)]}' { "log": [ { "commit": "551c722f40809618230001baccf219193e22fc5a", "tree": "0bf196a56f701d3e13b0faa81ae4513728b9eb3b", "parents": [ "a243ede718463c7b481878656f1ff32a0ce0fd54", "055ef5ce9f67a6a3a1363fa663007f8196cc0fb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 18:54:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 18:54:21 2026 -0700" }, "message": "Merge tag \u0027rtc-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC fixes from Alexandre Belloni:\n \"Mostly small issues found using AI. The efi change is to avoid a\n regression on some platforms\n\n Subsystem:\n - fix a possible information leak\n\n Drivers:\n - efi: restore alarm support with runtime capability probe\"\n\n* tag \u0027rtc-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n rtc: spear: initialize IRQ state before requesting alarm IRQ\n rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()\n rtc: ac100: Fix clock provider use-after-free on probe failure\n rtc: ac100: Assign .num before accessing .hws\n rtc: efi: restore alarm support with runtime capability probe\n rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak\n" }, { "commit": "a243ede718463c7b481878656f1ff32a0ce0fd54", "tree": "cd0a20a14f345ee1e6350b7b35810cd552c928ce", "parents": [ "b004c4b1c4180fc7f2326de4ac941d5edfe16076", "1c1a342aceec79528b3ba51f376eca2be5928fe7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 13:45:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 13:45:18 2026 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull MTD fixes from Miquel Raynal:\n \"The most important set of fixes are around the handling of the QE bit\n in SPI NAND.\n\n There are also a couple of behavioral fixes (mutex issue in SPI-NOR,\n spurious bitflips on vf610_nfc, OOB bytes count in SPI NAND and\n cfi_cmdset stack usage).\n\n The rest is mostly AI fuzzing results\"\n\n* tag \u0027mtd/fixes-for-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n mtd: spinand: Do not update the QE bit on devices without one\n mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()\n mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ\n mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages\n mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB\n mtd: spinand: fix zero oobavail when no ECC engine is used\n mtd: spinand: fix NULL pointer dereference with no ECC engine\n mtd: mtd_intel_dg: reset poll counter for each erase\n mtd: cfi_cmdset_0001: shrink do_write_buffer() stack frame\n mtd: core: call _get_device() with the master MTD\n mtd: core: avoid double-free of OTP NVMEM device\n mtd: spinand: Enable QE on all dies\n mtd: block2mtd: Fix divide error when erase_size is zero\n" }, { "commit": "b004c4b1c4180fc7f2326de4ac941d5edfe16076", "tree": "88abfbd7199ce2848fc5e4a14f1c2e4c28e7236a", "parents": [ "6f8319e3e9a44dd537d17f41565a8453c560a581", "f050c3e61d2a1aaece3170d459e4ce5fa2486c12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 11:30:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 11:30:52 2026 -0700" }, "message": "Merge tag \u0027arc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc\n\nPull ARC fix from Vineet Gupta\n\n - cmpxchg snafu spotted by Bradley and other misc fixes\n\n* tag \u0027arc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:\n ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer\n arc: kernel: Fix clk reference leak in show_cpuinfo()\n arc: remove unused profile.h includes\n ARC: cleanup dead ARC_CANT_LLSC option in Kconfig\n" }, { "commit": "6f8319e3e9a44dd537d17f41565a8453c560a581", "tree": "40f22848d969a66da9d35c7b8d6661f3eab346f8", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e", "976d5e0ddac885b0219252f004f6c561c344df9d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 28 20:11:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 28 20:11:31 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-09-27-19-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - Fix module loading incorrectly returning success after alloc_tag\n codetag setup failed\n\n - Restore MADV_COLLAPSE semantics for shmem so forced collapse ignores\n the shmem THP/mTHP sysfs settings\n\n - Make alloc_tag UAPI structure padding explicit\n\n - Fix DAMON schemes unexpectedly stopping after quotas are disabled\n through the online parameter update interface\n\n - Fix a false SW_TAGS KASAN invalid-access report when freeing vmapped\n task stacks\n\n - Split the MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION MAINTAINERS\n entry into separate MIGRATION and NUMA PLACEMENT entries\n\n - Move memory tiering maintenance under NUMA PLACEMENT\n\n - Add Gregory Price as a NUMA PLACEMENT co-maintainer\n\n - Add Heming Zhao as an ocfs2 reviewer\n\n - Fix mmap_prepare() state being copied onto a merged VMA rather than\n only onto a newly allocated VMA\n\n* tag \u0027mm-hotfixes-stable-2026-09-27-19-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc\n MAINTAINERS: add Heming Zhao as ocfs2 reviewer\n MAINTAINERS: make Gregory a co-maintainer of MEMORY MANAGEMENT - NUMA PLACEMENT\n MAINTAINERS: move memory tiering under MEMORY MANAGEMENT - NUMA PLACEMENT\n MAINTAINERS: split up MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION\n kasan: unpoison task stack below watermark only in generic mode\n mm/damon/core: don\u0027t skip damos_adjust_quota() while esz is not zero\n alloc_tag: avoid implicit padding in uapi\n mm: shmem: ignore sysfs configs for shmem forced collapse\n module: fix lost error code from codetag_load_module()\n" }, { "commit": "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e", "tree": "b9e9f22cee46d79f64ee1d888a80ca0d04dd8df6", "parents": [ "d266640c6c760c9bc215bf5a3ece122ca488b6f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 13:55:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 13:55:01 2026 -0700" }, "message": "Linux 7.3-rc5\n" }, { "commit": "d266640c6c760c9bc215bf5a3ece122ca488b6f5", "tree": "985730170ea1f7e6591dbe6a6d69131424595519", "parents": [ "64d34cef2a32331fedabf25ea8fa8a30128af9f7", "77be3641f3e3a56e42a5ed889372ef395a933f3c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:57:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:57:03 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fix from Danilo Krummrich:\n\n - Suppress spurious \"debugfs is not initialized yet\" boot warnings when\n the caller passes an error parent to debugfs file creation; callers\n propagating an earlier failure should not trigger the warning\n\n* tag \u0027driver-core-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n debugfs: don\u0027t warn about uninitialized debugfs for an error parent\n" }, { "commit": "64d34cef2a32331fedabf25ea8fa8a30128af9f7", "tree": "1dad8ea478eb71dde53c7e093f26d100772bf4e6", "parents": [ "104484baf7484266fa0cb8b26362b105cf2d6a10", "cb97bf3d4f91453b881acaf8e9f0cc47bb40b604" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:26:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:26:10 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fix from Andi Shyti:\n\n - qcom-geni: select the correct source clock table entry\n\n* tag \u0027i2c-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL\n" }, { "commit": "104484baf7484266fa0cb8b26362b105cf2d6a10", "tree": "383026782405c26ea1e260cdc55510a3b7728171", "parents": [ "b1fa457bddf009907b023bc0c09ba4eca3191a8e", "db6365ced4d5855e321f772b240c0e473bcfcdd5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:55:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:55:24 2026 -0700" }, "message": "Merge tag \u0027wq-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fix from Tejun Heo:\n\n - Fix a NULL dereference in the flush dependency check when a worker\n flushes outside a work item, such as from the OOM path during worker\n creation\n\n* tag \u0027wq-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: Fix NULL current_pwq deref in flush dependency check\n" }, { "commit": "b1fa457bddf009907b023bc0c09ba4eca3191a8e", "tree": "f4f64520b9dd4558c7a26a045651fb3ca8ea61af", "parents": [ "7cdf91542e1ed03aa8f5ab029702b3abde5be6d5", "31c88350b7dd1522792f726f79607f31bb55c50f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:51:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:51:45 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fix from Tejun Heo:\n\n - A cpuset partition could claim CPUs an ancestor partition already\n held exclusively. Restore the rejection an earlier change had turned\n into a warning.\n\n* tag \u0027cgroup-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n" }, { "commit": "7cdf91542e1ed03aa8f5ab029702b3abde5be6d5", "tree": "cb8513755a9ac84005cb9792f0eae2cfc0dcc889", "parents": [ "efb44d93a620c294c049db37c810c8ab7ee1122d", "94480606a677deb68d5622cf0ded88626514b3f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:50:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:50:25 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fix from Tejun Heo:\n\n - The CPU topology helper for BPF schedulers took no buffer size, so\n its structure couldn\u0027t grow without breaking schedulers built against\n the older layout. Add a size argument.\n\n* tag \u0027sched_ext-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Add a size argument to scx_bpf_cid_topo() so struct scx_cid_topo can grow\n" }, { "commit": "efb44d93a620c294c049db37c810c8ab7ee1122d", "tree": "095d326e3948f0fc217652bfb3545702831c8f49", "parents": [ "673dab7eac1618b6622bbee9eb2aaa47817631e3", "b8d1d5b63a8ef532038eebd9d97d406860385668" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:44:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:44:12 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix preemption bugs in the SVSM vTPM guest implementation\n (Melody Wang)\n\n - Fix MCE-triggered hardware debug register corruption on\n task migration (Masami Hiramatsu)\n\n* tag \u0027x86-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mce: Fix hardware debug register corruption on task migration\n x86/sev: Make vTPM SVSM calls preemption-safe\n" }, { "commit": "673dab7eac1618b6622bbee9eb2aaa47817631e3", "tree": "d0e914a549a5b6faa0b6ca1b11ec7a2cc2b6c952", "parents": [ "5ccda18d1ba2ecf436102a211baf1fbd5d81703f", "a0bb6fac53fa7cf1cadb487b43d4c9276a6b82e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:24:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:24:16 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix LLC mis-scheduling bugs (Tim Chen, Lu Wang)\n\n - Fix cache-grouping related scheduling statistics UAF bugs (Tim Chen)\n\n - Skip kernel threads for cache aware scheduling to rubustify the code\n (Chen Yu)\n\n - Refresh LLC capacity across CPU hotplug, to fix capacity\n underestimation bug (Davi Chaves Azevedo)\n\n - Account PSI IRQ time to the execution context, not the scheduling\n context, to fix proxy scheduling accounting bug (Zhan Xusheng)\n\n* tag \u0027sched-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/core: Account PSI IRQ time to the execution context, not the scheduling context\n sched/cache: Refresh LLC capacity across CPU hotplug, to fix capacity underestimation bug\n sched/cache: Skip kernel threads for cache aware scheduling to rubustify the code\n sched/cache: Introduce task_struct-\u003esched_cache_grp to fix UAF\n sched/cache: Decouple sched_cache_group from mm to fix UAF\n sched/cache: Honor migrate_llc_task semantics in active load balance, to fix LLC mis-scheduling bug\n sched/cache: Keep nr_pref_llc_running in the runnable domain, to fix LLC mis-scheduling bug\n" }, { "commit": "5ccda18d1ba2ecf436102a211baf1fbd5d81703f", "tree": "adc457d112f1f87ef0fe8c97f9ad7ccf54c3de0d", "parents": [ "fd179f8a05be3ccae366b9b96e176b51fbe54aab", "24b620729e53d978b3e425f55bc66efd3bab1f59" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:15:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:15:58 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fixes for KVM guest PEBS virtualization (Sean Christopherson)\n\n - Fixes for various Intel PMUs related to PEBS data-source (Dapeng Mi)\n\n - Fix Intel Panther Cove event scheduling constraints (Dapeng Mi)\n\n - Fix Intel DMR/NVL OMR extra registers event scheduling (Dapeng Mi)\n\n - Rename two confusingly named PMU attributes (Dapeng Mi)\n\n - Fix a refcount leak in attach_perf_ctx_data() (Namhyung Kim)\n\n - Fix NULL pointer dereference crash in __perf_pmu_sched_task()\n (Puranjay Mohan)\n\n - Fix CPU-wide event scheduling (Puranjay Mohan)\n\n - Fix x86 LBR branch entry generation (Puranjay Mohan)\n\n* tag \u0027perf-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fill branch entries with a single assignment\n perf/core: Run sched_task() for PMUs with only CPU-wide events\n perf/core: Fix NULL pmu_ctx passed to pmu-\u003esched_task()\n perf/core: Fix a refcount leak in attach_perf_ctx_data()\n perf/x86/intel: Rename NVL offcore_rsp attribute to offmodule_rsp\n perf/x86/intel: Rename DMR offcore_rsp attribute to offmodule_rsp\n perf/x86/intel: Fix precise OMR event scheduling for DMR/NVL\n perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to PMCs 0-3\n perf/x86/intel: Delete dead NVL PEBS data-source initcall\n perf/x86/intel: Fix Panther Cove PEBS data-source snoop states\n perf/x86/intel: Remove incorrect Panther Cove PEBS data-source constraints\n perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints\n perf/x86/intel: Update arw_latency_data() mem-op direction handling\n perf/x86/intel: Fix DKT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Fix CMT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()\n perf/x86/intel: Don\u0027t pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused\n perf/x86/intel: Don\u0027t write PEBS_ENABLED on host\u003c\u003d\u003eguest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED\n perf/x86/intel: Ensure KVM guest PEBS path doesn\u0027t set unwanted PERF_GLOBAL_CTRL bits\n" }, { "commit": "db6365ced4d5855e321f772b240c0e473bcfcdd5", "tree": "9fc275da334edaba7504c847b121b39664962660", "parents": [ "93e257938aa67a6c957217db94091d9d9e5d403f" ], "author": { "name": "Pavankumar Kondeti", "email": "pavan.kondeti@oss.qualcomm.com", "time": "Fri Sep 25 15:25:12 2026 +0530" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 22:18:50 2026 -1000" }, "message": "workqueue: Fix NULL current_pwq deref in flush dependency check\n\ncheck_flush_dependency() uses current_wq_worker() to determine whether\nthe caller is a workqueue worker and then dereferences worker-\u003ecurrent_pwq\nto test whether the current workqueue is WQ_MEM_RECLAIM.\n\ncurrent_wq_worker() only means that %current has PF_WQ_WORKER set. A\nkworker can reach check_flush_dependency() while it is not executing a\nwork item. One such path is worker_thread() acting as the pool manager,\nwhere create_worker() does GFP_KERNEL allocation and the allocation path\ninvokes the OOM notifier. In that state worker-\u003ecurrent_pwq is NULL\nbecause current_pwq is set only by process_one_work() and cleared again\nafter the work function returns.\n\n[ 416.760634][ T375] Call trace:\n[ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P)\n[ 416.760648][ T375] __flush_work+0x98/0x224\n[ 416.760657][ T375] flush_work+0x30/0x44\n[ 416.760665][ T375] ...\n[ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0\n[ 416.760719][ T375] out_of_memory+0xb4/0x458\n[ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8\n[ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c\n[ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4\n[ 416.760753][ T375] new_slab+0x12c/0x484\n[ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c\n[ 416.760765][ T375] __slab_alloc+0x74/0xd8\n[ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304\n[ 416.760779][ T375] alloc_worker+0x28/0x60\n[ 416.760785][ T375] create_worker+0x4c/0x20c\n[ 416.760790][ T375] worker_thread+0xe8/0x2b8\n[ 416.760796][ T375] kthread+0x1a8/0x200\n[ 416.760805][ T375] ret_from_fork+0x10/0x20\n\nGuard the WQ_MEM_RECLAIM-worker warning with worker-\u003ecurrent_pwq. If the\nkworker is not currently executing a work item, there is no current\nworkqueue to diagnose with that warning. The PF_MEMALLOC warning is left\nunchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target\nis still reported.\n\nFixes: fca839c00a12 (\"workqueue: warn if memory reclaim tries to flush !WQ_MEM_RECLAIM workqueue\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Pavankumar Kondeti \u003cpavan.kondeti@oss.qualcomm.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "976d5e0ddac885b0219252f004f6c561c344df9d", "tree": "c517142d3cf314f2f45484fd57db51ecff83caf1", "parents": [ "6cc8f549f6888e36036ab14d84a8ec46b4a393c0" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Wed Sep 23 18:45:41 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:11 2026 -0700" }, "message": "mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc\n\nIt only makes sense to manipulate VMA fields if a new VMA was allocated,\nrather than merged.\n\nVMA merging does not compare vm_ops or vm_private_data, so a merged VMA\nkeeps its own, which is also what the legacy f_op-\u003emmap path does since it\nnever touches an existing VMA.\n\nCurrently, these fields will get overwritten by whatever state is\nestablished in the mmap_prepare hook, and if the VMA was merged,\nvm_ops-\u003emapped will not have been called, so this could destructively\nclear existing state without replacing it with anything valid.\n\nThere is an implicit requirement that vm_private_data and vm_ops are\nfungible across VMAs which means that losing the \u0027new\u0027 state is fine.\n\nHowever in this case the \u0027old\u0027 state is being overwritten by potentially\ninvalid \u0027new\u0027 state, so this must be rectified.\n\nAdditionally constify have_mmap_prepare while here.\n\nAll existing in-tree users either derive state from the file or are\nunmergeable due to VMA flags, so this has no direct impact.\n\nLink: https://lore.kernel.org/20260923-fix-mmap-prepare-overwrite-v1-1-3b3f1bfcdf5e@kernel.org\nFixes: c84bf6dd2b83 (\"mm: introduce new .mmap_prepare() file callback\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nReviewed-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "6cc8f549f6888e36036ab14d84a8ec46b4a393c0", "tree": "d95af7314fb56ae862893a2018ac19acdd4c5e84", "parents": [ "b3f0c1a4e41f356c3126a676ad55c0f6881e7514" ], "author": { "name": "Joseph Qi", "email": "joseph.qi@linux.alibaba.com", "time": "Wed Sep 23 08:39:20 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:11 2026 -0700" }, "message": "MAINTAINERS: add Heming Zhao as ocfs2 reviewer\n\nHeming Zhao has contributed ocfs2 a lot recent years, both as a author and\nreviewer. So add him as ocfs2 reviewer.\n\nLink: https://lore.kernel.org/20260923003920.2382398-1-joseph.qi@linux.alibaba.com\nSigned-off-by: Joseph Qi \u003cjoseph.qi@linux.alibaba.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Heming Zhao \u003cheming.zhao@suse.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\n" }, { "commit": "b3f0c1a4e41f356c3126a676ad55c0f6881e7514", "tree": "2d0c3c05edf0f44c02065dbbed8aa8eadcccdf1c", "parents": [ "4050a73a90f456887dc35d5bbfa4f4790eb5c2cf" ], "author": { "name": "David Hildenbrand (Arm)", "email": "david@kernel.org", "time": "Fri Sep 18 18:34:26 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:11 2026 -0700" }, "message": "MAINTAINERS: make Gregory a co-maintainer of MEMORY MANAGEMENT - NUMA PLACEMENT\n\nGregory is extremely familiar with NUMA placement handling and volunteer\nto help co-maintain the numa placement bits. So add him as a\nco-maintainer.\n\nLink: https://lore.kernel.org/20260918-maintainers-mempolicy-v1-3-9a94cac6d135@kernel.org\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nAcked-by: Gregory Price (Meta) \u003cgourry@gourry.net\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nAcked-by: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Byungchul Park \u003cbyungchul@sk.com\u003e\nCc: \"Huang, Ying\" \u003cying.huang@linux.alibaba.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Rakie Kim \u003crakie.kim@sk.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\n" }, { "commit": "4050a73a90f456887dc35d5bbfa4f4790eb5c2cf", "tree": "6429d6a1827a583ba56b748d18b682ad06186121", "parents": [ "711d886fe76e28854814759f51ee175e279ef8c7" ], "author": { "name": "David Hildenbrand (Arm)", "email": "david@kernel.org", "time": "Fri Sep 18 18:34:25 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:11 2026 -0700" }, "message": "MAINTAINERS: move memory tiering under MEMORY MANAGEMENT - NUMA PLACEMENT\n\nNUMA PLACEMENT is a better place for memory tiering.\n\nMy best guess is that existing MISC reviewers are not that interested in\nmemory tiering, so don\u0027t carry any over.\n\nLink: https://lore.kernel.org/20260918-maintainers-mempolicy-v1-2-9a94cac6d135@kernel.org\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nReviewed-byt: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Byungchul Park \u003cbyungchul@sk.com\u003e\nCc: Gregory Price \u003cgourry@gourry.net\u003e\nCc: \"Huang, Ying\" \u003cying.huang@linux.alibaba.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Rakie Kim \u003crakie.kim@sk.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\n" }, { "commit": "711d886fe76e28854814759f51ee175e279ef8c7", "tree": "5b65aa979e58639b17d9a4d03088b0d580186eaf", "parents": [ "22ab0647764c38924669673634ae333578d77768" ], "author": { "name": "David Hildenbrand (Arm)", "email": "david@kernel.org", "time": "Fri Sep 18 18:34:24 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:10 2026 -0700" }, "message": "MAINTAINERS: split up MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION\n\nPatch series \"MAINTAINERS: rework MEMORY MANAGEMENT - MEMORY POLICY\".\n\nLet\u0027s rework MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION.\n\nAs I can use some maintenance help in that area, add Gregory as a new\nco-maintainer for the split out MEMORY MANAGEMENT - NUMA PLACEMENT\nsection.\n\n\nThis patch (of 3):\n\nLet\u0027s split it up into MIGRATION and NUMA PLACEMENT. The latter is a\nbetter fitting description for mempolicy.c.\n\nMake a best guess about which pieces existing reviewers are interested in.\nMove the split sections to keep alphabetical order.\n\nLink: https://lore.kernel.org/20260918-maintainers-mempolicy-v1-1-9a94cac6d135@kernel.org\nSigned-off-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Byungchul Park \u003cbyungchul@sk.com\u003e\nCc: Gregory Price \u003cgourry@gourry.net\u003e\nCc: \"Huang, Ying\" \u003cying.huang@linux.alibaba.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Rakie Kim \u003crakie.kim@sk.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\n" }, { "commit": "22ab0647764c38924669673634ae333578d77768", "tree": "a954ddf7069cd14e8447a4b5788a64880e77f419", "parents": [ "52ae167ce16609c7e6fffef588b3c2c26de2db19" ], "author": { "name": "Andrey Ryabinin", "email": "ryabinin.a.a@gmail.com", "time": "Wed Sep 16 19:51:13 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:10 2026 -0700" }, "message": "kasan: unpoison task stack below watermark only in generic mode\n\nCPU resume and BPF exception handling can discard stack frames without\nrunning their compiler-generated epilogues. Generic KASAN needs\nkasan_unpoison_task_stack_below() to clear the redzones left behind by\nthose frames before the stack is reused.\n\nCONFIG_KASAN_STACK also enables this helper for SW_TAGS. The helper\nderives the stack base from an untagged stack pointer, so kasan_unpoison()\nwrites KASAN_TAG_KERNEL (0xff) into the shadow for [base, watermark). For\na vmapped task stack, vm_area-\u003eaddr still carries the original random\nallocation tag. This creates a tag mismatch at the stack base even if\nthat memory has never held an instrumented stack object.\n\nWhen the task exits and its stack is not cached, thread_stack_free_rcu()\npasses vm_area-\u003eaddr to vfree(). In RCU callback context this reaches\nvfree_atomic(), whose llist_add() writes to the allocation base through\nthe tagged pointer and triggers a false KASAN invalid-access report:\n\n BUG: KASAN: invalid-access in vfree_atomic+0x90/0x150\n Write of size 8 at addr c2ffffc0a8f70000 by task rcuop/7/75\n Pointer tag: [c2], memory tag: [ff]\n Call trace:\n __hwasan_store8_noabort+0xe8/0xf8\n vfree_atomic+0x90/0x150\n vfree+0x220/0x298\n thread_stack_free_rcu+0x3c/0x4c\n rcu_do_batch+0x308/0xaf0\n rcu_nocb_cb_kthread+0x33c/0x708\n\nThe deferred-free path started using the tagged vm_area-\u003eaddr in commit\n449e0b4ed5a1 (\"fork: clean-up naming of vm_stack/vm_struct variables in\nvmap stacks code\"). Previously it freed the untagged pointer derived from\ntsk-\u003estack, so the write was never tag-checked.\n\nSW_TAGS does not need the blanket shadow reset to make subsequent stack\naccesses valid: untagged kernel pointers have the match-all 0xff tag, and\nthe compiler initializes the shadow tags of instrumented stack objects\nbefore use.\n\nReturn early unless CONFIG_KASAN_GENERIC is enabled. Keep the mode check\nin the common helper so it covers both resume and bpf_throw().\n\nLink: https://lore.kernel.org/20260916175113.1327454-1-ryabinin.a.a@gmail.com\nFixes: 449e0b4ed5a1 (\"fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code\")\nSigned-off-by: Andrey Ryabinin \u003cryabinin.a.a@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Shaobo Huang \u003chuangshaobo3@xiaomi.com\u003e\nCloses: https://lore.kernel.org/all/20260806123020.90869-1-huangshaobo3@xiaomi.com/\nAssisted-by: LLM\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: Andrey Konovalov \u003candreyknvl@gmail.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Vincenzo Frascino \u003cvincenzo.frascino@arm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "52ae167ce16609c7e6fffef588b3c2c26de2db19", "tree": "100d4d9bdb98a024e93219e0c588615a49bd5841", "parents": [ "347c6ed8cf7768883252e106994de62c7947f0a0" ], "author": { "name": "SJ Park", "email": "sj@kernel.org", "time": "Wed Sep 16 06:50:19 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:10 2026 -0700" }, "message": "mm/damon/core: don\u0027t skip damos_adjust_quota() while esz is not zero\n\nDAMOS could unexpectedly stop working when a user disables quota using the\nonline parameters commit feature. Fix it by correcting a wrong quota\nunset check in damos_adjust_quota().\n\nDAMON users could disable all quotas by unsetting time and size quotas,\nand removing all quota goals. The intention of disabling quotas would be\nmaking DAMOS run at full speed. When such quota disabled setup is\ndetected, damos_adjust_quota() skips all its work. The skipped works\ninclude effective size quota (damos_quota-\u003eesz) updates and charged quota\namount (damos_quota-\u003echarged_sz) resets. The intention is to avoid doing\nunnecessary work when quotas are disabled.\n\nHowever, users could do the setup while effective size quota is non-zero,\nby doing the disabling with the online DAMON parameters commit feature. \nIn this case, because the effective size quota exists, DAMOS will keep\nworking with the quota until it is fully charged. After the effective\nquota is fully charged, the charged quota amount (damos_quota-\u003echarged_sz)\ncannot be reset because damos_adjust_quota() skips it. Then, DAMOS stops\nworking until the quota is newly set or DAMON is entirely restarted.\n\nThe problem happens because damos_adjust_quota() assumes the user setup\nfor disabling quota immediately disabled it. In reality, the quota is\nstill working until the effective size quota is also updated to zero. \nOther logic for catching that uses damos_quota_is_set(), which understands\nthe fact and therefore checks the effective size quota in addition to the\nuser setup. Fix the issue by using damos_quota_is_set() in\ndamos_adjust_quota() to determine if its works should be skipped.\n\nThe user impact is a non-deterministic and unexpected DAMOS stop behavior.\nThat is, users would disable quotas using the online parameters commit\nfeature, expecting DAMOS will run at full speed. However, depending on\nthe timing, the setup can be updated while the effective size quota is\nnon-zero. Due to the above mentioned internal mechanism, DAMOS stops\nworking instead of running at full speed. It is unexpected behavior. It\nis also non-deterministic because sometimes the setup is done when the\neffective size quota is zero, depending on the timing. It doesn\u0027t cause\ncritical issues like crashes or leaks. Users can simply set a reasonable\nquota again, or restart DAMON. But definitely it is an unexpected and\nnon-deterministic behavior that makes it difficult to reliably use. Also\ninvestigating the root cause of the behavior would be quite difficult.\n\nLink: https://lore.kernel.org/20260916135020.86483-1-sj@kernel.org\nFixes: da87878010e5 (\"mm/damon/sysfs: support online inputs update\")\nSigned-off-by: SJ Park \u003csj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 5.19.x\n" }, { "commit": "347c6ed8cf7768883252e106994de62c7947f0a0", "tree": "8d01534e2b927685b767c9b74e74111c15ee6b9e", "parents": [ "72c3d682c165b836b54a3d07a01f72e39c47022c" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Tue Sep 15 22:23:47 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:10 2026 -0700" }, "message": "alloc_tag: avoid implicit padding in uapi\n\nThe implied padding causes a harmless warning when testing the uapi\nheaders with -Wpadded that could in theory indicate incompatibilities\nor data leaks:\n\n./usr/include/linux/alloc_tag.h:41:1: error: padding struct size to alignment boundary with 7 bytes [-Werror\u003dpadded]\n\nThe code here is fine, but it\u0027s better to make the padding explicit and\navoid the warning here.\n\nLink: https://lore.kernel.org/20260916065830.1619425-1-arnd@kernel.org\nLink: https://lore.kernel.org/20260915202404.3568029-1-arnd@kernel.org\nFixes: 1d581ab2348c (\"alloc_tag: add ioctl to /proc/allocinfo\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nAcked-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nAcked-by: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Hao Ge \u003chao.ge@linux.dev\u003e\n" }, { "commit": "72c3d682c165b836b54a3d07a01f72e39c47022c", "tree": "299e7f2876d645c0663f827b9cfe735fde25a535", "parents": [ "c79cf15eb35a4c703bf18f8c33c47e80dd660f8e" ], "author": { "name": "Baolin Wang", "email": "baolin.wang@linux.alibaba.com", "time": "Mon Sep 14 10:12:41 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:09 2026 -0700" }, "message": "mm: shmem: ignore sysfs configs for shmem forced collapse\n\nAccording to Documentation/mm/transhuge.rst, MADV_COLLAPSE is expected to\nignore any THP or mTHP interface settings.\n\nHowever, after commit 26c7d8413aaf (\"mm: thp: support \"THPeligible\"\nsemantics for mTHP with anonymous shmem\"), performing MADV_COLLAPSE on\nshmem will depend on /sys/.../hugepages-2048kB/shmem_enabled being set to\n\"inherit\" (although that is the default), which can cause MADV_COLLAPSE to\nfail unexpectedly.\n\nThis could cause a userspace-visible performance regression.\n\nFix this by returning the result of shmem_huge_global_enabled() directly\nwhen MADV_COLLAPSE is requested, allowing PMD-order collapse while\nignoring shmem THP/mTHP settings.\n\nLink: https://lore.kernel.org/063f655b4d6c4234f3aa27ed6ecab10283ecb880.1789351825.git.baolin.wang@linux.alibaba.com\nFixes: 26c7d8413aaf (\"mm: thp: support \"THPeligible\" semantics for mTHP with anonymous shmem\")\nSigned-off-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260908125105.1510704-7-kirill@shutemov.name/\nReviewed-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nAcked-by: Zi Yan \u003cziy@nvidia.com\u003e\nReviewed-by: Lance Yang \u003clance.yang@linux.dev\u003e\nReviewed-by: Barry Song \u003cbaohua@kernel.org\u003e\nAcked-by: Qi Zheng \u003cqi.zheng@linux.dev\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nCc: Dev Jain \u003cdev.jain@arm.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "c79cf15eb35a4c703bf18f8c33c47e80dd660f8e", "tree": "9280fb9bb723d711a87d6e595de091c1f104fc2f", "parents": [ "fe2ec83746e501645709761605c2464a44fd2929" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Thu Aug 27 11:05:03 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Sat Sep 26 13:55:09 2026 -0700" }, "message": "module: fix lost error code from codetag_load_module()\n\nIf codetag_load_module() fails, err is not set to reflect the failure\nand load_module() returns 0 after the module has been torn down.\n\nAlso, if the module is a livepatch, mod-\u003eklp_info allocated by\ncopy_module_elf() leaks on this error path. Free it via a new\nlivepatch_cleanup label.\n\nLink: https://lore.kernel.org/20260827030503.49171-1-hao.ge@linux.dev\nFixes: 044d2aee6c57 (\"alloc_tag: handle module codetag load errors as module load failures\")\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSuggested-by: Petr Pavlu \u003cpetr.pavlu@suse.com\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nCc: Aaron Tomlin \u003catomlin@atomlin.com\u003e\nCc: Luis Chamberalin \u003cmcgrof@kernel.org\u003e\nCc: Sami Tolvanen \u003csamitolvanen@google.com\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "94480606a677deb68d5622cf0ded88626514b3f2", "tree": "aea4107658e2745f85fe4af1e3d396183feeea5d", "parents": [ "4409a85735cdca5c4c400c0dad1feee091872eee" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 09:23:02 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 10:09:12 2026 -1000" }, "message": "sched_ext: Add a size argument to scx_bpf_cid_topo() so struct scx_cid_topo can grow\n\nscx_bpf_cid_topo() copies struct scx_cid_topo into a buffer the BPF program\nsized from its own vmlinux.h while the verifier sizes the write from the\nrunning kernel\u0027s BTF. The struct may grow and each growth then breaks every\nscheduler built against the older layout, rejected at load or written past\nits buffer. This is the usual hole for a struct handed to BPF, closed\nelsewhere with a size argument, and it was missed here.\n\nTake the buffer size, copy the smaller of it and the kernel\u0027s struct and set\nthe rest to -1. Accesses to the copy are CO-RE relocated, so the struct can\ngrow by appending fields, which its comment now states. The kfunc changes in\nplace: the cid interface is still being finalized and no released scheduler\nuses the current form.\n\nFixes: e9b55af47edf (\"sched_ext: Add topological CPU IDs (cids)\")\nCc: stable@vger.kernel.org # v7.2+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "fd179f8a05be3ccae366b9b96e176b51fbe54aab", "tree": "6fd0a86c6653717c718ee2a67d43f45c5e25ac53", "parents": [ "fddfc3ec31799a932bb92f1b8a84cb3d1f963be9", "113dcdfadf30ea11fbbdfcd4f6ea87687655cc5b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 11:14:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 11:14:35 2026 -0700" }, "message": "Merge tag \u0027ata-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Extend the quirk \"no LPM on ATI\" quirk, that is currently only\n applied for Samsung drives, to include AMD controllers as well.\n\n The AMD AHCI controllers are newer versions of the ATI AHCI\n controllers, and these controllers still have LPM issues with\n Samsung drives - LPM works with drives from other vendors (me)\n\n - Fix errors in the libata.force parameter documentation (me)\n\n - Verify the sense data descriptor lengths for ATA PASS-THROUGH\n command, so that a malicious device cannot write past the buffer\n length (Matthias)\n\n - Mention the libata for-next branch in MAINTAINERS such that the\n git ls-remote command done by get_maintainer.pl --self-test\u003dscm\n can verify it (Matthias)\n\n* tag \u0027ata-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n MAINTAINERS: name the libata/linux for-next branch\n ata: libata-scsi: bound the ATA passthru sense descriptor writes\n ata: libata: Correct libata.force parameter documentation\n ata: libata-core: Extend Samsung LPM quirk to AMD controllers\n" }, { "commit": "31c88350b7dd1522792f726f79607f31bb55c50f", "tree": "178864e68d77a689ee0e94de38d977bedf6ea93e", "parents": [ "1765a153d985c231357145e26798f9408db10e42" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Thu Sep 24 04:27:27 2026 +0000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 08:07:26 2026 -1000" }, "message": "cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent-\u003epartition_root_state \u003d\u003d PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp-\u003enew_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n mkdir -p /tmp/cg1\n mount -t cgroup2 none /tmp/cg1\n echo \"+cpuset\" \u003e /tmp/cg1/cgroup.subtree_control\n\n mkdir /tmp/cg1/A\n echo 1 \u003e /tmp/cg1/A/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/cpuset.cpus.exclusive\n echo root \u003e /tmp/cg1/A/cpuset.cpus.partition\n echo \"+cpuset\" \u003e /tmp/cg1/A/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B\n echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus.exclusive\n echo \"+cpuset\" \u003e /tmp/cg1/A/B/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B/D\n echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n echo root \u003e /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp-\u003enew_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nFixes: 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs\")\nSuggested-by: Guopeng Zhang \u003cguopeng.zhang@linux.dev\u003e\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nReviewed-by: Waiman Long \u003clongman@redhat.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "fddfc3ec31799a932bb92f1b8a84cb3d1f963be9", "tree": "e58931420843a71d64cd014fdc7c9b4d34ba16ca", "parents": [ "efb27d47677397961c9017c0f8f469eb25a15d68", "4fde448225123442c5796f54b7a4400e2d3cbaf6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 09:59:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 09:59:59 2026 -0700" }, "message": "Merge tag \u0027pci-v7.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Make BAR resize work even for devices where no upstream bridge is\n visible to the OS, which fixes an amdgpu regression on SolidRun\n HoneyComb, which doesn\u0027t expose Root Ports to the OS (Liz Fong-Jones)\n\n - Omit bus properties in dynamic OF nodes when a bridge has no\n subordinate bus, which fixes early boot hangs caused by NULL pointer\n dereferences with CONFIG_PCI_DYNAMIC_OF_NODES enabled (Angel J)\n\n - Disable enhanced atomics on AMD NBIO 7.7 and 7.11 to avoid silent\n data corruption on 64-bit DMAs (Mario Limonciello)\n\n* tag \u0027pci-v7.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11\n PCI: of_property: Omit bus properties without a subordinate bus\n PCI: Fix BAR resize for devices on a root bus\n" }, { "commit": "efb27d47677397961c9017c0f8f469eb25a15d68", "tree": "b12031100ff54150265aca97defb079968d1a6d9", "parents": [ "eff8d2791c086388ba5bae36385afd9bc6f0507e", "5bfa9f1a9dcb6ecb607adbc1c0226605c972935b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:36:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:36:29 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probe fixes from Masami Hiramatsu:\n\n - kprobes: Fix permanent hang when flushing the kprobe optimizer\n\n Fix a deadlock when disabling kprobe optimization via sysctl or\n debugfs where flushers hung waiting for optimizer_completion.\n Replaced the completion with an optimizer_passes counter and\n wait_var_event_mutex() under kprobe_mutex so concurrent flushers can\n wait and wake up safely.\n\n - fprobe: Terminate the fgraph_data list when the reservation is not\n filled\n\n Fix an issue where unused shadow stack data left uninitialized by\n fprobe_fgraph_entry() was misparsed as stale fprobe headers on\n return. Explicitly write a zero word to terminate the list and update\n read_fprobe_header() to handle the zeroed slot properly.\n\n - ftracetest: Fix unique symbol check in kprobe_non_uniq_symbol.tc\n\n Fix false test failures in kprobe_non_uniq_symbol.tc on architectures\n like s390 where a symbol exists once in core kernel but also in\n modules. Anchor the /proc/kallsyms search regex to the end of the\n line so that module symbols are not incorrectly counted.\n\n* tag \u0027probes-fixes-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n kprobes: Fix permanent hang when flushing the kprobe optimizer\n fprobe: Terminate the fgraph_data list when the reservation is not filled\n selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc\n" }, { "commit": "eff8d2791c086388ba5bae36385afd9bc6f0507e", "tree": "98f599bf0edf5f3ab510c7d2cc8cf11a969fcdc4", "parents": [ "6812ce4e4379ffc99c52401ec28f0d7ffbc36206", "c2f24f140c2ee6c00775c2a93c6ac931acec2b60" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:26:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:26:12 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Arm:\n\n - Invalidate the ITS translation cache when the guest changes the\n base address of the ITS tables (Fuad Tabba)\n\n - Skip saving ITS devices with device IDs that are out-of-bounds\n rather than failing the entire ITS save ioctl (Fuad Tabba)\n\n - Close race between VM teardown and invalidations of nested MMUs\n when handling MMU operations that are allowed to block (Lorenzo\n Stoakes)\n\n - Various fixes for the handling of the host\u0027s untrusted SVE\n configuration in pKVM (Fuad Tabba)\n\n - Make sure that empty SMCCC ranges based at 0 are rejected by the\n kvm_smccc_set_filter() (Karl Mehltretter)\n\n - Revoke the host mapping for pKVM\u0027s private stack pages, along with\n a new sanity check that all mappings in the hyp\u0027s private VA range\n have been correctly marked as hyp-owned (Fuad Tabba)\n\n - Lifetime fixes for the array of shadow stage-2 MMUs, ensuring that\n concurrent vCPU initialization cannot relocate in-use MMUs. Defer\n the freeing of shadow stage-2 MMUs to the point that no other users\n (e.g. MMU notifier) could reference them (Marc Zyngier)\n\n - Drop useless WARN when rejecting an unsupported ioctl for pKVM\n (Fuad Tabba)\n\n - Fix the steal_time selftest to install correctly-sized mappings for\n non-4K hosts (Sebastian Ott)\n\n - Correct mapping of fine-grained trap for GCSPOPX instruction (Mark\n Brown)\n\n - Fix KVM_BUG_ON() due to missing handling of DBGBXVR\u003cn\u003e from 32-bit\n guests (Karl Mehltretter)\n\n RISC-V:\n\n - Synchronize hrtimer during VCPU teardown\n\n - Fix the conversion between vsip and hvip values\n\n - Serialize IMSIC attributes with vCPU migration\n\n - Release unused page after MMU invalidation\n\n - Propagate interrupted G-stage faults to KVM user-space as EINTR\n\n - Fix nested acceleration hfence entry update order\n\n - Fix sdata leak and stale snapshot_addr in snapshot_set_shmem\n\n - Preserve firmware counter value across PMU counter stop/start\n\n - Report PMU snapshot write failure to the guest\n\n - Fix perf-backed counter accounting across PMU stop and read\n\n - Correctly propagate error of a hart status SBI call\n\n s390:\n\n - Ensure that accesses through kvm_arch_set_irq_inatomic mark as\n dirty the pages that contain indicator and summary bits\n\n - Fix compile warning for kvm_s390_update_cmma_dirty()\n\n - Fix incorrect propagation of ENOENT from _gaccess_shadow_fault() to\n userspace\n\n - Move s390_kvm_mmu_commit_memory_region() into\n s390_kvm_mmu_prepare_memory_region() so that it can fail instead of\n WARN\n\n - Add missing srcu in kvm_s390_set_irq_state()\n\n - Fix potential races in storage functions\n\n - Fix race in _destroy_pages_crste()\n\n - Fix issues in the handling of KVM interrupt and page resources,\n when a queue that is assigned to a mediated device (mdev) is\n removed from the host\u0027s AP configuration\n\n - Fix loop condition in uv_find_secrets\n\n - Prevent potential out-of-bounds read\n\n x86:\n\n - Fix a brown paper bag bug where KVM would incorrectly treat Intel\n PMU MSRs as valid on AMD\n\n - Fix a regression in the hardware disable selftest where it checked\n the wrong macro when detecting glibc support (breaks at least musl)\n\n - Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is\n especially important for KVM_BUG_ON() flows, which often guard more\n dangerous bugs\n\n - Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a\n bug where KVM would let userspace run a broken setup with stale\n vmcs12 pages\n\n - Fix a class of bugs where KVM would fail to fill kvm_run exit\n fields if getting nested pages failed\n\n - Treat reserved entries in the memory attributes xarray as \"no\n attributes\", to fix false positives when checking for mixed\n attributes\n\n - Fix memcg accounting for the memory attributes xarray (the xarray\n library subtly requires the xarray to be configured for accounting\n upfront; the gfp flags taken at runtime are used only rarely)\n\n - Don\u0027t pre-reserve xarray entries when storing empty attributes, as\n storing NULL must not require memory allocation (KVM and other\n subsystems heavily rely on this behavior)\n\n - Fix a memory leak and a cache maintenance issue related to doing\n intra-host migration on an SEV guest\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (54 commits)\n KVM: SEV: Do cache maintenance on the source VM during intra-host migration\n KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n KVM: Don\u0027t pre-reserve xarray entries when storing empty/NULL attributes\n KVM: Ensure memory attributes xarray nodes are accounted to the caller\u0027s memcg\n KVM: Don\u0027t treat reserved xarray entries as having memory attributes\n KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths\n KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n KVM: arm64: Fix AArch32 DBGBXVR\u003cn\u003e handling\n KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP\n KVM: selftests: fix steal_time for arm64 with host page size \u003e 4K\n KVM: arm64: Don\u0027t WARN on an unknown VM ioctl in protected mode\n KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n KVM: arm64: nv: Fix life cycle of the nested_mmus array\n KVM: arm64: Check every private mapping is hyp-owned at pKVM init\n KVM: arm64: Move the private VA allocation cursor to __io_map_next\n KVM: arm64: Match hyp text by physical address in fix_host_ownership()\n KVM: arm64: Transfer the hyp stack pages out of the host stage-2\n KVM: arm64: selftests: Test empty SMCCC filter range at base 0\n KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0\n KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2\n ...\n" }, { "commit": "c2f24f140c2ee6c00775c2a93c6ac931acec2b60", "tree": "fd13802556683cc72528d35173ccbc4429742f73", "parents": [ "93de2a6a4b91b72607136dd656edf03fb399d27f", "119e9db233ad0f4cbd4cfb9f9385a7bca378b37d" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:40:07 2026 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:40:07 2026 -0400" }, "message": "Merge tag \u0027kvm-x86-fixes-7.3-rc5\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM fixes for 7.3-rcN\n\n - Fix a brown paper bag bug where KVM would incorrectly treat Intel PMU MSRs\n as valid on AMD.\n\n - Fix a regression in the hardware disable selftest where it checked the wrong\n macro when detecting glibc support (breaks at least musl).\n\n - Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is especially\n important for KVM_BUG_ON() flows, which often guard more dangerous bugs.\n\n - Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a bug\n where KVM would let userspace run a broken setup with stale vmcs12 pages.\n\n - Fix a class of bugs where KVM would fail to fill kvm_run exit fields if\n getting nested pages failed.\n\n - Treat reserved entries in the memory attributes xarray as \"no attributes\",\n to fix false positives when checking for mixed attributes.\n\n - Fix memcg accounting for the memory attributes xarray (the xarray library\n subtly requires the xarray to be configured for accounting upfront; the gfp\n flags taken at runtime are used only rarely).\n\n - Don\u0027t pre-reserve xarray entries when storing empty attributes, as storing\n NULL must not require memory allocation (KVM and other subsystems heavily\n rely on this behavior).\n" }, { "commit": "93de2a6a4b91b72607136dd656edf03fb399d27f", "tree": "9220c76eb23cb39a146fac9692ee69afa4aa3135", "parents": [ "12c1f6e03f944e399bd2c88441dca5dc702b95a5" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Wed Sep 23 09:37:21 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:39:55 2026 -0400" }, "message": "KVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed. Because the source VM is \"converted\" to a non-SEV VM, KVM\u0027s\nmemory reclaim flows won\u0027t trigger cache maintenance, e.g. when all guest\nmemory is reclaimed in response to detaching from the mmu_notifier.\n\nNote, relying on the destination VM to do cache maintenance isn\u0027t an option\nas KVM doesn\u0027t require identical guest memory configurations, i.e. the\nsource VM may have access to memory that the destination VM does not.\nEnforcing equivalent memory configurations is infeasible, as it would\nrequire a *deep* comparison of memslots, e.g. to verify that not only are\nthe memslot identical, but what the memslots point at is also identical.\n\nFixes: b56639318bb2 (\"KVM: SEV: Add support for SEV intra host migration\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Teodorescu \u003cfane@google.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260923163721.1584779-3-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "12c1f6e03f944e399bd2c88441dca5dc702b95a5", "tree": "0e0a8ad1e1198d422be6c98a2d8aacdc0e261cfe", "parents": [ "072b2abae978b57291d1db31a7f75e8db5f9ff85" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Wed Sep 23 09:37:20 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:39:55 2026 -0400" }, "message": "KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n\nUnconditionally free SEV\u0027s \"have run CPUs\" cpumask in the VM destroy path,\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV\nVM if its state is intra-host migrated. Alternatively, the mask could be\nfreed in sev_migrate_from() when \"converting\" the source VM, but that gets\nannoying because ideally KVM would nullify the mask to guard against UAF,\nand nullifying the mask would need be conditioned on CPUMASK_OFFSTACK\u003dy.\n\nFreeing the mask during sev_migrate_from() is also not robust against other\nKVM bugs, though that\u0027s kind of a moot point since any such bugs would show\nup even if sev-\u003eactive is never set. I.e. KVM must get that side of things\ncorrect. But, that\u0027s not a great reason to add more code just to make\nthings marginally less robust.\n\nFixes: 6f38f8c57464 (\"KVM: SVM: Flush cache only on CPUs running SEV guest\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Teodorescu \u003cfane@google.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260923163721.1584779-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "6812ce4e4379ffc99c52401ec28f0d7ffbc36206", "tree": "f4c39d343f774530caa4466f2386205e9a31557a", "parents": [ "75467f60a3d14f08f86f2b353298d2826382ff23", "a9ed3aa9b87ee41e8ab3ff471b1331c154767e45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 16:00:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 16:00:18 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-09-26\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"While most of this is AI inspired fixes for error handling paths,\n leaks and use after frees, there are some normal things.\n\n nouveau has probably the biggest changes with some fixes to stabilise\n runtime suspend/resume on 570 firmware which regressed after we moved\n from 535, there are some fixes to stackframe issues seen with amdgpu,\n and otherwise the usual bunch of i915/xe/amdgpu fixes, and some\n virtio-gpu fixes.\n\n Hopefully it will start to quiten down a bit from here.\n\n client:\n - fix restore of partially initialized client\n\n i915:\n - Fix incorrect RCU teardown order leading to endless loop\n - Fix DP MST TU and FEC handling for disconnected streams\n - Fix selective fetch disable, again\n - Fix export namespace for kunit helpers\n - Workaround eDP flicker on a specific laptop model\n\n xe:\n - CRI throttle reasons report\n - TLB invalidation at wedge\n - SVM eviction and VM close\n - Display corruption on LNL on Xen PV\n - W/a fix and addition\n\n amdgpu:\n - Display ref count fix\n - Userq fixes\n - VCN 4, 5 reset fixes\n - Fixes for various error paths\n - Stack frame size fixes for various combinations of compilers and\n configs\n\n amdkfd:\n - Possible UAF fix\n\n nouveau:\n - runtime suspend/resume fixes for newer firmware\n - rcu free the scheduler\n - fix VRAM pinning\n - fix double free\n - fix reference leaks\n - fix runtime PM leak\n - fix cursor list usage problems\n - fix HDMI config rejection without SCDC\n\n virtio:\n - fix a bunch of object/memory leaks in failure paths\n - add pixel blend mode property to cursor plane\n - revert prime buffers import\n - sync shmem backing on guest transfers\n\n imagination:\n - propogate map failures properly\n - fix page count in map interface\n - clamp freelist reconstruction requests\n\n ivpu:\n - use separate flag for job timeout\n\n bridge:\n - samsung-dsim: fix TE GPIO lifetime for host attach\"\n\n* tag \u0027drm-fixes-2026-09-26\u0027 of https://gitlab.freedesktop.org/drm/kernel: (60 commits)\n drm/amd/display: Bump frame warning limit for all builds of dml\n drm/imagination: clamp freelist reconstruction requests\n drm/imagination: Fix page count for page table for map() interface\n drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()\n drm/amd/display: Bump frame warning limit for clang builds of dml\n drm/amd/display: Relax DML frame limit with UBSAN\n drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()\n drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()\n drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()\n drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()\n drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait\n drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait\n drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout\n drm/amdgpu: move userq fence wait out of signalling section\n drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()\n drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms\n drm/xe: harden adjust_idledly() against divide-by-zero and overflow\n drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV\n drm/i915: fix incorrect RCU teardown order\n ...\n" }, { "commit": "75467f60a3d14f08f86f2b353298d2826382ff23", "tree": "acd8a7d5b5a675042449386efa5b42ec44d8bf81", "parents": [ "049380360ca6f4cc22ac2f67fe95b98967c887f0", "2776e9c28513a1c855a94792b292cbcc533418c8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 15:55:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 15:55:03 2026 -0700" }, "message": "Merge tag \u0027ipe-pr-20260925\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe\n\nPull IPE fixes from Fan Wu:\n \"Two fixes for use-after-free issues found by recent LLM-assisted code\n analysis.\n\n - move successful policy load auditing under the new policy\n directory\u0027s inode lock, preventing a concurrent policy deletion\n from freeing the policy while it is still being audited\n\n - protect the dm-verity root hash with RCU, preventing policy\n evaluation from racing with root hash replacement during preresume\"\n\n* tag \u0027ipe-pr-20260925\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:\n ipe: protect the dm-verity root hash with RCU\n ipe: fix use-after-free when auditing a newly loaded policy\n" }, { "commit": "a9ed3aa9b87ee41e8ab3ff471b1331c154767e45", "tree": "cc62d74e0eb4905246978674461e78e2f9df2afd", "parents": [ "0f50dab8b4265e42e8719c2998c908a9d79a589e", "45585c3aa285854face65293acc95eff73063d6d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Sep 26 07:57:59 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Sep 26 07:58:24 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA number of fixes:\n - bridge:\n - samsung-dsim: fix GPIO lifetime\n - client: Null pointer dereference fix\n - imagination: error handling fix, page handling fix\n - nouveau: fix reference leaks, double-frees, out-of-bounds accesses,\n use-after-frees, don\u0027t reject config without SCDC, a number of\n workarounds\n - virtio: fix memory leak, reference leaks, null pointer dereference,\n add pixel blend mode, cache coherency fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/arU22zzqUGDEco1y@houat\n" }, { "commit": "049380360ca6f4cc22ac2f67fe95b98967c887f0", "tree": "1868b58c95de695689a2298c228d11264b0fef37", "parents": [ "f14572c203d57492e1d4e5d7851a3b143e083b82", "42d1221d321e55afc7bba9109a77aaf5a817c8a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 14:41:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 14:41:52 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Mostly small driver fixes. The biggest fix is the one to the block\n zone handling which might trip for real or virtual hardware if the\n number of zones is \u003e 2^32\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()\n scsi: sd_zbc: Reject disks with too many zones\n scsi: block: Fix zones_cond out-of-bounds write on zone report\n scsi: leapraid: Avoid -Wformat-security warning\n scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix\n scsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction\n scsi: ufs: core: Keep internal commands dispatchable during error handling\n" }, { "commit": "2776e9c28513a1c855a94792b292cbcc533418c8", "tree": "4e397474f21da51145f5e2cf2ce7d62366348fe2", "parents": [ "9814077275eca36ebf8d510d2f076d235ff9f51a" ], "author": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Tue Sep 22 20:13:49 2026 -0700" }, "committer": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Fri Sep 25 13:30:27 2026 -0700" }, "message": "ipe: protect the dm-verity root hash with RCU\n\nipe_bdev_setintegrity() frees the old root hash when dm-verity publishes\na new one on -\u003epreresume, while policy evaluation can still be\ndereferencing it.\n\nProtect the root hash with RCU. The evaluation path already runs under\nrcu_read_lock().\n\nFixes: e155858dd995 (\"ipe: add support for dm-verity as a trust provider\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\n[FW: remove model name according to latest guideline]\nSigned-off-by: Fan Wu \u003cwufan@kernel.org\u003e\n\n" }, { "commit": "9814077275eca36ebf8d510d2f076d235ff9f51a", "tree": "326132c295ffab42b268b487bd3bee604f964ed1", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Tue Sep 22 20:13:48 2026 -0700" }, "committer": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Fri Sep 25 13:30:27 2026 -0700" }, "message": "ipe: fix use-after-free when auditing a newly loaded policy\n\nnew_policy() audits the policy after ipe_new_policyfs_node() publishes it\nand drops the new directory\u0027s inode lock. A concurrent delete can free\nthe policy while ipe_audit_policy_load() is still using it.\n\nAudit the successful load under that lock.\n\nFixes: f44554b5067b (\"audit,ipe: add IPE auditing support\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\n[FW: remove model name according to latest guideline]\nSigned-off-by: Fan Wu \u003cwufan@kernel.org\u003e\n\n" }, { "commit": "f14572c203d57492e1d4e5d7851a3b143e083b82", "tree": "3e509947147565629021a557b21e272d585bbb45", "parents": [ "aa98230e410f0ed212b6788c46b1e4d49e0ff7ca", "e66cf1625ec4a3fe68346119f371def713fd0a4d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 13:30:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 13:30:04 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc5\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - Fix leaked server handles and dropped errors in the SMB2 compound\n create path: a parsing error reported as success, an earlier CREATE\n left open when a later command fails, the cached directory open\n losing the FID needed for cleanup, and SMB2_open() not closing the\n handle after a create-context parse failure\n\n - Fix out-of-bounds reads when parsing create contexts from a\n malicious server: bound each context by its Next field, parse the\n lease and QFid contexts from their declared offsets and validate\n the POSIX create context length\n\n - Fix a double credit decrement, and its warning, when a compound\n send fails and triggers a reconnect; found by syzbot\n\n - Fix a dentry and server handle leak in cifs_atomic_open() when an\n O_CREAT open resolves to a symlink or other non-regular inode\n\n - Use GFP_KERNEL in the DFS get_targets() path\n\n - Minor update to the POSIX extension specification references\n\n* tag \u0027cifs-fixes-7.3-rc5\u0027 of https://git.manguebit.org/linux:\n smb: client: use finish_no_open() for non-regular inodes\n smb: client: use GFP_KERNEL in get_targets()\n smb: client: update POSIX extension specification references\n smb: client: preserve create-context parsing errors\n smb: client: close completed creates on compound wait errors\n smb: client: clean up failed cached directory opens\n smb: client: close handle after create-context parsing failure\n smb: client: validate POSIX create context length\n smb: client: fix create context out-of-bounds reads\n smb: client: delete compound mids on send failure before unlock\n" }, { "commit": "aa98230e410f0ed212b6788c46b1e4d49e0ff7ca", "tree": "6db874088ac0592753eb0abd503cc45d51c72bd5", "parents": [ "a2ff1b626e1c9e65c9d384cfb3da3d292025cb4b", "b78b728e21c32ec4c330b299f657fb1eb02dffc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:12:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:12:06 2026 -0700" }, "message": "Merge tag \u0027vfs-7.3-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Revert \"put_mnt_ns(): leave mounts connected\". This allows the\n creation of reference count cycles in a very trivial way. We can\u0027t\n bring this in until we have fixed the underlying cause\n\n - vfs: Don\u0027t create the private nullfs instance for kthreads under\n namespace_sem to avoid false lockdeps complaints\n\n - binfmt_misc:\n - Copy the name into a stack buffer and look up the copy in\n bpf_binprm_select_interp()\n - bpf_binprm_set_interp() and bpf_binprm_set_interp_arg(): Check\n the private copy instead so the string that gets staged is the\n kstring that was checked\n\n - netfs:\n - Make netfs_read_gaps() use separate sink folios rather than one\n reused sink folio to discard unwanted data so that cifs checksum\n checking sees all the data that was fetched\n - Trim reads down to i_size so afs symlinks read correctly from the\n cache\n - Wrap the direct mempool -\u003ealloc() calls the GFP_KERNEL paths make\n in alloc_hooks() via a new mempool_alloc_noreserve() helper\n\n - iov_iter: Use iov_iter_alignment() for the start and length check\n added to iov_iter_extract_bvecs() this cycle. It used iter_iov_addr()\n and iter_iov_len() which are only valid for ITER_UBUF and ITER_IOVEC\n iterators\n\n - super: Make iterate_supers_type() deletion-safe\n\n - inode: Stop evict_inodes() from rescanning the same inodes\n\n - writeback: Bound the cleanup_offline_cgwb() rescans\n\n - ntfs3: Use d_instantiate_new() in ntfs_create_inode()\n\n - ovl: Fix a use-after-free in the ovl_do_mkdir() debug print\n\n - dcache: Unpoison the inline name buffer in __d_alloc() for KMSAN\n\n - autofs: Fix a pipe file reference leak in autofs_kill_sb()\n\n - bpf: Drop the path_unlink and path_rmdir hooks from the list of hooks\n for which the verifier rewrites bpf_{set,remove}_dentry_xattr() to\n the _locked variants\n\n - squashfs: Range check the xz dictionary size before shifting by it\n\n - selftests: Add the missing eventfd, open_tree_ns, openat2 and xattr\n filesystems selftests to TARGETS and drop the stale openat2 entry\n left behind when those tests moved\n\n* tag \u0027vfs-7.3-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n netfs: Fix missing alloc tagging of direct mempool allocations\n bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n autofs: fix sbi-\u003epipe file reference leak in autofs_kill_sb()\n dcache: unpoison the inline name buffer in __d_alloc()\n ovl: fix UAF in ovl_do_mkdir() debug print\n super: make iterate_supers_type() deletion-safe\n Revert \"put_mnt_ns(): leave mounts connected\"\n Revert \"selftests/filesystems: add mntns cleanup test\"\n binfmt_misc: fix racy checks in bpf set_interp kfuncs\n binfmt_misc: fix OOB read in bpf_binprm_select_interp()\n fs: don\u0027t create the private nullfs mount under namespace_sem\n writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes\n fs: avoid repeated scans in evict_inodes()\n netfs, afs: Fix symlink reading\n netfs: Fix netfs_read_gaps() to use separate sink folios\n squashfs: Add dictionary size range check to prevent shift-out-of-bounds\n fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot\u0027s \"WARNING in do_new_mount\" saga\n selftests/filesystems: fix missing and stale TARGETS entries\n block: Fix start and length check added to iov_iter_extract_bvecs()\n" }, { "commit": "a2ff1b626e1c9e65c9d384cfb3da3d292025cb4b", "tree": "5db771ff43585e1235c681286fdca86735a4bcb8", "parents": [ "b9dbb658e2101ea37ad6953eb4e2ea234dd9681a", "883b776abe48fed8ef615f4ff7e91113a6c4dffb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:07:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:07:44 2026 -0700" }, "message": "Merge tag \u0027fs_for_v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull isofs fix from Jan Kara:\n \"A fix for reading tightly packed isofs directories\"\n\n* tag \u0027fs_for_v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n isofs: Fix handling of directories with tight blocks\n" }, { "commit": "b9dbb658e2101ea37ad6953eb4e2ea234dd9681a", "tree": "3029c670e9327d576c95f86f8490e4bc4ad44809", "parents": [ "4ba51ef66a7773c2ce4a5356e2f97f5c291463ca", "ec0d89150a9381d591344a9f6f5428655c227a7f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 10:11:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 10:11:15 2026 -0700" }, "message": "Merge tag \u0027thermal-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fix from Rafael Wysocki:\n \"Fix a step-wise thermal governor issue that causes thermal mitigation\n to contiune forever after the temperature has dropped below the trip\n point threshold in some cases (Manaf Meethalavalappu Pallikunhi)\"\n\n* tag \u0027thermal-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds\n" }, { "commit": "4ba51ef66a7773c2ce4a5356e2f97f5c291463ca", "tree": "1766ab31d3452701ba61576c2afd3c3eaa364dcd", "parents": [ "547463efb935dec67c476f90917a0ff4baf6d0b5", "41112a787f9182c7f2d27122817861e3f22ef928" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:47:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:47:05 2026 -0700" }, "message": "Merge tag \u0027pm-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"Address a hibernation regression introduced during the 7.2 development\n cycle that causes the image memory preallocation to deadlock if it\n depends on frozen kernel threads (Florian Schmaus)\"\n\n* tag \u0027pm-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM: hibernate: Freeze kernel threads after image preallocation\n" }, { "commit": "547463efb935dec67c476f90917a0ff4baf6d0b5", "tree": "1959fb847274893c3f1c432b0fd92874686fe27c", "parents": [ "80e466f0c8acc545159a1f1fcca62512bf848413", "5b76268dac968612f7283d59b539036de955b7d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:39:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:39:33 2026 -0700" }, "message": "Merge tag \u0027s390-7.3-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Heiko Carstens:\n\n - Fix several bugs in PCI error recovery SCLP reporting: don\u0027t report\n success on skipped recovery, report errors when no pdev is\n associated, add missing device lock, and fix struct pci_dev reference\n leak in zpci_report_status()\n\n - Fix several bugs in CIO code: fix use of invalid SCHIB data, guard\n PMCW field accesses, check device number valid bit in PMWC before\n accessing other fields, and fix NULL pointer dereference in\n ccw_device_get_util_str()\n\n - Fix virtual vs physical address confusion in channel measurement\n facility code on kernels with CONFIG_RANDOMIZE_IDENTITY_BASE\u003dy\n\n - Fix couple of bugs in s390dbf: fix copy of failed static debug areas,\n skip view registration on failure, and reject NULL pointer in\n debug_dump()\n\n - Fix sriov_numvfs attribute name in zPCI documentation\n\n - Fix typos in comments\n\n* tag \u0027s390-7.3-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()\n s390/debug: Fix NULL pointer dereference in debug_info_copy()\n s390/debug: Do not register views for failed static debug areas\n s390/debug: Reject NULL debug info in debug_dump()\n s390/cmf: Fix virtual vs physical address confusion\n s390/pci: Don\u0027t report recovery success on skipped recovery\n s390/pci: Report SCLP status on error events when no pdev is associated\n s390/pci: Fix missing device lock in zpci_report_status()\n s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()\n s390/cio: Guard PMCW field accesses with dnv check\n s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points\n s390/cio: Fix cio_update_schib() to not cache invalid schib\n s390/pci/docs: Fix sriov_numvfs attribute name\n s390: Fix typos in comments\n" }, { "commit": "80e466f0c8acc545159a1f1fcca62512bf848413", "tree": "cb868fc26f5814c2dcd33899024df6cf122202ba", "parents": [ "165768bb70265b5c38cf0b73fafd75be235f8b14", "270437f3fe62516f16482742a7762a075e7a9457" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:35:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:35:07 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix a regression introduced by moving GPIO hog handling into GPIOLIB\n core where of_node_name was used if line name property was missing on\n DT systems\n\n - fix kernel stack leak to user-space in error path in GPIO character\n device code\n\n - fix runtime PM leaks in gpio-xilinx and gpio-arizona\n\n - fix several register programming bugs in gpio-tps65219\n\n - fix interrupt storm on resume in gpio-mvebu\n\n* tag \u0027gpio-fixes-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: tps65219: Fix TPS65214 GPIO direction programming\n gpio: tps65219: Use the variant-specific direction callback\n gpio: tps65219: Fix GPIO input value reads\n gpio: zynq: fix runtime PM leak on request error path\n gpio: cdev: fix kernel stack leak to user-space in error path\n gpiolib: use of_node_name if line-name is missing\n gpio: mvebu: keep resume masks within the irqchip cache\n gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()\n" }, { "commit": "b78b728e21c32ec4c330b299f657fb1eb02dffc2", "tree": "febfa1c4b03d0eb2681391b77fe45fe64b16a2f8", "parents": [ "35d442ed1f86465e49df3119fb898f985186db13" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Wed Sep 23 14:37:59 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 17:30:39 2026 +0200" }, "message": "netfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool\u0027s reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool\u0027s -\u003ealloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current-\u003ealloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG\u003dy this leads to\n\n current-\u003ealloc_tag not set\n WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n alloc_tag was not set\n WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct -\u003ealloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now.\n\nFixes: 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by adding a mempool\")\nReported-by: Erhard Furtner \u003cerhard_f@mailbox.org\u003e\nCloses: https://lore.kernel.org/all/0b004319-9ef7-437c-a4dd-174d6a9a83db@mailbox.org/\nTested-by: Erhard Furtner \u003cerhard_f@mailbox.org\u003e\nSuggested-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nLink: https://patch.msgid.link/20260923063759.34667-1-hao.ge@linux.dev\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "35d442ed1f86465e49df3119fb898f985186db13", "tree": "eebdeea823b5556aeeae19161db765660b4b62cf", "parents": [ "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e" ], "author": { "name": "Andrea Parri", "email": "parri.andrea@gmail.com", "time": "Tue Sep 22 16:55:30 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 17:22:09 2026 +0200" }, "message": "bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode\u0027s i_rwsem. The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode\u0027s i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim\u0027s xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.\n\nFixes: 56467292794b8 (\"bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Andrea Parri \u003cparri.andrea@gmail.com\u003e\nLink: https://patch.msgid.link/20260922145530.369775-1-parri.andrea@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "1c1a342aceec79528b3ba51f376eca2be5928fe7", "tree": "15aacc0402153736dcdfbe57a2a97f53aeed630f", "parents": [ "44b8a0bf5f96e8393312fc34b956766882341f16" ], "author": { "name": "Sagnik Sasmal", "email": "sagnik@sagnik.me", "time": "Thu Sep 10 22:44:05 2026 +0000" }, "committer": { "name": "Miquel Raynal", "email": "miquel.raynal@bootlin.com", "time": "Fri Sep 25 16:53:51 2026 +0200" }, "message": "mtd: spinand: Do not update the QE bit on devices without one\n\nCommit be0b86c648bf (\"mtd: spinand: Gather all the bus interface\nsteps in one single function\") moved quad-enable setup into\nspinand_configure_chip(). The new code only determines whether quad\nmode is needed when SPINAND_HAS_QE_BIT is set, but calls\nspinand_init_quad_enable() unconditionally. This clears configuration\nregister bit 0 on devices without a QE bit.\n\nThat bit is not universally a QE bit. On the Winbond W25N02KV it is\nH-DIS, which disables the active-low HOLD function. Clearing H-DIS\nenables HOLD during single and dual I/O operations. If IO3 is not kept\nhigh, the flash can pause a command and ignore clock and data.\n\nH-DIS is not restored by the FFh reset command, allowing the incorrect\nstate to survive an SoC warm reboot while the flash remains powered.\n\nBefore the refactoring, spinand_init_quad_enable() returned without\ntouching the configuration register on devices without\nSPINAND_HAS_QE_BIT. Restore that behavior by only calling the helper\nwhen the flag is set.\n\nReturn zero explicitly once SSDR configuration completes, as all errors\nare returned immediately. This avoids returning an uninitialized value\nwhen neither optional configuration step runs.\n\nThe regression was reproduced on a JioRouter JIDU6401 with an MT7986\nSoC and a W25N02KV. With Linux 6.18.44, sysupgrade failed and the\nfollowing warm reboot hung in BL2. With this change applied, both\nsysupgrade and warm reboot completed successfully.\n\nFixes: be0b86c648bf (\"mtd: spinand: Gather all the bus interface steps in one single function\")\nCc: stable@vger.kernel.org\nSuggested-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nAssisted-by: LLM\nSigned-off-by: Sagnik Sasmal \u003csagnik@sagnik.me\u003e\nSigned-off-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\n" }, { "commit": "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e", "tree": "ab2c0b01f220db3998196cc71307f58a8a16fae9", "parents": [ "76d8e697242e7e4e30dd08eff7c278728f9dd8e2" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Sat Sep 19 20:48:08 2026 +0000" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 16:51:46 2026 +0200" }, "message": "autofs: fix sbi-\u003epipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -\u003e autofs_catatonic_mode(sbi).\n\nBecause AUTOFS_SBI_CATATONIC is still set in sbi-\u003eflags,\nautofs_catatonic_mode() returns early without calling fput(sbi-\u003epipe),\npermanently leaking the pipe struct file reference.\n\nExplicitly release sbi-\u003epipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode().\n\nFixes: ebc921ca9b92 (\"autofs: copy autofs4 to autofs\")\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260919204808.2812930-1-benquike@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "5bfa9f1a9dcb6ecb607adbc1c0226605c972935b", "tree": "63fff8ed565f0f96a893d0074c3abe3b417d54fe", "parents": [ "1d653a183973f5283a3db5a38cd5e195eb152244" ], "author": { "name": "Andrea Parri", "email": "parri.andrea@gmail.com", "time": "Thu Sep 24 11:21:39 2026 +0200" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 25 23:35:23 2026 +0900" }, "message": "kprobes: Fix permanent hang when flushing the kprobe optimizer\n\nWriting 0 to /proc/sys/debug/kprobes-optimization while a kprobe is\njump-optimized never returns. The writer sleeps in D state forever with\nkprobe_sysctl_mutex held, so any later read or write of that sysctl\nhangs as well. For example, with vfs_read+9 as an optimizable address\nin this build:\n\n # cd /sys/kernel/tracing\n # echo \u0027p:myprobe vfs_read+9\u0027 \u003e\u003e kprobe_events\n # echo 1 \u003e events/kprobes/myprobe/enable\n # # wait until /sys/kernel/debug/kprobes/list shows [OPTIMIZED]\n # echo 0 \u003e /proc/sys/debug/kprobes-optimization\n\n INFO: task sh:246 blocked for more than 10 seconds.\n Call Trace:\n \u003cTASK\u003e\n __schedule+0x1176/0x4f70\n schedule+0xdc/0x2c0\n schedule_timeout+0x17b/0x260\n wait_for_completion+0x173/0x3c0\n wait_for_kprobe_optimizer_locked+0xbc/0x130\n proc_kprobes_optimization_handler+0x156/0x1b0\n proc_sys_call_handler+0x324/0x490\n vfs_write+0x52d/0xfe0\n ksys_write+0xff/0x200\n do_syscall_64+0x106/0x630\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n ...\n INFO: task cat:265 is blocked on a mutex likely owned by task sh:246.\n\nwait_for_kprobe_optimizer_locked() reinitializes optimizer_completion,\nasks the optimizer thread to flush and sleeps in wait_for_completion().\nThe thread drains the (un)optimizing lists, but calls complete() only\nif completion_done() is true, i.e. if the completion is already done,\nwhich never happens while someone waits. disarm_all_kprobes() and\nkprobe_trace_self_tests_init() wait the same way.\n\nCalling complete() unconditionally would not be enough: the waiter\ndrops kprobe_mutex while it sleeps, and nothing else serializes the\nsysctl handler against the debugfs \"enabled\" file. A second flusher\nthat still finds the lists non-empty, e.g. because a disabled probe is\nqueued for unoptimizing, reinitializes the completion under the first:\n\n sysctl write debugfs \"enabled\" write\n unoptimize_all_kprobes()\n wait_for_kprobe_optimizer_locked()\n init_completion(c)\n mutex_unlock(\u0026kprobe_mutex)\n wait_for_completion(c)\n disarm_all_kprobes()\n wait_for_kprobe_optimizer_locked()\n init_completion(c)\n // c-\u003ewait is reset, the first\n // waiter is off the queue\n mutex_unlock(\u0026kprobe_mutex)\n wait_for_completion(c)\n kprobe_optimizer()\n complete(c)\n // wakes the debugfs writer only\n\nwhere c is \u0026optimizer_completion. Lining up the two writes during an\noptimizer pass loses the sysctl writer this way.\n\nReplace the completion with a counter of optimizer passes, bumped at the\nend of each pass and signalled with wake_up_var_locked(), both under\nkprobe_mutex. A flusher samples the count and waits with\nwait_var_event_mutex(), which drops kprobe_mutex only while sleeping, so\na new count means a whole pass ran in the meantime. Nothing is\nreinitialized, so several flushers can sleep in the wait at once.\n\nLink: https://lore.kernel.org/all/20260924092142.199198-1-parri.andrea@gmail.com/\n\nFixes: 73c12f209462 (\"kprobes: Use dedicated kthread for kprobe optimizer\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Andrea Parri \u003cparri.andrea@gmail.com\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "76d8e697242e7e4e30dd08eff7c278728f9dd8e2", "tree": "f2c307436045e4a74fbcc8a8bba6e7ff7bd59b0e", "parents": [ "ae146bc1abdeb4607abf2975b858c053024e8ac1" ], "author": { "name": "Drif Abdelmalek Mohamed Said", "email": "drifabdelmalekmohamedsaid@gmail.com", "time": "Fri Sep 18 23:42:04 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 15:54:23 2026 +0200" }, "message": "dcache: unpoison the inline name buffer in __d_alloc()\n\nsyzbot reported:\n\n BUG: KMSAN: uninit-value in dentry_string_cmp fs/dcache.c:291 [inline]\n BUG: KMSAN: uninit-value in dentry_cmp fs/dcache.c:322 [inline]\n BUG: KMSAN: uninit-value in __d_lookup_rcu+0x37d/0x5e0 fs/dcache.c:2522\n\n dentry_string_cmp fs/dcache.c:291 [inline]\n dentry_cmp fs/dcache.c:322 [inline]\n __d_lookup_rcu+0x37d/0x5e0 fs/dcache.c:2522\n lookup_fast+0x194/0xa40 fs/namei.c:1854\n lookup_fast_for_open fs/namei.c:4545 [inline]\n open_last_lookups fs/namei.c:4579 [inline]\n path_openat+0x9ef/0x6540 fs/namei.c:4856\n do_file_open+0x2aa/0x680 fs/namei.c:4888\n do_sys_openat2+0x17c/0x390 fs/open.c:1395\n do_sys_open fs/open.c:1401 [inline]\n __do_sys_openat fs/open.c:1417 [inline]\n __se_sys_openat fs/open.c:1412 [inline]\n __x64_sys_openat+0x240/0x300 fs/open.c:1412\n x64_sys_call+0x2445/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:258\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was stored to memory at:\n copy_name fs/dcache.c:3031 [inline]\n __d_move+0xd29/0x21f0 fs/dcache.c:3099\n d_move+0x71/0xf0 fs/dcache.c:3147\n vfs_rename+0x2619/0x2770 fs/namei.c:6085\n filename_renameat2+0xa59/0x1230 fs/namei.c:6188\n __do_sys_rename fs/namei.c:6232 [inline]\n __se_sys_rename+0xc5/0x5c0 fs/namei.c:6228\n __x64_sys_rename+0x78/0xb0 fs/namei.c:6228\n x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83\n do_syscall_x64 arch/x86/entry/syscall_64.c:63\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4617 [inline]\n slab_alloc_node mm/slub.c:4939 [inline]\n kmem_cache_alloc_lru_noprof+0x376/0x1230 mm/s\n __d_alloc+0x52/0x9f0 fs/dcache.c:1902\n d_alloc+0x57/0x300 fs/dcache.c:1981\n lookup_one_qstr_excl+0x19d/0x7a0 fs/namei.c:1806\n __start_renaming+0x341/0x850 fs/namei.c:3888\n filename_renameat2+0x625/0x1230 fs/namei.c:6163\n __do_sys_rename fs/namei.c:6232 [inline]\n __se_sys_rename+0xc5/0x5c0 fs/namei.c:6228\n __x64_sys_rename+0x78/0xb0 fs/namei.c:6228\n x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83\n do_syscall_x64 arch/x86/entry/syscall_64.c:63\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe race is between a concurrent open() and rename() of the same path.\n\n__d_alloc() only stores the name itself and its terminating NUL, so the\nrest of the inline buffer (d_shortname, DNAME_INLINE_LEN bytes) is left\nuninitialized. copy_name(), called from rename(), copies that buffer as a\nwhole, so the uninitialized tail is propagated into the dentry that is\nbeing moved. Meanwhile __d_lookup_rcu(), called from open(), is an\noptimistic lockless lookup: it checks d_name.hash_len first and leaves the\nseqcount retry to its caller, so it can end up comparing against a dentry\nwhose name a rename is rewriting in place, using a stale (longer) length.\nThe comparison then runs past the terminating NUL and reads bytes of the\nuninitialized tail, which KMSAN reports.\n\nThe read is harmless by design: it stays inside the buffer, the name is\nstill NUL-terminated, and the result is thrown away by the seqcount retry.\nIt is not specific to KMSAN either - with CONFIG_DCACHE_WORD_ACCESS\nenabled the very same bytes are read by read_word_at_a_time(), which is\n__no_sanitize_or_inline and therefore invisible to KMSAN. KMSAN builds\nonly see the instrumented byte-at-a-time dentry_string_cmp() because\nCONFIG_DCACHE_WORD_ACCESS is disabled when KMSAN is enabled on x86:\n\ncommit 7cf8f44a5a1c (\"x86: fs: kmsan: disable CONFIG_DCACHE_WORD_ACCESS\")\n\nZeroing the inline buffer would hide the report, but it would add a\nmemset() to a hot allocation path just to initialize bytes that are never\nused as part of a name. Instead, tell KMSAN the inline buffer is\ninitialized: kmsan_unpoison_memory() compiles to nothing unless\nCONFIG_KMSAN is set, and doing it at allocation time is enough for every\ndentry, because copy_name() and swap_names() copy the whole buffer and\nthus propagate its shadow.\n\nReported-by: syzbot+7ff3adde89dd795ad4c4@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d7ff3adde89dd795ad4c4\nSigned-off-by: Drif Abdelmalek Mohamed Said \u003cdrifabdelmalekmohamedsaid@gmail.com\u003e\n\nChanges in v3:\n- Annotate for KMSAN instead of zeroing, as suggested in review: the read\n is harmless, so unpoison the inline buffer in __d_alloc() with\n kmsan_unpoison_memory() (a no-op unless CONFIG_KMSAN) rather than adding\n a memset() to the dentry allocation path.\n- Document why only KMSAN builds report this at all: with\n CONFIG_DCACHE_WORD_ACCESS the same read goes through\n read_word_at_a_time(), which KMSAN does not instrument.\n- Rewrite the commit message; the previous one had several truncated\n lines.\n\nLink: https://patch.msgid.link/20260918224204.3056-1-drifabdelmalekmohamedsaid@gmail.com\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "ae146bc1abdeb4607abf2975b858c053024e8ac1", "tree": "4c722a805ae2e7c1636d8c0182eb14b2f008a621", "parents": [ "2d2a2d7aa98741b58f54cacc99b52024e4d865f9" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Mon Sep 21 12:40:13 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 15:52:26 2026 +0200" }, "message": "ovl: fix UAF in ovl_do_mkdir() debug print\n\novl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().\nSince commit fe497f0759e0 (\"VFS: change vfs_mkdir() to unlock on\nfailure.\"), vfs_mkdir() calls end_creating() on the input dentry on\nfailure and may replace it on success, so the post-call %pd can\nuse-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.\n\nPrint the dentry before the call and only the result afterward.\n\nReported-by: syzbot+ced26b784bf977d223dd@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dced26b784bf977d223dd\nFixes: fe497f0759e0 (\"VFS: change vfs_mkdir() to unlock on failure.\")\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nLink: https://patch.msgid.link/20260921104013.40475-1-amir73il@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "113dcdfadf30ea11fbbdfcd4f6ea87687655cc5b", "tree": "667a2ee587f8351d2fc8ea333f5641d8c8082bf5", "parents": [ "80320b278fea07ffcda3f57b67b61658e0a4e1ca" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Sep 25 13:23:29 2026 +0800" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Fri Sep 25 11:08:37 2026 +0200" }, "message": "MAINTAINERS: name the libata/linux for-next branch\n\nThe T: entry for LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)\nnames libata/linux without a branch. The repository\u0027s HEAD pointer\npoints to branch master, which has no active development. Active\ndevelopment is on the for-next branch. Name the branch so the entry\nidentifies where development happens.\n\nDocumentation/process/submitting-patches.rst sends contributors to the\nT: entry to find the tree to prepare patches against, so a branch-less\nentry whose HEAD is already in mainline points them to the wrong branch.\n\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260925052329.2683619-1-matthias.goergens@gmail.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "0f50dab8b4265e42e8719c2998c908a9d79a589e", "tree": "e5017d73939a2aee0ecdf91081d84514f5d8024c", "parents": [ "c5d1690ff144fce4b7cebe877d2ef1d1b5eb6aa2", "15814c01ac57643edf1662a076d2961332f277a5" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:54:43 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 18:04:49 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-09-24:\n\namdgpu:\n- Display ref count fix\n- Userq fixes\n- VCN 4, 5 reset fixes\n- Fixes for various error paths\n- Stack frame size fixes for various combinations of compilers and configs\n\namdkfd:\n- Possible UAF fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260924172938.634777-1-alexander.deucher@amd.com\n" }, { "commit": "c5d1690ff144fce4b7cebe877d2ef1d1b5eb6aa2", "tree": "3be950a4d69d141665fa622733e1fbca2c298875", "parents": [ "fd0ba310f9ab6faa0059d9649564ac97e67ad137", "cc319238e3f6668f867beb381ce93727c69b7317" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:50:02 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:50:21 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nFixes in:\n - CRI throttle reasons report (Sk)\n - TLB invalidation at wedge (Shuicheng)\n - SVM eviction and VM close (Brost)\n - Display corruption on LNL on Xen PV (Szymon)\n - W/a fix and addition (Tilak)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/arUoUf9LpsJpJouN@intel.com\n" }, { "commit": "f050c3e61d2a1aaece3170d459e4ce5fa2486c12", "tree": "8721f22f1fe492a6512dcc2f3ca79474845dc055", "parents": [ "d12c6a6f0c8fd5b5b41120f7be319f743dae3b4f" ], "author": { "name": "Vineet Gupta", "email": "vgupta@kernel.org", "time": "Wed Sep 23 15:01:38 2026 -0700" }, "committer": { "name": "Vineet Gupta", "email": "vgupta@kernel.org", "time": "Thu Sep 24 21:17:09 2026 -0700" }, "message": "ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer\n\nBradley spotted this snafu when working on two-byte cmpxchg emulation.\nHe originally folded this fix into his series but the fix itself\nuncovered a pre-existing issue, missing arch_atomic64_cmpxchg_relaxed\nwhich just needed to be wired up.\n\nFixes: e188f3330a13 (\"ARC: cmpxchg/xchg: rewrite as macros to make type safe\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202609240539.AkulvjVe-lkp@intel.com/\nSuggested-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Vineet Gupta \u003cvgupta@kernel.org\u003e\n" }, { "commit": "165768bb70265b5c38cf0b73fafd75be235f8b14", "tree": "214b14a6bf18f87a07ed067feb7cf8eab2582eff", "parents": [ "ee9c669f9bf5fd2c24206746ded9382fe810df89", "c6b51091cafff9ce6c03c1416aa13864d17ab97c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 17:09:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 17:09:56 2026 -0700" }, "message": "Merge tag \u0027firewire-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a race in the cdev layer that can cause a fw_iso_resource_auto\n object to transition back to a previous state. This can happen when a\n file descriptor is closed while the work item for the object is\n running. The race can leak several memory objects, including client\n object itself\"\n\n* tag \u0027firewire-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: cdev: fix back-transition for iso_resource_auto client resource\n" }, { "commit": "fd0ba310f9ab6faa0059d9649564ac97e67ad137", "tree": "701a596139fc4f36c1b52213f11f8eb52292f292", "parents": [ "93f51579e7df248780214094418f205253383cc5", "d2da6696e0c4e60414706e607029d0bb0330c67e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 09:47:45 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 09:47:46 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc5:\n- Fix incorrect RCU teardown order leading to endless loop\n- Fix DP MST TU and FEC handling for disconnected streams\n- Fix selective fetch disable, again\n- Fix export namespace for kunit helpers\n- Workaround eDP flicker on a specific laptop model\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/9b8ff50ad5c3ff9ca120207b1e7aa95d5a16423f@intel.com\n" }, { "commit": "ee9c669f9bf5fd2c24206746ded9382fe810df89", "tree": "dfc46791f0ed3fb6455e9144f8245456486ed2fe", "parents": [ "e8dfd03a1c51c4e84fbf2e5ef5cd7d33cc8b7578", "4409a85735cdca5c4c400c0dad1feee091872eee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 15:04:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 15:04:11 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - A task reenqueued while its dispatch was still completing had its\n queued state clobbered by the dispatcher, dropping every later\n dispatch of the task. Wait for the in-flight dispatch to settle\n first\n\n - A wakeup activation on another CPU marked the destination runqueue as\n mid-wakeup, stranding a pending local reenqueue. If the scheduler was\n unloaded first, the stale request pointed into freed memory that the\n next scheduler dereferenced\n\n - ops.dequeue() ran with the source dispatch queue\u0027s lock held, so a\n scheduler iterating that queue from the callback deadlocked the CPU\n\n - Schedulers with their own CPU ID mapping had no way to learn a task\u0027s\n initial CPU mask and rebuilt it themselves, which went wrong across\n sub-scheduler enable and re-home. Pass it to ops.enable()\n\n - A bypass dispatch event counter missed the dispatches made by the\n end-of-dispatch fallback and under-reported\n\n - Selftests for the dequeue locking and initial mask changes\n\n* tag \u0027sched_ext-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Count SCX_EV_SUB_BYPASS_DISPATCH in the dispatch fallback\n selftests/sched_ext: Check the cmask cid-form ops.enable() receives\n sched_ext: Pass the initial cmask to cid-form ops.enable()\n selftests/sched_ext: Test that ops.dequeue() can iterate the consumed DSQ\n sched_ext: Don\u0027t run ops.dequeue() with a DSQ lock held\n sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags\n sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task\n" }, { "commit": "e8dfd03a1c51c4e84fbf2e5ef5cd7d33cc8b7578", "tree": "4eb94e7cc6d3b5bbae07209efa19816a87b377fd", "parents": [ "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de", "1765a153d985c231357145e26798f9408db10e42" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 14:26:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 14:26:12 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - With local event accounting, a fork rejected by the pids controller\n updated pids.events without notifying its pollers\n\n - A cgroup selftest failed to compile with fortification enabled\n because an O_TMPFILE open lacked its mode argument\n\n* tag \u0027cgroup-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/pids: Restore pids.events notifications in local mode\n selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode\n" }, { "commit": "cb97bf3d4f91453b881acaf8e9f0cc47bb40b604", "tree": "01255366ffbc8f4b3d2b27a194ed3acca3eec810", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Viken Dadhaniya", "email": "viken.dadhaniya@oss.qualcomm.com", "time": "Mon Sep 21 17:17:01 2026 +0530" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Thu Sep 24 22:52:30 2026 +0200" }, "message": "i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL\n\nqcom_geni_i2c_conf() writes a hardcoded 0 to SE_GENI_CLK_SEL, which\nselects an index from the hardware clock performance table. This always\npicks the first table entry regardless of the actual source clock\nconfiguration. On platforms where the matching entry is not at index 0,\nthe wrong source clock divider is active and the I2C bus runs at an\nincorrect frequency.\n\nUse geni_se_clk_freq_match() in geni_i2c_clk_map_idx() to find the\nperformance table index for the source clock (32 MHz or 19.2 MHz). Store\nthe resolved index in a new clk_idx field in geni_i2c_dev and write it\nto SE_GENI_CLK_SEL instead of the hardcoded 0.\n\nFixes: 37692de5d523 (\"i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller\")\nSigned-off-by: Viken Dadhaniya \u003cviken.dadhaniya@oss.qualcomm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v4.19+\nReviewed-by: Mukesh Kumar Savaliya \u003cmukesh.savaliya@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260921-i2c-fix-se-clk-conf-v2-1-8b5537ceff2d@oss.qualcomm.com\n" }, { "commit": "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de", "tree": "dd635091fe8fde9c898b9e9a1a4c51e49d6161df", "parents": [ "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "fc6d80eb504458d6416b75a94188b268c95c6533" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, NFC and Netfilter.\n\n Every week in this release is record-setting for number of posted\n patches. It doesn\u0027t seem like we\u0027re creating any regressions with all\n these fixes, three \u0027Fixes\u0027 tags here point to 7.2 commits but none are\n true regression fixes. We\u0027re trying to keep the count down,\n nonetheless.\n\n Previous releases - regressions:\n\n - net: don\u0027t require the hwtstamp NDOs when a PHY provides\n timestamping\n\n - ipv6: fix dst leak for uncached routes\n\n - vrf: stop corrupting skb-\u003ecsum when capturing CHECKSUM_COMPLETE\n packets\n\n Previous releases - always broken:\n\n - packet: use ubuf_info completion for TX_RING packets\n\n - arp: terminate device name before lookup\n\n - ipv6: do not let ipv6_find_hdr() return an offset past the packet\n end\n\n - udp: remove a disconnected socket from the 4-tuple hash table\n\n - sctp: discard the rest of the packet on a stale-cookie error\n\n - eth: mlx5: Bridge, fix remaining switchdev ownership gaps on merged\n eswitch\"\n\n[ And lots of other random network driver fixes ]\n\n* tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (189 commits)\n tcp: prevent collapsing skbs across boundary in rtx queue\n vlan: ensure sufficient headroom in vlan_dev_hard_header()\n net/sched: sch_teql: fix shadowed err in __teql_resolve()\n bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n llc: reserve device headroom for allocated frames\n gve: DQO: reject TSO packets with an out of range MSS\n gve: fix TX drop when GSO MSS is too small for hw\n gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n net: flush skb_defer_nodes in dev_cpu_dead()\n net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n net/smc: fix UAF on lgr list traversal in smcr_port_err()\n net/rds: size a connection\u0027s path set by the transport it ends up with\n nfp: hold IPsec RX state under the XArray lock\n net: ena: fix MMIO read buffer leak on probe failure\n net: ena: fix PHC cleanup on probe failure\n net/sched: act_ct: fix helper UAF due to extensions realloc\n ...\n" }, { "commit": "fc6d80eb504458d6416b75a94188b268c95c6533", "tree": "5487970b2bfe7b6d0737e3c7059af732ca493d41", "parents": [ "1078a38344a852eefafcc61c42dcc333b53c7478" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Thu Sep 24 11:44:12 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:03:42 2026 -0700" }, "message": "tcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)-\u003eeor \u003d 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk-\u003esk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk-\u003etcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb-\u003edecrypted set. The merged skb\n keeps decrypted \u003d 0 from the earlier skb, so merged data sent after\n psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n tls_set_device_offload(). The software fallback (fill_sg_in() returns\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n skb and drop it. Every retransmit rebuilds the same skb, so the\n connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n condition.\n\nFixes: e8f69799810c (\"net/tls: Add generic NIC offload infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20260924154427.953800-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1078a38344a852eefafcc61c42dcc333b53c7478", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52", "cd5dd68267c4238795fadaf02b3575ca3f8a6500" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:04 2026 -0700" }, "message": "Merge branch \u0027vlan-ensure-sufficient-headroom-in-vlan_dev_hard_header\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less, or skbs allocated before\ndynamic device/headroom changes (such as toggling VLAN_FLAG_REORDER_HDR\nor bonding/team switching slaves), can reach vlan_dev_hard_header() with\ninsufficient headroom and trigger skb_under_panic().\n\nWhen vlan_dev_hard_header() returns -ENOMEM upon skb_cow_head() failure,\na few callers of dev_hard_header() / llc_mac_hdr_init() had pre-existing\nerror-handling bugs:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924082951.1599377-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cd5dd68267c4238795fadaf02b3575ca3f8a6500", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "vlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),\nor skbs allocated before dynamic device/headroom changes (e.g. toggling\nVLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach\nvlan_dev_hard_header() with insufficient headroom and trigger\nskb_under_panic().\n\nUse skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR\nis not set to ensure sufficient headroom for the VLAN header(s) and the\nunderlying device hard header.\n\nUse READ_ONCE() to read dev-\u003ehard_header_len and dev-\u003eneeded_headroom as\nthey can be updated concurrently under RTNL (e.g. in\nvlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on\nthe transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the\nextra HH_DATA_MOD alignment padding does not trigger unnecessary\npskb_expand_head() reallocations on inner stacked VLAN devices after the\nouter VLAN header has been pushed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/cover.1789987105.git.petalzu987@gmail.com/\nLink: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6", "tree": "99c10e831fdd7b59ce532cdc840640aae27ad3ca", "parents": [ "ac704ff08e511c87643799c385f55ecd69b85e03" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:50 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "net/sched: sch_teql: fix shadowed err in __teql_resolve()\n\n__teql_resolve() declares an inner \u0027int err;\u0027 inside the\n\u0027if (neigh_event_send(n, skb_res) \u003d\u003d 0)\u0027 block, shadowing the outer\n\u0027int err \u003d 0;\u0027. As a result, a negative return from dev_hard_header()\nis written to the inner variable and __teql_resolve() still returns 0.\n\nRemove the shadowed variable and set the outer err to -EINVAL when\ndev_hard_header() returns a negative error.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac704ff08e511c87643799c385f55ecd69b85e03", "tree": "5f38ad6d4b85abd248210eec244ab86ed2bb3621", "parents": [ "72f9dd522f8d6c5a00be9695c7bb74631eb5069e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:49 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n\nIf llc_mac_hdr_init() fails (for instance if the port device type does\nnot support LLC or dev_hard_header() fails), br_send_bpdu() should drop\nthe skb instead of resetting the mac header to the LLC payload and\ntransmitting a malformed frame.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nCc: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: bridge@lists.linux.dev\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72f9dd522f8d6c5a00be9695c7bb74631eb5069e", "tree": "bac4f4f9105b9f14cd11c4f6c5d44cca3a88cc33", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:48 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72b5b9a28b996e09b8b5b944370c79851bb68f52", "tree": "80b7fa56b5820d1f2be01da4399dda48eb003ab1", "parents": [ "488089055b61be8f7e97817d4608844f0fba2648" ], "author": { "name": "Zixuan Chai", "email": "petalzu987@gmail.com", "time": "Thu Sep 24 09:26:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:58:16 2026 -0700" }, "message": "llc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice\u0027s Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device\u0027s actual required\nheadroom while preserving the existing LLC device-type check.\n\nFixes: bf9ae5386bca (\"llc: use dev_hard_header\")\nCc: stable@vger.kernel.org\nReported-by: VEGA \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924012613.2533934-1-weir@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "488089055b61be8f7e97817d4608844f0fba2648", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d", "296c83b5ccc808c080865eb20fd7a477b0355bb7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "message": "Merge branch \u0027gve-dqo-fix-handling-of-out-of-range-tso-mss\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngve: DQO: fix handling of out of range TSO MSS\n\nThe DQO TX path assumes that the MSS of a TSO packet is within the\nrange supported by the device, [88, 9728].\n\nThis holds for locally generated traffic, but not for packets coming\nfrom a tap or from a packet socket: virtio_net_hdr_to_skb() takes\ngso_size from user space and only enforces a minimum, layer 2\nforwarding does not check the MTU of GSO packets, and\ngso_features_check() bounds skb-\u003elen and gso_segs but never gso_size.\n\nPatch 1, from Eddie Phillips, deals with the lower bound. It moves the\nexisting test out of gve_prep_tso() into gve_features_check_dqo(), so\nthat these packets are segmented in software instead of being dropped.\n\nPatch 2 deals with the upper bound, which is currently not checked at\nall. gve_tx_fill_tso_ctx_desc() stores gso_size into a 14 bits wide\nfield, so that an MSS of 16384 silently becomes zero. Falling back to\nsoftware segmentation is not an option here, because skb_segment()\nsplits at gso_size regardless of the MTU, and would only replace an\ninvalid TSO packet by non TSO packets larger than the 9728 bytes the\ndevice supports. These packets are dropped instead.\n\nAs noted in patch 2, oversized non TSO packets can still reach the\ndevice whenever the stack segments in software. This is not specific\nto gve and is better fixed in the core, so a patch for\n__is_skb_forwardable() will be sent separately for net-next.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924004252.1196328-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "296c83b5ccc808c080865eb20fd7a477b0355bb7", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "3b430ea6234087957b0d3cd181e3116722b59819" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 00:42:52 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: DQO: reject TSO packets with an out of range MSS\n\ngve_prep_tso() notes that the device requires the MSS to be \u003c\u003d 9728,\nbut does not enforce it, assuming the 9K MTU enforced by the hypervisor\nand the 64KB limit on TSO sizes are enough.\n\nThis does not hold for packets that were not generated locally.\nA guest behind a tap, or any packet socket user, can provide an\narbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check\nthe MTU for GSO packets (is_skb_forwardable()), and gso_features_check()\nonly bounds skb-\u003elen and gso_segs, never gso_size.\n\nSuch a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size\ninto the mss field of the TSO context descriptor. This field is 14 bits\nwide, so a gso_size of 16384 is silently turned into an MSS of zero.\n\nDrop these packets from gve_prep_tso(), and make sure that\ngve_features_check_dqo() leaves their GSO bits alone: skb_segment()\nsplits at gso_size regardless of the MTU, so falling back to software\nsegmentation would give the device non TSO packets bigger than the\n9728 bytes it supports.\n\nNote that the device can still be given oversized non TSO packets when\nthe stack segments in software for other reasons, for instance after\nTSO has been disabled with ethtool. This is a generic issue, because\nthe MTU check is skipped for GSO packets in the forwarding path, and\nis addressed separately.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3b430ea6234087957b0d3cd181e3116722b59819", "tree": "0f861c1c8f08498ad4c8fc89fc79dfd0222ce039", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d" ], "author": { "name": "Eddie Phillips", "email": "eddiephillips@google.com", "time": "Thu Sep 24 00:42:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: fix TX drop when GSO MSS is too small for hw\n\nThe device has a strict requirement that the minimum MSS\n(gso_size) for TSO/GSO packets must be at least 88 bytes. If a packet\nbelow this threshold is pushed to the hardware, it can cause\nhardware to silently drop the packet, leading to increased latency\nand retransmissions.\n\nCurrently, this is validated too late in the transmit pipeline\n(gve_prep_tso), leading to silent drops.\n\nFix this by moving the validation into the .ndo_features_check\ncallback (gve_features_check_dqo). If we detect a GSO packet with\na gso_size smaller than GVE_TX_MIN_TSO_MSS_DQO, we clear the GSO\nfeature flags for this packet.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eddie Phillips \u003ceddiephillips@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "tree": "71512a50ce57f1a72f253b74264dff7fde3de777", "parents": [ "5fc5768c7ca92895ccd1de94dc521e5a55ae7896", "e7e0a54300a896e731dffd3e2e8dae5631d6243d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fixes from Mickaël Salaün:\n \"This mainly fixes the Landlock tracepoint support merged this cycle so\n that denial and rule events report the intended policy context,\n whether through tracefs or BTF-visible callbacks.\n\n The size of this all is mainly from propagating the corrected contract\n through event definitions and producers, adding new tests for the\n reported context, and updating the documentation.\n\n Also improve annotation and fix a GCC 16 build warning\"\n\n* tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Widen ruleset versions to 64 bits\n landlock: Add counted_by in landlock_domain\n landlock: Fix tracepoint contract documentation\n selftests/landlock: Test network denial context\n selftests/landlock: Test filesystem denial blockers\n landlock: Report the effective signal number\n landlock: Report the actual ptrace tracer\n landlock: Fix network denial trace context\n landlock: Fix rule tracepoint context\n landlock: Fix filesystem denial blocker reporting\n landlock: Fix tracepoint fixed-width type names\n landlock: Work around gcc-16 -Wuninitialized warning\n" }, { "commit": "83769c23fb1879edc916a526ba424285033baf2d", "tree": "ac3e133847e92e1be5420840455588279ccab477", "parents": [ "06e3f54e8b22040ada01a28343badf1990b4dd7d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 14:59:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:51:29 2026 -0700" }, "message": "gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.\n\nFixes: 014c607f86ab (\"gve: add support for UDP GSO for DQO format\")\nCloses: https://lore.kernel.org/netdev/CANn89i+MS4L60sFQ49\u003d-f-mibeveUfcrpVkD5X+Qy6SOnEpd6w@mail.gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Ankit Garg \u003cnktgrg@google.com\u003e\nCc: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nCc: Joshua Washington \u003cjoshwash@google.com\u003e\nCc: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Ankit Garg \u003cnktgrg@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260923145942.731365-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "06e3f54e8b22040ada01a28343badf1990b4dd7d", "tree": "9aef63ca855d0f5730db275590fac7c010bc317e", "parents": [ "8db67bb6a1fffa4df68fbbc22e39943aeeff9178" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 13:03:18 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:48:10 2026 -0700" }, "message": "net: flush skb_defer_nodes in dev_cpu_dead()\n\nWhen a CPU goes offline, dev_cpu_dead() drains its softnet queues\n(completion_queue, output_queue, poll_list, process_queue, and\ninput_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched.\n\nIf oldcpu goes offline while holding pending skbs in its\nskb_defer_nodes lists (e.g. below the sysctl_skb_defer_max \u003e\u003e 1 IPI\nthreshold, or if the IPI races with CPU teardown), those skbs remain\nstranded until oldcpu is brought back online. If any of these skbs\nhold page_pool fragments, page_pool_destroy() will stall indefinitely\nwaiting for inflight pages to be returned when a netdev or driver is\ntorn down while oldcpu is offline.\n\nAdditionally, if smp_call_function_single_async() fails in\nkick_defer_list_purge() because the target CPU went offline, reset\ndefer_ipi_scheduled to 0 so future IPI kicks are not blocked when the\nCPU comes back online.\n\nAlso, if oldcpu was the last online CPU on its NUMA node, drain that\nnode\u0027s slot across all CPUs so no skbs deferred from that node remain\nstranded on idle remote CPUs (or if the node itself is subsequently\nofflined).\n\nFinally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and\nwhether the caller migrated CPUs after llist_add(), flushing the node\nlist if so, to close the preemption TOCTOU race against CPU/node\nteardown.\n\nFixes: 68822bdf76f1 (\"net: generalize skb freeing deferral to per-cpu lists\")\nFixes: 5628f3fe3b16 (\"net: add NUMA awareness to skb_attempt_defer_free()\")\nCloses: https://lore.kernel.org/netdev/20260916003430.3612956-1-kris.pan@intel.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kris Pan \u003ckris.pan@intel.com\u003e\nLink: https://patch.msgid.link/20260923130318.607255-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8db67bb6a1fffa4df68fbbc22e39943aeeff9178", "tree": "a2ce3f2b519033b14058d38935960be67ffe4a1e", "parents": [ "56d82862a0a243ac14ba11b6d7b57ddc2d064b95" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Wed Sep 23 20:37:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:47:24 2026 -0700" }, "message": "net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n\ngmac_clk_enable() enables the bulk clocks first and then the optional\nPHY clock. If clk_prepare_enable() on the PHY clock fails, the function\nreturns without rolling back the bulk clocks, and bsp_priv-\u003eclk_enabled\nstays false, so the later gmac_clk_enable(bsp_priv, false) becomes a\nno-op and the bulk clock references are leaked.\n\nAdd the missing clk_bulk_disable_unprepare() on that failure path.\n\nFixes: ea449f7fa0bf (\"net: ethernet: stmmac: dwmac-rk: rework optional clock handling\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20260923123713.3137146-1-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56d82862a0a243ac14ba11b6d7b57ddc2d064b95", "tree": "fe06631dbb251cf22f86807315d0aa8bd1b1258c", "parents": [ "8e1937fed6738460554ec123c64839e2445e7d53" ], "author": { "name": "Dairui Zhang", "email": "zhangdairui@gmail.com", "time": "Wed Sep 23 13:01:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:40:50 2026 -0700" }, "message": "af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n\nprb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:\n\n mbits \u003d (blk_size_in_bytes * 8) / (1024 * 1024);\n\nIf I\u0027m reading the validation right, tp_block_size is user\ncontrolled and packet_set_ring() only rejects values that are \u003c\u003d 0\nas int or not page aligned, so a 256MiB block goes right through\n(and alloc_one_pg_vec_page() even has a vzalloc fallback for it).\n0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps\n(div \u003d\u003d 1) the function ends up returning -2047.\n\nThe condition is actually (8 * size) mod 2^32 \u003e\u003d 2^31 \u0026\u0026 div \u003d\u003d 1,\nso the trigger set is [256,512), [768,1024), [1280,1536) and\n[1792,2048) MiB. Other sizes wrap to non-negative values and faster\nlinks divide the unsigned value back below 2^31, which is why this\ndoesn\u0027t blow up for everyone.\n\nWhat makes it fatal is what happens next in init_prb_bdqc():\n\n p1-\u003einterval_ktime \u003d ms_to_ktime(prb_calc_retire_blk_tmo(...));\n hrtimer_start(\u0026p1-\u003eretire_blk_timer, p1-\u003einterval_ktime,\n HRTIMER_MODE_REL_SOFT);\n\nA negative relative timeout expires immediately. The callback\nunconditionally returns HRTIMER_RESTART, and hrtimer_forward() turns\nthe negative interval into hrtimer_resolution:\n\n if (interval \u003c hrtimer_resolution)\n interval \u003d hrtimer_resolution;\n\nSo the SOFT timer re-fires at the maximum rate forever, holding\nsk_receive_queue.lock each pass. One CPU spins in softirq until the\nsocket is closed. Repeat with more rings and the machine is gone.\n\nThe overflow itself is ancient - it was introduced together with\nTPACKET_V3 in f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer\nimplementation.\"). Its effect prior to f7460d2989fa (\"net:\naf_packet: Use hrtimer to do the retire operation\", v6.18) was not\nas clear-cut, though: the return value was stored into an unsigned\nshort retire_blk_tov, so a negative result was truncated, and a\n0-jiffy delay loop could be programmed as well. Neither is nearly\nas detrimental as the immediate maximum-rate spin the hrtimer\nconversion turned it into.\n\n(Unrelated to CVE-2019-20812 - that one was the ethtool failure path\nreturning 0, which now returns DEFAULT_PRB_RETIRE_TOV.)\n\nReproducer, needs CAP_NET_RAW (a --network host container has it by\ndefault) and a 1 Gbps NIC (QEMU e1000 works):\n\n int fd \u003d socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));\n bind(fd, ...);\n int v \u003d TPACKET_V3;\n setsockopt(fd, SOL_PACKET, PACKET_VERSION, \u0026v, sizeof(v));\n struct tpacket_req3 req \u003d {\n .tp_block_size \u003d 0x10000000,\n .tp_block_nr \u003d 1,\n .tp_frame_size \u003d 2048,\n .tp_frame_nr \u003d 0x10000000 / 2048,\n .tp_retire_blk_tov \u003d 0,\n };\n setsockopt(fd, SOL_PACKET, PACKET_RX_RING, \u0026req, sizeof(req));\n\nCompute in 64 bits instead. The operands are already bounded by the\nexisting validation, so nothing else changes. If you\u0027d prefer a\ndifferent fix, just say so and I\u0027ll respin.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dairui Zhang \u003czhangdairui@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260923050101.1510064-1-zhangdairui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e1937fed6738460554ec123c64839e2445e7d53", "tree": "5d10c6bd523256962d460cb9fc378f48216ffa8b", "parents": [ "b94773dc4df7026a6f29b2c65e96e88d29cdb576" ], "author": { "name": "Ginger Li", "email": "ginger.jzllee@gmail.com", "time": "Tue Sep 22 16:09:09 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:45 2026 -0700" }, "message": "tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n\nmon_timeout() evaluates dom_size(mon-\u003epeer_cnt) before it takes mon-\u003elock,\nwhile mon-\u003epeer_cnt is updated under that lock by tipc_mon_add_peer() and\ntipc_mon_remove_peer(). The value can therefore be stale, and the decision\nwhether the local domain has to be recomputed can be based on an outdated\nmember count.\n\nRead mon-\u003epeer_cnt inside the write_lock_bh(\u0026mon-\u003elock) protected region.\n\nFixes: 35c55c9877f8 (\"tipc: add neighbor monitoring framework\")\nSigned-off-by: Ginger Li \u003cginger.jzllee@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260922080909.21123-1-ginger.jzllee@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b94773dc4df7026a6f29b2c65e96e88d29cdb576", "tree": "f33a3cffc1582c8a98067d7580d114efafaea961", "parents": [ "61cb282fe97b3b0ba32ca09417a693162bf4ae3f" ], "author": { "name": "Alexander Sverdlin", "email": "alexander.sverdlin@siemens.com", "time": "Tue Sep 22 09:52:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:20 2026 -0700" }, "message": "net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n\nMaxLinear GSW12x/GSW14x Ethernet Switch Errata Sheet states:\n\"An issue has been sporadically observed after device power-on on the first\nlink-up attempt in 100BASE-TX mode resulting in either the link-up taking a\nlong time, or failing to link-up altogether...\n\nWorkaround:\nAfter power-on, enable Cable Diagnostic Mode for all ports and disable\nit...\"\n\nImplement the proposed workaround unconditionally in the Intel XWAY driver\n(MaxLinear GSW1xx switches incorporate Intel XWAY PHYs) because the\ndiagnostic bits have the same meaning even in older integral PHYs such as\nGPY111/PEF7071/PHY11G. So it\u0027s not clear how to distinguish the affected\nnewer integrated PHYs, but the workaround should not hurt the older PHYs.\n\nCc: stable@vger.kernel.org\nFixes: 22335939ec90 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nSigned-off-by: Alexander Sverdlin \u003calexander.sverdlin@siemens.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260922075251.23386-1-alexander.sverdlin@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "61cb282fe97b3b0ba32ca09417a693162bf4ae3f", "tree": "d1214b84bb1f1773f609603d93bee4c9a07749b3", "parents": [ "ba3d1f480c7a3fba963e7867ad6cc557c197acbc" ], "author": { "name": "Sidraya Jayagond", "email": "sidraya@linux.ibm.com", "time": "Tue Sep 22 09:31:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:19:50 2026 -0700" }, "message": "net/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock.\n\nFixes: 541afa10c126 (\"net/smc: add smcr_port_err() and smcr_link_down() processing\")\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nSigned-off-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260922073149.474762-1-sidraya@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ba3d1f480c7a3fba963e7867ad6cc557c197acbc", "tree": "77e8369813a2d60c9464a9262a30b7e8938d9ad5", "parents": [ "1a983a4e14c635c40354be110cd9a1a5c94e01e6" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Mon Sep 21 14:50:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:03:23 2026 -0700" }, "message": "net/rds: size a connection\u0027s path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller\u0027s transport before\nit decides whether a connection to one of the host\u0027s own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport\u0027s RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller\u0027s transport; the unused entries are freed with it.\n\nFixes: 4716af3897e9 (\"net/rds: Give each connection path its own workqueue\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260921215027.174657-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a983a4e14c635c40354be110cd9a1a5c94e01e6", "tree": "34bab83130682d046ee59f149ea21b3e6ffcde0d", "parents": [ "5b49efa1e16228921ceeae68d34defc8a4548dcb" ], "author": { "name": "Sang-Hoon Choi", "email": "csh0052@gmail.com", "time": "Tue Sep 22 03:15:59 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:59:32 2026 -0700" }, "message": "nfp: hold IPsec RX state under the XArray lock\n\nnfp_net_ipsec_rx() drops the XArray lock before taking a reference to the\nxfrm_state it found. The delete path can erase the entry and drop the last\nstate reference in that interval. RX can then try to increment a zero\nrefcount after the state has been queued for destruction.\n\nThe driver queues firmware invalidation asynchronously; the delete path\ndoes not wait for the command to complete or drain pending RX processing.\n\nThe XFRM garbage collector waits for an RCU grace period before freeing\nthe state. That delays reclamation but does not make acquiring a reference\nfrom zero valid.\n\nTake the xfrm_state reference before releasing the XArray lock so\nxa_erase() cannot run between lookup and reference acquisition.\n\nFixes: 57f273adbcd4 (\"nfp: add framework to support ipsec offloading\")\nReported-by: Changyul Lee \u003clcy8047@gmail.com\u003e\nSigned-off-by: Sang-Hoon Choi \u003ccsh0052@gmail.com\u003e\nLink: https://patch.msgid.link/179001455912.44752.17153022439349797877.idr-bug-92@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5b49efa1e16228921ceeae68d34defc8a4548dcb", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "9476b4468862927297c94c440863cd8ed1e7cc83" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "message": "Merge branch \u0027net-ena-fix-resource-cleanup-on-probe-failure\u0027\n\nGuangshuo Li says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ena: fix resource cleanup on probe failure\n\nThis series fixes two resource leaks in the ena_probe() error path after\nena_device_init() has successfully initialized device resources.\n\nPatch 1 adds the missing PHC cleanup.\nPatch 2 adds the missing MMIO read request cleanup.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921154202.471662-1-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9476b4468862927297c94c440863cd8ed1e7cc83", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "0958ea4355e2e9220ad4e13da3b7d94f365ed34f" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:02 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases this buffer through\nena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails\nafter ena_device_init() succeeds, the error path destroys the admin\nresources and eventually frees ena_dev without destroying the MMIO read\nrequest, leaving the coherent DMA buffer allocated.\n\nCall ena_com_mmio_reg_read_request_destroy() in the probe error path\nbefore releasing the remaining device resources.\n\nThis issue was found by manual code inspection.\n\nFixes: 1738cd3ed342 (\"net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nLink: https://patch.msgid.link/20260921154202.471662-3-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0958ea4355e2e9220ad4e13da3b7d94f365ed34f", "tree": "e95c06fefb48b50ed31f2076c92801ab53e9a4c8", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix PHC cleanup on probe failure\n\nena_probe() initializes the PHC as part of ena_device_init(), but the\nprobe failure path does not destroy it before freeing the PHC private\ndata.\n\nThe normal removal path calls ena_phc_destroy() through\nena_destroy_device() before ena_phc_free(). However, if probe fails\nafter ena_device_init() succeeds, the error path reaches ena_phc_free()\nwithout unregistering the PTP clock or destroying the device PHC\nresources.\n\nCall ena_phc_destroy() in the probe error path before freeing the PHC\nprivate data.\n\nThis issue was found by manual code inspection.\n\nCc: stable@vger.kernel.org tags and describe this as a consistency cleanup\nFixes: e0ea34158ee8 (\"net: ena: Add PHC support in the ENA driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nCc: stable\nLink: https://patch.msgid.link/20260921154202.471662-2-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "dad19b59da050cb60d3f7023dac2a042a84bf0bd" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:04 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:05 2026 -0700" }, "message": "Merge branch \u0027ovs-net-sched-fixes-for-uaf-after-conntrack-extension-realloc\u0027\n\nIlya Maximets says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\novs, net/sched: fixes for UAF after conntrack extension realloc\n\nOne clean up change plus two fixes for the UAF on helper extension\nrealloc x 2. First half for OVS and the second half for the similar\ncode in act_ct. This should cover all the known cases of this problem\nin these two modules.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921145655.3167436-1-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dad19b59da050cb60d3f7023dac2a042a84bf0bd", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "00df72e39f306e2f7adb68528a5c92109da6a0a9" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-7-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "00df72e39f306e2f7adb68528a5c92109da6a0a9", "tree": "3756562aa8c9c3ed5be520af59077dca7bfed2f2", "parents": [ "f85009dfcd65e5969526b0db7a49b5413746e630" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-6-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f85009dfcd65e5969526b0db7a49b5413746e630", "tree": "fb3f76eda2d5e8748a669f6dba07a7242e1f81f7", "parents": [ "1a4151e6be57b098b7a5ebfbde58585e83200cdc" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels or run NAT and adds the\n new extension for that breaking the pointer in the expectation\n list causing UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where we need to process both clones without\nmodifications in the same zone. So, let\u0027s just reset the entry in\ncase for some reason we got an skb with a shared one. This doesn\u0027t\naffect any known use cases, but avoids any potential problems with\nsharing and modification of the unconfirmed ct entry.\n\nUnlike openvswitch module, act_ct allows for NAT without commit.\nChanging that would be a uAPI break. So, act_ct needs to reset on NAT\nregardless of the commit flag to avoid reallocation of the extension\nspace. This, however, doesn\u0027t really change the picture for sensible\nnetworking cases as there should be no need to run the same packet\ntwice (before and after the clone) through conntrack without packet\nheader or zone changes and without commit.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-5-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a4151e6be57b098b7a5ebfbde58585e83200cdc", "tree": "7c4feed8cf53f38f69d6cdf6c54216d625b43ad7", "parents": [ "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-4-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4", "tree": "a51be25ec871fdbf14d524e15560acaf26de558b", "parents": [ "26b2bd70d22457556e2fa01cbf1192cb1a94d619" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:44 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: 3c1860543fcc (\"openvswitch: add nf_ct_is_confirmed check before assigning the helper\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-3-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26b2bd70d22457556e2fa01cbf1192cb1a94d619", "tree": "add4d4409a93d8e8e7ac9fc4522902413d8de5eb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n for that breaking the pointer in the expectation list causing\n UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed. So, let\u0027s just reset the entry in case\nfor some reason we got an skb with a shared one during commit. This\ndoesn\u0027t affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-2-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "tree": "2d3503172121f63ef09798d7f62ea7c8400f55aa", "parents": [ "3173cba1170131816972ed2b6185cb970ba8b747", "006208026819d5e9e5ec07b3e73d95960a059327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncluded fixes:\n* add selftest coverage for peer VPN address validation\n* reject multicast, broadcast and loopback peer VPN addresses, which\n can never identify a peer\n* reject MP peers left with no usable VPN address, as they can never\n be selected for TX\n* reject duplicate peer VPN addresses, which made peer lookup return\n an arbitrary peer\n* fix stale entry left in the VPN address hashtable when an address\n is cleared\n* fix torn IPv6 address read on lockless TX when the unusable local\n source is cleared in place\n* fix torn IPv6 address read on lockless TX when a new local endpoint\n is learned in place\n* fix dst cache being populated with a route resolved from an already\n replaced bind\n* fix stale route being reused after the socket mark or UDP source\n port changed\n* fix bogus validation of an unspecified local source address, which\n must instead be left to route source autoselection\n* fix IPv6 link-local peer endpoints losing their scope id when\n configured via netlink, breaking route lookup\n\n* tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n selftests: ovpn: validate peer VPN addresses\n ovpn: reject invalid peer VPN addresses\n ovpn: reject multipeer peers without VPN addresses\n ovpn: reject duplicate peer VPN addresses\n ovpn: always unhash old VPN addresses before rehashing\n ovpn: replace bind when clearing stale local source\n ovpn: replace bind when learning local endpoint\n ovpn: validate peer state before caching UDP dst\n ovpn: track UDP socket route key for peer dst cache\n ovpn: skip UDP source validation for unspecified addresses\n ovpn: preserve IPv6 scope id for netlink peer endpoints\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921102215.3599702-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3173cba1170131816972ed2b6185cb970ba8b747", "tree": "961e6baefb38b4633e6a0cc8352928bc62fcde9b", "parents": [ "a940003f44e7e441c228151dd212642152700ec8" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Sep 21 15:15:49 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:40:29 2026 -0700" }, "message": "net: libwx: fix races in Tx timestamp handling\n\nwx-\u003eptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.\n\nFixes: 06e75161b9d4 (\"net: wangxun: Add support for PTP clock\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/6C7EC12D69217315%2B20260818074721.45536-1-jiawenwu%40trustnetic.com\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/77431AF9A0E369F3+20260921071549.1141804-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a940003f44e7e441c228151dd212642152700ec8", "tree": "4e491ab33176cf4658363151cc3350da30c5b785", "parents": [ "f75f21ef36285e5f56ee0c428bd2909ee81165b9" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Mon Sep 21 01:20:44 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:36:05 2026 -0700" }, "message": "net: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl-\u003ephydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers\nunwind with phy_detach(), which knows nothing about pl-\u003ephydev, so a\npointer to a PHY that is no longer attached outlives the failed\nconnect.\n\nWhat that costs depends on how the caller got here.\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses\nto attach while pl-\u003ephydev is set, turning a transient MDIO error into\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()\nanswers the failure with phy_device_remove() and phy_device_free(), and\nit assigns sfp-\u003emod_phy only past that error return, so nothing clears\npl-\u003ephydev and it is left pointing at a freed phy_device that\nphylink_resolve() and the ethtool helpers go on reading.\nphylink_fwnode_phy_connect() has no such check, so a later connect\noverwrites the stale pointer and hides the problem. A disconnect does\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),\nand the second phy_detach() on the same PHY drops references the first\none already released.\n\nFound while making a DSA port survive a PHY whose driver arrives after\nthe switch probes: keeping the port across a failed connect and\nretrying is what makes this window reachable.\n\nPublish the pointer after the last call that can fail instead of\nunwinding it afterwards. Nothing between the two points reads\npl-\u003ephydev, and the registration that follows cannot fail:\nphy_request_interrupt() falls back to polling on its own. The PHY-side\nstate keeps the order it had, so no MDIO operation moves relative to\nanother.\n\nFixes: 03abf2a7c654 (\"net: phylink: add EEE management\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260920222044.1752860-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f75f21ef36285e5f56ee0c428bd2909ee81165b9", "tree": "a7311bba54a71a7f756e92f4df75dc0eb3c9a100", "parents": [ "fe99bbeee5c5dbd3abc30721a8079ced59649d97" ], "author": { "name": "Ming Wang", "email": "wangming01@loongson.cn", "time": "Sun Sep 20 15:44:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:27:47 2026 -0700" }, "message": "net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist\n\nThe MeiG Smart SRM821 5G module (0x2dee:0x4d53) crashes and drops off\nthe USB bus when it receives a Zero Length Packet (ZLP) after sending\nor receiving an NTB of exactly 16384 bytes (tx_max).\n\nAccording to the MBIM specification, devices do not require a ZLP\nif the NTB size is exactly dwNtbOutMaxSize. However, the cdc_mbim\ndriver defaults to sending ZLPs for devices not explicitly whitelisted\nto accommodate non-conformant hardware. This default behavior breaks\nthe strictly conformant MeiG SRM821 module.\n\nAdd this device to the ZLP conformance whitelist (cdc_mbim_info) so\nthe driver will pad the NTB to avoid sending ZLPs, preventing the\ndevice firmware from crashing.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Ming Wang \u003cwangming01@loongson.cn\u003e\nLink: https://patch.msgid.link/20260920074500.826121-1-wangming01@loongson.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1765a153d985c231357145e26798f9408db10e42", "tree": "912bac6b31e58ac675a62df8ba0064b2d13cdddc", "parents": [ "c774ec8f0a5d02a06d34c27f5a7de7e333b91265" ], "author": { "name": "Guopeng Zhang", "email": "zhangguopeng@kylinos.cn", "time": "Thu Sep 24 17:15:36 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Sep 24 06:22:11 2026 -1000" }, "message": "cgroup/pids: Restore pids.events notifications in local mode\n\nA fork rejected by the pids controller increments the counter reported by\npids.events. When local event accounting is selected, however, pids_event()\nreturns after notifying only events_local_file, leaving pids.events pollers\nasleep.\n\nOn legacy hierarchies, pids.events.local does not exist. With\npids_localevents, pids.events reports the same local counter. In both\ncases, pids.events changes without generating a notification.\n\nThis can be reproduced with a pids_localevents mount:\n\n mkdir /tmp/test\n mount -t cgroup2 -o pids_localevents none /tmp/test\n mkdir /tmp/test/t\n echo 1 \u003e /tmp/test/t/pids.max\n cat /tmp/test/t/pids.events # max 0\n timeout 3 inotifywait -e modify /tmp/test/t/pids.events \u0026\n sh -c \u0027echo $$ \u003e /tmp/test/t/cgroup.procs; (true \u0026)\u0027 2\u003e/dev/null\n wait\n cat /tmp/test/t/pids.events # max 1\n\nWithout this patch, inotifywait times out without reporting an event.\nNotify pids.events before returning from the local event path.\n\nFixes: 3f26a885a068 (\"cgroup/pids: Add pids.events.local\")\nCc: stable@vger.kernel.org # v6.11+\nSigned-off-by: Guopeng Zhang \u003czhangguopeng@kylinos.cn\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "fe99bbeee5c5dbd3abc30721a8079ced59649d97", "tree": "a983718e1dd5f2de4f05cfc58217735bea003abf", "parents": [ "26cc0e69cce062cd3aa6fae33074684669c35a71" ], "author": { "name": "Yilin Zhang", "email": "yilinzhang@moonshot.ai", "time": "Thu Sep 24 12:49:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:17:10 2026 -0700" }, "message": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy.\n\nFixes: c31b70c9968f (\"tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit\")\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nTested-by: Weiming Shi \u003cshiweiming@moonshot.ai\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/8a9dff4063a2745653b7e88ceb745d75efa16e68.1790224474.git.yilinzhang@moonshot.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26cc0e69cce062cd3aa6fae33074684669c35a71", "tree": "b3f83760ecd653ecac8511928c3da0d5ae809c40", "parents": [ "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Mon Sep 21 05:10:01 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:11:56 2026 -0700" }, "message": "mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns \u0026mns-\u003ekeys list\nand matches netid, req_tag, peer_addr, and manual_alloc, without\nchecking whether tmp-\u003esk \u003d\u003d \u0026msk-\u003esk. This allows any MCTP socket in the\nsame network namespace to use and consume another socket\u0027s preallocated\ntag.\n\nIterate the socket\u0027s own tag list (\u0026msk-\u003ekeys via sklist) instead of the\nnamespace-wide \u0026mns-\u003ekeys list in mctp_lookup_prealloc_tag(), ensuring\nthat only tags allocated by msk are matched.\n\nTested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A\u0027s\npreallocated tag succeeds (ret \u003d 4); with this patch applied,\nsendto(sock_b) fails with -ENOENT (errno \u003d 2) while sendto(sock_a)\nsucceeds (ret \u003d 4).\n\nFixes: 63ed1aab3d40 (\"mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control\")\nSuggested-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260921051002.1656692-1-benquike@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "5fc5768c7ca92895ccd1de94dc521e5a55ae7896" }