigned-off-by: Christian Loehle \u003cchristian.loehle@arm.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d87c828daa7ead9763416f75cc416496969cf1dc", "tree": "fe380a2e24f4ebaf865f5a7d6e713f487f509e7a", "parents": [ "97c5550b763171dbef61e6239cab372b9f9cd4a2" ], "author": { "name": "Yifan Wu", "email": "wuyifan50@huawei.com", "time": "Thu Mar 05 09:36:37 2026 +0800" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Fri Mar 06 11:54:26 2026 +0000" }, "message": "selftest/arm64: Fix sve2p1_sigill() to hwcap test\n\nThe FEAT_SVE2p1 is indicated by ID_AA64ZFR0_EL1.SVEver. However,\nthe BFADD requires the FEAT_SVE_B16B16, which is indicated by\nID_AA64ZFR0_EL1.B16B16. This could cause the test to incorrectly\nfail on a CPU that supports FEAT_SVE2.1 but not FEAT_SVE_B16B16.\n\nLD1Q Gather load quadwords which is decoded from SVE encodings and\nimplied by FEAT_SVE2p1.\n\nFixes: c5195b027d29 (\"kselftest/arm64: Add SVE 2.1 to hwcap test\")\nSigned-off-by: Yifan Wu \u003cwuyifan50@huawei.com\u003e\nReviewed-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "97c5550b763171dbef61e6239cab372b9f9cd4a2", "tree": "fd4e577ff364cd9a602d1f732fe42b498f54a6d1", "parents": [ "0100e495cdf0436bd4ed2dc034d385b44cb5993c" ], "author": { "name": "Piotr Jaroszynski", "email": "pjaroszynski@nvidia.com", "time": "Thu Mar 05 15:26:29 2026 -0800" }, "committer": { "name": "Will Deacon", "email": "will@kernel.org", "time": "Fri Mar 06 11:25:59 2026 +0000" }, "message": "arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults\n\ncontpte_ptep_set_access_flags() compared the gathered ptep_get() value\nagainst the requested entry to detect no-ops. ptep_get() ORs AF/dirty\nfrom all sub-PTEs in the CONT block, so a dirty sibling can make the\ntarget appear already-dirty. When the gathered value matches entry, the\nfunction returns 0 even though the target sub-PTE still has PTE_RDONLY\nset in hardware.\n\nFor a CPU with FEAT_HAFDBS this gathered view is fine, since hardware may\nset AF/dirty on any sub-PTE and CPU TLB behavior is effectively gathered\nacross the CONT range. But page-table walkers that evaluate each\ndescriptor individually (e.g. a CPU without DBM support, or an SMMU\nwithout HTTU, or with HA/HD disabled in CD.TCR) can keep faulting on the\nunchanged target sub-PTE, causing an infinite fault loop.\n\nGathering can therefore cause false no-ops when only a sibling has been\nupdated:\n - write faults: target still has PTE_RDONLY (needs PTE_RDONLY cleared)\n - read faults: target still lacks PTE_AF\n\nFix by checking each sub-PTE against the requested AF/dirty/write state\n(the same bits consumed by __ptep_set_access_flags()), using raw\nper-PTE values rather than the gathered ptep_get() view, before\nreturning no-op. Keep using the raw target PTE for the write-bit unfold\ndecision.\n\nPer Arm ARM (DDI 0487) D8.7.1 (\"The Contiguous bit\"), any sub-PTE in a CONT\nrange may become the effective cached translation and software must\nmaintain consistent attributes across the range.\n\nFixes: 4602e5757bcc (\"arm64/mm: wire up PTE_CONT for user mappings\")\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nCc: John Hubbard \u003cjhubbard@nvidia.com\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nCc: Breno Leitao \u003cleitao@debian.org\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Alistair Popple \u003capopple@nvidia.com\u003e\nReviewed-by: James Houghton \u003cjthoughton@google.com\u003e\nReviewed-by: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nTested-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Piotr Jaroszynski \u003cpjaroszynski@nvidia.com\u003e\nAcked-by: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n" }, { "commit": "8475d8fe21ec9c7eb2faca555fbc5b68cf0d2597", "tree": "34173716a4ea9b97769abde99bf8334a318447ae", "parents": [ "17c144f1104bfc29a3ce3f7d0931a1bfb7a3558c" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Wed Mar 04 22:24:18 2026 +0100" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri Mar 06 11:33:13 2026 +0100" }, "message": "parisc: Fix initial page table creation for boot\n\nThe KERNEL_INITIAL_ORDER value defines the initial size (usually 32 or\n64 MB) of the page table during bootup. Up until now the whole area was\ninitialized with PTE entries, but there was no check if we filled too\nmany entries. Change the code to fill up with so many entries that the\n\"_end\" symbol can be reached by the kernel, but not more entries than\nactually fit into the initial PTE tables.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.0+\n" }, { "commit": "17c144f1104bfc29a3ce3f7d0931a1bfb7a3558c", "tree": "71652792f0dc046d119f5a6dc5c14c9c4efe6ea1", "parents": [ "8e732934fb81282be41602550e7e07baf265e972" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Tue Mar 03 23:36:11 2026 +0100" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri Mar 06 11:33:13 2026 +0100" }, "message": "parisc: Check kernel mapping earlier at bootup\n\nThe check if the initial mapping is sufficient needs to happen much\nearlier during bootup. Move this test directly to the start_parisc()\nfunction and use native PDC iodc functions to print the warning, because\npanic() and printk() are not functional yet.\n\nThis fixes boot when enabling various KALLSYSMS options which need\nmuch more space.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.0+\n" }, { "commit": "8e732934fb81282be41602550e7e07baf265e972", "tree": "f95943ab7adbd23f575b58072137574f666b48ba", "parents": [ "11439c4635edd669ae435eec308f4ab8a0804808" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Tue Mar 03 23:36:10 2026 +0100" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Fri Mar 06 11:33:13 2026 +0100" }, "message": "parisc: Increase initial mapping to 64 MB with KALLSYMS\n\nThe 32MB initial kernel mapping can become too small when CONFIG_KALLSYMS\nis used. Increase the mapping to 64 MB in this case.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.0+\n" }, { "commit": "96bfe9ff7e88f0541002640acbcb3ec63c9d0130", "tree": "8ac88f4920da90770f1566181dc9609d527329bf", "parents": [ "431989960f9442b0d3b41d899005f8fcbcfc1130", "0cfe9c4838f1147713f6b5c02094cd4dc0c598fa" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 19:45:11 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 19:45:19 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-03-05\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nCross-subsystem Changes:\n - mm: Fix a hmm_range_fault() livelock / starvation problem (Thomas)\n\nCore Changes:\n - Revert \"drm/pagemap: Disable device-to-device migration\" (Thomas)\n\nDriver Changes:\n - Do not preempt fence signaling CS instructions (Brost)\n - Some leak and finalization fixes (Shuicheng, Tomasz, Varun, Zhanjun)\n - Workaround fix (Roper)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aamGvvGRBRtX8-6u@intel.com\n" }, { "commit": "431989960f9442b0d3b41d899005f8fcbcfc1130", "tree": "cfb042d95886e73a5d777fd07e971288ce5fe220", "parents": [ "3d3234d5daaacd468d1bc2c22ed8a26124e9da57", "021f1b77f70d62351bba67b050b8d784641d817f" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 19:40:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 19:41:28 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-03-06\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nAnother early drm-misc-fixes PR to revert the previous uapi fix sent in\ndrm-misc-fixes-2026-03-05, together with a UAF fix in TTM, an argument\norder fix for panthor, a fix for the firmware getting stuck on\nresource allocation error handling for amdxdna, and a few fixes for\nethosu (size calculation and reference underflows, and a validation\nfix).\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260306-grumpy-pegasus-of-witchcraft-6bd2db@houat\n" }, { "commit": "3d3234d5daaacd468d1bc2c22ed8a26124e9da57", "tree": "3f7fcc550d9f68e9fa2912e1320c43abde729162", "parents": [ "3fcb1cbd7678ec057c62dbfe49369cf65badf8a4", "8f3c6f08ababad2e3bdd239728cf66a9949446b4" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 17:45:47 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 19:40:00 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-03-05\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA return type fix for ttm, a display fix for solomon, several misc fixes\nfor amdxdna, a DSI clock rate fix for rz-du, a uapi fix for syncobj, a\npossible build failure fix for dma-buf, a doc warning fix for sched, a\nbuild failure fix for ttm tests, and a crash fix when suspended for\nnouveau.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260305-ludicrous-quirky-raven-7cdafd@houat\n" }, { "commit": "ee0e6e69a772d601e152e5368a1da25d656122a8", "tree": "82fdf6994f09b9df643aac3b18114f17fff72ce3", "parents": [ "b92b0075ee1870f78f59ab1f7da7dbfdd718ad7a" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Mar 05 18:48:05 2026 -0800" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Fri Mar 06 09:58:47 2026 +0100" }, "message": "ata: libata-eh: Fix detection of deferred qc timeouts\n\nIf the ata_qc_for_each_raw() loop finishes without finding a matching SCSI\ncommand for any QC, the variable qc will hold a pointer to the last element\nexamined, which has the tag i \u003d\u003d ATA_MAX_QUEUE - 1. This qc can match the\nport deferred QC (ap-\u003edeferred_qc).\n\nIf that happens, the condition qc \u003d\u003d ap-\u003edeferred_qc evaluates to true\ndespite the loop not breaking with a match on the SCSI command for this QC.\nIn that case, the error handler mistakenly intercepts a command that has\nnot been issued yet and that has not timed out, and thus erroneously\nreturning a timeout error.\n\nFix the problem by checking for i \u003c ATA_MAX_QUEUE in addition to\nqc \u003d\u003d ap-\u003edeferred_qc.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y.\n\nAssisted-by: Gemini:gemini-3.1-pro\nFixes: eddb98ad9364 (\"ata: libata-eh: correctly handle deferred qc timeouts\")\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n[cassel: modified commit log as suggested by Damien]\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "3fcb1cbd7678ec057c62dbfe49369cf65badf8a4", "tree": "0774acdfa96e1f9578cd2af03b325e0bfd24d463", "parents": [ "681d787cb61f3616dde8d4b747bacf03b3e4d665", "a99cac460ddeb3705cb54a8421339f351586b25d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 17:10:00 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 06 17:10:02 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-03-05\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix for #7284: Lenovo T14 G7 display not refreshing\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/aakz17Jx3Ye9Vqci@jlahtine-mobl\n" }, { "commit": "048efe129a297256d3c2088cf8d79515ff5ec864", "tree": "d9cc63ae7ceafcf562d77886f24174303b5876f8", "parents": [ "340cea84f691c5206561bb2e0147158fe02070be" ], "author": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Thu Mar 05 21:57:06 2026 -0300" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu Mar 05 20:41:16 2026 -0600" }, "message": "smb: client: fix oops due to uninitialised var in smb2_unlink()\n\nIf SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the\niovs set @rqst will be left uninitialised, hence calling\nSMB2_open_free(), SMB2_close_free() or smb2_set_related() on them will\noops.\n\nFix this by initialising @close_iov and @open_iov before setting them\nin @rqst.\n\nReported-by: Thiago Becker \u003ctbecker@redhat.com\u003e\nFixes: 1cf9f2a6a544 (\"smb: client: handle unlink(2) of files open by different clients\")\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: linux-cifs@vger.kernel.org\nCc: stable@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "021f1b77f70d62351bba67b050b8d784641d817f", "tree": "505e94cbdeef3be15bc94fb693590ef30edd5f2a", "parents": [ "838ae99f9a77a5724ee6d4e7b7b1eb079147f888" ], "author": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Wed Feb 18 16:21:57 2026 -0600" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Mar 05 15:21:17 2026 -0600" }, "message": "accel: ethosu: Handle possible underflow in IFM size calculations\n\nIf the command stream has larger padding sizes than the IFM and OFM\ndiminsions, then the calculations will underflow to a negative value.\nThe result is a very large region bounds which is caught on submit, but\nit\u0027s better to catch it earlier.\n\nCurrent mesa ethosu driver has a signedness bug which resulted in\npadding of 127 (the max) and triggers this issue.\n\nReviewed-and-Tested-by: Anders Roxell \u003canders.roxell@linaro.org\u003e\nLink: https://patch.msgid.link/20260218-ethos-fixes-v1-3-be3fa3ea9a30@kernel.org\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "838ae99f9a77a5724ee6d4e7b7b1eb079147f888", "tree": "6f55331007cba213a12336e4d4e56a149549a7c1", "parents": [ "150bceb3e0a4a30950279d91ea0e8cc69a736742" ], "author": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Wed Feb 18 16:21:56 2026 -0600" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Mar 05 15:21:17 2026 -0600" }, "message": "accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar\n\nThe NPU_OP_ELEMENTWISE instruction uses a scalar value for IFM2 if the\nIFM2_BROADCAST \"scalar\" mode is set. It is a bit (7) on the u65 and\npart of a field (bits 3:0) on the u85. The driver was hardcoded to the\nu85.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nReviewed-and-Tested-by: Anders Roxell \u003canders.roxell@linaro.org\u003e\nLink: https://patch.msgid.link/20260218-ethos-fixes-v1-2-be3fa3ea9a30@kernel.org\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "150bceb3e0a4a30950279d91ea0e8cc69a736742", "tree": "a0aea57285e630ca9665421e8bdec9015160a034", "parents": [ "d5b8b0347fa8470b751a506fb801797e271d7548" ], "author": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Wed Feb 18 16:21:55 2026 -0600" }, "committer": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Thu Mar 05 15:21:17 2026 -0600" }, "message": "accel: ethosu: Fix job submit error clean-up refcount underflows\n\nIf the job submit fails before adding the job to the scheduler queue\nsuch as when the GEM buffer bounds checks fail, then doing a\nethosu_job_put() results in a pm_runtime_put_autosuspend() without the\ncorresponding pm_runtime_resume_and_get(). The dma_fence_put()\u0027s are\nalso unnecessary, but seem to be harmless.\n\nSplit the ethosu_job_cleanup() function into 2 parts for the before\nand after the job is queued.\n\nFixes: 5a5e9c0228e6 (\"accel: Add Arm Ethos-U NPU driver\")\nReviewed-and-Tested-by: Anders Roxell \u003canders.roxell@linaro.org\u003e\nLink: https://patch.msgid.link/20260218-ethos-fixes-v1-1-be3fa3ea9a30@kernel.org\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\n" }, { "commit": "78c2ce0fd6ddb6c87aaa56b0d49c70e17df21e6d", "tree": "61881d480b6d2e3aef46278809002c92483e29b7", "parents": [ "3c6ddb58f670baa584b22eef761aade77bd81b16" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Mar 03 15:59:03 2026 -0800" }, "committer": { "name": "Boqun Feng", "email": "boqun@kernel.org", "time": "Thu Mar 05 13:11:10 2026 -0800" }, "message": "scftorture: Update due to x86 not supporting none/voluntary preemption\n\nAs of v7.0-rc1, architectures that support preemption, including x86 and\narm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY.\nAttempting to build kernels with these two Kconfig options results in\n.config errors. This commit therefore switches such scftorture scenarios\nto CONFIG_PREEMPT_LAZY.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Boqun Feng \u003cboqun@kernel.org\u003e\nLink: https://patch.msgid.link/20260303235903.1967409-4-paulmck@kernel.org\n" }, { "commit": "3c6ddb58f670baa584b22eef761aade77bd81b16", "tree": "69794ef1b4492d49ed62c499bc219650f8f48821", "parents": [ "59af2d5652e998fea64335de6145afb3c1e0c958" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Mar 03 15:59:02 2026 -0800" }, "committer": { "name": "Boqun Feng", "email": "boqun@kernel.org", "time": "Thu Mar 05 13:11:07 2026 -0800" }, "message": "refscale: Update due to x86 not supporting none/voluntary preemption\n\nAs of v7.0-rc1, architectures that support preemption, including x86 and\narm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY.\nAttempting to build kernels with these two Kconfig options results in\n.config errors. This commit therefore switches such refscale scenarios\nto CONFIG_PREEMPT_LAZY.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Boqun Feng \u003cboqun@kernel.org\u003e\nLink: https://patch.msgid.link/20260303235903.1967409-3-paulmck@kernel.org\n" }, { "commit": "59af2d5652e998fea64335de6145afb3c1e0c958", "tree": "a41b96831450ccb62df2ddacc56a84af23d9a283", "parents": [ "f2fa6cc736ef518628f6a9d1155f9ec24e0af4e7" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Mar 03 15:59:01 2026 -0800" }, "committer": { "name": "Boqun Feng", "email": "boqun@kernel.org", "time": "Thu Mar 05 13:11:03 2026 -0800" }, "message": "rcuscale: Update due to x86 not supporting none/voluntary preemption\n\nAs of v7.0-rc1, architectures that support preemption, including x86 and\narm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY.\nAttempting to build kernels with these two Kconfig options results in\n.config errors. This commit therefore switches such rcuscale scenarios\nto CONFIG_PREEMPT_LAZY.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Boqun Feng \u003cboqun@kernel.org\u003e\nLink: https://patch.msgid.link/20260303235903.1967409-2-paulmck@kernel.org\n" }, { "commit": "f2fa6cc736ef518628f6a9d1155f9ec24e0af4e7", "tree": "799c2ae4820a332c54c6b3c20651f56367337efa", "parents": [ "11439c4635edd669ae435eec308f4ab8a0804808" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Mar 04 16:01:19 2026 -0800" }, "committer": { "name": "Boqun Feng", "email": "boqun@kernel.org", "time": "Thu Mar 05 13:07:38 2026 -0800" }, "message": "rcutorture: Update due to x86 not supporting none/voluntary preemption\n\nAs of v7.0-rc1, architectures that support preemption, including x86 and\narm64, no longer support CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY.\nAttempting to build kernels with these two Kconfig options results in\n.config errors. This commit therefore switches such rcutorture scenarios\nto CONFIG_PREEMPT_LAZY.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Boqun Feng \u003cboqun@kernel.org\u003e\nLink: https://patch.msgid.link/bfe89f6c-3b63-40c6-aa6d-5f523e3e9a31@paulmck-laptop\n" }, { "commit": "5ee8dbf54602dc340d6235b1d6aa17c0f283f48c", "tree": "6edd1e11fbe3c4366d45e503d6a1fdb4ba822820", "parents": [ "6a42ff33f38d171a6bf8304f6323c43e8a0ed9b6", "a300000233a9ff842e2fb450fb9a79f7827a586d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:52:03 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:52:03 2026 -0800" }, "message": "Merge tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux\n\nPull fsverity fix from Eric Biggers:\n \"Prevent CONFIG_FS_VERITY from being enabled when the page size is\n 256K, since it doesn\u0027t work in that case\"\n\n* tag \u0027fsverity-for-linus\u0027 of git://git.kernel.org/pub/scm/fs/fsverity/linux:\n fsverity: add dependency on 64K or smaller pages\n" }, { "commit": "6a42ff33f38d171a6bf8304f6323c43e8a0ed9b6", "tree": "cbc80bb0b7f772a9133fd32032c3e6b952c0a231", "parents": [ "398871616ffd8a793f01861b0ee66f6bee494389", "3875ceb592d3cb23dc932165cc1eeb74cf4dc319" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:49:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:49:05 2026 -0800" }, "message": "Merge tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux\n\nPull crypto library fixes from Eric Biggers:\n\n - Several test fixes:\n\n - Fix flakiness in the interrupt context tests in certain VMs\n\n - Make the lib/crypto/ KUnit tests depend on the corresponding\n library options rather than selecting them. This follows the\n standard KUnit convention, and it fixes an issue where enabling\n CONFIG_KUNIT_ALL_TESTS pulled in all the crypto library code\n\n - Add a kunitconfig file for lib/crypto/\n\n - Fix a couple stale references to \"aes-generic\" that made it in\n concurrently with the rename to \"aes-lib\"\n\n - Update the help text for several CRYPTO kconfig options to remove\n outdated information about users that now use the library instead\n\n* tag \u0027libcrypto-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:\n crypto: testmgr - Fix stale references to aes-generic\n crypto: Clean up help text for CRYPTO_CRC32\n crypto: Clean up help text for CRYPTO_CRC32C\n crypto: Clean up help text for CRYPTO_XXHASH\n crypto: Clean up help text for CRYPTO_SHA256\n crypto: Clean up help text for CRYPTO_BLAKE2B\n lib/crypto: tests: Add a .kunitconfig file\n lib/crypto: tests: Depend on library options rather than selecting them\n kunit: irq: Ensure timer doesn\u0027t fire too frequently\n" }, { "commit": "398871616ffd8a793f01861b0ee66f6bee494389", "tree": "93f38b1bdb95aa198fd990eba6ca9d36206a335d", "parents": [ "abacaf559950eec0d99d37ff6b92049409af5943", "084f843093bee5563b179fd4b630122ba820e0c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:37:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:37:27 2026 -0800" }, "message": "Merge tag \u0027acpi-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n\n - Revert a commit related to ACPI device power management that was\n not supposed to make any functional difference, but it did so and\n introduced a regression (Rafael Wysocki)\n\n - Update the _CPC object definition in ACPICA to match ACPI 6.6 and\n prevent the kernel from printing a false-positive warning regarding\n _CPC output package format on platforms shipping with firmware based\n on ACPI 6.6 (Saket Dumbre)\n\n* tag \u0027acpi-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n Revert \"ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM\"\n ACPICA: Update the _CPC definition to match ACPI 6.6\n" }, { "commit": "abacaf559950eec0d99d37ff6b92049409af5943", "tree": "35cb46179fc961ff60205f261c97213bea3321c0", "parents": [ "18ecff396c9edb9add34f612d9fb99bb34833cc0", "cf440e5b40649d1ffbc6c4e33fef3223c7482897" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:00:46 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 11:00:46 2026 -0800" }, "message": "Merge tag \u0027net-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from CAN, netfilter and wireless.\n\n Current release - new code bugs:\n\n - sched: cake: fixup cake_mq rate adjustment for diffserv config\n\n - wifi: fix missing ieee80211_eml_params member initialization\n\n Previous releases - regressions:\n\n - tcp: give up on stronger sk_rcvbuf checks (for now)\n\n Previous releases - always broken:\n\n - net: fix rcu_tasks stall in threaded busypoll\n\n - sched:\n - fq: clear q-\u003eband_pkt_count[] in fq_reset()\n - only allow act_ct to bind to clsact/ingress qdiscs and shared\n blocks\n\n - bridge: check relevant per-VLAN options in VLAN range grouping\n\n - xsk: fix fragment node deletion to prevent buffer leak\n\n Misc:\n\n - spring cleanup of inactive maintainers\"\n\n* tag \u0027net-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (138 commits)\n xdp: produce a warning when calculated tailroom is negative\n net: enetc: use truesize as XDP RxQ info frag_size\n libeth, idpf: use truesize as XDP RxQ info frag_size\n i40e: use xdp.frame_sz as XDP RxQ info frag_size\n i40e: fix registering XDP RxQ info\n ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n ice: fix rxq info registering in mbuf packets\n xsk: introduce helper to determine rxq-\u003efrag_size\n xdp: use modulo operation to calculate XDP frag tailroom\n selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour\n net/sched: act_ife: Fix metalist update behavior\n selftests: net: add test for IPv4 route with loopback IPv6 nexthop\n net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n MAINTAINERS: remove Thomas Falcon from IBM ibmvnic\n MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch\n MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera\n MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP\n MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC\n ...\n" }, { "commit": "084f843093bee5563b179fd4b630122ba820e0c7", "tree": "27c9b584dbf5736a306f1cd7a8491964a685b088", "parents": [ "00fd9aad55e7ced494a738a07662155d058b872f", "800ca7b88a0c0eba6fa721e043eb3ed5b10ecc4f" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 05 18:46:43 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 05 18:46:43 2026 +0100" }, "message": "Merge branch \u0027acpica\u0027\n\nMerge a fix updating the _CPC object definition in ACPICA to avoid\nprinting a false-positive output package format warning on new\nplatforms (Saket Dumbre)\n\n* acpica:\n ACPICA: Update the _CPC definition to match ACPI 6.6\n" }, { "commit": "9f2c7349b2810c671badfc1adc804f711a83e420", "tree": "a2df54a23af49fa42210838e74cc207d6442a557", "parents": [ "147dae12985947cdb9e1918142f06482c5077a81" ], "author": { "name": "Dave Hansen", "email": "dave.hansen@linux.intel.com", "time": "Thu Mar 05 09:18:52 2026 -0800" }, "committer": { "name": "Bjorn Helgaas", "email": "bhelgaas@google.com", "time": "Thu Mar 05 11:34:21 2026 -0600" }, "message": "MAINTAINERS: Orphan Altera PCIe controller driver\n\nEmail to Joyce Ooi \u003cjoyce.ooi@intel.com\u003e now bounces. Remove the address\nand mark the Altera PCIe controller driver as an orphan for now.\n\nSigned-off-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nLink: https://patch.msgid.link/20260305171852.3114177-1-dave.hansen@linux.intel.com\n" }, { "commit": "d5b8b0347fa8470b751a506fb801797e271d7548", "tree": "c015ff454740afe3ff7c7007dc56a1f0eecc16a8", "parents": [ "76e8173ba92e15eeb0421b7cdbaef20513193b51" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Wed Mar 04 22:20:41 2026 -0800" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Thu Mar 05 09:24:33 2026 -0800" }, "message": "accel/amdxdna: Split mailbox channel create function\n\nThe management channel used for firmware control command submission is\ncurrently created after the firmware is started. If channel creation\nfails (for example, due to memory allocation failure or workqueue\ncreation interruption), the firmware remains in a pending state and is\nunable to receive any control commands.\n\nTo avoid leaving the firmware in this inconsistent state, split\nxdna_mailbox_create_channel() into two separate functions so that\nresource allocation can be completed before interacting with the\nhardware.\n xdna_mailbox_alloc_channel()\n Allocates memory and initializes the workqueue. This can be called\n earlier, before interacting with the hardware.\n xdna_mailbox_start_channel()\n Performs the hardware interaction required to start the channel.\n\nRename xdna_mailbox_destroy_channel() to xdna_mailbox_free_channel().\nEnsure that xdna_mailbox_stop_channel() and xdna_mailbox_free_channel()\nproperly unwind the corresponding start and allocation steps, respectively.\n\nFixes: b87f920b9344 (\"accel/amdxdna: Support hardware mailbox\")\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260305062041.3954024-1-lizhi.hou@amd.com\n" }, { "commit": "76e8173ba92e15eeb0421b7cdbaef20513193b51", "tree": "6a7bae47b5cc19c7184c2b9b3e575c14aaecbf92", "parents": [ "ee8ade4d9678a456bb5ea675c270738b250eda68" ], "author": { "name": "Akash Goel", "email": "akash.goel@arm.com", "time": "Thu Mar 05 11:07:23 2026 +0000" }, "committer": { "name": "Liviu Dudau", "email": "liviu.dudau@arm.com", "time": "Thu Mar 05 16:53:09 2026 +0000" }, "message": "drm/panthor: Correct the order of arguments passed to gem_sync\n\nThis commit corrects the order of arguments passed to panthor_gem_sync()\nfunction, called when the SYNC_WAIT condition has to be evaluated for a\nblocked GPU queue.\n\nFixes: cd2c9c3015e6 (\"drm/panthor: Add flag to map GEM object Write-Back Cacheable\")\nSigned-off-by: Akash Goel \u003cakash.goel@arm.com\u003e\nReviewed-by: Steven Price \u003csteven.price@arm.com\u003e\nReviewed-by: Boris Brezillon \u003cboris.brezillon@collabora.com\u003e\nReviewed-by: Liviu Dudau \u003cliviu.dudau@arm.com\u003e\nLink: https://patch.msgid.link/20260305110723.2871733-1-akash.goel@arm.com\nSigned-off-by: Liviu Dudau \u003cliviu.dudau@arm.com\u003e\n" }, { "commit": "e31a374a99f5026df6ebff2a1c49492276e776fd", "tree": "0b58eab405a654764432ac4aacc403d8f2f4cf8c", "parents": [ "11439c4635edd669ae435eec308f4ab8a0804808" ], "author": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Wed Mar 04 19:15:48 2026 +0100" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Thu Mar 05 17:35:12 2026 +0100" }, "message": "fbdev: au1100fb: Fix build on MIPS64\n\nFix an error reported by the kernel test robot:\n au1100fb.c: error: implicit declaration of function \u0027KSEG1ADDR\u0027; did you mean \u0027CKSEG1ADDR\u0027?\n\narch/mips/include/asm/addrspace.h defines KSEG1ADDR only for 32 bit\nconfigurations. So provide its compile-test stub also for 64bit mips builds.\n\nFixes: 6f366e86481a (\"fbdev: au1100fb: Make driver compilable on non-mips platforms\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202603042127.PT6LuKqi-lkp@intel.com/\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\nAcked-by: Uwe Kleine-König \u003cu.kleine-koenig@baylibre.com\u003e\n" }, { "commit": "8457669db968c98edb781892d73fa559e1efcbd4", "tree": "adcc5996b2cc6ceb3702421a77144531dd241217", "parents": [ "3d543d9515928e4754a741c338dbcdf68ac47e39", "325291b20f8a6f14b9c82edbf5d12e4e71f6adaa" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Mar 05 17:22:14 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Mar 05 17:22:14 2026 +0100" }, "message": "Merge tag \u0027asoc-fix-v7.0-rc2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.0\n\nA moderately large pile of fixes, though none of them are super major,\nplus a few new quirks and device IDs.\n" }, { "commit": "18ecff396c9edb9add34f612d9fb99bb34833cc0", "tree": "09c8e31ef39a17bbc57c818b2331dc61bd8d8a20", "parents": [ "c107785c7e8dbabd1c18301a1c362544b5786282", "f26b098d937488e8f5c617d465760a10bfcc7f13" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 08:05:05 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 05 08:05:05 2026 -0800" }, "message": "Merge tag \u0027trace-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix thresh_return of function graph tracer\n\n The update to store data on the shadow stack removed the abuse of\n using the task recursion word as a way to keep track of what\n functions to ignore. The trace_graph_return() was updated to handle\n this, but when function_graph tracer is using a threshold (only trace\n functions that took longer than a specified time), it uses\n trace_graph_thresh_return() instead.\n\n This function was still incorrectly using the task struct recursion\n word causing the function graph tracer to permanently set all\n functions to \"notrace\"\n\n - Fix thresh_return nosleep accounting\n\n When the calltime was moved to the shadow stack storage instead of\n being on the fgraph descriptor, the calculations for the amount of\n sleep time was updated. The calculation was done in the\n trace_graph_thresh_return() function, which also called the\n trace_graph_return(), which did the calculation again, causing the\n time to be doubled.\n\n Remove the call to trace_graph_return() as what it needed to do\n wasn\u0027t that much, and just do the work in\n trace_graph_thresh_return().\n\n - Fix syscall trace event activation on boot up\n\n The syscall trace events are pseudo events attached to the\n raw_syscall tracepoints. When the first syscall event is enabled, it\n enables the raw_syscall tracepoint and doesn\u0027t need to do anything\n when a second syscall event is also enabled.\n\n When events are enabled via the kernel command line, syscall events\n are partially enabled as the enabling is called before rcu_init. This\n is due to allow early events to be enabled immediately. Because\n kernel command line events do not distinguish between different types\n of events, the syscall events are enabled here but are not fully\n functioning. After rcu_init, they are disabled and re-enabled so that\n they can be fully enabled.\n\n The problem happened is that this \"disable-enable\" is done one at a\n time. If more than one syscall event is specified on the command\n line, by disabling them one at a time, the counter never gets to\n zero, and the raw_syscall is not disabled and enabled, keeping the\n syscall events in their non-fully functional state.\n\n Instead, disable all events and re-enabled them all, as that will\n ensure the raw_syscall event is also disabled and re-enabled.\n\n - Disable preemption in ftrace pid filtering\n\n The ftrace pid filtering attaches to the fork and exit tracepoints to\n add or remove pids that should be traced. They access variables\n protected by RCU (preemption disabled). Now that tracepoint callbacks\n are called with preemption enabled, this protection needs to be added\n explicitly, and not depend on the functions being called with\n preemption disabled.\n\n - Disable preemption in event pid filtering\n\n The event pid filtering needs the same preemption disabling guards as\n ftrace pid filtering.\n\n - Fix accounting of the memory mapped ring buffer on fork\n\n Memory mapping the ftrace ring buffer sets the vm_flags to DONTCOPY.\n But this does not prevent the application from calling\n madvise(MADVISE_DOFORK). This causes the mapping to be copied on\n fork. After the first tasks exits, the mapping is considered unmapped\n by everyone. But when he second task exits, the counter goes below\n zero and triggers a WARN_ON.\n\n Since nothing prevents two separate tasks from mmapping the ftrace\n ring buffer (although two mappings may mess each other up), there\u0027s\n no reason to stop the memory from being copied on fork.\n\n Update the vm_operations to have an \".open\" handler to update the\n accounting and let the ring buffer know someone else has it mapped.\n\n - Add all ftrace headers in MAINTAINERS file\n\n The MAINTAINERS file only specifies include/linux/ftrace.h But misses\n ftrace_irq.h and ftrace_regs.h. Make the file use wildcards to get\n all *ftrace* files.\n\n* tag \u0027trace-v7.0-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ftrace: Add MAINTAINERS entries for all ftrace headers\n tracing: Fix WARN_ON in tracing_buffers_mmap_close\n tracing: Disable preemption in the tracepoint callbacks handling filtered pids\n ftrace: Disable preemption in the tracepoint callbacks handling filtered pids\n tracing: Fix syscall events activation by ensuring refcount hits zero\n fgraph: Fix thresh_return nosleeptime double-adjust\n fgraph: Fix thresh_return clear per-task notrace\n" }, { "commit": "cf440e5b40649d1ffbc6c4e33fef3223c7482897", "tree": "b1433ad464bd0521de238365ba888de2e7d9a13f", "parents": [ "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f", "8821e857759be9db3cde337ad328b71fe5c8a55f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:27 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:03:27 2026 -0800" }, "message": "Merge branch \u0027Address-XDP-frags-having-negative-tailroom\u0027\n\nLarysa Zaremba says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nAddress XDP frags having negative tailroom\n\nAside from the issue described below, tailroom calculation does not account\nfor pages being split between frags, e.g. in i40e, enetc and\nAF_XDP ZC with smaller chunks. These series address the problem by\ncalculating modulo (skb_frag_off() % rxq-\u003efrag_size) in order to get\ndata offset within a smaller block of memory. Please note, xskxceiver\ntail grow test passes without modulo e.g. in xdpdrv mode on i40e,\nbecause there is not enough descriptors to get to flipped buffers.\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case,\nbut due to tailroom being stored as an unsigned int, it is reported to be\nsomewhere near UINT_MAX, resulting in a tail being grown, even if the\nrequested offset is too much(it is around 2K in the abovementioned test).\nThis later leads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/0x6b0\n[ 7340.430672] ? __do_sys_clone3+0xd9/0x120\n[ 7340.431212] ? switch_fpu_return+0x4e/0xd0\n[ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0\n[ 7340.432498] ? do_syscall_64+0xbb/0x6b0\n[ 7340.433015] ? __handle_mm_fault+0x445/0x690\n[ 7340.433582] ? count_memcg_events+0xd6/0x210\n[ 7340.434151] ? handle_mm_fault+0x212/0x340\n[ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0\n[ 7340.435271] ? clear_bhb_loop+0x30/0x80\n[ 7340.435788] ? clear_bhb_loop+0x30/0x80\n[ 7340.436299] ? clear_bhb_loop+0x30/0x80\n[ 7340.436812] ? clear_bhb_loop+0x30/0x80\n[ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 7340.437973] RIP: 0033:0x7f4161b14169\n[ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f.\n[ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\n[ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169\n[ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990\n[ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff\n[ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0\n[ 7340.444586] \u003c/TASK\u003e\n[ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg\n[ 7340.449650] ---[ end trace 0000000000000000 ]---\n\nThe issue can be fixed in all in-tree drivers, but we cannot just trust OOT\ndrivers to not do this. Therefore, make tailroom a signed int and produce a\nwarning when it is negative to prevent such mistakes in the future.\n\nThe issue can also be easily reproduced with ice driver, by applying\nthe following diff to xskxceiver and enjoying a kernel panic in xdpdrv mode:\n\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c\nindex 5af28f359cfd..042d587fa7ef 100644\n--- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c\n+++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c\n@@ -2541,8 +2541,8 @@ int testapp_adjust_tail_grow_mb(struct test_spec *test)\n {\n test-\u003emtu \u003d MAX_ETH_JUMBO_SIZE;\n /* Grow by (frag_size - last_frag_Size) - 1 to stay inside the last fragment */\n- return testapp_adjust_tail(test, (XSK_UMEM__MAX_FRAME_SIZE / 2) - 1,\n- XSK_UMEM__LARGE_FRAME_SIZE * 2);\n+ return testapp_adjust_tail(test, XSK_UMEM__MAX_FRAME_SIZE * 100,\n+ 6912);\n }\n\n int testapp_tx_queue_consumer(struct test_spec *test)\n\nIf we print out the values involved in the tailroom calculation:\n\ntailroom \u003d rxq-\u003efrag_size - skb_frag_size(frag) - skb_frag_off(frag);\n\n4294967040 \u003d 3456 - 3456 - 256\n\nI personally reproduced and verified the issue in ice and i40e,\naside from WiP ixgbevf implementation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260305111253.2317394-1-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8821e857759be9db3cde337ad328b71fe5c8a55f", "tree": "b1433ad464bd0521de238365ba888de2e7d9a13f", "parents": [ "f8e18abf183dbd636a8725532c7f5aa58957de84" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:50 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "xdp: produce a warning when calculated tailroom is negative\n\nMany ethernet drivers report xdp Rx queue frag size as being the same as\nDMA write size. However, the only user of this field, namely\nbpf_xdp_frags_increase_tail(), clearly expects a truesize.\n\nSuch difference leads to unspecific memory corruption issues under certain\ncircumstances, e.g. in ixgbevf maximum DMA write size is 3 KB, so when\nrunning xskxceiver\u0027s XDP_ADJUST_TAIL_GROW_MULTI_BUFF, 6K packet fully uses\nall DMA-writable space in 2 buffers. This would be fine, if only\nrxq-\u003efrag_size was properly set to 4K, but value of 3K results in a\nnegative tailroom, because there is a non-zero page offset.\n\nWe are supposed to return -EINVAL and be done with it in such case, but due\nto tailroom being stored as an unsigned int, it is reported to be somewhere\nnear UINT_MAX, resulting in a tail being grown, even if the requested\noffset is too much (it is around 2K in the abovementioned test). This later\nleads to all kinds of unspecific calltraces.\n\n[ 7340.337579] xskxceiver[1440]: segfault at 1da718 ip 00007f4161aeac9d sp 00007f41615a6a00 error 6\n[ 7340.338040] xskxceiver[1441]: segfault at 7f410000000b ip 00000000004042b5 sp 00007f415bffecf0 error 4\n[ 7340.338179] in libc.so.6[61c9d,7f4161aaf000+160000]\n[ 7340.339230] in xskxceiver[42b5,400000+69000]\n[ 7340.340300] likely on CPU 6 (core 0, socket 6)\n[ 7340.340302] Code: ff ff 01 e9 f4 fe ff ff 0f 1f 44 00 00 4c 39 f0 74 73 31 c0 ba 01 00 00 00 f0 0f b1 17 0f 85 ba 00 00 00 49 8b 87 88 00 00 00 \u003c4c\u003e 89 70 08 eb cc 0f 1f 44 00 00 48 8d bd f0 fe ff ff 89 85 ec fe\n[ 7340.340888] likely on CPU 3 (core 0, socket 3)\n[ 7340.345088] Code: 00 00 00 ba 00 00 00 00 be 00 00 00 00 89 c7 e8 31 ca ff ff 89 45 ec 8b 45 ec 85 c0 78 07 b8 00 00 00 00 eb 46 e8 0b c8 ff ff \u003c8b\u003e 00 83 f8 69 74 24 e8 ff c7 ff ff 8b 00 83 f8 0b 74 18 e8 f3 c7\n[ 7340.404334] Oops: general protection fault, probably for non-canonical address 0x6d255010bdffc: 0000 [#1] SMP NOPTI\n[ 7340.405972] CPU: 7 UID: 0 PID: 1439 Comm: xskxceiver Not tainted 6.19.0-rc1+ #21 PREEMPT(lazy)\n[ 7340.408006] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014\n[ 7340.409716] RIP: 0010:lookup_swap_cgroup_id+0x44/0x80\n[ 7340.410455] Code: 83 f8 1c 73 39 48 ba ff ff ff ff ff ff ff 03 48 8b 04 c5 20 55 fa bd 48 21 d1 48 89 ca 83 e1 01 48 d1 ea c1 e1 04 48 8d 04 90 \u003c8b\u003e 00 48 83 c4 10 d3 e8 c3 cc cc cc cc 31 c0 e9 98 b7 dd 00 48 89\n[ 7340.412787] RSP: 0018:ffffcc5c04f7f6d0 EFLAGS: 00010202\n[ 7340.413494] RAX: 0006d255010bdffc RBX: ffff891f477895a8 RCX: 0000000000000010\n[ 7340.414431] RDX: 0001c17e3fffffff RSI: 00fa070000000000 RDI: 000382fc7fffffff\n[ 7340.415354] RBP: 00fa070000000000 R08: ffffcc5c04f7f8f8 R09: ffffcc5c04f7f7d0\n[ 7340.416283] R10: ffff891f4c1a7000 R11: ffffcc5c04f7f9c8 R12: ffffcc5c04f7f7d0\n[ 7340.417218] R13: 03ffffffffffffff R14: 00fa06fffffffe00 R15: ffff891f47789500\n[ 7340.418229] FS: 0000000000000000(0000) GS:ffff891ffdfaa000(0000) knlGS:0000000000000000\n[ 7340.419489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 7340.420286] CR2: 00007f415bfffd58 CR3: 0000000103f03002 CR4: 0000000000772ef0\n[ 7340.421237] PKRU: 55555554\n[ 7340.421623] Call Trace:\n[ 7340.421987] \u003cTASK\u003e\n[ 7340.422309] ? softleaf_from_pte+0x77/0xa0\n[ 7340.422855] swap_pte_batch+0xa7/0x290\n[ 7340.423363] zap_nonpresent_ptes.constprop.0.isra.0+0xd1/0x270\n[ 7340.424102] zap_pte_range+0x281/0x580\n[ 7340.424607] zap_pmd_range.isra.0+0xc9/0x240\n[ 7340.425177] unmap_page_range+0x24d/0x420\n[ 7340.425714] unmap_vmas+0xa1/0x180\n[ 7340.426185] exit_mmap+0xe1/0x3b0\n[ 7340.426644] __mmput+0x41/0x150\n[ 7340.427098] exit_mm+0xb1/0x110\n[ 7340.427539] do_exit+0x1b2/0x460\n[ 7340.427992] do_group_exit+0x2d/0xc0\n[ 7340.428477] get_signal+0x79d/0x7e0\n[ 7340.428957] arch_do_signal_or_restart+0x34/0x100\n[ 7340.429571] exit_to_user_mode_loop+0x8e/0x4c0\n[ 7340.430159] do_syscall_64+0x188/0x6b0\n[ 7340.430672] ? __do_sys_clone3+0xd9/0x120\n[ 7340.431212] ? switch_fpu_return+0x4e/0xd0\n[ 7340.431761] ? arch_exit_to_user_mode_prepare.isra.0+0xa1/0xc0\n[ 7340.432498] ? do_syscall_64+0xbb/0x6b0\n[ 7340.433015] ? __handle_mm_fault+0x445/0x690\n[ 7340.433582] ? count_memcg_events+0xd6/0x210\n[ 7340.434151] ? handle_mm_fault+0x212/0x340\n[ 7340.434697] ? do_user_addr_fault+0x2b4/0x7b0\n[ 7340.435271] ? clear_bhb_loop+0x30/0x80\n[ 7340.435788] ? clear_bhb_loop+0x30/0x80\n[ 7340.436299] ? clear_bhb_loop+0x30/0x80\n[ 7340.436812] ? clear_bhb_loop+0x30/0x80\n[ 7340.437323] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 7340.437973] RIP: 0033:0x7f4161b14169\n[ 7340.438468] Code: Unable to access opcode bytes at 0x7f4161b1413f.\n[ 7340.439242] RSP: 002b:00007ffc6ebfa770 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca\n[ 7340.440173] RAX: fffffffffffffe00 RBX: 00000000000005a1 RCX: 00007f4161b14169\n[ 7340.441061] RDX: 00000000000005a1 RSI: 0000000000000109 RDI: 00007f415bfff990\n[ 7340.441943] RBP: 00007ffc6ebfa7a0 R08: 0000000000000000 R09: 00000000ffffffff\n[ 7340.442824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[ 7340.443707] R13: 0000000000000000 R14: 00007f415bfff990 R15: 00007f415bfff6c0\n[ 7340.444586] \u003c/TASK\u003e\n[ 7340.444922] Modules linked in: rfkill intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit libnvdimm kvm_intel vfat fat kvm snd_pcm irqbypass rapl iTCO_wdt snd_timer intel_pmc_bxt iTCO_vendor_support snd ixgbevf virtio_net soundcore i2c_i801 pcspkr libeth_xdp net_failover i2c_smbus lpc_ich failover libeth virtio_balloon joydev 9p fuse loop zram lz4hc_compress lz4_compress 9pnet_virtio 9pnet netfs ghash_clmulni_intel serio_raw qemu_fw_cfg\n[ 7340.449650] ---[ end trace 0000000000000000 ]---\n\nThe issue can be fixed in all in-tree drivers, but we cannot just trust OOT\ndrivers to not do this. Therefore, make tailroom a signed int and produce a\nwarning when it is negative to prevent such mistakes in the future.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-10-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8e18abf183dbd636a8725532c7f5aa58957de84", "tree": "9575635f7033a7cfa902539fa53f3f77c3c512d3", "parents": [ "75d9228982f23d68066ca0b7d87014c3eb8ddc85" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:49 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "net: enetc: use truesize as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects truesize instead of DMA\nwrite size. Different assumptions in enetc driver configuration lead to\nnegative tailroom.\n\nSet frag_size to the same value as frame_sz.\n\nFixes: 2768b2e2f7d2 (\"net: enetc: register XDP RX queues with frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-9-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75d9228982f23d68066ca0b7d87014c3eb8ddc85", "tree": "19a61716e1289e779feb690fc73f0465c9684090", "parents": [ "c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:48 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:05 2026 -0800" }, "message": "libeth, idpf: use truesize as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead\nof DMA write size. Different assumptions in idpf driver configuration lead\nto negative tailroom.\n\nTo make it worse, buffer sizes are not actually uniform in idpf when\nsplitq is enabled, as there are several buffer queues, so rxq-\u003erx_buf_size\nis meaningless in this case.\n\nUse truesize of the first bufq in AF_XDP ZC, as there is only one. Disable\ngrowing tail for regular splitq.\n\nFixes: ac8a861f632e (\"idpf: prepare structures to support XDP\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-8-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c69d22c6c46a1d792ba8af3d8d6356fdc0e6f538", "tree": "11155a899c3938024362de3d4df98a60f956ba3a", "parents": [ "8f497dc8a61429cc004720aa8e713743355d80cf" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:47 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "i40e: use xdp.frame_sz as XDP RxQ info frag_size\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buffer size instead\nof DMA write size. Different assumptions in i40e driver configuration lead\nto negative tailroom.\n\nSet frag_size to the same value as frame_sz in shared pages mode, use new\nhelper to set frag_size when AF_XDP ZC is active.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-7-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f497dc8a61429cc004720aa8e713743355d80cf", "tree": "0d248580ac95dde2ff9c66697f6e74248eef9b02", "parents": [ "e142dc4ef0f451b7ef99d09aaa84e9389af629d7" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:46 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "i40e: fix registering XDP RxQ info\n\nCurrent way of handling XDP RxQ info in i40e has a problem, where frag_size\nis not updated when xsk_buff_pool is detached or when MTU is changed, this\nleads to growing tail always failing for multi-buffer packets.\n\nCouple XDP RxQ info registering with buffer allocations and unregistering\nwith cleaning the ring.\n\nFixes: a045d2f2d03d (\"i40e: set xdp_rxq_info::frag_size\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-6-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e142dc4ef0f451b7ef99d09aaa84e9389af629d7", "tree": "2baf8713348e6bddb6b7cdfcb3ddc0dc3496c15d", "parents": [ "02852b47c706772af795d3e28fca99fc9b923b2c" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:45 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:04 2026 -0800" }, "message": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz\n\nThe only user of frag_size field in XDP RxQ info is\nbpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead\nof DMA write size. Different assumptions in ice driver configuration lead\nto negative tailroom.\n\nThis allows to trigger kernel panic, when using\nXDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to\n6912 and the requested offset to a huge value, e.g.\nXSK_UMEM__MAX_FRAME_SIZE * 100.\n\nDue to other quirks of the ZC configuration in ice, panic is not observed\nin ZC mode, but tailroom growing still fails when it should not.\n\nUse fill queue buffer truesize instead of DMA write size in XDP RxQ info.\nFix ZC mode too by using the new helper.\n\nFixes: 2fba7dc5157b (\"ice: Add support for XDP multi-buffer on Rx side\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-5-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02852b47c706772af795d3e28fca99fc9b923b2c", "tree": "b9a711fd9859b1c2377c5405f18a7f1a3bea6c70", "parents": [ "16394d80539937d348dd3b9ea32415c54e67a81b" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:44 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "ice: fix rxq info registering in mbuf packets\n\nXDP RxQ info contains frag_size, which depends on the MTU. This makes the\nold way of registering RxQ info before calculating new buffer sizes\ninvalid. Currently, it leads to frag_size being outdated, making it\nsometimes impossible to grow tailroom in a mbuf packet. E.g. fragments are\nactually 3K+, but frag size is still as if MTU was 1500.\n\nAlways register new XDP RxQ info after reconfiguring memory pools.\n\nFixes: 2fba7dc5157b (\"ice: Add support for XDP multi-buffer on Rx side\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-4-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "16394d80539937d348dd3b9ea32415c54e67a81b", "tree": "3675d1fc662565c6f8fae92a441e2f96e2ab2cbd", "parents": [ "88b6b7f7b216108a09887b074395fa7b751880b1" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:43 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "xsk: introduce helper to determine rxq-\u003efrag_size\n\nrxq-\u003efrag_size is basically a step between consecutive strictly aligned\nframes. In ZC mode, chunk size fits exactly, but if chunks are unaligned,\nthere is no safe way to determine accessible space to grow tailroom.\n\nReport frag_size to be zero, if chunks are unaligned, chunk_size otherwise.\n\nFixes: 24ea50127ecf (\"xsk: support mbuf on ZC RX\")\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-3-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "88b6b7f7b216108a09887b074395fa7b751880b1", "tree": "9d8605f8808c41e424dbb0e3d09bce3de742a0c2", "parents": [ "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f" ], "author": { "name": "Larysa Zaremba", "email": "larysa.zaremba@intel.com", "time": "Thu Mar 05 12:12:42 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 08:02:03 2026 -0800" }, "message": "xdp: use modulo operation to calculate XDP frag tailroom\n\nThe current formula for calculating XDP tailroom in mbuf packets works only\nif each frag has its own page (if rxq-\u003efrag_size is PAGE_SIZE), this\ndefeats the purpose of the parameter overall and without any indication\nleads to negative calculated tailroom on at least half of frags, if shared\npages are used.\n\nThere are not many drivers that set rxq-\u003efrag_size. Among them:\n* i40e and enetc always split page uniformly between frags, use shared\n pages\n* ice uses page_pool frags via libeth, those are power-of-2 and uniformly\n distributed across page\n* idpf has variable frag_size with XDP on, so current API is not applicable\n* mlx5, mtk and mvneta use PAGE_SIZE or 0 as frag_size for page_pool\n\nAs for AF_XDP ZC, only ice, i40e and idpf declare frag_size for it. Modulo\noperation yields good results for aligned chunks, they are all power-of-2,\nbetween 2K and PAGE_SIZE. Formula without modulo fails when chunk_size is\n2K. Buffers in unaligned mode are not distributed uniformly, so modulo\noperation would not work.\n\nTo accommodate unaligned buffers, we could define frag_size as\ndata + tailroom, and hence do not subtract offset when calculating\ntailroom, but this would necessitate more changes in the drivers.\n\nDefine rxq-\u003efrag_size as an even portion of a page that fully belongs to a\nsingle frag. When calculating tailroom, locate the data start within such\nportion by performing a modulo operation on page offset.\n\nFixes: bf25146a5595 (\"bpf: add frags support to the bpf_xdp_adjust_tail() API\")\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260305111253.2317394-2-larysa.zaremba@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d1271ff4c131cd4a601dabdfdcdc1fe1252493f", "tree": "3942b977020b98f11de797118f794a03ddaffc3e", "parents": [ "e2cedd400c3ec0302ffca2490e8751772906ac23" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Wed Mar 04 09:06:03 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:54:09 2026 -0800" }, "message": "selftests/tc-testing: Add tests exercising act_ife metalist replace behaviour\n\nAdd 2 test cases to exercise fix in act_ife\u0027s internal metalist\nbehaviour.\n\n- Update decode ife action into encode with tcindex metadata\n- Update decode ife action into encode with multiple metadata\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260304140603.76500-2-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2cedd400c3ec0302ffca2490e8751772906ac23", "tree": "51a208c2cad6d61e0402ec608c3dd4d1a5d7b0c3", "parents": [ "4517b74cc07c3b766ca92cf6cea352e65f6e8f9b" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Mar 04 09:06:02 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:54:08 2026 -0800" }, "message": "net/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[ 138.423369][ C1] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 138.425800][ C1] Call Trace:\n[ 138.425804][ C1] \u003cIRQ\u003e\n[ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122)\n[ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168)\n[ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.\n\nFixes: aa9fd9a325d51 (\"sched: act: ife: update parameters via rcu handling\")\nReported-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nTested-by: Ruitong Liu \u003ccnitlrt@gmail.com\u003e\nCo-developed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260304140603.76500-1-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4517b74cc07c3b766ca92cf6cea352e65f6e8f9b", "tree": "55719399e40a72211ad9dc662cadd2ea05a33a20", "parents": [ "168ff39e4758897d2eee4756977d036d52884c7e", "46c1ef0cfcea50aaf0b52316fdab94bf4b45795b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:19 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:20 2026 -0800" }, "message": "Merge branch \u0027net-ipv6-fix-panic-when-ipv4-route-references-loopback-ipv6-nexthop-and-add-selftest\u0027\n\nJiayuan Chen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop and add selftest\n\nsyzbot reported a kernel panic [1] when an IPv4 route references\na loopback IPv6 nexthop object:\n\nBUG: unable to handle page fault for address: ffff8d069e7aa000\nPF: supervisor read access in kernel mode\nPF: error_code(0x0000) - not-present page\nPGD 6aa01067 P4D 6aa01067 PUD 0\nOops: Oops: 0000 [#1] SMP PTI\nCPU: 2 UID: 0 PID: 530 Comm: ping Not tainted 6.19.0+ #193 PREEMPT\nRIP: 0010:ip_route_output_key_hash_rcu+0x578/0x9e0\nRSP: 0018:ffffd2ffc1573918 EFLAGS: 00010286\nRAX: ffff8d069e7aa000 RBX: ffffd2ffc1573988 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffd2ffc1573978 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8d060d496000\nR13: 0000000000000000 R14: ffff8d060399a600 R15: ffff8d06019a6ab8\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff8d069e7aa000 CR3: 0000000106eb0001 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ip_route_output_key_hash+0x86/0x1a0\n __ip4_datagram_connect+0x2b5/0x4e0\n udp_connect+0x2c/0x60\n inet_dgram_connect+0x88/0xd0\n __sys_connect_file+0x56/0x90\n __sys_connect+0xa8/0xe0\n __x64_sys_connect+0x18/0x30\n x64_sys_call+0xfb9/0x26e0\n do_syscall_64+0xd3/0x1510\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nReproduction:\n\n ip -6 nexthop add id 100 dev lo\n ip route add 172.20.20.0/24 nhid 100\n ping -c1 172.20.20.1 # kernel crash\n\nProblem Description\n\nWhen a standalone IPv6 nexthop object is created with a loopback device,\nfib6_nh_init() misclassifies it as a reject route. Nexthop objects have\nno destination prefix (fc_dst\u003d::), so fib6_is_reject() always matches\nany loopback nexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. When an IPv4 route later references\nthis nexthop and triggers a route lookup, __mkroute_output() calls\nraw_cpu_ptr(nhc-\u003enhc_pcpu_rth_output) on a NULL pointer, causing a page\nfault.\n\nThe reject classification was designed for regular IPv6 routes to prevent\nkernel routing loops, but nexthop objects should not be subject to this\ncheck since they carry no destination information. Loop prevention is\nhandled separately when the route itself is created.\n[1] https://syzkaller.appspot.com/bug?extid\u003d334190e097a98a1b81bb\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260304113817.294966-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "46c1ef0cfcea50aaf0b52316fdab94bf4b45795b", "tree": "55719399e40a72211ad9dc662cadd2ea05a33a20", "parents": [ "21ec92774d1536f71bdc90b0e3d052eff99cf093" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Mar 04 19:38:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:17 2026 -0800" }, "message": "selftests: net: add test for IPv4 route with loopback IPv6 nexthop\n\nAdd a regression test for a kernel panic that occurs when an IPv4 route\nreferences an IPv6 nexthop object created on the loopback device.\n\nThe test creates an IPv6 nexthop on lo, binds an IPv4 route to it, then\ntriggers a route lookup via ping to verify the kernel does not crash.\n\n ./fib_nexthops.sh\n Tests passed: 249\n Tests failed: 0\n\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260304113817.294966-3-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "21ec92774d1536f71bdc90b0e3d052eff99cf093", "tree": "21c7a3b1e1e714536ed927fc669b29db633a5634", "parents": [ "168ff39e4758897d2eee4756977d036d52884c7e" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Wed Mar 04 19:38:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:53:17 2026 -0800" }, "message": "net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop\n\nWhen a standalone IPv6 nexthop object is created with a loopback device\n(e.g., \"ip -6 nexthop add id 100 dev lo\"), fib6_nh_init() misclassifies\nit as a reject route. This is because nexthop objects have no destination\nprefix (fc_dst\u003d::), causing fib6_is_reject() to match any loopback\nnexthop. The reject path skips fib_nh_common_init(), leaving\nnhc_pcpu_rth_output unallocated. If an IPv4 route later references this\nnexthop, __mkroute_output() dereferences NULL nhc_pcpu_rth_output and\npanics.\n\nSimplify the check in fib6_nh_init() to only match explicit reject\nroutes (RTF_REJECT) instead of using fib6_is_reject(). The loopback\npromotion heuristic in fib6_is_reject() is handled separately by\nip6_route_info_create_nh(). After this change, the three cases behave\nas follows:\n\n1. Explicit reject route (\"ip -6 route add unreachable 2001:db8::/64\"):\n RTF_REJECT is set, enters reject path, skips fib_nh_common_init().\n No behavior change.\n\n2. Implicit loopback reject route (\"ip -6 route add 2001:db8::/32 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. ip6_route_info_create_nh() still promotes it to reject\n afterward. nhc_pcpu_rth_output is allocated but unused, which is\n harmless.\n\n3. Standalone nexthop object (\"ip -6 nexthop add id 100 dev lo\"):\n RTF_REJECT is not set, takes normal path, fib_nh_common_init() is\n called. nhc_pcpu_rth_output is properly allocated, fixing the crash\n when IPv4 routes reference this nexthop.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nFixes: 493ced1ac47c (\"ipv4: Allow routes to use nexthop objects\")\nReported-by: syzbot+334190e097a98a1b81bb@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/698f8482.a70a0220.2c38d7.00ca.GAE@google.com/T/\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260304113817.294966-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "168ff39e4758897d2eee4756977d036d52884c7e", "tree": "192f382072961aa5c179efd814dddd59fc92bd45", "parents": [ "e5e890630533bdc15b26a34bb8e7ef539bdf1322" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:57 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:52:56 2026 -0800" }, "message": "net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If an IPv6 packet is injected into the interface,\nroute_shortcircuit() is called and a NULL pointer dereference happens on\nneigh_lookup().\n\n BUG: kernel NULL pointer dereference, address: 0000000000000380\n Oops: Oops: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x20/0x270\n [...]\n Call Trace:\n \u003cTASK\u003e\n vxlan_xmit+0x638/0x1ef0 [vxlan]\n dev_hard_start_xmit+0x9e/0x2e0\n __dev_queue_xmit+0xbee/0x14e0\n packet_sendmsg+0x116f/0x1930\n __sys_sendto+0x1f5/0x200\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x12f/0x1590\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFix this by adding an early check on route_shortcircuit() when protocol\nis ETH_P_IPV6. Note that ipv6_mod_enabled() cannot be used here because\nVXLAN can be built-in even when IPv6 is built as a module.\n\nFixes: e15a00aafa4b (\"vxlan: add ipv6 route short circuit support\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260304120357.9778-2-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e5e890630533bdc15b26a34bb8e7ef539bdf1322", "tree": "a651114bee5c34c0ef2f9fa7e492ac3e5c1d9aea", "parents": [ "02b2920e30e323522438593e6ed9525f31cc727e" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Wed Mar 04 13:03:56 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:52:56 2026 -0800" }, "message": "net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. Then, if neigh_suppress is enabled and an ICMPv6\nNeighbor Discovery packet reaches the bridge, br_do_suppress_nd() will\ndereference ipv6_stub-\u003end_tbl which is NULL, passing it to\nneigh_lookup(). This causes a kernel NULL pointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000268\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n [...]\n RIP: 0010:neigh_lookup+0x16/0xe0\n [...]\n Call Trace:\n \u003cIRQ\u003e\n ? neigh_lookup+0x16/0xe0\n br_do_suppress_nd+0x160/0x290 [bridge]\n br_handle_frame_finish+0x500/0x620 [bridge]\n br_handle_frame+0x353/0x440 [bridge]\n __netif_receive_skb_core.constprop.0+0x298/0x1110\n __netif_receive_skb_one_core+0x3d/0xa0\n process_backlog+0xa0/0x140\n __napi_poll+0x2c/0x170\n net_rx_action+0x2c4/0x3a0\n handle_softirqs+0xd0/0x270\n do_softirq+0x3f/0x60\n\nFix this by replacing IS_ENABLED(IPV6) call with ipv6_mod_enabled() in\nthe callers. This is in essence disabling NS/NA suppression when IPv6 is\ndisabled.\n\nFixes: ed842faeb2bd (\"bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports\")\nReported-by: Guruprasad C P \u003cgurucp2005@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp\u003dutE2H2VTX5nqfgs7LDxQ@mail.gmail.com/\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260304120357.9778-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b92b0075ee1870f78f59ab1f7da7dbfdd718ad7a", "tree": "5e119b8da1e3a35437a058aa65fe959d53db093e", "parents": [ "aac9b27f7c1f2b2cf7f50a9ca633ecbbcaf22af9" ], "author": { "name": "Pedro Falcato", "email": "pfalcato@suse.de", "time": "Thu Mar 05 14:53:12 2026 +0000" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu Mar 05 16:49:02 2026 +0100" }, "message": "ata: libata-core: Add BRIDGE_OK quirk for QEMU drives\n\nCurrently, whenever you boot with a QEMU drive over an AHCI interface,\nyou get:\n[ 1.632121] ata1.00: applying bridge limits\n\nThis happens due to the kernel not believing the given drive is SATA,\nsince word 93 of IDENTIFY (ATA_ID_HW_CONFIG) is non-zero. The result is\na pretty severe limit in max_hw_sectors_kb, which limits our IO sizes.\n\nQEMU has set word 93 erroneously for SATA drives but does not, in any\nway, emulate any of these real hardware details. There is no PATA\ndrive and no SATA cable.\n\nAs such, add a BRIDGE_OK quirk for QEMU HARDDISK. Special care is taken\nto limit this quirk to \"2.5+\", to allow for fixed future versions.\n\nThis results in the max_hw_sectors being limited solely by the\ncontroller interface\u0027s limits. Which, for AHCI controllers, takes it\nfrom 128KB to 32767KB.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "02b2920e30e323522438593e6ed9525f31cc727e", "tree": "c7c8931229ed3ce82e7b7eabdce0b2e3e16bfa50", "parents": [ "c952291593e54415a7bb74c4a7187a7c7c7e8651", "ed6579002548f3d9c00380e2aeaa8305d3ed8fc5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:47 2026 -0800" }, "message": "Merge branch \u0027maintainers-annual-cleanup-of-inactive-maintainers\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMAINTAINERS: annual cleanup of inactive maintainers\n\nAnnual cleanup of inactive maintainers under networking.\nThe goal is to make sure MAINTAINERS reflect reality for\ncode which is relatively actively changed (at least 70 commits\nin the last 2 years or at least 120 commits in the last 5 years).\n\nThose who either:\n - were the initial author / \"upstreamer\" of the driver; or\n - authored at least 1/3rd of the exiting code base (per git blame); or\n - authored at least 25% of commits before becoming inactive\nare moved to CREDITS.\n\nThe discovery of inactive maintainers was done using gitdm tools,\nwith a bunch of ad-hoc scripts on top to do the rest. I tried to\ndouble check the results but this is mostly a scripted cleanup\nso please report inaccuracies if any.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260303215339.2333548-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ed6579002548f3d9c00380e2aeaa8305d3ed8fc5", "tree": "c7c8931229ed3ce82e7b7eabdce0b2e3e16bfa50", "parents": [ "4d37e68c46d15beb4af782b19d7f1b382316776c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:11 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Thomas Falcon from IBM ibmvnic\n\nWe have not seen emails or tags from Thomas\u0027s IBM address\n(tlfalcon@linux.ibm.com) in over 5 years. Looks like Thomas\nis active in perf tooling at Intel (thomas.falcon@intel.com).\n\nSubsystem IBM Power SRIOV Virtual NIC Device Driver\n Changes 49 / 134 (36%)\n Last activity: 2025-08-26\n Haren Myneni \u003charen@linux.ibm.com\u003e:\n Tags 3c14917953a5 2025-08-26 00:00:00 2\n Rick Lindsley \u003cricklind@linux.ibm.com\u003e:\n Nick Child \u003cnnac123@linux.ibm.com\u003e:\n Author d93a6caab5d7 2025-03-25 00:00:00 14\n Tags d93a6caab5d7 2025-03-25 00:00:00 16\n Thomas Falcon \u003ctlfalcon@linux.ibm.com\u003e:\n Top reviewers:\n [22]: drt@linux.ibm.com\n [13]: horms@kernel.org\n [9]: ricklind@linux.vnet.ibm.com\n [3]: davemarq@linux.ibm.com\n INACTIVE MAINTAINER Thomas Falcon \u003ctlfalcon@linux.ibm.com\u003e\n\nMove Thomas to CREDITS as the initial author of ibmvnic.\n\nAcked-by: Thomas Falcon \u003cthomas.falcon@intel.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-12-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d37e68c46d15beb4af782b19d7f1b382316776c", "tree": "088ec7cfb8b5c6d79dbd2ce6db8c029abc4488ba", "parents": [ "9ede3e910f088fb3ffec0ed821f0b03951000d23" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:10 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Claudiu Manoil and Alexandre Belloni from Ocelot switch\n\nWe have not seen tags from Claudiu for the Ocelot switch driver\nin over 5 years. He is active upstream in other NXP subsystems\n(ENETC, gianfar), with 46 emails on lore since 2024.\nWe have not seen tags from Alexandre for the Ocelot switch driver\nin over 5 years. He is very active upstream in other subsystems\n(RTC, I3C, Atmel/Microchip SoC), with over 1,200 emails on lore\nsince 2024.\nVladimir Oltean is active.\n\nSubsystem OCELOT ETHERNET SWITCH DRIVER\n Changes 180 / 494 (36%)\n Last activity: 2026-02-12\n Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e:\n Author c22ba07c827f 2026-02-10 00:00:00 33\n Tags 026f6513c588 2026-02-12 00:00:00 39\n Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e:\n Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e:\n Top reviewers:\n [49]: f.fainelli@gmail.com\n [19]: horms@kernel.org\n [10]: richardcochran@gmail.com\n [9]: jacob.e.keller@intel.com\n [8]: colin.foster@in-advantage.com\n INACTIVE MAINTAINER Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e\n\nAcked-by: Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e\nAcked-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-11-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9ede3e910f088fb3ffec0ed821f0b03951000d23", "tree": "5fc2f986a8be64c6e27d6b181b861dbed5bed659", "parents": [ "60da2d2752ac4513fc3a91a0558dfd8176d2313f" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:09 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: replace Taras Chornyi with Elad Nachman for Marvell Prestera\n\nWe have not seen emails or tags from Taras in over 5 years,\nand there is no recent mailing list activity.\nElad Nachman has been providing reviews in the last couple\nof years and is the top reviewer for this subsystem.\n\nSubsystem MARVELL PRESTERA ETHERNET SWITCH DRIVER\n Changes 39 / 157 (24%)\n (No activity)\n Top reviewers:\n [8]: enachman@marvell.com\n [6]: horms@kernel.org\n [4]: idosch@nvidia.com\n [3]: andrew@lunn.ch\n [3]: jacob.e.keller@intel.com\n [3]: jiri@nvidia.com\n INACTIVE MAINTAINER Taras Chornyi \u003ctaras.chornyi@plvision.eu\u003e\n\nLink: https://patch.msgid.link/20260303215339.2333548-10-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "60da2d2752ac4513fc3a91a0558dfd8176d2313f", "tree": "aa14c8ccb2650b99c23e2b019441db6c28234355", "parents": [ "34f49454b25cd2e532f137174ef59b778f1a09f5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:08 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:45 2026 -0800" }, "message": "MAINTAINERS: remove Jonathan Lemon from OpenCompute PTP\n\nWe have not seen emails or tags from Jonathan in over 5 years,\nand there is no recent mailing list activity.\nVadim Fedorenko is active.\n\nSubsystem OPENCOMPUTE PTP CLOCK DRIVER\n Changes 49 / 130 (37%)\n Last activity: 2025-11-25\n Jonathan Lemon \u003cjonathan.lemon@gmail.com\u003e:\n Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e:\n Author d3ca2ef0c915 2025-09-19 00:00:00 5\n Tags 648282e2d1e5 2025-11-25 00:00:00 20\n Top reviewers:\n [7]: horms@kernel.org\n [4]: jiri@nvidia.com\n [3]: richardcochran@gmail.com\n [2]: aleksandr.loktionov@intel.com\n INACTIVE MAINTAINER Jonathan Lemon \u003cjonathan.lemon@gmail.com\u003e\n\nAdd Jonathan to CREDITS as the initial author of ptp_ocp.\n\nAcked-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-9-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "34f49454b25cd2e532f137174ef59b778f1a09f5", "tree": "a3f97f48c53b1298485eb7c275a86eb0bc7614b7", "parents": [ "593cdf14523bfb837b947012cdc6545a53ea67b5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 03 13:53:07 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Mar 05 07:35:44 2026 -0800" }, "message": "MAINTAINERS: replace Clark Wang with Frank Li for Freescale FEC\n\nWe have not seen tags from Clark for FEC in over 5 years.\nHe has some limited recent activity on the mailing list in other\nNXP subsystems (stmmac, phy). Wei Fang and Shenwei Wang are active,\nwith decent review coverage (61%).\n\nFrank Li has been reviewing code actively more recenty, let\u0027s\nmake it official.\n\nSubsystem FREESCALE IMX / MXC FEC DRIVER\n Changes 57 / 92 (61%)\n Last activity: 2026-02-10\n Wei Fang \u003cwei.fang@nxp.com\u003e:\n Author 25eb3058eb70 2026-02-10 00:00:00 33\n Tags 25eb3058eb70 2026-02-10 00:00:00 61\n Shenwei Wang \u003cshenwei.wang@nxp.com\u003e:\n Author d466c16026e9 2025-09-14 00:00:00 6\n Tags d466c16026e9 2025-09-14 00:00:00 6\n Clark Wang \u003cxiaoning.wang@nxp.com\u003e:\n Top reviewers:\n [23]: Frank.Li@nxp.com\n [17]: andrew@lunn.ch\n [4]: csokas.bence@prolan.hu\n [3]: horms@kernel.org\n [2]: maxime.chevallier@bootlin.com\n INACTIVE MAINTAINER Clark Wang \u003cxiaoning.wang@nxp.com\u003e\n\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260303215339.2333548-8-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "593cdf14523bfb837b947012cdc6545a53ea67b5" }