)]}' { "log": [ { "commit": "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "tree": "6c70b7a6aa9eb203f4ceb558151b8c56ea33f487", "parents": [ "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "39f1c201b93f4ff71631bac72cff6eb155f976a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm updates from Paolo Bonzini:\n \"On top of a lot of Arm fixes, this includes a massive rename of types\n and variables in tools/testing/selftests/kvm - these were\n unnecessarily different from what the kernel uses, so they\u0027re being\n made consistent.\n\n arm64:\n\n - Allow tracing for non-pKVM, which was accidentally disabled when\n the series was merged\n\n - Rationalise the way the pKVM hypercall ranges are defined by using\n the same mechanism as already used for the vcpu_sysreg enum\n\n - Enforce that SMCCC function numbers relayed by the pKVM proxy are\n actually compliant with the specification\n\n - Fix a couple of feature to idreg mappings which resulted in the\n wrong sanitisation being applied\n\n - Fix the GICD_IIDR revision number field that could never been\n written correctly by userspace\n\n - Make kvm_vcpu_initialized() correctly use its parameter instead of\n relying on the surrounding context\n\n - Enforce correct ordering in __pkvm_init_vcpu(), plugging a\n potential pin leak at the same time\n\n - Move __pkvm_init_finalise() to a less dangerous spot, avoiding\n future problems\n\n - Restore functional userspace irqchip support after a four year\n breakage (last functional kernel was 5.18...)\n\n - Spelling fixes\n\n Selftests:\n\n - Rename types across all KVM selftests to more closely align with\n types used in the kernel:\n\n vm_vaddr_t -\u003e gva_t\n vm_paddr_t -\u003e gpa_t\n\n uint64_t -\u003e u64\n uint32_t -\u003e u32\n uint16_t -\u003e u16\n uint8_t -\u003e u8\n\n int64_t -\u003e s64\n int32_t -\u003e s32\n int16_t -\u003e s16\n int8_t -\u003e s8\n\n - Fix Loongarch compilation\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (31 commits)\n KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch\n KVM: arm64: Wake-up from WFI when iqrchip is in userspace\n KVM: arm64: Fix initialisation order in __pkvm_init_finalise()\n KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n KVM: arm64: Fix kvm_vcpu_initialized() macro parameter\n KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer\n KVM: arm64: Fix typo in feature check comments\n KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer\n KVM: arm64: Reject non compliant SMCCC function calls in pKVM\n KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value\n KVM: selftests: Replace \"paddr\" with \"gpa\" throughout\n KVM: selftests: Replace \"u64 nested_paddr\" with \"gpa_t l2_gpa\"\n KVM: selftests: Replace \"u64 gpa\" with \"gpa_t\" throughout\n KVM: selftests: Replace \"vaddr\" with \"gva\" throughout\n KVM: selftests: Clarify that arm64\u0027s inject_uer() takes a host PA, not a guest PA\n KVM: selftests: Rename translate_to_host_paddr() \u003d\u003e translate_hva_to_hpa()\n KVM: selftests: Rename vm_vaddr_populate_bitmap() \u003d\u003e vm_populate_gva_bitmap()\n KVM: selftests: Rename vm_vaddr_unused_gap() \u003d\u003e vm_unused_gva_gap()\n KVM: selftests: Drop \"vaddr_\" from APIs that allocate memory for a given VM\n KVM: selftests: Use u8 instead of uint8_t\n ...\n" }, { "commit": "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "tree": "7e2714963b58fa6732df54be5685588158ec2a51", "parents": [ "dca922e019dd758b4c1b4bec8f1d509efddeaab4", "d99f7a32f09dccbe396187370ec1a74a31b73d7e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n \"The merge window pulled in the cgroup sub-scheduler infrastructure,\n and new AI reviews are accelerating bug reporting and fixing - hence\n the larger than usual fixes batch:\n\n - Use-after-frees during scheduler load/unload:\n - The disable path could free the BPF scheduler while deferred\n irq_work / kthread work was still in flight\n - cgroup setter callbacks read the active scheduler outside the\n rwsem that synchronizes against teardown\n Fix both, and reuse the disable drain in the enable error paths so\n the BPF JIT page can\u0027t be freed under live callbacks.\n\n - Several BPF op invocations didn\u0027t tell the framework which runqueue\n was already locked, so helper kfuncs that re-acquire the runqueue\n by CPU could deadlock on the held lock\n\n Fix the affected callsites, including recursive parent-into-child\n dispatch.\n\n - The hardlockup notifier ran from NMI but eventually took a\n non-NMI-safe lock. Bounce it through irq_work.\n\n - A handful of bugs in the new sub-scheduler hierarchy:\n - helper kfuncs hard-coded the root instead of resolving the\n caller\u0027s scheduler\n - the enable error path tried to disable per-task state that had\n never been initialized, and leaked cpus_read_lock on the way\n out\n - a sysfs object was leaked on every load/unload\n - the dispatch fast-path used the root scheduler instead of the\n task\u0027s\n - a couple of CONFIG #ifdef guards were misclassified\n\n - Verifier-time hardening: BPF programs of unrelated struct_ops types\n (e.g. tcp_congestion_ops) could call sched_ext kfuncs - a semantic\n bug and, once sub-sched was enabled, a KASAN out-of-bounds read.\n Now rejected at load. Plus a few NULL and cross-task argument\n checks on sched_ext kfuncs, and a selftest covering the new deny.\n\n - rhashtable (Herbert): restore the insecure_elasticity toggle and\n bounce the deferred-resize kick through irq_work to break a\n lock-order cycle observable from raw-spinlock callers. sched_ext\u0027s\n scheduler-instance hash is the first user of both.\n\n - The bypass-mode load balancer used file-scope cpumasks; with\n multiple scheduler instances now possible, those raced. Move to\n per-instance cpumasks, plus a follow-up to skip tasks whose\n recorded CPU is stale relative to the new owning runqueue.\n\n - Smaller fixes:\n - a dispatch queue\u0027s first-task tracking misbehaved when a parked\n iterator cursor sat in the list\n - the runqueue\u0027s next-class wasn\u0027t promoted on local-queue\n enqueue, leaving an SCX task behind RT in edge cases\n - the reference qmap scheduler stopped erroring on legitimate\n cross-scheduler task-storage misses\"\n\n* tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (26 commits)\n sched_ext: Fix scx_flush_disable_work() UAF race\n sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable\n sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime\n sched_ext: Refuse cross-task select_cpu_from_kfunc calls\n sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED\n sched_ext: Make bypass LB cpumasks per-scheduler\n sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before\n sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task\n sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP\n sched_ext: Use dsq-\u003efirst_task instead of list_empty() in dispatch_enqueue() FIFO-tail\n sched_ext: Resolve caller\u0027s scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued()\n sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n sched_ext: Don\u0027t disable tasks in scx_sub_enable_workfn() abort path\n sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()\n sched_ext: Guard scx_dsq_move() against NULL kit-\u003edsq after failed iter_new\n sched_ext: Unregister sub_kset on scheduler disable\n sched_ext: Defer scx_hardlockup() out of NMI\n sched_ext: sync disable_irq_work in bpf_scx_unreg()\n sched_ext: Fix local_dsq_post_enq() to use task\u0027s scheduler in sub-sched\n ...\n" }, { "commit": "d99f7a32f09dccbe396187370ec1a74a31b73d7e", "tree": "54a5a52b58b3ce0f5cb550bb4a93da8681bb34c9", "parents": [ "163f8b7f9a84086c67c76aeadc04e6d43e32df6e" ], "author": { "name": "Cheng-Yang Chou", "email": "yphbchou0911@gmail.com", "time": "Wed Apr 29 01:36:12 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 07:40:03 2026 -1000" }, "message": "sched_ext: Fix scx_flush_disable_work() UAF race\n\nscx_flush_disable_work() calls irq_work_sync() followed by\nkthread_flush_work() to ensure that the disable kthread work has\nfully completed before bpf_scx_unreg() frees the SCX scheduler.\n\nHowever, a concurrent scx_vexit() (e.g., triggered by a watchdog stall)\ncreates a race window between scx_claim_exit() and irq_work_queue():\n\n CPU A (scx_vexit (watchdog)) CPU B (bpf_scx_unreg)\n ---- ----\n scx_claim_exit()\n atomic_try_cmpxchg(NONE-\u003ekind)\n stack_trace_save()\n vscnprintf()\n scx_disable()\n scx_claim_exit() -\u003e FAIL\n scx_flush_disable_work()\n irq_work_sync() // no-op: not queued yet\n kthread_flush_work() // no-op: not queued yet\n kobject_put(\u0026sch-\u003ekobj) -\u003e free %sch\n irq_work_queue() -\u003e UAF on %sch\n scx_disable_irq_workfn()\n kthread_queue_work() -\u003e UAF\n\nThe root cause is that CPU B\u0027s scx_flush_disable_work() returns after\nsyncing an irq_work that has not yet been queued, while CPU A is still\nexecuting the code between scx_claim_exit() and irq_work_queue().\n\nLoop until exit_kind reaches SCX_EXIT_DONE or SCX_EXIT_NONE, draining\ndisable_irq_work and disable_work in each pass. This ensures that any\nwork queued after the previous check is caught, while also correctly\nhandling cases where no disable was triggered (e.g., the\nscx_sub_enable_workfn() abort path).\n\nFixes: 510a27055446 (\"sched_ext: sync disable_irq_work in bpf_scx_unreg()\")\nReported-by: https://sashiko.dev/#/patchset/20260424100221.32407-1-icheng%40nvidia.com\nSuggested-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Cheng-Yang Chou \u003cyphbchou0911@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "163f8b7f9a84086c67c76aeadc04e6d43e32df6e", "tree": "571d82152fb8e08455663c68d3b6dae14e8dc875", "parents": [ "deb7b2f93d0129b79425f830a1e5e7e1bb2c4973" ], "author": { "name": "Kuba Piecuch", "email": "jpiecuch@google.com", "time": "Tue Apr 28 12:46:01 2026 +0000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 06:28:48 2026 -1000" }, "message": "sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n\nThere are several edge cases (see linked thread) where an IMMED task\ncan be left lingering on a local DSQ if an RT task swoops in at the\nwrong time. All of these edge cases are due to rq-\u003enext_class being idle\neven after dispatching a task to rq\u0027s local DSQ. We should bump\nrq-\u003enext_class to \u0026ext_sched_class as soon as we\u0027ve inserted a task into\nthe local DSQ.\n\nTo optimize the common case of rq-\u003enext_class \u003d\u003d \u0026ext_sched_class,\nonly call wakeup_preempt() if rq-\u003enext_class is below EXT. If next_class\nis EXT or above, wakeup_preempt() is a no-op anyway.\n\nThis lets us also simplify the preempt_curr() logic a bit since\nwakeup_preempt() will call preempt_curr() for us if next_class is\nbelow EXT.\n\nLink: https://lore.kernel.org/all/DHZPHUFXB4N3.2RY28MUEWBNYK@google.com/\nSigned-off-by: Kuba Piecuch \u003cjpiecuch@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "dca922e019dd758b4c1b4bec8f1d509efddeaab4", "tree": "7403100f30823d1e2df21c9624b748c5ff17f29e", "parents": [ "3b3bea6d4b9c162f9e555905d96b8c1da67ecd5b", "24daca4fc07f3ff8cd0e3f629cd982187f48436a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 18:36:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 18:36:47 2026 -0700" }, "message": "Merge tag \u0027xsa48x-7.1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n \"XSA-485 and XSA-487 security patches\"\n\n* tag \u0027xsa48x-7.1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n xen/privcmd: fix double free via VMA splitting\n Buffer overflow in drivers/xen/sys-hypervisor.c\n" }, { "commit": "3b3bea6d4b9c162f9e555905d96b8c1da67ecd5b", "tree": "284f9fe4fdf9c12ed32588a5f42f0c1efcb507c1", "parents": [ "a1a671092d29455a890af272f0702925adafdf59", "981cd338614c96070cf9854679014fd027c1fb1d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:51:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:51:27 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - Fix UAF race in psi pressure_write() against cgroup file release by\n extending cgroup_mutex coverage and ordering of-\u003epriv access after\n cgroup_kn_lock_live()\n\n - Fix integer overflow in rdmacg_try_charge() when usage equals INT_MAX\n by performing the increment in s64\n\n - Fix asymmetric DL bandwidth accounting on cpuset attach rollback by\n recording the CPU used by dl_bw_alloc() so cancel_attach() returns\n the reservation to the same root domain\n\n - Fix nr_dying_subsys_* race that briefly showed 0 in cgroup.stat after\n rmdir by incrementing from kill_css() instead of offline_css()\n\n - Typo fix in cgroup-v2 documentation\n\n* tag \u0027cgroup-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n docs: cgroup: fix typo \u0027protetion\u0027 -\u003e \u0027protection\u0027\n cgroup: Increment nr_dying_subsys_* from rmdir context\n cgroup/cpuset: record DL BW alloc CPU for attach rollback\n cgroup/rdma: fix integer overflow in rdmacg_try_charge()\n sched/psi: fix race between file release and pressure write\n" }, { "commit": "a1a671092d29455a890af272f0702925adafdf59", "tree": "fc1828033e3f452fd617ab38dd0789f34559cf45", "parents": [ "53b6156308e5ec9f4440e7cd3e84c6d1775167b1", "13917f71a95a6ee6132ecb9a544cd5bc7197c68d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:45:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:45:39 2026 -0700" }, "message": "Merge tag \u0027fs_for_v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull isofs and udf fixes from Jan Kara:\n \"Several isofs and udf fixes\"\n\n* tag \u0027fs_for_v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n docs: isofs: replace dead ECMA-119 FTP link\n udf: reject descriptors with oversized CRC length\n isofs: use QSTR_LEN() in isofs_cmp\n isofs: validate block number from NFS file handle in isofs_export_iget\n isofs: validate Rock Ridge CE continuation extent against volume size\n" }, { "commit": "53b6156308e5ec9f4440e7cd3e84c6d1775167b1", "tree": "ebd57aa06c99f98c30d46542b0054bf51ed4ec38", "parents": [ "73082fbdb10aba317e8469f51e3411814f2e65b4", "4aca914ac152f5d055ddcb36704d1e539ac08977" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:40:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:40:24 2026 -0700" }, "message": "Merge tag \u0027fsnotify_for_v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fixes from Jan Kara:\n \"Three fixes for fsnotify / fanotify\"\n\n* tag \u0027fsnotify_for_v7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n fsnotify: fix inode reference leak in fsnotify_recalc_mask()\n fanotify: Fix spelling mistake \"enforecement\" -\u003e \"enforcement\"\n fanotify: fix false positive on permission events\n" }, { "commit": "73082fbdb10aba317e8469f51e3411814f2e65b4", "tree": "66967b8113abd95a7cce98c4419443f2b08c94e1", "parents": [ "d762a96e3dc2c82b551f0cc3506e89c904880cf9", "82323b1a7088b7a5c3e528a5d634bff447fa286f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:35:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:35:44 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - space reservation fixes:\n - correctly undo \u0027may_use\u0027 accounting for remap tree\n - avoid double decrement of \u0027may_use\u0027 when submitting async io\n\n - actually enable the shutdown ioctl callback (not just the superblock\n ops)\n\n - raid stripe tree fixes when deleting extents\n - add missing error handling\n - fix various incorrect values set\n\n - fix transaction state when removing a directory, possibly leading to\n EIO during log replay\n\n - additional b-tree node key checks during metadata readahead\n\n - error handling and transaction abort updates\n\n* tag \u0027for-7.1-rc1-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()\n btrfs: check return value of btrfs_partially_delete_raid_extent()\n btrfs: handle -EAGAIN from btrfs_duplicate_item and refresh stale leaf pointer\n btrfs: replace ASSERT with proper error handling in stripe lookup fallback\n btrfs: fix wrong min_objectid in btrfs_previous_item() call\n btrfs: fix raid stripe search missing entries at leaf boundaries\n btrfs: copy devid in btrfs_partially_delete_raid_extent()\n btrfs: handle unexpected free-space-tree key types\n btrfs: fix missing last_unlink_trans update when removing a directory\n btrfs: don\u0027t clobber errors in add_remap_tree_entries()\n btrfs: enable shutdown ioctl for non-experimental builds\n btrfs: apply first key check for readahead when possible\n btrfs: abort transaction in do_remap_reloc_trans() on failure\n btrfs: fix bytes_may_use leak in do_remap_reloc_trans()\n btrfs: fix bytes_may_use leak in move_existing_remap()\n" }, { "commit": "d762a96e3dc2c82b551f0cc3506e89c904880cf9", "tree": "190c1337c587d2872f2452fb8d2cc9db6fe0b22b", "parents": [ "a7cc308da5f78eee8d94bf666c026671a180d7e5", "09a65adc7d8bbfce06392cb6d375468e2728ead5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:33:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 16:33:23 2026 -0700" }, "message": "Merge tag \u0027for-7.1/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fix from Mikulas Patocka:\n\n - fix metadata corruption in dm-thin\n\n* tag \u0027for-7.1/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm-thin: fix metadata refcount underflow\n" }, { "commit": "a7cc308da5f78eee8d94bf666c026671a180d7e5", "tree": "52360ffaa437d0337c4c9539e106e074bf4d2d96", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731", "6e937f4e769e60947909e3525965f0137b9039e8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 15:21:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 27 15:21:18 2026 -0700" }, "message": "Merge tag \u0027mailbox-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox\n\nPull mailbox updates from Jassi Brar:\n\n - core: fix NULL message handling and add API to query TX queue slots\n\n - test: resolve concurrency bugs, dangling IRQs, and memory leaks\n\n - dt-bindings: qcom: add Eliza IPCC\n\n - mtk: fix address calculation and pointer handling bugs\n\n - cix: resolve SCMI suspend timeouts\n\n - misc memory allocation optimizations and cleanups\n\n* tag \u0027mailbox-v7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:\n mailbox: mailbox-test: make data_ready a per-instance variable\n mailbox: mailbox-test: initialize struct earlier\n mailbox: mailbox-test: don\u0027t free the reused channel\n mailbox: mailbox-test: handle channel errors consistently\n mailbox: update kdoc for struct mbox_controller\n mailbox: add sanity check for channel array\n mailbox: mailbox-test: free channels on probe error\n mailbox: prefix new constants with MBOX_\n dt-bindings: mailbox: qcom-ipcc: Document the Eliza Inter-Processor Communication Controller\n mailbox: cix: Add IRQF_NO_SUSPEND to mailbox interrupt\n mailbox: Fix NULL message support in mbox_send_message()\n mailbox: remove superfluous internal header\n mailbox: correct kdoc title for mbox_bind_client\n mailbox: test: really ignore optional memory resources\n mailbox: exynos: drop superfluous mbox setting per channel\n mailbox: mtk-cmdq: Fix CURR and END addr for task insert case\n mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()\n mailbox: hi6220: kzalloc + kcalloc to kzalloc\n mailbox: rockchip: kzalloc + kcalloc to kzalloc\n mailbox: add API to query available TX queue slots\n" }, { "commit": "981cd338614c96070cf9854679014fd027c1fb1d", "tree": "d6a6e3633d42e4ec3b61e1ed48cee16851f5fd26", "parents": [ "13e786b64bd3fd81c7eb22aa32bf8305c32f2ccf" ], "author": { "name": "Petr Vaněk", "email": "arkamar@atlas.cz", "time": "Sat Apr 25 10:03:54 2026 +0200" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Apr 27 07:55:40 2026 -1000" }, "message": "docs: cgroup: fix typo \u0027protetion\u0027 -\u003e \u0027protection\u0027\n\nFix a small typo in the description of the memory_hugetlb_accounting\nmount option.\n\nSigned-off-by: Petr Vaněk \u003carkamar@atlas.cz\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "13917f71a95a6ee6132ecb9a544cd5bc7197c68d", "tree": "31c7df708ffb97caaf997eae08835f9c05a808e4", "parents": [ "55d41b0a20128e86b9e960dd2e3f0a2d69a18df7" ], "author": { "name": "Ziran Zhang", "email": "zhangcoder@yeah.net", "time": "Sat Apr 25 22:29:43 2026 +0800" }, "committer": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Apr 27 12:58:07 2026 +0200" }, "message": "docs: isofs: replace dead ECMA-119 FTP link\n\nThe original link is no longer valid. Replace it with the official\nPDF of the 2nd edition. The new link points to the exact 2nd edition\nthat the existing comment in isofs.rst refers to.\n\nSigned-off-by: Ziran Zhang \u003czhangcoder@yeah.net\u003e\nLink: https://patch.msgid.link/20260425142943.6809-1-zhangcoder@yeah.net\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n" }, { "commit": "39f1c201b93f4ff71631bac72cff6eb155f976a4", "tree": "f90db9f427fa7a64674f3edfcf23739e9a2b6593", "parents": [ "909eac682c984c3cb02485d5950c2a8d573c1667", "dfd2a8b07c6cc94145e11d87d2f11137d6444854" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Mon Apr 27 04:24:41 2026 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Mon Apr 27 04:24:41 2026 -0400" }, "message": "Merge tag \u0027kvm-x86-selftests_kernel_types-7.1\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM selftests type renames for 7.1\n\nRenames types across all KVM selftests to more closely align with types used\nin the kernel:\n\n vm_vaddr_t -\u003e gva_t\n vm_paddr_t -\u003e gpa_t\n\n uint64_t -\u003e u64\n uint32_t -\u003e u32\n uint16_t -\u003e u16\n uint8_t -\u003e u8\n\n int64_t -\u003e s64\n int32_t -\u003e s32\n int16_t -\u003e s16\n int8_t -\u003e s8\n\nUsing the kernel\u0027s preferred types eliminates a source of friction for many\ncontributors, as the majority of KVM selftests contributions come from kernel\ndevelopers. The kernel names are also shorter, which allows for more concise\ncode, and in any many cases eliminates newlines thanks to shorter types and\nparameter names.\n\nRename variables and parameters as well as types, e.g. gpa instead of paddr,\nto again align with the kernel, and in a few cases to remove ambiguity, e.g.\nwhere paddr is used to refer to a _host_ physical address.\n" }, { "commit": "909eac682c984c3cb02485d5950c2a8d573c1667", "tree": "87c3b8f221ff4b5dfd2e8658a532a26a7234078c", "parents": [ "1101baca98669833fb3ad2dcd24bc06f9e70e66b", "4ce98bf0865c349e7026ad9c14f48da264920953" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Mon Apr 27 04:24:34 2026 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Mon Apr 27 04:24:34 2026 -0400" }, "message": "Merge tag \u0027kvmarm-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.1, take #1\n\n- Allow tracing for non-pKVM, which was accidentally disabled when\n the series was merged\n\n- Rationalise the way the pKVM hypercall ranges are defined by using\n the same mechanism as already used for the vcpu_sysreg enum\n\n- Enforce that SMCCC function numbers relayed by the pKVM proxy are\n actually compliant with the specification\n\n- Fix a couple of feature to idreg mappings which resulted in the\n wrong sanitisation being applied\n\n- Fix the GICD_IIDR revision number field that could never been\n written correctly by userspace\n\n- Make kvm_vcpu_initialized() correctly use its parameter instead\n of relying on the surrounding context\n\n- Enforce correct ordering in __pkvm_init_vcpu(), plugging a\n potential pin leak at the same time\n\n- Move __pkvm_init_finalise() to a less dangerous spot, avoiding\n future problems\n\n- Restore functional userspace irqchip support after a four year\n breakage (last functional kernel was 5.18...). This is obviously\n ripe for garbage collection.\n\n- ... and the usual lot of spelling fixes\n" }, { "commit": "1101baca98669833fb3ad2dcd24bc06f9e70e66b", "tree": "fec0797b507bb0cde367bc660787853e356d235f", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Mon Apr 20 12:26:44 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Mon Apr 27 04:23:17 2026 -0400" }, "message": "KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch\n\nDefine check_steal_time_uapi() for LoongArch so that the steal_time test\nbuilds. Note, while LoongArch\u0027s steal_time_init() has some funky asserts,\nnone of the code is uniquely verifying KVM\u0027s uAPI.\n\nCc: Jiakai Xu \u003cxujiakai2025@iscas.ac.cn\u003e\nCc: Jiakai Xu \u003cjiakaiPeanut@gmail.com\u003e\nCc: Andrew Jones \u003candrew.jones@oss.qualcomm.com\u003e\nCc: Anup Patel \u003canup@brainfault.org\u003e\nCc: Tianrui Zhao \u003czhaotianrui@loongson.cn\u003e\nCc: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nCc: Huacai Chen \u003cchenhuacai@kernel.org\u003e\nFixes: 40351ed924dd (\"KVM: selftests: Refactor UAPI tests into dedicated function\")\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260420192644.3892050-1-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "254f49634ee16a731174d2ae34bc50bd5f45e731", "tree": "85d458ac0d767dfd837e09fce9cbf96186955475", "parents": [ "14479877c1ec9667edb4a7c20a8d7a704e7249ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:19:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:19:00 2026 -0700" }, "message": "Linux 7.1-rc1\n" }, { "commit": "14479877c1ec9667edb4a7c20a8d7a704e7249ca", "tree": "5c90898ad7fd03b7d0164bcde816bd25c1e51c79", "parents": [ "20b64cf8705a0f6268bb9a320eb6b4c425f3ec6c", "522567362b634015ca85b5460482ee0843feb105" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:03:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 14:03:20 2026 -0700" }, "message": "Merge tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux\n\nPull clk fix from Stephen Boyd:\n \"One more fix for the merge window to avoid a boot hang on\n Raspberry Pi 3B by marking the VEC clk critical so that it\n doesn\u0027t get turned off and hang the bus\"\n\n* tag \u0027clk-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:\n clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED\n" }, { "commit": "20b64cf8705a0f6268bb9a320eb6b4c425f3ec6c", "tree": "6e55fdd6b6bfc4efe61d061cca785890663ba769", "parents": [ "b935117fe6d1af576e39b1f18c9e875f44bd146f", "3177779ae17db4c66c851f799505fb95c7530c03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 09:51:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Apr 26 09:51:29 2026 -0700" }, "message": "Merge tag \u0027tsm-for-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm\n\nPull PCIe TSP update from Dan Williams:\n \"A small update for the TSM core. It is arguably a fix and coming in\n late as I have been offline the past few weeks:\n\n - Drop class_create() for the \u0027tsm\u0027 class\"\n\n* tag \u0027tsm-for-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:\n virt: coco: change tsm_class to a const struct\n" }, { "commit": "b935117fe6d1af576e39b1f18c9e875f44bd146f", "tree": "1da88d9f76fcf4a130f93657dbe79f16e7959968", "parents": [ "2ff1bc41ef9133a52c116b36e5e88430353a8ba5", "75f7c47ccd78c947cf1b6ddb18ea453ff0555716" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 17:04:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 17:04:15 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nicolas Schier:\n\n - builddeb - avoid recompiles for non-cross-compiles\n\n Avoid triggering complete rebuilds for non-cross-compile Debian\n package builds by only triggering the rebuild of host tools for\n actual cross-compile builds\n\n - Never respect CONFIG_WERROR / W\u003de to fixdep\n\n Avoid spurious rebuilds of fixdep w/ and w/o -Werror during a single\n kbuild invocation by never respecting CONFIG_WERROR for fixdep\n\n* tag \u0027kbuild-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n kbuild: Never respect CONFIG_WERROR / W\u003de to fixdep\n kbuild: builddeb - avoid recompiles for non-cross-compiles\n" }, { "commit": "2ff1bc41ef9133a52c116b36e5e88430353a8ba5", "tree": "b996f0b1396f6300f50afa1703b54ec4f4c249bb", "parents": [ "211d5933141197b37a7501271e49e4b88540615f", "6112da1ea4a7cfac35e51a20d17ca9cdf946c368" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:58:34 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:58:34 2026 -0700" }, "message": "Merge tag \u0027power-utilities-2026.04.25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux\n\nPull power utility updates from Len Brown:\n \"x86_energy_perf_policy:\n - Initial SoC Slider support\n\n turbostat:\n - Display HT siblings in cpu# order\n - Add Module-ID column\n - Print Core-ID and APIC-ID in hex\n - Fix misc bugs\"\n\n* tag \u0027power-utilities-2026.04.25\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:\n tools/power x86_energy_perf_policy: Version 2026.04.25\n tools/power x86_energy_perf_policy.8: Document SoC Slider Options\n tools/power x86_energy_perf_policy: Enhances SoC Slider related checks\n tools/power turbostat: v2026.04.21\n tools/power turbostat: Process HT siblings in CPU order\n tools/power turbostat: Show module_id column\n tools/power turbostat: Print core_id and apic_id in hex\n tools/power turbostat: Cleanup print helper functions\n tools/power turbostat: Fix --cpu-set 1 regression on HT systems\n tools/power turbostat: Fix --cpu-set 0 regression on HT systems\n tools/power turbostat: Fix unrecognized option \u0027-P\u0027\n tools/power turbostat: Fix AMD RAPL regression on big systems\n tools/power/x86: Add SOC slider and platform profile support\n" }, { "commit": "211d5933141197b37a7501271e49e4b88540615f", "tree": "010d7ae0a4ac4aeda99bebefc4c0194551613424", "parents": [ "1d9f1b5e4374c6b40df1a56b35901312ec98c9af", "0fedce7244e4b85c049ce579c87e298a1b0b811d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:39:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:39:03 2026 -0700" }, "message": "Merge tag \u0027rtc-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC updates from Alexandre Belloni:\n \"Subsystem:\n - add data_race() in rtc_dev_poll()\n\n Drivers:\n - remove i2c_match_id usage\n - abx80x: Disable alarm feature if no interrupt attached\n - ti-k3: support resuming from IO DDR low power mode\"\n\n* tag \u0027rtc-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n rtc: abx80x: Disable alarm feature if no interrupt attached\n rtc: ntxec: fix OF node reference imbalance\n rtc: pic32: allow driver to be compiled with COMPILE_TEST\n rtc: ti-k3: Add support to resume from IO DDR low power mode\n rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe()\n dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc\n dt-bindings: rtc: sc2731: Add compatible for SC2730\n rtc: add data_race() in rtc_dev_poll()\n rtc: armada38x: zalloc + calloc to single allocation\n dt-bindings: rtc: isl12026: convert to YAML schema\n dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply\n rtc: max77686: convert to i2c_new_ancillary_device\n dt-bindings: rtc: mpfs-rtc: permit resets\n rtc: rx8025: Remove use of i2c_match_id()\n rtc: rv8803: Remove use of i2c_match_id()\n rtc: rs5c372: Remove use of i2c_match_id()\n rtc: pcf2127: Remove use of i2c_match_id()\n rtc: m41t80: Remove use of i2c_match_id()\n rtc: abx80x: Remove use of i2c_match_id()\n" }, { "commit": "1d9f1b5e4374c6b40df1a56b35901312ec98c9af", "tree": "d4619174e5c8572a61a0d3b103abd776bb509a29", "parents": [ "897d54018cc9aa97fd1529ca08a53b429d05a566", "949692da7211572fac419b2986b6abc0cd1aeb76" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:20:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 16:20:52 2026 -0700" }, "message": "Merge tag \u0027for-next-tpm-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull tpm updates from Jarkko Sakkinen:\n \"Here are the accumulated fixes for 7.1-rc1 and a single structural\n change worth mentioning separately: Rafael\u0027s commit converting tpm_crb\n from ACPI driver to a platform driver\"\n\n* tag \u0027for-next-tpm-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm: tpm_tis: stop transmit if retries are exhausted\n tpm: tpm_tis: add error logging for data transfer\n tpm: avoid -Wunused-but-set-variable\n tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()\n tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()\n tpm: Fix auth session leak in tpm2_get_random() error path\n tpm: i2c: atmel: fix block comment formatting\n tpm_crb: Convert ACPI driver to a platform one\n tpm: Make tcpci_pm_ops variable static const\n" }, { "commit": "6112da1ea4a7cfac35e51a20d17ca9cdf946c368", "tree": "6911677516ff9b9f380e363762a648b7890b3fe8", "parents": [ "b488997b9cb006e175908b70fc0a2f3601a763d1", "f1c35c73191b7d23ed4bbc660a7b9ed5b32614e0" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:26:32 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:26:32 2026 -0400" }, "message": "Merge branches \u0027turbostat\u0027 and \u0027x86_energy_perf_policy\u0027 into power-utilities\n" }, { "commit": "f1c35c73191b7d23ed4bbc660a7b9ed5b32614e0", "tree": "193af4b6b1059c628898d654c6bca19453d07e20", "parents": [ "18c5b9ea4ea4be5ed9b5b6add30a2a7911326224" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 13:26:16 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:18:45 2026 -0400" }, "message": "tools/power x86_energy_perf_policy: Version 2026.04.25\n\nSince v2025.11.22:\n\tInitial SoC Slider support\n\tSoC Slider is an SoC-wide power/performance policy setting.\n\tOn SoC Slider systems, EPP plays a diminished role.\n\nWhitespace cleanup via: indent -npro -kr -i8 -ts8 -sob -l160 -ss -ncs -cp1\n\nNo functional changes\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "18c5b9ea4ea4be5ed9b5b6add30a2a7911326224", "tree": "b164c15492eca81b874bb7463ea44b3ffc58ed75", "parents": [ "25ff5848c05bc660739089cf9c6de4a166bd7932" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 12:10:54 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:16:53 2026 -0400" }, "message": "tools/power x86_energy_perf_policy.8: Document SoC Slider Options\n\nx86_energy_perf_policy accesses the SoC Slider via standard\nuser/kernel APIs to the processor_thermal_soc_slider driver.\n\nMachines that support SoC Slider largely use it instead of EPP,\nwhich may continue to exist in a diminished role, or vanish entirely.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "25ff5848c05bc660739089cf9c6de4a166bd7932", "tree": "917afde8bd56248fc3aba561a6302061138407be", "parents": [ "feffac1874820d501e51cd8dcee697063b792c82" ], "author": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Wed Apr 15 15:12:29 2026 -0400" }, "committer": { "name": "Len Brown", "email": "len.brown@intel.com", "time": "Sat Apr 25 14:10:13 2026 -0400" }, "message": "tools/power x86_energy_perf_policy: Enhances SoC Slider related checks\n\nWhen processor_thermal_soc_slider is loaded, its slider\nand offset modparams are visible. Check that the driver\nactually registered the profile named \"SoC Slider\" before\nreading or writing these modparams.\n\nn.b. This utility allows writing the Slider and Offset modparams\neven if the driver policy is not \"balanced\". Currently the\nprocessor_thermal_soc_slider consults those modparams\nonly in \"balanced\" mode.\n\nSigned-off-by: Len Brown \u003clen.brown@intel.com\u003e\n" }, { "commit": "522567362b634015ca85b5460482ee0843feb105", "tree": "6b85f36328e4c3b3a196c2077184e6f273b76ad7", "parents": [ "6b701fde9b31f085f39fc2a371cb33212fab6f68" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Apr 24 16:34:52 2026 +0100" }, "committer": { "name": "Stephen Boyd", "email": "sboyd@kernel.org", "time": "Sat Apr 25 10:51:23 2026 -0700" }, "message": "clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED\n\nOn Raspberry Pi 3B, the VEC clock is used by the VideoCore firmware\ndisplay driver, which remains active until the vc4 driver loads and\nsends NOTIFY_DISPLAY_DONE. If this clock is disabled during boot, a bus\nlockup happens and the firmware becomes unresponsive, causing a complete\nsystem lockup.\n\nMark the VEC clock with CLK_IGNORE_UNUSED so it survives the unused\nclock disablement and remains available until the vc4 driver takes over\ndisplay management.\n\nFixes: 672299736af6 (\"clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks\")\nReported-by: Mark Brown \u003cbroonie@kernel.org\u003e\nCloses: https://lore.kernel.org/r/5f0bec08-f458-4fba-8bf3-06817a100c4c@sirena.org.uk\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nLink: https://patch.msgid.link/20260401111416.562279-2-mcanal@igalia.com\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nAcked-by: Brian Masney \u003cbmasney@redhat.com\u003e # Active contributor to clk\nReviewed-by: Stefan Wahren \u003cwahrenst@gmx.net\u003e\nSigned-off-by: Stephen Boyd \u003csboyd@kernel.org\u003e\n" }, { "commit": "897d54018cc9aa97fd1529ca08a53b429d05a566", "tree": "82a5c1195638ccdfafab23fb6e6c402646c02a12", "parents": [ "129d6eb266e0848c9bf45da6e30291688c12b5ad", "448aaf54d3ae1b73dfcf723c9f8a02c2116f3358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:48:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:48:33 2026 -0700" }, "message": "Merge tag \u0027fbdev-for-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev fixes from Helge Deller:\n\n - request memory region before use (cobalt_lcdfb, clps711x-fb, hgafb)\n\n - reference cleanups in failure path (offb, savage)\n\n - a spelling fix (atyfb)\n\n* tag \u0027fbdev-for-7.1-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: hgafb: Request memory region before ioremap\n fbdev: clps711x-fb: Request memory region for MMIO\n fbdev: cobalt_lcdfb: Request memory region\n fbdev: atyfb: Fix spelling mistake \"enfore\" -\u003e \"enforce\"\n fbdev: savage: fix probe-path EDID cleanup leaks\n fbdev: offb: fix PCI device reference leak on probe failure\n" }, { "commit": "129d6eb266e0848c9bf45da6e30291688c12b5ad", "tree": "6709cec6768c96c3f7da2d248f7fdf9b55f62271", "parents": [ "27d128c1cff64c3b8012cc56dd5a1391bb4f1821", "c6e61c06d6061750597e79c598acb5dead44c35b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:44:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 25 07:44:26 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM updates from Russell King:\n\n - fix a race condition handling PG_dcache_clean\n\n - further cleanups for the fault handling, allowing RT to be enabled\n\n - fixing nzones validation in adfs filesystem driver\n\n - fix for module unwinding\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9463/1: Allow to enable RT\n ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()\n ARM: 9471/1: module: fix unwind section relocation out of range error\n fs/adfs: validate nzones in adfs_validate_bblk()\n ARM: provide individual is_translation_fault() and is_permission_fault()\n ARM: move FSR fault status definitions before fsr_fs()\n ARM: use BIT() and GENMASK() for fault status register fields\n ARM: move is_permission_fault() and is_translation_fault() to fault.h\n ARM: move vmalloc() lazy-page table population\n ARM: ensure interrupts are enabled in __do_user_fault()\n" }, { "commit": "deb7b2f93d0129b79425f830a1e5e7e1bb2c4973", "tree": "d9acfc2d936b8c30f94e7fb9bc6ab2ee1b0b8edc", "parents": [ "05b4a9a9bc37f1fa289a8f07b4fbfc3ae681b650" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable\n\nscx_root_enable_workfn() takes cpus_read_lock() before\nscx_link_sched(sch), but the `if (ret) goto err_disable` on failure\nskips the matching cpus_read_unlock() - all other err_disable gotos\nalong this path drop the lock first.\n\nscx_link_sched() only returns non-zero on the sub-sched path\n(parent !\u003d NULL), so the leak path is unreachable via the root\ncaller today. Still, the unwind is out of line with the surrounding\npaths.\n\nDrop cpus_read_lock() before goto err_disable.\n\nv2: Correct Fixes: tag (Andrea Righi).\n\nFixes: 25037af712eb (\"sched_ext: Add rhashtable lookup for sub-schedulers\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "05b4a9a9bc37f1fa289a8f07b4fbfc3ae681b650", "tree": "102d45a21e497d38a3d30e362c7bffe77449ca27", "parents": [ "ea7c716a24aebe887e0990649ab697bd698cc325" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime\n\nscx_prog_sched(aux) returns NULL for TRACING / SYSCALL BPF progs that\nhave no struct_ops association when the root scheduler has sub_attach\nset. scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() pass\nthat NULL into scx_task_on_sched(sch, p), which under\nCONFIG_EXT_SUB_SCHED is rcu_access_pointer(p-\u003escx.sched) \u003d\u003d sch. For\nany non-scx task p-\u003escx.sched is NULL, so NULL \u003d\u003d NULL returns true\nand the authority gate is bypassed - a privileged but\nnon-struct_ops-associated prog can poke p-\u003escx.slice /\np-\u003escx.dsq_vtime on arbitrary tasks.\n\nReject !sch up front so the gate only admits callers with a resolved\nscheduler.\n\nFixes: 245d09c594ea (\"sched_ext: Enforce scheduler ownership when updating slice and dsq_vtime\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "ea7c716a24aebe887e0990649ab697bd698cc325", "tree": "8df8dfc682cc2c173f579a737dec1b3933a1c956", "parents": [ "c0e8ddc76d54402171787414b1b8eb387812f1f6" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Refuse cross-task select_cpu_from_kfunc calls\n\nselect_cpu_from_kfunc() skipped pi_lock for @p when called from\nops.select_cpu() or another rq-locked SCX op, assuming the held lock\nprotects @p. scx_bpf_select_cpu_dfl() / __scx_bpf_select_cpu_and() accept an\narbitrary KF_RCU task_struct, so a caller in e.g. ops.select_cpu(p1) or\nops.enqueue(p1) can pass some other p2 - the held pi_lock / rq lock is p1\u0027s,\nnot p2\u0027s - and reading p2-\u003ecpus_ptr / nr_cpus_allowed races with\nset_cpus_allowed_ptr() and migrate_disable_switch() on another CPU.\n\nAbort the scheduler on cross-task calls in both branches: for\nops.select_cpu() use scx_kf_arg_task_ok() to verify @p is the wake-up\ntask recorded in current-\u003escx.kf_tasks[] by SCX_CALL_OP_TASK_RET();\nfor other rq-locked SCX ops compare task_rq(p) against scx_locked_rq().\n\nv2: Switch the in_select_cpu cross-task check from direct_dispatch_task\n comparison to scx_kf_arg_task_ok(). The former spuriously rejects when\n ops.select_cpu() calls scx_bpf_dsq_insert() first, then calls\n scx_bpf_select_cpu_*() on the same task. (Andrea Righi)\n\nFixes: 0022b328504d (\"sched_ext: Decouple kfunc unlocked-context check from kf_mask\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "c0e8ddc76d54402171787414b1b8eb387812f1f6", "tree": "b6bcacd11c46483ba151f3cbf6e157882f26da5d", "parents": [ "d292aa00de1aea72961f94c0db43f6b5c72684c9" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED\n\nTwo EXT_GROUP_SCHED/SUB_SCHED guards are misclassified:\n\n- scx_root_enable_workfn()\u0027s cgroup_get(cgrp) and the err_put_cgrp unwind\n in scx_alloc_and_add_sched() are under `#if GROUP || SUB`, but the\n matching cgroup_put() in scx_sched_free_rcu_work() is inside `#ifdef SUB`\n only (via sch-\u003ecgrp, stored only under SUB). GROUP-only would leak a\n reference on every root-sched enable.\n\n- sch_cgroup() / set_cgroup_sched() live under `#if GROUP || SUB` but touch\n SUB-only fields (sch-\u003ecgrp, cgroup-\u003escx_sched). GROUP-only wouldn\u0027t\n compile.\n\nGROUP needs CGROUP_SCHED; SUB needs only CGROUPS. CGROUPS\u003dy/CGROUP_SCHED\u003dn\ngives the reachable GROUP\u003dn, SUB\u003dy combination; GROUP\u003dy, SUB\u003dn isn\u0027t\nreachable today (SUB is def_bool y under CGROUPS). Neither miscategorization\ntriggers a real bug in any reachable config, but keep the guards honest:\n\n- Narrow cgroup_get and err_put_cgrp to `#ifdef SUB` (matches the free-side\n put).\n- Move sch_cgroup() and set_cgroup_sched() to a separate `#ifdef SUB` block\n with no-op stubs for the !SUB case; keep root_cgroup() and scx_cgroup_{\n lock,unlock}() under `#if GROUP || SUB` since those only need cgroup core.\n\nFixes: ebeca1f930ea (\"sched_ext: Introduce cgroup sub-sched support\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "d292aa00de1aea72961f94c0db43f6b5c72684c9", "tree": "05cc41ddda26a0aeea1e3c6729d5a7851c9a32b8", "parents": [ "4155fb489fa175ec74eedde7d02219cf2fe74303" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Make bypass LB cpumasks per-scheduler\n\nscx_bypass_lb_{donee,resched}_cpumask were file-scope statics shared by all\nscheduler instances. With CONFIG_EXT_SUB_SCHED, multiple sched instances\neach arm their own bypass_lb_timer; concurrent bypass_lb_node() calls RMW\nthe global cpumasks with no lock, corrupting donee/resched decisions.\n\nMove the cpumasks into struct scx_sched, allocate them alongside the timer\nin scx_alloc_and_add_sched(), free them in scx_sched_free_rcu_work().\n\nFixes: 95d1df610cdc (\"sched_ext: Implement load balancer for bypass mode\")\nCc: stable@vger.kernel.org # v6.19+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "4155fb489fa175ec74eedde7d02219cf2fe74303", "tree": "f6450db0bcd577141990272cf3eb0887e4786f3e", "parents": [ "207d76a372fb1bb324eadc8cb5bcaa0a8da7cefd" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before\n\nscx_prio_less() runs from core-sched\u0027s pick_next_task() path with rq\nlocked but invokes ops.core_sched_before() with NULL locked_rq, leaving\nscx_locked_rq_state NULL. If the BPF callback calls a kfunc that\nre-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu)\n- it re-acquires the already-held rq.\n\nPass task_rq(a).\n\nFixes: 7b0888b7cc19 (\"sched_ext: Implement core-sched support\")\nCc: stable@vger.kernel.org # v6.12+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "207d76a372fb1bb324eadc8cb5bcaa0a8da7cefd", "tree": "829c04fa70360042cae90f67778b6b5362e16e83", "parents": [ "7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task\n\nscx_dump_state() walks CPUs with rq_lock_irqsave() held and invokes\nops.dump_cpu / ops.dump_task with NULL locked_rq, leaving\nscx_locked_rq_state NULL. If the BPF callback calls a kfunc that\nre-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu)\n- it re-acquires the already-held rq.\n\nPass the held rq to SCX_CALL_OP(). Thread it into scx_dump_task() too.\nThe pre-loop ops.dump call runs before rq_lock_irqsave() so keeps\nrq\u003dNULL.\n\nFixes: 07814a9439a3 (\"sched_ext: Print debug dump after an error exit\")\nCc: stable@vger.kernel.org # v6.12+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "7fb39e4eb4c3db52e4707a6a1cd45362f7e803f5", "tree": "f651e0c7f74c9d3a19458672ee8e8d255e400e9e", "parents": [ "2f2ea77092660b53bfcbc4acc590b57ce9ab5dce" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:36 2026 -1000" }, "message": "sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP\n\nSCX_CALL_OP{,_RET}() unconditionally clears scx_locked_rq_state to NULL on\nexit. Correct at the top level, but ops can recurse via\nscx_bpf_sub_dispatch(): a parent\u0027s ops.dispatch calls the helper, which\ninvokes the child\u0027s ops.dispatch under another SCX_CALL_OP. When the inner\ncall returns, the NULL clobbers the outer\u0027s state. The parent\u0027s BPF then\ncalls kfuncs like scx_bpf_cpuperf_set() which read scx_locked_rq()\u003d\u003dNULL and\nre-acquire the already-held rq.\n\nSnapshot scx_locked_rq_state on entry and restore on exit. Rename the rq\nparameter to locked_rq across all SCX_CALL_OP* macros so the snapshot local\ncan be typed as \u0027struct rq *\u0027 without colliding with the parameter token in\nthe expansion. SCX_CALL_OP_TASK{,_RET}() and SCX_CALL_OP_2TASKS_RET() funnel\nthrough the two base macros and inherit the fix.\n\nFixes: 4f8b122848db (\"sched_ext: Add basic building blocks for nested sub-scheduler dispatching\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "2f2ea77092660b53bfcbc4acc590b57ce9ab5dce", "tree": "78a52bc8f01ee978a3ef70997f763815b3836c0d", "parents": [ "cc2a387d330d1fc51a9b7f211a7e5d39c9f0ab94" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Use dsq-\u003efirst_task instead of list_empty() in dispatch_enqueue() FIFO-tail\n\ndispatch_enqueue()\u0027s FIFO-tail path used list_empty(\u0026dsq-\u003elist) to decide\nwhether to set dsq-\u003efirst_task on enqueue. dsq-\u003elist can contain parked BPF\niterator cursors (SCX_DSQ_LNODE_ITER_CURSOR), so list_empty() is not a\nreliable \"no real task\" check. If the last real task is unlinked while a\ncursor is parked, first_task becomes NULL; the next FIFO-tail enqueue then\nsees list_empty() \u003d\u003d false and skips the first_task update, leaving\nscx_bpf_dsq_peek() returning NULL for a non-empty DSQ.\n\nTest dsq-\u003efirst_task directly, which already tracks only real tasks and is\nmaintained under dsq-\u003elock.\n\nFixes: 44f5c8ec5b9a (\"sched_ext: Add lockless peek operation for DSQs\")\nCc: stable@vger.kernel.org # v6.19+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nCc: Ryan Newton \u003cnewton@meta.com\u003e\n" }, { "commit": "cc2a387d330d1fc51a9b7f211a7e5d39c9f0ab94", "tree": "d1519dfa16225a67d358b075ee90400620045477", "parents": [ "80afd4c84bc8f5e80145ce35279f5ce53f6043db" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Resolve caller\u0027s scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued()\n\nscx_bpf_create_dsq() resolves the calling scheduler via scx_prog_sched(aux)\nand inserts the new DSQ into that scheduler\u0027s dsq_hash. Its inverse\nscx_bpf_destroy_dsq() and the query helper scx_bpf_dsq_nr_queued() were\nhard-coded to rcu_dereference(scx_root), so a sub-scheduler could only\ndestroy or query DSQs in the root scheduler\u0027s hash - never its own. If the\nroot had a DSQ with the same id, the sub-sched silently destroyed it and the\nroot aborted on the next dispatch (\"invalid DSQ ID 0x0..\").\n\nTake a const struct bpf_prog_aux *aux via KF_IMPLICIT_ARGS and resolve the\nscheduler with scx_prog_sched(aux), matching scx_bpf_create_dsq().\n\nFixes: ebeca1f930ea (\"sched_ext: Introduce cgroup sub-sched support\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "80afd4c84bc8f5e80145ce35279f5ce53f6043db", "tree": "592c4cbb256355b680e5d5d4b30dc1c8a5f473a1", "parents": [ "21a5a97ba47842ef0c52d6c89e501dce27806550" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n\nscx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring\nscx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.\nIf the loaded scheduler is disabled and freed (via RCU work) and another is\nenabled between the naked load and the rwsem acquire, the reader sees\nscx_cgroup_enabled\u003dtrue (the new scheduler\u0027s) but dereferences the freed one\n- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).\n\nscx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write\n(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section\ncorrelates @sch with the enabled snapshot.\n\nFixes: a5bd6ba30b33 (\"sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations\")\nCc: stable@vger.kernel.org # v6.18+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "21a5a97ba47842ef0c52d6c89e501dce27806550", "tree": "b2a7e5575376c0eb1e4e7fbd3af971bd397723f4", "parents": [ "da2d81b4118a74e65d2335e221a38d665902a98c" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Don\u0027t disable tasks in scx_sub_enable_workfn() abort path\n\nscx_sub_enable_workfn()\u0027s prep loop calls __scx_init_task(sch, p, false)\nwithout transitioning task state, then sets SCX_TASK_SUB_INIT. If prep fails\npartway, the abort path runs __scx_disable_and_exit_task(sch, p) on the\nmarked tasks. Task state is still the parent\u0027s ENABLED, so that dispatches\nto the SCX_TASK_ENABLED arm and calls scx_disable_task(sch, p) - i.e.\nchild-\u003eops.disable() - for tasks on which child-\u003eops.enable() never ran. A\nBPF sub-scheduler allocating per-task state in enable/freeing in disable\nwould operate on uninitialized state.\n\nThe dying-task branch in scx_disable_and_exit_task() has the same problem,\nand scx_enabling_sub_sched was cleared before the abort cleanup loop - a\ntask exiting during cleanup tripped the WARN and skipped both ops.exit_task\nand the SCX_TASK_SUB_INIT clear, leaking per-task resources and leaving the\ntask stuck.\n\nIntroduce scx_sub_init_cancel_task() that calls ops.exit_task with\ncancelled\u003dtrue - matching what the top-level init path does when init_task\nitself returns -errno. Use it in the abort loop and in the dying-task\nbranch. scx_enabling_sub_sched now stays set until the abort loop finishes\nclearing SUB_INIT, so concurrent exits hitting the dying-task branch can\nstill find @sch. That branch also clears SCX_TASK_SUB_INIT unconditionally\nwhen seen, leaving the task unmarked even if the WARN fires.\n\nFixes: 337ec00b1d9c (\"sched_ext: Implement cgroup sub-sched enabling and disabling\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "da2d81b4118a74e65d2335e221a38d665902a98c", "tree": "a9200c1da08a6977a8c41f0872716898e1a67413", "parents": [ "4fda9f0e7c950da4fe03cedeb2ac818edf5d03e9" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()\n\nbypass_lb_cpu() transfers tasks between per-CPU bypass DSQs without\nmigrating them - task_cpu() only updates when the donee later consumes the\ntask via move_remote_task_to_local_dsq(). If the LB timer fires again before\nconsumption and the new DSQ becomes a donor, @p is still on the previous CPU\nand task_rq(@p) !\u003d donor_rq. @p can\u0027t be moved without its own rq locked.\n\nSkip such tasks.\n\nFixes: 95d1df610cdc (\"sched_ext: Implement load balancer for bypass mode\")\nCc: stable@vger.kernel.org # v6.19+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "4fda9f0e7c950da4fe03cedeb2ac818edf5d03e9", "tree": "cd1b6adff1970c12664671392d422a61712383b5", "parents": [ "411d3ef1a70589755e3beed2f5bf1f8aa0c27d1a" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Guard scx_dsq_move() against NULL kit-\u003edsq after failed iter_new\n\nbpf_iter_scx_dsq_new() clears kit-\u003edsq on failure and\nbpf_iter_scx_dsq_{next,destroy}() guard against that. scx_dsq_move() doesn\u0027t -\nit dereferences kit-\u003edsq immediately, so a BPF program that calls\nscx_bpf_dsq_move[_vtime]() after a failed iter_new oopses the kernel.\n\nReturn false if kit-\u003edsq is NULL.\n\nFixes: 4c30f5ce4f7a (\"sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq()\")\nCc: stable@vger.kernel.org # v6.12+\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "411d3ef1a70589755e3beed2f5bf1f8aa0c27d1a", "tree": "590aa364c20e5b794751e98b50490ba36f3efd89", "parents": [ "bd2d76455b65aab77652823919db128a8e585825" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:31:35 2026 -1000" }, "message": "sched_ext: Unregister sub_kset on scheduler disable\n\nWhen ops.sub_attach is set, scx_alloc_and_add_sched() creates sub_kset as a\nchild of \u0026sch-\u003ekobj, which pins the parent with its own reference. The\ndisable paths never call kset_unregister(), so the final kobject_put() in\nbpf_scx_unreg() leaves a stale reference and scx_kobj_release() never runs,\nleaking the whole struct scx_sched on every load/unload cycle.\n\nUnregister sub_kset in scx_root_disable() and scx_sub_disable() before\nkobject_del(\u0026sch-\u003ekobj).\n\nFixes: ebeca1f930ea (\"sched_ext: Introduce cgroup sub-sched support\")\nReported-by: Chris Mason \u003cclm@meta.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "bd2d76455b65aab77652823919db128a8e585825", "tree": "63a3a1290e9593c3200dad7fb538e3f2e9c9ba59", "parents": [ "510a27055446b8f0d29487ca8b8d2033dc2b6ca6" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 10:14:32 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 14:13:22 2026 -1000" }, "message": "sched_ext: Defer scx_hardlockup() out of NMI\n\nscx_hardlockup() runs from NMI and eventually calls scx_claim_exit(),\nwhich takes scx_sched_lock. scx_sched_lock isn\u0027t NMI-safe and grabbing\nit from NMI context can lead to deadlocks.\n\nThe hardlockup handler is best-effort recovery and the disable path it\ntriggers runs off of irq_work anyway. Move the handle_lockup() call into\nan irq_work so it runs in IRQ context.\n\nFixes: ebeca1f930ea (\"sched_ext: Introduce cgroup sub-sched support\")\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "27d128c1cff64c3b8012cc56dd5a1391bb4f1821", "tree": "4a4c32f9935f662e6141e663dde256152ea984ff", "parents": [ "f3e3dbcea15e20f7413afd8c791a496f0b80e80b", "92d5a606721f759ebebf448b3bd2b7a781d50bd0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:17:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:17:23 2026 -0700" }, "message": "Merge tag \u0027trace-ring-buffer-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fix from Steven Rostedt:\n\n - Fix accounting of persistent ring buffer rewind\n\n On boot up, the head page is moved back to the earliest point of the\n saved ring buffer. This is because the ring buffer being read by user\n space on a crash may not save the part it read. Rewinding the head\n page back to the earliest saved position helps keep those events from\n being lost.\n\n The number of events is also read during boot up and displayed in the\n stats file in the tracefs directory. It\u0027s also used for other\n accounting as well. On boot up, the \"reader page\" is accounted for\n but a rewind may put it back into the buffer and then the reader page\n may be accounted for again.\n\n Save off the original reader page and skip accounting it when\n scanning the pages in the ring buffer.\n\n* tag \u0027trace-ring-buffer-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Do not double count the reader_page\n" }, { "commit": "f3e3dbcea15e20f7413afd8c791a496f0b80e80b", "tree": "c86781264f4dde34121efe316c2cf39790d9c8e2", "parents": [ "fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247", "895a9b37917d2718ef2240a7ead7458c22f1f011" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:06:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:06:55 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Series for zloop, fixing a variety of issues\n\n - t10-pi code cleanup\n\n - Fix for a merge window regression with the bio memory allocation mask\n\n - Fix for a merge window regression in ublk, caused by an issue with\n the maple tree iteration code at teardown\n\n - ublk self tests additions\n\n - Zoned device pgmap fixes\n\n - Various little cleanups and fixes\n\n* tag \u0027block-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits)\n Revert \"floppy: fix reference leak on platform_device_register() failure\"\n ublk: avoid unpinning pages under maple tree spinlock\n ublk: refactor common helper ublk_shmem_remove_ranges()\n ublk: fix maple tree lockdep warning in ublk_buf_cleanup\n selftests: ublk: add ublk auto integrity test\n selftests: ublk: enable test_integrity_02.sh on fio 3.42\n selftests: ublk: remove unused argument to _cleanup\n block: only restrict bio allocation gfp mask asked to block\n block/blk-throttle: Add WQ_PERCPU to alloc_workqueue users\n block: Add WQ_PERCPU to alloc_workqueue users\n block: relax pgmap check in bio_add_page for compatible zone device pages\n block: add pgmap check to biovec_phys_mergeable\n floppy: fix reference leak on platform_device_register() failure\n ublk: use unchecked copy helpers for bio page data\n t10-pi: reduce ref tag code duplication\n zloop: remove irq-safe locking\n zloop: factor out zloop_mark_{full,empty} helpers\n zloop: set RQF_QUIET when completing requests on deleted devices\n zloop: improve the unaligned write pointer warning\n zloop: use vfs_truncate\n ...\n" }, { "commit": "fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247", "tree": "63d499f179e09f3377213221f6d8c55f70059d69", "parents": [ "b85900e91c8402bedc1db14e6d293e26f25d30d4", "d0be8884f56b0b800cd8966e37ce23417cd5044e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:00:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 15:00:54 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix for a NOMMU bug with io_uring, where NOMMU doesn\u0027t grab page refs\n at mmap time. NOMMU also has entirely broken FOLL_PIN support, yet\n here we are\n\n - A few fixes covering minor issues introduced in this merge window\n\n - data race annotation to shut up KCSAN for when io-wq limits are\n applied\n\n - A nospec addition for direct descriptor file updating. Rest of the\n direct descriptor path already had this, but for some reason the\n update did not. Now they are all the same\n\n - Various minor defensive changes that claude identified and suggested\n terrible fixes for, turned into actually useful cleanups:\n\n - Use kvfree() for the imu cache. These can come from kmalloc or\n vmalloc depending on size, but the in-cache ones are capped\n where it\u0027s always kmalloc based. Change to kvfree() in the\n cleanup path, making future changes unlikely to mess that up\n\n - Negative kbuf consumption lengths. Can\u0027t happen right now, but\n cqe-\u003eres is used directly, which if other codes changes could\n then be an error value\n\n - Fix for an issue with the futex code, where partial wakes on a\n vectored fuxes would potentially wake the same futex twice, rather\n than move on to the next one. This could confuse an application as it\n would\u0027ve expected the next futex to have been woken\n\n - Fix for a bug with ring resizing, where SQEs or CQEs might not have\n been copied correctly if large SQEs or CQEs are used in the ring.\n Application side issue, where SQEs or CQEs might have been lost\n during resize\n\n - Fix for a bug where EPOLL_URING_WAKE might have been lost, causing a\n multishot poll to not be terminated when it\u0027s nested, like it should\n have been\n\n - Fix for an issue with signed comparison of poll references for the\n slow path\n\n - Fix for a user struct UAF in the zcrx code\n\n - Two minor zcrx cleanups\n\n* tag \u0027io_uring-7.1-20260424\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: take page references for NOMMU pbuf_ring mmaps\n io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE\n io_uring/zcrx: warn on freelist violations\n io_uring/zcrx: clear RQ headers on init\n io_uring/zcrx: fix user_struct uaf\n io_uring/register: fix ring resizing with mixed/large SQEs/CQEs\n io_uring/futex: ensure partial wakes are appropriately dequeued\n io_uring/rw: add defensive hardening for negative kbuf lengths\n io_uring/rsrc: use kvfree() for the imu cache\n io_uring/rsrc: unify nospec indexing for direct descriptors\n io_uring: fix spurious fput in registered ring path\n io_uring: fix iowq_limits data race in tctx node addition\n io_uring/tctx: mark io_wq as exiting before error path teardown\n io_uring/tctx: check for setup tctx-\u003eio_wq before teardown\n io_uring/poll: fix signed comparison in io_poll_get_ownership()\n" }, { "commit": "b85900e91c8402bedc1db14e6d293e26f25d30d4", "tree": "22ff0ae976fab5251d72ad8f9c4552034f32a421", "parents": [ "ac2dc6d57425ffa9629941d7c9d7c0e51082cb5a", "e6614b88d59d110ee1a80ed0826e34f24dd35c96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 14:20:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 14:20:03 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.1-1\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs\n\nPull NFS client updates from Trond Myklebust:\n \"Bugfixes:\n\n - Fix handling of ENOSPC so that if we have to resend writes, they\n are written synchronously\n\n - SUNRPC RDMA transport fixes from Chuck\n\n - Several fixes for delegated timestamps in NFSv4.2\n\n - Failure to obtain a directory delegation should not cause stat() to\n fail with NFSv4\n\n - Rename was failing to update timestamps when a directory delegation\n is held on NFSv4\n\n - Ensure we check rsize/wsize after crossing a NFSv4 filesystem\n boundary\n\n - NFSv4/pnfs:\n\n - If the server is down, retry the layout returns on reboot\n\n - Fallback to MDS could result in a short write being incorrectly\n logged\n\n Cleanups:\n\n - Use memcpy_and_pad in decode_fh\"\n\n* tag \u0027nfs-for-7.1-1\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (21 commits)\n NFS: Fix RCU dereference of cl_xprt in nfs_compare_super_address\n NFS: remove redundant __private attribute from nfs_page_class\n NFSv4.2: fix CLONE/COPY attrs in presence of delegated attributes\n NFS: fix writeback in presence of errors\n nfs: use memcpy_and_pad in decode_fh\n NFSv4.1: Apply session size limits on clone path\n NFSv4: retry GETATTR if GET_DIR_DELEGATION failed\n NFS: fix RENAME attr in presence of directory delegations\n pnfs/flexfiles: validate ds_versions_cnt is non-zero\n NFS/blocklayout: print each device used for SCSI layouts\n xprtrdma: Post receive buffers after RPC completion\n xprtrdma: Scale receive batch size with credit window\n xprtrdma: Replace rpcrdma_mr_seg with xdr_buf cursor\n xprtrdma: Decouple frwr_wp_create from frwr_map\n xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot\n xprtrdma: Avoid 250 ms delay on backlog wakeup\n xprtrdma: Close sendctx get/put race that can block a transport\n nfs: update inode ctime after removexattr operation\n nfs: fix utimensat() for atime with delegated timestamps\n NFS: improve \"Server wrote zero bytes\" error\n ...\n" }, { "commit": "ac2dc6d57425ffa9629941d7c9d7c0e51082cb5a", "tree": "1a63ab616fe8a13d2f37772290c4aa6f8a1323ae", "parents": [ "ff9726d7a0068e6c2ae1969415285d12ef4d5c6f", "b1137e0b3d4bad1cad73fa9bac763c74ddd1813d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:47:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:47:19 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc1\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph updates from Ilya Dryomov:\n \"We have a series from Alex which extends CephFS client metrics with\n support for per-subvolume data I/O performance and latency tracking\n (metadata operations aren\u0027t included) and a good variety of fixes and\n cleanups across RBD and CephFS\"\n\n* tag \u0027ceph-for-7.1-rc1\u0027 of https://github.com/ceph/ceph-client:\n ceph: add subvolume metrics collection and reporting\n ceph: parse subvolume_id from InodeStat v9 and store in inode\n ceph: handle InodeStat v8 versioned field in reply parsing\n libceph: Fix slab-out-of-bounds access in auth message processing\n rbd: fix null-ptr-deref when device_add_disk() fails\n crush: cleanup in crush_do_rule() method\n ceph: clear s_cap_reconnect when ceph_pagelist_encode_32() fails\n ceph: only d_add() negative dentries when they are unhashed\n libceph: update outdated comment in ceph_sock_write_space()\n libceph: Remove obsolete session key alignment logic\n ceph: fix num_ops off-by-one when crypto allocation fails\n libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()\n" }, { "commit": "ff9726d7a0068e6c2ae1969415285d12ef4d5c6f", "tree": "1eda5d8552f6d806f69c49838a6b1d7706574899", "parents": [ "bdcb864c719f7cf8629ada18450fd4efbb16afe8", "36ee1313199b7f16bf963c6ac0241861585125d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:40:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:40:25 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs updates from Namjae Jeon:\n\n - Fix potential data leakage by zeroing the portion of the straddle\n block beyond initialized_size when reading non-resident attributes\n\n - Remove unnecessary zeroing in ntfs_punch_hole() for ranges beyond\n initialized_size, as they are already returned as zeros on read\n\n - Fix writable check in ntfs_file_mmap_prepare() to correctly handle\n shared mappings using VMA_SHARED_BIT | VMA_MAYWRITE_BIT\n\n - Use page allocation instead of kmemdup() for IOMAP_INLINE data to\n ensure page-aligned address and avoid BUG trap in\n iomap_inline_data_valid() caused by the page boundary check\n\n - Add a size check before memory allocation in ntfs_attr_readall() and\n reject overly large attributes\n\n - Remove unneeded noop_direct_IO from ntfs_aops as it is no longer\n required following the FMODE_CAN_ODIRECT flag\n\n - Fix seven static analysis warnings reported by Smatch\n\n* tag \u0027ntfs-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: use page allocation for resident attribute inline data\n ntfs: fix mmap_prepare writable check for shared mappings\n ntfs: fix potential 32-bit truncation in ntfs_write_cb()\n ntfs: fix uninitialized variable in ntfs_map_runlist_nolock\n ntfs: delete dead code\n ntfs: add missing error code in ntfs_mft_record_alloc()\n ntfs: fix uninitialized variables in ntfs_ea_set_wsl_inode()\n ntfs: fix uninitialized pointer in ntfs_write_mft_block\n ntfs: fix uninitialized variable in ntfs_write_simple_iomap_begin_non_resident\n ntfs: remove noop_direct_IO from address_space_operations\n ntfs: limit memory allocation in ntfs_attr_readall\n ntfs: not zero out range beyond init in punch_hole\n ntfs: zero out stale data in straddle block beyond initialized_size\n" }, { "commit": "bdcb864c719f7cf8629ada18450fd4efbb16afe8", "tree": "718baa82d9a32732a9ab06cc398c79f31d5f1455", "parents": [ "f9569c6ce4a4bbad0876ca7bd1e04fbfbbc1641f", "8fc518e489c1386fd0cf7f4256d055960ed6a2e4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:37:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:37:26 2026 -0700" }, "message": "Merge tag \u00279p-for-7.1-rc1\u0027 of https://github.com/martinetd/linux\n\nPull 9p updates from Dominique Martinet:\n\n - 9p access flag fix (cannot change access flag since new mount API implem)\n\n - some minor cleanup\n\n* tag \u00279p-for-7.1-rc1\u0027 of https://github.com/martinetd/linux:\n 9p/trans_xen: replace simple_strto* with kstrtouint\n 9p/trans_xen: make cleanup idempotent after dataring alloc errors\n 9p: document missing enum values in kernel-doc comments\n 9p: fix access mode flags being ORed instead of replaced\n 9p: fix memory leak in v9fs_init_fs_context error path\n" }, { "commit": "f9569c6ce4a4bbad0876ca7bd1e04fbfbbc1641f", "tree": "c2b6752bb078de1593437400ae359ea1e4af2ab0", "parents": [ "cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a", "ebf1bafd090790704ba54c032de299fccd90a9da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:30:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:30:54 2026 -0700" }, "message": "Merge tag \u0027spdx-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx\n\nPull SPDX update from Greg KH:\n \"Here is a single SPDX-like change for 7.1-rc1. It explicitly allows\n the use of SPDX-FileCopyrightText which has been used already in many\n files.\n\n At the same time, update checkpatch to catch any \"non allowed\" spdx\n identifiers as we don\u0027t want to go overboard here.\n\n This has been in linux-next for a long time with no reported problems\"\n\n* tag \u0027spdx-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:\n LICENSES: Explicitly allow SPDX-FileCopyrightText\n" }, { "commit": "cb4eb6771c0f8fd1c52a8f6fdec7762fb087380a", "tree": "c50311c87c0d464bfbba34e5c3b8699897fb1b65", "parents": [ "b2680ba4a2ad259c7bbd856ed830b459e11d88ba", "1c0220a61508d67a09a6e71eb09593a8aea61822" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:23:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:23:50 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char / misc / IIO / and others driver updates from Greg KH:\n \"Here is the char/misc/iio and other smaller driver subsystem updates\n for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the\n different drivers they touch. Major points in here is:\n\n - the usual large set of new IIO drivers and updates for that\n subsystem (the large majority of this diffstat)\n\n - lots of comedi driver updates and bugfixes\n\n - coresight driver updates\n\n - interconnect driver updates and additions\n\n - mei driver updates\n\n - binder (both rust and C versions) updates and fixes\n\n - lots of other smaller driver subsystem updates and additions\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027char-misc-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits)\n coresight: tpdm: fix invalid MMIO access issue\n mei: me: add nova lake point H DID\n mei: lb: add late binding version 2\n mei: bus: add mei_cldev_uuid\n w1: ds2490: drop redundant device reference\n bus: mhi: host: pci_generic: Add Telit FE912C04 modem support\n mei: csc: wake device while reading firmware status\n mei: csc: support controller with separate PCI device\n mei: convert PCI error to common errno\n mei: trace: print return value of pci_cfg_read\n mei: me: move trace into firmware status read\n mei: fix idle print specifiers\n mei: me: use PCI_DEVICE_DATA macro\n sonypi: Convert ACPI driver to a platform one\n misc: apds990x: fix all kernel-doc warnings\n most: usb: Use kzalloc_objs for endpoint address array\n hpet: Convert ACPI driver to a platform one\n misc: vmw_vmci: Fix spelling mistakes in comments\n parport: Remove completed item from to-do list\n char: remove unnecessary module_init/exit functions\n ...\n" }, { "commit": "b2680ba4a2ad259c7bbd856ed830b459e11d88ba", "tree": "4d90dbf641d88509cbb27e82dd92bad5294f4ce6", "parents": [ "f64399836125c8512f8a3fe72c1719795a9c5812", "16ab65df5d867961a79cef366cdb33f09ebda603" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:16:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:16:36 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"This is quite a big set of fixes, almost all from Johan Hovold who is\n on an ongoing quest to clean up issues with probe and removal handling\n in drivers.\n\n There isn\u0027t anything too concerning here especially with the\n deregistration stuff which will very rarely get run in production\n systems since this is all platform devices in the SoC on embedded\n hardware, but it\u0027s all real issues which should be fixed. There\u0027s more\n in flight here.\n\n We also have a few other minor fixes, one from Felix Gu along the same\n lines as Johan\u0027s work and a couple of documentation things\"\n\n* tag \u0027spi-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (23 commits)\n spi: fix controller cleanup() documentation\n spi: fix resource leaks on device setup failure\n spi: axiado: clean up probe return value\n spi: axiado: rename probe error labels\n spi: axiado: fix runtime pm imbalance on probe failure\n spi: orion: clean up probe return value\n spi: orion: fix clock imbalance on registration failure\n spi: orion: fix runtime pm leak on unbind\n spi: imx: fix runtime pm leak on probe deferral\n spi: mpc52xx: fix use-after-free on registration failure\n spi: Fix the error description in the `ptp_sts_word_post` comment\n spi: topcliff-pch: fix use-after-free on unbind\n spi: topcliff-pch: fix controller deregistration\n spi: orion: fix controller deregistration\n spi: mxic: fix controller deregistration\n spi: mpc52xx: fix use-after-free on unbind\n spi: mpc52xx: fix controller deregistration\n spi: cadence-quadspi: fix controller deregistration\n spi: cadence: fix controller deregistration\n spi: mtk-snfi: fix memory leak in probe\n ...\n" }, { "commit": "f64399836125c8512f8a3fe72c1719795a9c5812", "tree": "0c024bf9d45eae5160b7a2ad875c40596b36b0e2", "parents": [ "6e2d43100c906c6f3d68c45fd2a08ea4be92285c", "2af72ec297d1d4928d0522b45c8ee87cb0d5f5ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:06:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 13:06:25 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"Just one trivial cleanup of the user visible prompts in Kconfig here,\n standardising how we describe Qualcomm\"\n\n* tag \u0027regulator-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: qcom: Unify user-visible \"Qualcomm\" name\n" }, { "commit": "92d5a606721f759ebebf448b3bd2b7a781d50bd0", "tree": "009c94ff1d7585306dadcf2e1256129b22d0e510", "parents": [ "5335e318ad3cf12d905de27e3be4e7fd7b1c6746" ], "author": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Apr 24 15:52:10 2026 +0900" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Apr 24 15:34:39 2026 -0400" }, "message": "ring-buffer: Do not double count the reader_page\n\nSince the cpu_buffer-\u003ereader_page is updated if there are unwound\npages. After that update, we should skip the page if it is the\noriginal reader_page, because the original reader_page is already\nchecked.\n\nCc: stable@vger.kernel.org\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nLink: https://patch.msgid.link/177701353063.2223789.1471163147644103306.stgit@mhiramat.tok.corp.google.com\nFixes: ca296d32ece3 (\"tracing: ring_buffer: Rewind persistent ring buffer on reboot\")\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "6e2d43100c906c6f3d68c45fd2a08ea4be92285c", "tree": "34940de6fdcda1805d393a92d33fcad795c1e569", "parents": [ "d0fc5bf9fe9b89389287846f13cc4e462a89954d", "7e555fcae40ab2ba91fd5cd54a5a83096414957f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 12:11:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 12:11:26 2026 -0700" }, "message": "Merge tag \u0027regmap-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap\n\nPull regmap fixes from Mark Brown:\n \"There\u0027s couple of patches here that came in since my pull request:\n\n - What is effectively a quirk for shoehorning support for a wider\n range of I2C regmaps on weirdly restricted SMBus controllers\n\n - One minor fix for a memory leak on in error handling in the dummy\n driver used by the KUnit tests\"\n\n* tag \u0027regmap-fix-v7.1-merge-window\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:\n regmap: ram: fix memory leaks in __regmap_init_ram() on error\n regmap-i2c: add SMBus byte/word reg16 bus for adapters lacking I2C_FUNC_I2C\n" }, { "commit": "d0fc5bf9fe9b89389287846f13cc4e462a89954d", "tree": "bc927286a49c97539d1be06403ccc2da77d8b648", "parents": [ "1fe93b2a2ace9bba2cb90920f9300834e537665c", "e31eee4a961077d60ef2362507240c6743c1c2ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:59:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:59:46 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix a regression in gpio-rockchip introduced on older chips during\n the merge window when converting to dynamic GPIO base\n\n - fix AST2700 debounce selector bit definitions in gpio-aspeed\n\n* tag \u0027gpio-fixes-for-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: aspeed: fix AST2700 debounce selector bit definitions\n gpio: rockchip: Fix GPIO regression after conversion to dynamic base allocation\n" }, { "commit": "1fe93b2a2ace9bba2cb90920f9300834e537665c", "tree": "c6c53d4a4348603d1da32922903c9e35b2045b40", "parents": [ "cf950766e96e36c90871d955cfd2a2c1feddba37", "2724fbc90e5c133fbbd030e72fe8a3869a20df08" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:49:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:49:20 2026 -0700" }, "message": "Merge tag \u0027sound-fix-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Here are the rest of small updates for 7.1-rc1. All small fixes mostly\n for device-specific issues or regressions.\n\n Core:\n - Fix a potential data race in fasync handling\n\n USB-audio:\n - New device support: Line6 POD HD PRO, NexiGo N930W webcam\n - Fixes for Audio Advantage Micro II SPDIF switch and E-MU sample\n rates\n - Limit UAC2 rate parsing to prevent potential overflows\n\n HD-Audio:\n - Device-specific quirks for HP, Acer, and Honor laptops\n - Fix for TAS2781 SPI device abnormal sound\n - Move Intel firmware loading into probe work to avoid stalling\n\n ASoC:\n - New support for TI TAS5832\n - Fixes for SoundWire SDCA/DisCo boolean parsing\n - Driver-specific fixes for Intel SOF, ES8311, RT1320, and PXA2xx\n\n Misc:\n - Fixes for resource leaks and data races in 6fire, caiaq, als4000,\n and pcmtest drivers\"\n\n* tag \u0027sound-fix-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (41 commits)\n Revert \"ALSA: pcmtest: fix reference leak on failed device registration\"\n ASoC: tas2781: Add tas5832 support\n ASoC: dt-bindings: ti,tas2781: Add TAS5832 support\n ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch\n ALSA: usb-audio: Avoid false E-MU sample-rate notifications\n ASoC: sdw_utils: cs42l43: allow spk component names to be combined\n ASoC: qcom: x1e80100: limit speaker volumes\n ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa2xxx\n ALSA: pcmtest: Fix resource leaks in module init error paths\n ALSA: usb-audio/line6: Add support for POD HD PRO\n ALSA: hda/realtek: Add LED fixup for HP EliteBook 6 G2a Laptops\n ASoC: SDCA: Fix reading of mipi-sdca-control-deferrable\n regmap: sdw-mbq: Allow defers on undeferrable controls\n Revert \"ALSA: usb-audio: Add quirk for SmartlinkTechnology M01\"\n ALSA: als4000: Fix capture trigger chip-\u003emode race\n ALSA: core: Fix potential data race at fasync handling\n ALSA: hda/tas2781: Fix sound abnormal issue on some SPI device\n ALSA: hda/realtek: add quirk for Acer Nitro 16 AN16-41\n ALSA: caiaq: Fix control_put() result and cache rollback\n ALSA: pcmtest: fix reference leak on failed device registration\n ...\n" }, { "commit": "cf950766e96e36c90871d955cfd2a2c1feddba37", "tree": "898255d9dac7fa1c2b21175823a8a52885fe2e1b", "parents": [ "92c4c9fdc838d3b41a996bb700ea64b9e78fc7ea", "56d0a0b38faa13836568d425f6ea806e27f3a69e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:44:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:44:52 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull more drm fixes from Dave Airlie:\n \"These are the regular fixes that have built up over last couple of\n weeks, all pretty minor and spread all over.\n\n atomic:\n - raise the vblank timeout to avoid it on virtual drivers\n - fix colorop duplication\n\n bridge:\n - stm_lvds: state check fix\n - dw-mipi-dsi: bridge reference leak fix\n\n panel:\n - visionx-rm69299: init fix\n\n dma-fence:\n - fix sparse warning\n\n dma-buf:\n - UAF fix\n\n panthor:\n - mapping fix\n\n arcgpu:\n - device_node reference leak fix\n\n nouveau:\n - memory leak in error path fix\n - overflow in reloc path for old hw fix\n\n hv:\n - Kconfig fix\n\n v3d:\n - infinite loop fix\"\n\n* tag \u0027drm-fixes-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel:\n drm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers\n drm/v3d: Reject empty multisync extension to prevent infinite loop\n drm/panel: visionox-rm69299: Make use of prepare_prev_first\n drm/drm_atomic: duplicate colorop states if plane color pipeline in use\n drm/nouveau: fix nvkm_device leak on aperture removal failure\n hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS\n dma-fence: Silence sparse warning in dma_fence_describe\n drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails\n drm/arcpgu: fix device node leak\n drm/panthor: Fix outdated function documentation\n drm/panthor: Extend VM locked region for remap case to be a superset\n dma-buf: fix UAF in dma_buf_put() tracepoint\n drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector\n drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()\n" }, { "commit": "92c4c9fdc838d3b41a996bb700ea64b9e78fc7ea", "tree": "e5a1763ce1295ccdeb94f4e26ee52eb4f3c3aed6", "parents": [ "892c894b4ba4e4eb835f99de6fe7c41871e6d4f8", "e49712ef03dbc4e282dd0e76469642279c2811e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:33:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 11:33:23 2026 -0700" }, "message": "Merge tag \u0027drm-next-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm next fixes from Dave Airlie:\n \"This is the first of two fixes for the merge PRs, the other is based\n on 7.0 branch. This mostly AMD fixes, a couple of weeks of backlog\n built up and this weeks. The main complaint I\u0027ve seen is some boot\n warnings around the FP code handling which this should fix. Otherwise\n a single rcar-du and a single i915 fix.\n\n amdgpu:\n - SMU 14 fixes\n - Partition fixes\n - SMUIO 15.x fix\n - SR-IOV fixes\n - JPEG fix\n - PSP 15.x fix\n - NBIF fix\n - Devcoredump fixes\n - DPC fix\n - RAS fixes\n - Aldebaran smu fix\n - IP discovery fix\n - SDMA 7.1 fix\n - Runtime pm fix\n - MES 12.1 fix\n - DML2 fixes\n - DCN 4.2 fixes\n - YCbCr fixes\n - Freesync fixes\n - ISM fixes\n - Overlay cursor fix\n - DC FP fixes\n - UserQ locking fixes\n - DC idle state manager fix\n - ASPM fix\n - GPUVM SVM fix\n - DCE 6 fix\n\n amdkfd:\n - Fix memory clear handling\n - num_of_nodes bounds check fix\n\n i915:\n - Fix uninitialized variable in the alignment loop [psr]\n\n rcar-du:\n - fix NULL-ptr crash\"\n\n* tag \u0027drm-next-2026-04-24\u0027 of https://gitlab.freedesktop.org/drm/kernel: (75 commits)\n drm/amdkfd: Add upper bound check for num_of_nodes\n drm: rcar-du: Fix crash when no CMM is available\n drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x\n drm/amdgpu: OR init_pte_flags into invalid leaf PTE updates\n drm/amd: Adjust ASPM support quirk to cover more Intel hosts\n drm/amd/display: Undo accidental fix revert in amdgpu_dm_ism.c\n drm/i915/psr: Init variable to avoid early exit from et alignment loop\n drm/amdgpu: drop userq fence driver refs out of fence process()\n drm/amdgpu/userq: unpin and unref doorbell and wptr outside mutex\n drm/amdgpu/userq: use pm_runtime_resume_and_get and fix err handling\n drm/amdgpu/userq: unmap_helper dont return the queue state\n drm/amdgpu/userq: unmap is to be called before freeing doorbell/wptr bo\n drm/amdgpu/userq: hold root bo lock in caller of input_va_validate\n drm/amdgpu/userq: caller to take reserv lock for vas_list_cleanup\n drm/amdgpu/userq: create_mqd does not need userq_mutex\n drm/amdgpu/userq: dont lock root bo with userq_mutex held\n drm/amdgpu/userq: fix kerneldoc for amdgpu_userq_ensure_ev_fence\n drm/amdgpu/userq: clean the VA mapping list for failed queue creation\n drm/amdgpu/userq: avoid uneccessary locking in amdgpu_userq_create\n drm/amd/display: Fix ISM teardown crash from NULL dc dereference\n ...\n" }, { "commit": "510a27055446b8f0d29487ca8b8d2033dc2b6ca6", "tree": "b616a0d8dd53caad388709cb69247639bdb0a352", "parents": [ "4e3d7c89e15ac5dbf45b7d7a49bb374650c03339" ], "author": { "name": "Richard Cheng", "email": "icheng@nvidia.com", "time": "Fri Apr 24 18:02:21 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Apr 24 07:26:48 2026 -1000" }, "message": "sched_ext: sync disable_irq_work in bpf_scx_unreg()\n\nWhen unregistered my self-written scx scheduler, the following panic\noccurs.\n\n[ 229.923133] Kernel text patching generated an invalid instruction at 0xffff80009bc2c1f8!\n[ 229.923146] Internal error: Oops - BRK: 00000000f2000100 [#1] SMP\n[ 230.077871] CPU: 48 UID: 0 PID: 1760 Comm: kworker/u583:7 Not tainted 7.0.0+ #3 PREEMPT(full)\n[ 230.086677] Hardware name: NVIDIA GB200 NVL/P3809-BMC, BIOS 02.05.12 20251107\n[ 230.093972] Workqueue: events_unbound bpf_map_free_deferred\n[ 230.099675] Sched_ext: invariant_0.1.0_aarch64_unknown_linux_gnu_debug (disabling), task: runnable_at\u003d-174ms\n[ 230.116843] pc : 0xffff80009bc2c1f8\n[ 230.120406] lr : dequeue_task_scx+0x270/0x2d0\n[ 230.217749] Call trace:\n[ 230.228515] 0xffff80009bc2c1f8 (P)\n[ 230.232077] dequeue_task+0x84/0x188\n[ 230.235728] sched_change_begin+0x1dc/0x250\n[ 230.240000] __set_cpus_allowed_ptr_locked+0x17c/0x240\n[ 230.245250] __set_cpus_allowed_ptr+0x74/0xf0\n[ 230.249701] ___migrate_enable+0x4c/0xa0\n[ 230.253707] bpf_map_free_deferred+0x1a4/0x1b0\n[ 230.258246] process_one_work+0x184/0x540\n[ 230.262342] worker_thread+0x19c/0x348\n[ 230.266170] kthread+0x13c/0x150\n[ 230.269465] ret_from_fork+0x10/0x20\n[ 230.281393] Code: d4202000 d4202000 d4202000 d4202000 (d4202000)\n[ 230.287621] ---[ end trace 0000000000000000 ]---\n[ 231.160046] Kernel panic - not syncing: Oops - BRK: Fatal exception in interrupt\n\nThe root cause is that the JIT page backing ops-\u003equiescent() is freed\nbefore all callers of that function have stopped.\n\nThe expected ordering during teardown is:\n bitmap_zero(sch-\u003ehas_op) + synchronize_rcu()\n -\u003e guarantees no CPU will ever call sch-\u003eops.* again\n -\u003e only THEN free the BPF struct_ops JIT page\n\nbpf_scx_unreg() is supposed to enforce the order, but after\ncommit f4a6c506d118 (\"sched_ext: Always bounce scx_disable() through\nirq_work\"), disable_work is no longer queued directly, causing\nkthread_flush_work() to be a noop. Thus, the caller drops the struct_ops\nmap too early and poisoned with AARCH64_BREAK_FAULT before\ndisable_workfn ever execute.\n\nSo the subsequent dequeue_task() still sees SCX_HAS_OP(sch, quiescent)\nas true and calls ops.quiescent, which hit on the poisoned page and BRK\npanic.\n\nAdd a helper scx_flush_disable_work() so the future use cases that want\nto flush disable_work can use it.\nAlso amend the call for scx_root_enable_workfn() and\nscx_sub_enable_workfn() which have similar pattern in the error path.\n\nFixes: f4a6c506d118 (\"sched_ext: Always bounce scx_disable() through irq_work\")\nSigned-off-by: Richard Cheng \u003cicheng@nvidia.com\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nReviewed-by: Cheng-Yang Chou \u003cyphbchou0911@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "892c894b4ba4e4eb835f99de6fe7c41871e6d4f8", "tree": "9cc535ebc49a51e720b7a7d2f089738b75606343", "parents": [ "8f4e8687c8f9a3387f51cd534d80b383000d7776", "0adc92b910b3d6bf4913d79869365d553154a070" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:14:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:14:29 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fixes from Ingo Molnar:\n\n - Fix ww_mutex regression, which caused hangs/pauses in some DRM drivers\n\n - Fix rtmutex proxy-rollback bug\n\n* tag \u0027locking-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking/mutex: Fix ww_mutex wait_list operations\n rtmutex: Use waiter::task instead of current in remove_waiter()\n" }, { "commit": "8f4e8687c8f9a3387f51cd534d80b383000d7776", "tree": "91adaf2e869ef085ddb5132addbc0db27ea9a7fc", "parents": [ "feff82eb5f4075d541990d0ba60dad14ea83ea9b", "a39a7014825bd8d10b94fa4f953141b9473c25b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:05:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:05:42 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Prevent deadlock during shstk sigreturn (Rick Edgecombe)\n\n - Disable FRED when PTI is forced on (Dave Hansen)\n\n - Revert a CPA INVLPGB optimization that did not properly handle\n discontiguous virtual addresses (Dave Hansen)\n\n* tag \u0027x86-urgent-2026-04-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mm: Revert INVLPGB optimization for set_memory code\n x86/cpu: Disable FRED when PTI is forced on\n x86/shstk: Prevent deadlock during shstk sigreturn\n" }, { "commit": "feff82eb5f4075d541990d0ba60dad14ea83ea9b", "tree": "b9f16bbd5c8a44552fe94dd2462b296acc03dea8", "parents": [ "ff57d59200baadfdb41f94a49fed7d161a9a8124", "9b3a2be84803cf18c4b4d1efc695991f0daa153c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:00:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 10:00:37 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.1-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V updates from Paul Walmsley:\n \"There is one significant change outside arch/riscv in this pull\n request: the addition of a set of KUnit tests for strlen(), strnlen(),\n and strrchr().\n\n Otherwise, the most notable changes are to add some RISC-V-specific\n string function implementations, to remove XIP kernel support, to add\n hardware error exception handling, and to optimize our runtime\n unaligned access speed testing.\n\n A few comments on the motivation for removing XIP support. It\u0027s been\n broken in the RISC-V kernel for months. The code is not easy to\n maintain. Furthermore, for XIP support to truly be useful for RISC-V,\n we think that compile-time feature switches would need to be added for\n many of the RISC-V ISA features and microarchitectural properties that\n are currently implemented with runtime patching. No one has stepped\n forward to take responsibility for that work, so many of us think it\u0027s\n best to remove it until clear use cases and champions emerge.\n\n Summary:\n\n - Add Kunit correctness testing and microbenchmarks for strlen(),\n strnlen(), and strrchr()\n\n - Add RISC-V-specific strnlen(), strchr(), strrchr() implementations\n\n - Add hardware error exception handling\n\n - Clean up and optimize our unaligned access probe code\n\n - Enable HAVE_IOREMAP_PROT to be able to use generic_access_phys()\n\n - Remove XIP kernel support\n\n - Warn when addresses outside the vmemmap range are passed to\n vmemmap_populate()\n\n - Update the ACPI FADT revision check to warn if it\u0027s not at least\n ACPI v6.6, which is when key RISC-V-specific tables were added to\n the specification\n\n - Increase COMMAND_LINE_SIZE to 2048 to match ARM64, x86, PowerPC,\n etc.\n\n - Make kaslr_offset() a static inline function, since there\u0027s no need\n for it to show up in the symbol table\n\n - Add KASLR offset and SATP to the VMCOREINFO ELF notes to improve\n kdump support\n\n - Add Makefile cleanup rule for vdso_cfi copied source files, and add\n a .gitignore for the build artifacts in that directory\n\n - Remove some redundant ifdefs that check Kconfig macros\n\n - Add missing SPDX license tag to the CFI selftest\n\n - Simplify UTS_MACHINE assignment in the RISC-V Makefile\n\n - Clarify some unclear comments and remove some superfluous comments\n\n - Fix various English typos across the RISC-V codebase\"\n\n* tag \u0027riscv-for-linus-7.1-mw1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (31 commits)\n riscv: Remove support for XIP kernel\n riscv: Reuse compare_unaligned_access() in check_vector_unaligned_access()\n riscv: Split out compare_unaligned_access()\n riscv: Reuse measure_cycles() in check_vector_unaligned_access()\n riscv: Split out measure_cycles() for reuse\n riscv: Clean up \u0026 optimize unaligned scalar access probe\n riscv: lib: add strrchr() implementation\n riscv: lib: add strchr() implementation\n riscv: lib: add strnlen() implementation\n lib/string_kunit: extend benchmarks to strnlen() and chr searches\n lib/string_kunit: add performance benchmark for strlen()\n lib/string_kunit: add correctness test for strrchr()\n lib/string_kunit: add correctness test for strnlen()\n lib/string_kunit: add correctness test for strlen()\n riscv: vdso_cfi: Add .gitignore for build artifacts\n riscv: vdso_cfi: Add clean rule for copied sources\n riscv: enable HAVE_IOREMAP_PROT\n riscv: mm: WARN_ON() for bad addresses in vmemmap_populate()\n riscv: acpi: update FADT revision check to 6.6\n riscv: add hardware error trap handler support\n ...\n" }, { "commit": "ff57d59200baadfdb41f94a49fed7d161a9a8124", "tree": "ba3e10b29fe41a53e6b5c2f6f555189962859e56", "parents": [ "64edfa65062dc4509ba75978116b2f6d392346f5", "7939f96f26e96b69db1fe4e7c18537a679696358" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:54:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:54:45 2026 -0700" }, "message": "Merge tag \u0027loongarch-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch updates from Huacai Chen:\n\n - Adjust build infrastructure for 32BIT/64BIT\n\n - Add HIGHMEM (PKMAP and FIX_KMAP) support\n\n - Show and handle CPU vulnerabilites correctly\n\n - Batch the icache maintenance for jump_label\n\n - Add more atomic instructions support for BPF JIT\n\n - Add more features (e.g. fsession) support for BPF trampoline\n\n - Some bug fixes and other small changes\n\n* tag \u0027loongarch-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (21 commits)\n selftests/bpf: Enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch\n LoongArch: BPF: Add fsession support for trampolines\n LoongArch: BPF: Introduce emit_store_stack_imm64() helper\n LoongArch: BPF: Support up to 12 function arguments for trampoline\n LoongArch: BPF: Support small struct arguments for trampoline\n LoongArch: BPF: Open code and remove invoke_bpf_mod_ret()\n LoongArch: BPF: Support load-acquire and store-release instructions\n LoongArch: BPF: Support 8 and 16 bit read-modify-write instructions\n LoongArch: BPF: Add the default case in emit_atomic() and rename it\n LoongArch: Define instruction formats for AM{SWAP/ADD}.{B/H} and DBAR\n LoongArch: Batch the icache maintenance for jump_label\n LoongArch: Add flush_icache_all()/local_flush_icache_all()\n LoongArch: Add spectre boundry for syscall dispatch table\n LoongArch: Show CPU vulnerabilites correctly\n LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist\n LoongArch: Use get_random_canary() for stack canary init\n LoongArch: Improve the logging of disabling KASLR\n LoongArch: Align FPU register state to 32 bytes\n LoongArch: Handle CONFIG_32BIT in syscall_get_arch()\n LoongArch: Add HIGHMEM (PKMAP and FIX_KMAP) support\n ...\n" }, { "commit": "64edfa65062dc4509ba75978116b2f6d392346f5", "tree": "a452fde9ee3a647b29bf83f71827fedb59921abc", "parents": [ "82138f0183b40e76affa427bb59c57f079d41ec1", "0c22ed0fadcad620277a56c0ba2867d4850d053a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:41:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:41:58 2026 -0700" }, "message": "Merge tag \u0027net-deletions\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next\n\nPull networking deletions from Jakub Kicinski:\n \"Delete some obsolete networking code\n\n Old code like amateur radio and NFC have long been a burden to core\n networking developers. syzbot loves to find bugs in BKL-era code, and\n noobs try to fix them.\n\n If we want to have a fighting chance of surviving the LLM-pocalypse\n this code needs to find a dedicated owner or get deleted. We\u0027ve talked\n about these deletions multiple times in the past and every time\n someone wanted the code to stay. It is never very clear to me how many\n of those people actually use the code vs are just nostalgic to see it\n go. Amateur radio did have occasional users (or so I think) but most\n users switched to user space implementations since its all super slow\n stuff. Nobody stepped up to maintain the kernel code.\n\n We were lucky enough to find someone who wants to help with NFC so\n we\u0027re giving that a chance. Let\u0027s try to put the rest of this code\n behind us\"\n\n* tag \u0027net-deletions\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next:\n drivers: net: 8390: wd80x3: Remove this driver\n drivers: net: 8390: ultra: Remove this driver\n drivers: net: 8390: AX88190: Remove this driver\n drivers: net: fujitsu: fmvj18x: Remove this driver\n drivers: net: smsc: smc91c92: Remove this driver\n drivers: net: smsc: smc9194: Remove this driver\n drivers: net: amd: nmclan: Remove this driver\n drivers: net: amd: lance: Remove this driver\n drivers: net: 3com: 3c589: Remove this driver\n drivers: net: 3com: 3c574: Remove this driver\n drivers: net: 3com: 3c515: Remove this driver\n drivers: net: 3com: 3c509: Remove this driver\n net: packetengines: remove obsolete yellowfin driver and vendor dir\n net: packetengines: remove obsolete hamachi driver\n net: remove unused ATM protocols and legacy ATM device drivers\n net: remove ax25 and amateur radio (hamradio) subsystem\n net: remove ISDN subsystem and Bluetooth CMTP\n caif: remove CAIF NETWORK LAYER\n" }, { "commit": "82138f0183b40e76affa427bb59c57f079d41ec1", "tree": "7797a14fd0d12353cb67fb07df8c9fc2f60f6cbe", "parents": [ "bbc4af7ad94c452c00e64fc400fc1317351969b4", "082a6d03a2d685a83a332666b500ad3966349588" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:39:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:39:03 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - A stable fix for k(v)ealloc() where reallocating on a different node\n or shrinking the object can result in either losing the original data\n or a buffer overflow (Marco Elver)\n\n* tag \u0027slab-for-7.1-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n slub: fix data loss and overflow in krealloc()\n" }, { "commit": "bbc4af7ad94c452c00e64fc400fc1317351969b4", "tree": "d0b26a09925b3435fc75b2558088de61380fbc4b", "parents": [ "eefe0b9dee5db64ec87707c8e44f31851f257389", "4f96b7c68a9904e01049ef610d701b382dca9574" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:29:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:29:51 2026 -0700" }, "message": "Merge tag \u0027clang-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux\n\nPull Clang build fix from Nathan Chancellor:\n\n - Wrap declaration and assignment of key_pass in certs/extract-cert.c\n with \u0027#ifdef\u0027 that matches its only usage to clear up an instance of\n a new clang subwarning, -Wunused-but-set-global.\n\n* tag \u0027clang-fixes-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/nathan/linux:\n extract-cert: Wrap key_pass with \u0027#ifdef USE_PKCS11_ENGINE\u0027\n" }, { "commit": "eefe0b9dee5db64ec87707c8e44f31851f257389", "tree": "cf1f706574c5139653803742813ed1f161c44852", "parents": [ "dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b", "11b7df0952663f20ce72c9a22a3cf9278cf84db7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:22:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Apr 24 09:22:21 2026 -0700" }, "message": "Merge tag \u0027apparmor-pr-2026-04-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor\n\nPull apparmor updates from John Johansen:\n \"Cleanups\n - Use sysfs_emit in param_get_{audit,mode}\n - Remove redundant if check in sk_peer_get_label\n - Replace memcpy + NUL termination with kmemdup_nul in do_setattr\n\n Bug Fixes:\n - Fix aa_dfa_unpack\u0027s error handling in aa_setup_dfa_engine\n - Fix string overrun due to missing termination\n - Fix wrong dentry in RENAME_EXCHANGE uid check\n - fix unpack_tags to properly return error in failure cases\n - fix dfa size check\n - return error on namespace mismatch in verify_header\n - use target task\u0027s context in apparmor_getprocattr()\"\n\n* tag \u0027apparmor-pr-2026-04-23\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:\n apparmor/lsm: Fix aa_dfa_unpack\u0027s error handling in aa_setup_dfa_engine\n apparmor: Fix string overrun due to missing termination\n apparmor: Fix wrong dentry in RENAME_EXCHANGE uid check\n apparmor: fix unpack_tags to properly return error in failure cases\n apparmor: fix dfa size check\n apparmor: Use sysfs_emit in param_get_{audit,mode}\n apparmor: Remove redundant if check in sk_peer_get_label\n apparmor: Replace memcpy + NUL termination with kmemdup_nul in do_setattr\n apparmor: return error on namespace mismatch in verify_header\n apparmor: use target task\u0027s context in apparmor_getprocattr()\n" }, { "commit": "c6e61c06d6061750597e79c598acb5dead44c35b", "tree": "5838962da4e26e1dcbc042792566536ec51b620a", "parents": [ "6f685f12fd8327c9da19ae5b1875acaaa9297494" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Nov 11 16:54:38 2025 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:59 2026 +0100" }, "message": "ARM: 9463/1: Allow to enable RT\n\nAll known issues have been adressed.\nAllow to select RT.\n\nAcked-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "6f685f12fd8327c9da19ae5b1875acaaa9297494", "tree": "ccd62da8ba134ceb17d36c1b0b7bdc057ba4d985", "parents": [ "dd9d3e16c2d5fa166e13dce07413be51f42c8f5d", "d1fed2d600905e7f007d8c88c936b768d45c09d6", "75f9a484e817adea211c73f89ed938a2b2f90953", "5a21253b3073df578ee074da2f9427cbb4c3146a" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:07 2026 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:14:44 2026 +0100" }, "message": "Merge branches \u0027adfs\u0027, \u0027arm-fault-handling\u0027, \u0027fixes\u0027 and \u0027misc\u0027\n" }, { "commit": "75f9a484e817adea211c73f89ed938a2b2f90953", "tree": "f20c71037ce487744ac320ef4cf2fe14980249dc", "parents": [ "6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f" ], "author": { "name": "Brian Ruley", "email": "brian.ruley@gehealthcare.com", "time": "Wed Apr 15 18:12:48 2026 +0100" }, "committer": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Fri Apr 24 15:12:52 2026 +0100" }, "message": "ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache()\n\nThis bug was already discovered and fixed for arm64 in\ncommit 588a513d3425 (\"arm64: Fix race condition on PG_dcache_clean in\n__sync_icache_dcache()\").\n\nVerified with added instrumentation to track dcache flushes in a ring\nbuffer, as shown by the (distilled) output:\n\n kernel: SIGILL at b6b80ac0 cpu 1 pid 32663 linux_pte\u003d8eff659f\n hw_pte\u003d8eff6e7e young\u003d1 exec\u003d1\n kernel: dcache flush START cpu0 pfn\u003d8eff6 ts\u003d48629557020154\n kernel: dcache flush SKIPPED cpu1 pfn\u003d8eff6 ts\u003d48629557020154\n kernel: dcache flush FINISH cpu0 pfn\u003d8eff6 ts\u003d48629557036154\n audisp-syslog: comm\u003d\"journalctl\" exe\u003d\"/usr/bin/journalctl\" sig\u003d4 [...]\n\nDiscussions in the mailing list mentioned that arch/arm is also affected\nbut the fix was never applied to it [1][2]. Apply the change now, since\nthe race condition can cause sporadic SIGILL\u0027s and SEGV\u0027s especially\nwhile under high memory pressure.\n\nLink: https://lore.kernel.org/all/adzMOdySgMIePcue@willie-the-truck [1]\nLink: https://lore.kernel.org/all/20210514095001.13236-1-catalin.marinas@arm.com [2]\nSigned-off-by: Brian Ruley \u003cbrian.ruley@gehealthcare.com\u003e\nReviewed-by: Will Deacon \u003cwill@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nFixes: 6012191aa9c6 (\"ARM: 6380/1: Introduce __sync_icache_dcache() for VIPT caches\")\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\n" }, { "commit": "a39a7014825bd8d10b94fa4f953141b9473c25b4", "tree": "144aa25d316cc906986e3c6939776cde98d690ad", "parents": [ "932d922285ef4d0d655a6f5def2779ae86ca0d73" ], "author": { "name": "Dave Hansen", "email": "dave.hansen@linux.intel.com", "time": "Tue Apr 21 08:19:09 2026 -0700" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Apr 24 15:42:48 2026 +0200" }, "message": "x86/mm: Revert INVLPGB optimization for set_memory code\n\ntl;dr: Revert an INVLPGB optimization that did not properly handle\ndiscontiguous virtual addresses.\n\nFull story:\n\nI got a report from some graphics (i915) folks that bisected a\nregression in their test suite to 86e6815b316e (\"x86/mm: Change\ncpa_flush() to call flush_kernel_range() directly\"). There was a bit\nof flip-flopping on the exact bisect, but the code here does seem\nwrong to me. The i915 folks were calling set_pages_array_wc(), so\nusing the CPA_PAGES_ARRAY mode.\n\nBasically, the \u0027struct cpa_data\u0027 can wrap up all kinds of page table\nchanges. Some of these are virtually contiguous, but some are very\nmuch not which is one reason why there are -\u003evaddr and -\u003epages arrays.\n\n86e6815b316e made the mistake of assuming that the virtual addresses\nin the cpa_data are always contiguous. It got things right when neither\nCPA_ARRAY/CPA_PAGES_ARRAY is used, but theoretically wrong when either\nof those is used.\n\nIn the i915 case, it probably failed to flush some WB TLB entries and\ninstall WC ones, leaving some data in the caches and not flushing it\nout to where the device could see it. That eventually caused graphics\nproblems.\n\nRevert the INVLPGB optimization. It can be reintroduced later, but it\nwill need to be a bit careful about the array modes.\n\nFixes: 86e6815b316ec (\"x86/mm: Change cpa_flush() to call flush_kernel_range()\")\nReported-by: Cui, Ling \u003cling.cui@intel.com\u003e\nSigned-off-by: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Rick Edgecombe \u003crick.p.edgecombe@intel.com\u003e\nReviewed-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260421151909.6B3281C6@davehans-spike.ostc.intel.com\n" }, { "commit": "75f7c47ccd78c947cf1b6ddb18ea453ff0555716", "tree": "7749dcb203c93e5defb2a1f0b2f17876b495ef9b", "parents": [ "2452dcf4d740effff5aa71b7f6529ee8c04fd8f6" ], "author": { "name": "Thomas Weißschuh", "email": "linux@weissschuh.net", "time": "Wed Apr 22 17:10:27 2026 +0200" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Fri Apr 24 13:57:48 2026 +0200" }, "message": "kbuild: Never respect CONFIG_WERROR / W\u003de to fixdep\n\nThe fixdep hostprog may be built multiple times during a single build.\nOnce during the configuration phase and later during the regular phase.\nAs only the regular build phase respects CONFIG_WERROR / W\u003de, the\ncompiler flags might change between the phases, leading to rebuilds.\n\nExample, the rebuilds will happen twice on each invocation of the build:\n\n $ make allyesconfig prepare\n make[1]: Entering directory \u0027/tmp/deleteme\u0027\n HOSTCC scripts/basic/fixdep\n #\n # No change to .config\n #\n HOSTCC scripts/basic/fixdep\n DESCEND objtool\n INSTALL libsubcmd_headers\n make[1]: Leaving directory \u0027/tmp/deleteme\u0027\n\nFix the compilation flags used for scripts/basic/ before\nscripts/Makefile.warn is evaluated to stop CONFIG_WERROR / W\u003de\ninfluencing the fixdep build to avoid the spurious rebuilds.\n\nFixes: 7ded7d37e5f5 (\"scripts/Makefile.extrawarn: Respect CONFIG_WERROR / W\u003de for hostprogs\")\nSigned-off-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260422-kbuild-scripts-basic-werror-v1-1-8c6912ff22e0@weissschuh.net\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "4ce98bf0865c349e7026ad9c14f48da264920953", "tree": "36e896cb840328738aa5e0988d3e95e02b8fb3e4", "parents": [ "5bb0aed57ba944f8c201e4e82ec066e0187e0f85" ], "author": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Thu Apr 23 17:36:07 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Wake-up from WFI when iqrchip is in userspace\n\nIt appears that there is nothing in the wake-up path that\nevaluates whether the in-kernel interrupts are pending unless\nwe have a vgic.\n\nThis means that the userspace irqchip support has been broken for\nabout four years, and nobody noticed. It was also broken before\nas we wouldn\u0027t wake-up on a PMU interrupt, but hey, who cares...\n\nIt is probably time to remove the feature altogether, because it\nwas a terrible idea 10 years ago, and it still is.\n\nFixes: b57de4ffd7c6d (\"KVM: arm64: Simplify kvm_cpu_has_pending_timer()\")\nLink: https://patch.msgid.link/20260423163607.486345-1-maz@kernel.org\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "5bb0aed57ba944f8c201e4e82ec066e0187e0f85", "tree": "1b7e8cf8fe02455b27545189cdef74ba90ccf06d", "parents": [ "73b9c1e5da84cd69b1a86e374e450817cd051371" ], "author": { "name": "Quentin Perret", "email": "qperret@google.com", "time": "Fri Apr 24 09:49:08 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix initialisation order in __pkvm_init_finalise()\n\nfix_host_ownership() walks the hypervisor\u0027s stage-1 page-table to\nadjust the host\u0027s stage-2 accordingly. Any such adjustment that\nrequires cache maintenance operations depends on the per-CPU hyp\nfixmap being present. However, fix_host_ownership() is currently\ncalled before fix_hyp_pgtable_refcnt() and hyp_create_fixmap(), so\nthe fixmap does not yet exist when it runs.\n\nThis is benign today because the host stage-2 starts empty and no\nCMOs are needed, but it becomes a latent crash as soon as\nfix_host_ownership() is extended to operate on a non-empty\npage-table.\n\nReorder the calls so that fix_hyp_pgtable_refcnt() and\nhyp_create_fixmap() complete before fix_host_ownership() is invoked.\n\nFixes: 0d16d12eb26e (\"KVM: arm64: Fix-up hyp stage-1 refcounts for all pages mapped at EL2\")\nSigned-off-by: Quentin Perret \u003cqperret@google.com\u003e\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-7-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "73b9c1e5da84cd69b1a86e374e450817cd051371", "tree": "f5fb52f09fe294cba28058c4ccfd074793020544", "parents": [ "d89fdda7dd8a488f922e1175e6782f781ba8a23b" ], "author": { "name": "Fuad Tabba", "email": "tabba@google.com", "time": "Fri Apr 24 09:49:07 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n\nTwo bugs exist in the vCPU initialisation path:\n\n1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup\n path jumps to \u0027unlock\u0027 without calling unpin_host_vcpu() or\n unpin_host_sve_state(), permanently leaking pin references on the\n host vCPU and SVE state pages.\n\n Extract a register_hyp_vcpu() helper that performs the checks and\n the store. When register_hyp_vcpu() returns an error, call\n unpin_host_vcpu() and unpin_host_sve_state() inline before falling\n through to the existing \u0027unlock\u0027 label.\n\n2. register_hyp_vcpu() publishes the new vCPU pointer into\n \u0027hyp_vm-\u003evcpus[]\u0027 with a bare store, allowing a concurrent caller\n of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU\n object.\n\n Ensure the store uses smp_store_release() and the load uses\n smp_load_acquire(). While \u0027vm_table_lock\u0027 currently serialises the\n store and the load, these barriers ensure the reader sees the fully\n initialised \u0027hyp_vcpu\u0027 object even if there were a lockless path or\n if the lock\u0027s own ordering guarantees were insufficient for nested\n object initialization.\n\nFixes: 49af6ddb8e5c (\"KVM: arm64: Add infrastructure to create and track pKVM instances at EL2\")\nReported-by: Ben Simner \u003cben.simner@cl.cam.ac.uk\u003e\nCo-developed-by: Will Deacon \u003cwilldeacon@google.com\u003e\nSigned-off-by: Will Deacon \u003cwilldeacon@google.com\u003e\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-6-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "d89fdda7dd8a488f922e1175e6782f781ba8a23b", "tree": "f878aad08f5a9a498349f6954c61f0ffa6213e20", "parents": [ "08d715338287a1affb4c7ad5733decef4558a5c8" ], "author": { "name": "Fuad Tabba", "email": "tabba@google.com", "time": "Fri Apr 24 09:49:06 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix kvm_vcpu_initialized() macro parameter\n\nThe macro is defined with parameter \u0027v\u0027 but the body references the\nliteral token \u0027vcpu\u0027 instead, causing it to silently operate on whatever\n\u0027vcpu\u0027 resolves to in the caller\u0027s scope rather than the value passed by\nthe caller. All current call sites happen to use a variable named \u0027vcpu\u0027,\nso the bug is latent.\n\nFixes: e016333745c7 (\"KVM: arm64: Only reset vCPU-scoped feature ID regs once\")\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-5-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "08d715338287a1affb4c7ad5733decef4558a5c8", "tree": "78ac18f0d6e7a9be1e26d64ffcbc155470909177", "parents": [ "2a623408112626d2625a6f00aed665861d59665c" ], "author": { "name": "Fuad Tabba", "email": "tabba@google.com", "time": "Fri Apr 24 09:49:05 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer\n\nFEAT_SPE_FnE is architecturally detected via PMSIDR_EL1.FnE [6], not\nID_AA64DFR0_EL1.PMSVer. The FEAT_X macro form (register, field, value)\ncannot encode a PMSIDR_EL1-based feature, so FEAT_SPE_FnE was defined\nidentically to FEAT_SPEv1p2 (ID_AA64DFR0_EL1, PMSVer, V1P2), producing\na duplicate that used PMSVer \u003e\u003d V1P2 as a proxy.\n\nReplace the macro with feat_spe_fne(), following the same pattern as\nthe sibling feat_spe_fds(): guard on FEAT_SPEv1p2 and read\nPMSIDR_EL1.FnE [6] directly. Wire the two NEEDS_FEAT consumers to use\nthe new function.\n\nRemove the now-unused FEAT_SPE_FnE macro.\n\nFixes: 63d423a7635b (\"KVM: arm64: Switch to table-driven FGU configuration\")\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-4-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "2a623408112626d2625a6f00aed665861d59665c", "tree": "5ba0da5bd2fc0c744160df6fe5cac8a3f2b82144", "parents": [ "7fe2cd4e1a3ad230d8fcc00cc99c4bcce4412a75" ], "author": { "name": "Fuad Tabba", "email": "tabba@google.com", "time": "Fri Apr 24 09:49:04 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix typo in feature check comments\n\nRevists -\u003e Revisit. The following patch will add another similar line.\n\nNo functional change intended.\n\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-3-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\n" }, { "commit": "7fe2cd4e1a3ad230d8fcc00cc99c4bcce4412a75", "tree": "358aad045abce24cfac0df597eb22be48c781701", "parents": [ "480ea48cad873b49a1fabd07c0847c3cf1c32286" ], "author": { "name": "Fuad Tabba", "email": "tabba@google.com", "time": "Fri Apr 24 09:49:03 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer\n\nFEAT_Debugv8p9 is incorrectly defined against ID_AA64DFR0_EL1.PMUVer\ninstead of ID_AA64DFR0_EL1.DebugVer. All three consumers of the macro\ngate features that are architecturally tied to FEAT_Debugv8p9\n(DebugVer \u003d 0b1011, DDI0487 M.b A2.2.10):\n\n - HDFGRTR2_EL2.nMDSELR_EL1, HDFGWTR2_EL2.nMDSELR_EL1: MDSELR_EL1\n is present only when FEAT_Debugv8p9 is implemented (D24.3.21).\n\n - MDCR_EL2.EBWE: the Extended Breakpoint and Watchpoint Enable bit\n is RES0 unless FEAT_Debugv8p9 is implemented (D24.3.17).\n\nNeither register has any dependency on PMUVer.\n\nFEAT_Debugv8p9 and FEAT_PMUv3p9 are independent. Per DDI0487 M.b\nA2.2.10, FEAT_Debugv8p9 is unconditionally mandatory from Armv8.9,\nwhereas FEAT_PMUv3p9 is mandatory only when FEAT_PMUv3 is implemented.\nAn Armv8.9 CPU without a PMU has DebugVer \u003d 0b1011 but PMUVer \u003d 0b0000,\nso the wrong field check would cause KVM to incorrectly treat EBWE and\nMDSELR_EL1 as RES0 on such hardware.\n\nFixes: 4bc0fe089840 (\"KVM: arm64: Add sanitisation for FEAT_FGT2 registers\")\nSigned-off-by: Fuad Tabba \u003ctabba@google.com\u003e\nLink: https://patch.msgid.link/20260424084908.370776-2-tabba@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "480ea48cad873b49a1fabd07c0847c3cf1c32286", "tree": "41b172c563ede9bc8b15a18fccea7f071441c607", "parents": [ "a0e6ae45af17e8b27958830595799c702ffbab8d" ], "author": { "name": "Sebastian Ene", "email": "sebastianene@google.com", "time": "Wed Apr 08 11:41:18 2026 +0000" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:57 2026 +0100" }, "message": "KVM: arm64: Reject non compliant SMCCC function calls in pKVM\n\nPrevent the propagation of a function-id that has the top bits set since\nthis is not compliant with the SMCCC spec and can overlap with the\nalready known function-id decoders. (eg. if we invoke an smc with\n0xffffffffc4000012 it will be decoded as a PSCI reset call). Instead,\nmake it clear that we don\u0027t support it and return an error.\n\nSigned-off-by: Sebastian Ene \u003csebastianene@google.com\u003e\nLink: https://patch.msgid.link/20260408114118.422604-1-sebastianene@google.com\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\n" }, { "commit": "a0e6ae45af17e8b27958830595799c702ffbab8d", "tree": "5a44a0daf7e328c1fa9078d4bd5f9729601fdf43", "parents": [ "f05799491d6a2a29d8e15f4451e685c4a6e13d8f" ], "author": { "name": "David Woodhouse", "email": "dwmw@amazon.co.uk", "time": "Tue Apr 07 21:27:02 2026 +0100" }, "committer": { "name": "Marc Zyngier", "email": "maz@kernel.org", "time": "Fri Apr 24 12:03:47 2026 +0100" }, "message": "KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value\n\nThe uaccess write handlers for GICD_IIDR in both GICv2 and GICv3\nextract the revision field from \u0027reg\u0027 (the current IIDR value read back\nfrom the emulated distributor) instead of \u0027val\u0027 (the value userspace is\ntrying to write). This means userspace can never actually change the\nimplementation revision — the extracted value is always the current one.\n\nFix the FIELD_GET to use \u0027val\u0027 so that userspace can select a different\nrevision for migration compatibility.\n\nFixes: 49a1a2c70a7f (\"KVM: arm64: vgic-v3: Advertise GICR_CTLR.{IR, CES} as a new GICD_IIDR revision\")\nSigned-off-by: David Woodhouse \u003cdwmw@amazon.co.uk\u003e\nLink: https://patch.msgid.link/20260407210949.2076251-2-dwmw2@infradead.org\nSigned-off-by: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "56d0a0b38faa13836568d425f6ea806e27f3a69e", "tree": "7668ea1aaa9945c9f2ea43cd56e3fea73b2514ef", "parents": [ "028ef9c96e96197026887c0f092424679298aae8", "2fc87d37be1b730a149b035f9375fdb8cc5333a5" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 13:17:50 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 13:56:54 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-04-23\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nThis week in drm-misc-fixes, we have:\n- A patch to raise the vblank timeout to avoid it on virtual drivers\n- a state check fix for stm_lvds\n- a use-after-free fix for dma-buf\n- a mapping fix for panthor\n- a device_node reference leak fix for arcgpu\n- a bridge reference leak fix for dw-mipi-dsi\n- a sparse warning fix for dma-fence\n- a kconfig fix for hv\n- a memory leak fix for nouveau\n- a fix to duplicate colorop when duplicating states\n- a panel initialisation order fix for visionox-rm69299\n- a fix to prevent an infinite loop for v3d\n- an overflow fix for nouveau\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260423-realistic-eager-reindeer-4dacf7@houat\n" }, { "commit": "dd6c438c3e64a5ff0b5d7e78f7f9be547803ef1b", "tree": "c96be83061cb29d3e1d7cb6667440441e265e226", "parents": [ "bd1886d6e4ca6b84041d17ba6e11d0f85f7ee1a4", "ac8777cc36224b4705d2c6efb10c56135d479b21" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:08:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:08:04 2026 -0700" }, "message": "Merge tag \u0027vfs-7.1-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - eventpoll: fix ep_remove() UAF and follow-up cleanup\n\n - fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference\n error\n\n - writeback: Fix use after free in inode_switch_wbs_work_fn()\n\n - fuse: reject oversized dirents in page cache\n\n - fs: aio: reject partial mremap to avoid Null-pointer-dereference\n error\n\n - nstree: fix func. parameter kernel-doc warnings\n\n - fs: Handle multiply claimed blocks more gracefully with mmb\n\n* tag \u0027vfs-7.1-rc1.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n eventpoll: drop vestigial epi-\u003edying flag\n eventpoll: drop dead bool return from ep_remove_epi()\n eventpoll: refresh eventpoll_release() fast-path comment\n eventpoll: move f_lock acquisition into ep_remove_file()\n eventpoll: fix ep_remove struct eventpoll / struct file UAF\n eventpoll: move epi_fget() up\n eventpoll: rename ep_remove_safe() back to ep_remove()\n eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()\n eventpoll: kill __ep_remove()\n eventpoll: split __ep_remove()\n eventpoll: use hlist_is_singular_node() in __ep_remove()\n fs: Handle multiply claimed blocks more gracefully with mmb\n nstree: fix func. parameter kernel-doc warnings\n fs: aio: reject partial mremap to avoid Null-pointer-dereference error\n fuse: reject oversized dirents in page cache\n writeback: Fix use after free in inode_switch_wbs_work_fn()\n fs: aio: set VMA_DONTCOPY_BIT in mmap to fix NULL-pointer-dereference error\n" }, { "commit": "bd1886d6e4ca6b84041d17ba6e11d0f85f7ee1a4", "tree": "145b8288615b323d572d9497f18dbb46a25ce417", "parents": [ "d0ed69f3e380276e7ab36f1a3f19702c5e993915", "1249c01aa42160e40bc765ba5a3cde751491ff0a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:04:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 17:04:18 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc-part2-ksmbd-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull more smb server updates from Steve French:\n\n - move fs/smb/common/smbdirect to fs/smb/smbdirect\n\n - change signature calc to use AES-CMAC library, simpler and faster\n\n - invalid signature fix\n\n - multichannel fix\n\n - open create options fix\n\n - fix durable handle leak\n\n - cap maximum lock count to avoid potential denial of service\n\n - four connection fixes: connection free and session destroy IDA fixes,\n refcount fix, connection leak fix, max_connections off by one fix\n\n - IPC validation fix\n\n - fix out of bounds write in getting xattrs\n\n - fix use after free in durable handle reconnect\n\n - three ACL fixes: fix potential ACL overflow, harden num_aces check,\n and fix minimum ACE size check\n\n* tag \u0027v7.1-rc-part2-ksmbd-fixes\u0027 of git://git.samba.org/ksmbd:\n smb: smbdirect: move fs/smb/common/smbdirect/ to fs/smb/smbdirect/\n smb: server: stop sending fake security descriptors\n ksmbd: scope conn-\u003ebinding slowpath to bound sessions only\n ksmbd: fix CreateOptions sanitization clobbering the whole field\n ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open\n ksmbd: fix O(N^2) DoS in smb2_lock via unbounded LockCount\n ksmbd: destroy async_ida in ksmbd_conn_free()\n ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()\n ksmbd: Use AES-CMAC library for SMB3 signature calculation\n ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id()\n ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n ksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n ksmbd: fix use-after-free in smb2_open during durable reconnect\n ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()\n smb: server: fix max_connections off-by-one in tcp accept path\n ksmbd: require minimum ACE size in smb_check_perm_dacl()\n ksmbd: validate response sizes in ipc_validate_msg()\n smb: server: fix active_num_conn leak on transport allocation failure\n" }, { "commit": "d0ed69f3e380276e7ab36f1a3f19702c5e993915", "tree": "1fa742f35805c25ea97abda254f54db1f1fac182", "parents": [ "e728258debd553c95d2e70f9cd97c9fde27c7130", "a83307f34e0bd9b0e595b1074dc8fbcc1b7f3172" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:59:55 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc1-part3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Four bug fixes: OOB read in ioctl query info, 3 ACL fixes\n\n - SMB1 Unix extensions mount fix\n\n - Four crypto improvements: move to AES-CMAC library, simpler and faster\n\n - Remove drop_dir_cache to avoid potential crash, and move to /procfs\n\n - Seven SMB3.1.1 compression fixes\n\n* tag \u0027v7.1-rc1-part3-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: Drop \u0027allocate_crypto\u0027 arg from smb*_calc_signature()\n smb: client: Make generate_key() return void\n smb: client: Remove obsolete cmac(aes) allocation\n smb: client: Use AES-CMAC library for SMB3 signature calculation\n smb: common: add SMB3_COMPRESS_MAX_ALGS\n smb: client: compress: add code docs to lz77.c\n smb: client: compress: LZ77 optimizations\n smb: client: compress: increase LZ77_MATCH_MAX_DIST\n smb: client: compress: fix counting in LZ77 match finding\n smb: client: compress: fix buffer overrun in lz77_compress()\n smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl\n smb: client: fix (remove) drop_dir_cache module parameter\n smb: client: require a full NFS mode SID before reading mode bits\n smb: client: validate the whole DACL before rewriting it in cifsacl\n smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n cifs: update internal module version number\n smb: client: compress: fix bad encoding on last LZ77 flag\n smb: client: fix dir separator in SMB1 UNIX mounts\n" }, { "commit": "e728258debd553c95d2e70f9cd97c9fde27c7130", "tree": "18ef97c80f9923717f5cf6bdab44d77607ca0f4b", "parents": [ "e8df5a0c0d041588e7f02781822d637d226cdbe8", "5e6391da4539c35422c0df1d1d2d9a9bb97cd736" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:50:42 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:50:42 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Netfilter.\n\n Steady stream of fixes. Last two weeks feel comparable to the two\n weeks before the merge window. Lots of AI-aided bug discovery. A newer\n big source is Sashiko/Gemini (Roman Gushchin\u0027s system), which points\n out issues in existing code during patch review (maybe 25% of fixes\n here likely originating from Sashiko). Nice thing is these are often\n fixed by the respective maintainers, not drive-bys.\n\n Current release - new code bugs:\n\n - kconfig: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP\n\n Previous releases - regressions:\n\n - add async ndo_set_rx_mode and switch drivers which we promised to\n be called under the per-netdev mutex to it\n\n - dsa: remove duplicate netdev_lock_ops() for conduit ethtool ops\n\n - hv_sock: report EOF instead of -EIO for FIN\n\n - vsock/virtio: fix MSG_PEEK calculation on bytes to copy\n\n Previous releases - always broken:\n\n - ipv6: fix possible UAF in icmpv6_rcv()\n\n - icmp: validate reply type before using icmp_pointers\n\n - af_unix: drop all SCM attributes for SOCKMAP\n\n - netfilter: fix a number of bugs in the osf (OS fingerprinting)\n\n - eth: intel: fix timestamp interrupt configuration for E825C\n\n Misc:\n\n - bunch of data-race annotations\"\n\n* tag \u0027net-7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (148 commits)\n rxrpc: Fix error handling in rxgk_extract_token()\n rxrpc: Fix re-decryption of RESPONSE packets\n rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets\n rxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n rxgk: Fix potential integer overflow in length check\n rxrpc: Fix conn-level packet handling to unshare RESPONSE packets\n rxrpc: Fix potential UAF after skb_unshare() failure\n rxrpc: Fix rxkad crypto unalignment handling\n rxrpc: Fix memory leaks in rxkad_verify_response()\n net: rds: fix MR cleanup on copy error\n m68k: mvme147: Make me the maintainer\n net: txgbe: fix firmware version check\n selftests/bpf: check epoll readiness during reuseport migration\n tcp: call sk_data_ready() after listener migration\n vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()\n ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim\n tipc: fix double-free in tipc_buf_append()\n llc: Return -EINPROGRESS from llc_ui_connect()\n ipv4: icmp: validate reply type before using icmp_pointers\n selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges\n ...\n" }, { "commit": "e8df5a0c0d041588e7f02781822d637d226cdbe8", "tree": "aeb7d43c945caf4bd87c6d2c9945e67cd24545af", "parents": [ "5fb4fde3b287fdd9097c53fee7126c2f74698073", "79fc229e8a471356ddfea225f42e02f4fb73c469" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:45:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:45:17 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull more i2c updates from Wolfram Sang:\n\n - cx92755: convert I2C bindings to DT schema\n\n - mediatek: add optional bus power management during transfers\n\n - pxa: handle early bus busy condition\n\n - MAINTAINERS: update I2C RUST entry\n\n* tag \u0027i2c-for-7.1-rc1-part2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n MAINTAINERS: add Rust I2C tree and update Igor Korotin\u0027s email\n i2c: mediatek: add bus regulator control for power saving\n dt-bindings: i2c: cnxt,cx92755-i2c: Convert to DT schema\n i2c: pxa: handle \u0027Early Bus Busy\u0027 condition on Armada 3700\n" }, { "commit": "5fb4fde3b287fdd9097c53fee7126c2f74698073", "tree": "175fa19bad07f3a0c5369b7d0bdde9adbf2eb0db", "parents": [ "9c59b464517c6ef0302ffa7d993a979a4cb50bf7", "aa5903b47d4bc0e7d1fb76941731cbda32ef9cbc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:40:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 23 16:40:03 2026 -0700" }, "message": "Merge tag \u0027xtensa-20260422\u0027 of https://github.com/jcmvbkbc/linux-xtensa\n\nPull Xtensa updates from Max Filippov:\n\n - use register_sys_off_handler(SYS_OFF_MODE_RESTART) instead of\n the deprecated register_restart_handler()\n\n - drop custom ucontext.h and reuse asm-generic ucontext.h\n\n* tag \u0027xtensa-20260422\u0027 of https://github.com/jcmvbkbc/linux-xtensa:\n xtensa: uapi: Reuse asm-generic ucontext.h\n xtensa: xtfpga: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n xtensa: xt2000: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n xtensa: ISS: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)\n" }, { "commit": "e49712ef03dbc4e282dd0e76469642279c2811e5", "tree": "3ff1fc4f972978c1638997e7d859ef05e95d1866", "parents": [ "52edde745dde8fff44e9f0eeeb77a4e38ef9eef6", "74b73fa56a395d46745e4f245225963e9f8be7f1" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:17:31 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:17:41 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-04-23\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-next\n\namd-drm-fixes-7.1-2026-04-23:\n\namdgpu:\n- DC idle state manager fix\n- ASPM fix\n- GPUVM SVM fix\n- DCE 6 fix\n\namdkfd:\n- num_of_nodes bounds check fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260423170129.2345978-1-alexander.deucher@amd.com\n" }, { "commit": "52edde745dde8fff44e9f0eeeb77a4e38ef9eef6", "tree": "efa18725a687633485b77cf24367819105ae35ab", "parents": [ "a6fe8bd56f7344b0c42f287c4b744d4d43e31ebe", "f6c73e7156b54d8b9ddf1a27f4e93d3a1e49a73e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:16:33 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Apr 24 09:16:44 2026 +1000" }, "message": "Merge tag \u0027drm-misc-next-fixes-2026-04-23\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next\n\nShort summary of fixes pull:\n\nrcar-du:\n- fix NULL-ptr crash\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260423130852.GA114622@linux.fritz.box\n" }, { "commit": "0c22ed0fadcad620277a56c0ba2867d4850d053a", "tree": "57bd4b666e2edb807c49240104487401abe9d1df", "parents": [ "fc5f996bfb7576f8cffbba09cb02432622ffea61", "15d07f9ef4af71e454cde4eebfbf7676ac0d972e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 14:54:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "Merge branch \u0027remove-a-number-of-isa-and-pcmcia-ethernet-drivers\u0027\n\nAndrew Lunn says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nRemove a number of ISA and PCMCIA Ethernet drivers\n\nThese old drivers have not been much of a Maintenance burden until\nrecently. Now there are more newbies using AI and fuzzers finding\nissues, resulting in more work for Maintainers. Fixing these old\ndrivers make little sense, if it is not clear they have users.\n\nThese mostly ISA and PCMCIA Ethernet devices, mostly from the last\ncentury, a couple from 2001 or 2002. It seems unlikely they are still\nused. However, remove them one patch at a time so they can be brought\nback if somebody still has the hardware, runs modern kernels and wants\nto take up the roll of driver Maintainer.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-0-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15d07f9ef4af71e454cde4eebfbf7676ac0d972e", "tree": "57bd4b666e2edb807c49240104487401abe9d1df", "parents": [ "b0b807aa78d213ee08759130ba6a2e92fb5a3b76" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:58 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: wd80x3: Remove this driver\n\nThe wd80x3 was written by Donald Becker 1993 to 1994. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nAcked-by: Dominik Brodowski \u003clinux@dominikbrodowski.net\u003e\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-15-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b0b807aa78d213ee08759130ba6a2e92fb5a3b76", "tree": "500aaf0ab148713ab62f7599f9eaf0c143ce4f14", "parents": [ "57835223486216bc8b4187269e03dba1dc62168b" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:57 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: ultra: Remove this driver\n\nThe ultra was written by Donald Becker 1993 to 1998. It is an ISA\ndevice, so unlikely to be used with modern kernels.\n\nAcked-by: Dominik Brodowski \u003clinux@dominikbrodowski.net\u003e\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-14-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57835223486216bc8b4187269e03dba1dc62168b", "tree": "87001818cce1b9e575ad21d5fdd66270d4b32560", "parents": [ "51c1c88b64354a1c535799a7751cad20fa32f779" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:55 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: 8390: AX88190: Remove this driver\n\nThe ax88190 was written by David A. Hinds in 2001. It is an PCMCIA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-12-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "51c1c88b64354a1c535799a7751cad20fa32f779", "tree": "af78d62f9c29ed447d98a3aaa5aeb85e7d8615f8", "parents": [ "a3fb9a5bf66071e21f51696816f79bb0c051908c" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Wed Apr 22 13:01:54 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 23 15:57:10 2026 -0700" }, "message": "drivers: net: fujitsu: fmvj18x: Remove this driver\n\nThe fmvj18x was written by Shingo Fujimoto in 2002. It is an PCMCIA\ndevice, so unlikely to be used with modern kernels.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260422-v7-0-0-net-next-driver-removal-v1-v2-11-08a5b59784d5@lunn.ch\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "a3fb9a5bf66071e21f51696816f79bb0c051908c" }