)]}' { "log": [ { "commit": "2f0c1cf72f4682178506f513bbf015e591b1aa4a", "tree": "6a0d9322c1c028e257c2ce6403c65f2f2bcc748d", "parents": [ "3ce99a68f7d5b878a7746d479591a18651a8238f", "dc2136341be9835e70ba7c6b36904cf3683fd029" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 16:22:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 16:22:25 2026 -0700" }, "message": "Merge tag \u0027s390-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix NULL pointer dereferences in s390dbf when setting debug levels or\n resizing debug areas while logging events. Remove duplicate messages\n about kernel parameter overrides\n\n - Fix PAI perf crashes when per task events move to newly onlined CPUs.\n Add CPU hotplug callbacks to allocate and free the per-CPU data\n\n - Fix mutex use in atomic context in AES and PAES CTR code by using\n semaphore trylocks instead. Remove conditional locking and enable\n Clang CONTEXT_ANALYSIS for the crypto code\n\n - Fix scatterlist walk error handling in AES and PAES and avoid freeing\n PAES walk resources twice\n\n - Fix missing scrubbing of temporary AES and PAES buffers, including\n AES GCM error paths\n\n - Set missing CRYPTO_ALG_ASYNC and CRYPTO_ALG_NO_FALLBACK flags for\n PAES\n\n - Fix -EBUSY handling in PAES and PHMAC to avoid cleaning up requests\n already queued to the crypto engine\n\n - Fix PAES and PHMAC requests being completed twice on errors\n\n - Fix PAES and PHMAC hangs when key conversion keeps returning -EBUSY\n by returning -EIO after the last retry\n\n* tag \u0027s390-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/crypto: Enable CONTEXT_ANALYSIS\n s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly\n s390/crypto: Fix wrong return code to engine in asynch callbacks\n s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine\n s390/crypto: Fix handling of EBUSY in PAES when req is pushed to crypto engine\n s390/crypto: Fix missing cra_flags in paes_s390\n s390/crypto: Fix use of mutex in atomic context in PAES\n s390/crypto: Fix missing scrub of temp buffers with PAES algorithm\n s390/crypto: Fix return code handling at skcipher_walk_done in PAES algorithms\n s390/crypto: Fix use of mutex in atomic context\n s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm\n s390/crypto: Fix skcipher_walk return code handling in aes_s390\n s390/debug: Fix race between debug area resize and event logging\n s390/debug: Do not repeat parameter override notice on debug_set_level()\n s390/debug: Fix NULL pointer dereference in debug_set_level()\n s390/pai: Support CPU hotplug for PMU PAI\n s390/pai: Move locking to event init and delete\n s390/pai: Use PAI PMU index as parameter replacing event\n" }, { "commit": "3ce99a68f7d5b878a7746d479591a18651a8238f", "tree": "bb157d9c3b95daf4bb02bdd6e9f89487016ca7b6", "parents": [ "cba2348ab114391f5b1a00fa65c5b739f13f0563", "59351365ac271b5e0eb180f211c531476a36221f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 11:29:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 11:29:20 2026 -0700" }, "message": "Merge tag \u0027kbuild-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\n\nPull Kbuild fixes from Nicolas Schier:\n \"Fix a build race and builds on stable branches.\n\n The other two are low-hanging fruits from Lorenzo\u0027s recent kbuild\n speed-up patch set that fix older symbol leakages.\n\n - don\u0027t delete in-flight filechk temporaries in asm-headers\n\n A rule for generating header files was changed from using make\n $(wildcard) fnglob to \u0027find\u0027 instead; as \u0027find\u0027 finds \"hidden\"\n files by default, temporary files from Kbuild\u0027s \u0027filechk\u0027, used for\n generating asm header files, may get deleted and break header file\n generating.\n\n - scripts/sorttable: Mark long_size as __maybe_unused\n\n Fix builds with clang-23 or newer on trees w/o commit b055f4c431e3\n (\"sorttable: Move ELF parsing into scripts/elf-parse.[ch]\");\n targetting for backport to stable kernels \u003c 6.19.\n\n - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n\n Update regexp to remove kallsyms entries from kernel binary, saves\n about 32 KiB of bzImage.\n\n - scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n\n Prevent arm64 PIE namespace local symbols from appearing System.map\n and /proc/kallsyms\"\n\n* tag \u0027kbuild-fixes-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:\n scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n scripts/sorttable: Mark long_size as __maybe_unused\n kbuild: don\u0027t delete in-flight filechk temporaries in asm-headers\n" }, { "commit": "59351365ac271b5e0eb180f211c531476a36221f", "tree": "d41f4050105dffde43904c3cc37251543ac16008", "parents": [ "281b61d408d4c39544583e393c6707af0ef5ee50" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Tue Sep 08 21:55:02 2026 +0100" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:19 2026 +0200" }, "message": "scripts/mksysmap: fix escape of \u0027$\u0027 in the __pi_ pattern\n\nCommit b18b047002b7 (\"kbuild: change scripts/mksysmap into sed script\")\nconverted scripts/mksysmap from a shell script to a sed script.\n\nHowever an error was made - escaping of \u0027$\u0027 required \\\\ escaping in shell\nbut only \\ in a sed script.\n\nThis was mostly corrected in commit 7a6c355b55c0 (\"scripts/mksysmap: Fix\nescape chars \u0027$\u0027\"), but this fix missed arm64 PIE namespace local symbols\nlike __pi_$x and __pi_$d which appear in System.map and /proc/kallsyms:\n\n$ grep __pi_\\\\$ /proc/kallsyms | sort -u\n0000000000000000 d __pi_$d\n0000000000000000 t __pi_$x\n\nFix the escaping properly.\n\nFixes: b18b047002b7 (\"kbuild: change scripts/mksysmap into sed script\")\nAssisted-by: LLM\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Nicolas Schier \u003cnsc@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-build-speedup-v1-2-5dc1ac01672d@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "281b61d408d4c39544583e393c6707af0ef5ee50", "tree": "37b815d016c0a843fcf8a90385c90c583cb0a01f", "parents": [ "4f73462856576797b8f3c55564a9be99f76dc67b" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Tue Sep 08 21:55:01 2026 +0100" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:19 2026 +0200" }, "message": "scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms\n\nCommit 3e86e4d74c04 (\"kbuild: keep .modinfo section in vmlinux.unstripped\")\nkeeps .modinfo symbols out of System.map and kallsyms, which assumes unique\nIDs have a format like \u0027__UNIQUE_ID_modinfo123\u0027.\n\nHowever, commit afb026b6d35c (\"compiler: Tweak __UNIQUE_ID() naming\"), sent\nin the same cycle, changes this to \u0027__UNIQUE_ID_modinfo_123\u0027.\n\nAs a result this regexp has never matched and every kernel since v6.18 has\ncarried one kallsyms entries for every MODULE_INFO() declaration in the\nkernel whether the modules are compiled or not.\n\nThat\u0027s 5,810 entries for an x86 defconfig build and 15,200 for arm64.\n\nOn x86 defconfig that is 113 KiB of kallsyms tables and 32 KiB of bzImage,\nand every lookup walks past them.\n\nFix the pattern.\n\nFixes: 3e86e4d74c04 (\"kbuild: keep .modinfo section in vmlinux.unstripped\")\nAssisted-by: LLM\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Nicolas Schier \u003cnsc@kernel.org\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-build-speedup-v1-1-5dc1ac01672d@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "4f73462856576797b8f3c55564a9be99f76dc67b", "tree": "80c7ed0413854f2f54c1be274c2d19a59be96cce", "parents": [ "06bb43d8c79762fa3452f292cd080e54bef5d431" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Mon Aug 31 18:46:31 2026 -0700" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:18 2026 +0200" }, "message": "scripts/sorttable: Mark long_size as __maybe_unused\n\nWhen building in a kernel tree prior to commit b055f4c431e3 (\"sorttable:\nMove ELF parsing into scripts/elf-parse.[ch]\") with clang-23 or newer,\nwhich implements a new warning under -Wunused-but-set-variable for\nstatic global variable, there is a warning from sorttable because\nlong_size is unused when MCOUNT_SORT_ENABLED is not set:\n\n scripts/sorttable.c:452:12: error: variable \u0027long_size\u0027 set but not used [-Werror,-Wunused-but-set-global]\n 452 | static int long_size;\n | ^\n\nMark long_size as __maybe_unused to avoid inserting more ugly #ifdef\ndirectives while insuring the warning does not reappear, as the\naforementioned change does not alter the uses of long_size, so it\nappears to be coincidence that the warning disappears after this\nrefactoring.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nTested-by: Nicolas Schier \u003cn.schier@fritz.com\u003e\nLink: https://patch.msgid.link/20260831-sorttable-long_size-unused-but-set-global-v1-1-8a96b88697e5@kernel.org\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "06bb43d8c79762fa3452f292cd080e54bef5d431", "tree": "2e60278e074e77ed844dc12fff9492611ca2f594", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "Vlad Poenaru", "email": "vlad.wing@gmail.com", "time": "Wed Sep 02 09:13:47 2026 -0700" }, "committer": { "name": "Nicolas Schier", "email": "nsc@kernel.org", "time": "Sat Sep 12 20:01:13 2026 +0200" }, "message": "kbuild: don\u0027t delete in-flight filechk temporaries in asm-headers\n\nCommit 2d69b891e646 (\"kbuild: Support generated asm-headers in\nsubdirectories\") switched the stale-wrapper sweep in\nscripts/Makefile.asm-headers from $(wildcard $(obj)/*.h) to a find(1)\ninvocation, so that generated headers in subdirectories are considered.\n\nThe two do not match the same set of files. Make\u0027s $(wildcard) uses glob\nsemantics, where a leading \u0027.\u0027 has to be matched explicitly, whereas\nfind\u0027s -name uses fnmatch() without FNM_PERIOD, so \u0027*.h\u0027 matches\ndotfiles as well. filechk writes its output to $(dir $@).tmp_$(notdir $@)\nbefore renaming it into place, so such a scratch file, if it happens to\nexist in $(obj) when the sub-make is parsed, is now picked up in\nold-headers. It appears in neither generic-y, generated-y nor syscall-y,\nis therefore classified as unwanted, and cmd_remove deletes it.\n\nOn x86 this races with archprepare, which lists both asm-generic and\narch/x86/include/generated/asm/cpufeaturemasks.h as prerequisites. Under\n-j they run concurrently against the same directory, and the build fails\nintermittently:\n\n mv: cannot stat \u0027arch/x86/include/generated/asm/.tmp_cpufeaturemasks.h\u0027: No such file or directory\n make[1]: *** [arch/x86/Makefile:269: arch/x86/include/generated/asm/cpufeaturemasks.h] Error 1\n\nThe same commit also converted the generic wrapper rule to filechk, so\nthose wrappers now create .tmp_*.h in $(obj) too and can race among\nthemselves.\n\nRestore the previous behaviour by excluding dotfiles from the sweep.\nSubdirectories, which is what the find(1) conversion was for, keep being\ndescended into. While at it, quote the -name argument: it is currently\nexpanded by the shell against the build directory before find sees it.\n\nFixes: 2d69b891e646 (\"kbuild: Support generated asm-headers in subdirectories\")\nSigned-off-by: Vlad Poenaru \u003cvlad.wing@gmail.com\u003e\nReviewed-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nReviewed-by: Nicolas Schier \u003cn.schier@fritz.com\u003e\nLink: https://patch.msgid.link/20260902161347.4163577-1-vlad.wing@gmail.com\nSigned-off-by: Nicolas Schier \u003cnsc@kernel.org\u003e\n" }, { "commit": "cba2348ab114391f5b1a00fa65c5b739f13f0563", "tree": "3cbc431c93c6d9cc166e68365793de55bb37556c", "parents": [ "95deca8dd9a91063babb2ef3a69f5248b1fa824e", "ad4497a92caba4630f75c80d49cb947026213280" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:44:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:44:12 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"More than the usual amount of fixes.\n\n The highlights here are a block under reservation fix which caused an\n assert to be triggered in non-default configurations. The assert,\n initially added on 7.3-rc2 just makes the problem explicit but is not\n the cause. Another highlight is a missed lock/unlock mutex in the xfs\n healthmonitor which was causing lockdeps warnings.\n\n Besides those two, this also contains a myriad of fixes for random\n bugs found by LLM tools in the healthmon, scrub and online repair.\n\n A few bug fixes for zoned xfs are also included.\n\n This also includes an accounting fix for our buffer slab cache where\n the memory payload associated to each object was not being properly\n accounted for.\n\n The remaining of the patches are a few lock context annotations added\n and/or fixed. They are mostly disabled by now, but still worth fixing\n before we get them enabled.\n\n And last but not least, a few clean ups\"\n\n* tag \u0027xfs-fixes-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (75 commits)\n xfs: advance the findparent inode scan cursor while holding ILOCK\n xfs: reset parent pointer args before each dir tree unlink repair\n xfs: fix replaying dirent removals into the temporary directory\n xfs: fix termination logic in xchk_bmap\n xfs: fix rtrmap cross-referencing elision logic\n xfs: actually check internal-rtdev fields in the superblock\n xfs: fix under-reservation of blocks when repairing sf directories\n xfs: take hm-\u003elock in xfs_ioc_health_monitor() before insert\n xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices\n xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync\n xfs: don\u0027t continue on error in xfs_fsync\n xfs: also flush the RT device cache in xlog_write_iclog\n xfs: bail out on bitmap errors in xrep_agfl_fill\n xfs: snapshot old AGFL before rewriting it\n xfs: remove redundant function declaration\n xfs: report runtime failures in scrub\n xfs: report healthy filesystem events in scrub stats\n xfs: snapshot scrub stats when rendering them\n xfs: remove several unused and never-implemented declarations\n xfs: count escaped corruption errors in scrub stats\n ...\n" }, { "commit": "95deca8dd9a91063babb2ef3a69f5248b1fa824e", "tree": "5a427ef1b0ebaa1f29088f91b04785f62663979c", "parents": [ "4d85a45df03118ade0eb34486fb7948bca17acf8", "09f1294ee2abee7fe1c2d600671498b7642e0fe0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:31:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:31:48 2026 -0700" }, "message": "Merge tag \u0027for-7.3-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - tree-checker updates, validate values in b-tree item keys, other item\n length checks\n\n - don\u0027t do unnecessary transaction commit fallback when logging parent\n directories\n\n - in zoned mode, initialize space info of a block group early enough so\n it does not lead to NULL pointer dereference\n\n* tag \u0027for-7.3-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: tree-checker: validate name length for extref items\n btrfs: tree-checker: validate parent field for inode extref items\n btrfs: tree-checker: validate key offset for inode ref keys\n btrfs: fix unnecessary transaction commit fallback from btrfs_log_all_parents()\n btrfs: set space_info before adding new free space in btrfs_make_block_group()\n" }, { "commit": "4d85a45df03118ade0eb34486fb7948bca17acf8", "tree": "d3127fb0277496a56938961826caad5ccf1c06a3", "parents": [ "31a4327ffe2d8cbd0f51a3af6a3ffc5ecd7fdbee", "135d84c66f85426299db01a09d93a79a87af18ba" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:18:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:18:50 2026 -0700" }, "message": "Merge tag \u0027erofs-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs\n\nPull erofs updates from Gao Xiang:\n \"The most impactful fix here is to disable LZ4 rolling decompression\n for now.\n\n AWS folks recently found their systems could get corrupted data with\n some rare, specific LZ4 datasets, and after a deeper analysis, I found\n the root cause is that there could be uncontrolled backward memory\n copies in the current LZ4 implementation and it breaks the assumption\n of the rolling decompression optimization, since the kernel LZ4\n codebase is out of our control and it needs more time to plan how to\n do next, so disable LZ4 rolling decompression for now to ensure data\n correctness for real production on these rare cases first. The\n technical details also see the corresponding commit.\n\n Other changes are random minor fixes.\n\n Summary:\n\n - Disable LZ4 rolling decompression for now due to the uncontrolled\n LZ4 implementation\n\n - Fix missing sysfs feature entry for xattr prefixes\n\n - Fix invalid LZMA decoders on resize failure\n\n - Rearrange the inode_share cache key to avoid potential collisions\n\n - Fix erofs_bread() when fsoffset is used on sub-page-block EROFS\n filesystems\"\n\n* tag \u0027erofs-for-7.3-rc3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:\n erofs: add missing buf-\u003eoff in erofs_bread()\n erofs: delimit inode_share cache key components\n erofs: disable LZ4 rolling decompression for now\n erofs: preserve LZMA decoders on resize failure\n erofs: add sysfs feature entry for xattr prefixes\n" }, { "commit": "31a4327ffe2d8cbd0f51a3af6a3ffc5ecd7fdbee", "tree": "a53dd0ee2af18ff8dfc922b14f50066d590cadc0", "parents": [ "f6e213d5a2a94255b31926f0e9f7c1eb234bbf22", "a0a34a40ed299c9c7cff6af163a5b883ee9d6d73" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:06:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 08:06:04 2026 -0700" }, "message": "Merge tag \u0027fbdev-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev\n\nPull fbdev fixes from Helge Deller:\n \"Two patches for VT core code and fbcon prevent potential out-of-bounds\n reads on font or screen size changes, one fix limits the Superblitter\n in atafb to supported modes only, and some minor fixes for vfb,\n ssd1307fb and omapfb\"\n\n* tag \u0027fbdev-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:\n fbdev: vfb: defer cleanup until the last reference\n fbdev: atafb: Restrict SuperBlitter to supported formats\n fbdev: ssd1307fb: fix NULL pointer dereference on missing match data\n fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo\n fbdev: omapfb: Fix __be32 sparse warning in panel_enabled()\n vt: hide cursor prior to font changes to avoid out-of-bound reads\n" }, { "commit": "f6e213d5a2a94255b31926f0e9f7c1eb234bbf22", "tree": "ee541b499a544b516aad68c0766cdad53b95acdd", "parents": [ "52311be52f66f1a3c71bc808d156482feb1eb79f", "b63c3c26726576e2a87baeee80bc202a5a43c9e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:55:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:55:52 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull IOMMU fixes from Joerg Roedel:\n \"RISC-V:\n\n - Serialize command queue publication to prevent concurrent producers\n from exposing incomplete or out-of-order commands to hardware\n\n - Wait for queue space outside the command queue lock\n\n - Avoid waiting for IOFENCE completion when command enqueue failed\n\n AMD:\n\n - Prevent GA log buffers from being reallocated and leaked during\n resume, where allocation also occurs in an unsuitable syscore\n callback context\n\n - Fix a regression on older systems whose firmware advertises\n incorrect IOMMU features\n\n - Preserve allocation errors when assigning host domain IDs to nested\n domains\n\n s390:\n\n - Prevent a NULL dereference when translating an unmapped IOVA with\n five-level ZPCI translation tables\n\n Misc:\n\n - Remove a stale MAINTAINERS entry and clean up unused or redundant\n AMD IOMMU declarations, macros, and checks\"\n\n* tag \u0027iommu-fixes-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/amd: Remove unused macro\n iommu/amd: Remove redundant checks from interrupt handler path\n iommu/amd: Remove redundant check in irq_remapping_select()\n iommu/amd: Make iommu_sva_set_dev_pasid as static\n MAINTAINERS: Drop the nonexistent vsi-iommu.h file entry\n iommu/amd: Fix ineffective error check in nested domain allocation\n iommu/amd: Fix premature break in init_iommu_one() again\n iommu/amd: Do not reallocate GA log buffers on resume\n iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX\n iommu/riscv: Avoid waiting on failed command enqueue\n iommu/riscv: Serialize command queue publishing\n iommu/riscv: Add command queue lock\n" }, { "commit": "52311be52f66f1a3c71bc808d156482feb1eb79f", "tree": "e055921392335069c3655b60888fa377967d642c", "parents": [ "5225b8eec4c9bb21aecff6295fab6346a3c3738e", "9e5c53d75c560a058abef0e4338c5e3e52cb432a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:45:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 12 07:45:01 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - powerpc/entry: Fix double accounting of user time on interrupt entry\n\n - Fix leak in htmdump_init_debugfs\n\n - KVM: PPC: Book3S HV: Set irqfd-\u003eproducer only on success\n\n - powerpc/kexec_file: print configured kernel command line\n\n - Remove redundant early_init_dt_scan_root() call\n\n - misc fixes and cleanup\n\nThanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe\nLeroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan,\nMichail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM),\nShivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and\nVenkat Rao Bagalkote\n\n* tag \u0027powerpc-7.3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs\n powerpc/prom: Remove redundant early_init_dt_scan_root() call\n selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm\n powerpc/kexec_file: print configured kernel command line\n KVM: PPC: Book3S HV: Set irqfd-\u003eproducer only on success\n powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs\n selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value\n selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change\n powerpc/entry: Fix double accounting of user time on interrupt entry\n" }, { "commit": "5225b8eec4c9bb21aecff6295fab6346a3c3738e", "tree": "6cab48fce372373e9de81566c2b48c44b52db3cc", "parents": [ "114f73092b5d1bbea2554a6a784f5ebb53d47bdb" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Sep 11 15:45:37 2026 -0600" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:41:26 2026 -0700" }, "message": "mailmap: update entry for Jens Axboe\n\nI recently changed jobs, let\u0027s update the .mailmap entry so that patches\nare attributed to the right (current) company.\n\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "114f73092b5d1bbea2554a6a784f5ebb53d47bdb", "tree": "e99dba314e3855036cd5eb214d1dbd6b91528636", "parents": [ "0fb234ce373a331a21c1d33cffef28e53cee4ddb", "f3e6ef13e24c9f26dca0d35de57fcdf04f78e378" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:24:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:24:21 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"One fix for pf1550 which checked for errors on multiple regulators\n but always notified via one of them regardless of which one had the\n problem, plus one device ID addition in the fan53555 DT bindings\"\n\n* tag \u0027regulator-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: pf1550: fix which regulator is notified\n regulator: dt-bindings: fan53555: add tcs,tcs4526\n" }, { "commit": "0fb234ce373a331a21c1d33cffef28e53cee4ddb", "tree": "905161fe9c45d16ee4e0a8061ed94ce8ad8c383a", "parents": [ "525f0f99a4f775060288b3069e12b1d3e2b576da", "f77de4c33f0edbb33411f92a35d7196965597e6d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:10:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 15:10:31 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fix from Mark Brown:\n \"New device ID for v7.3: update the DesignWare DT binding to say how to\n describe the UltraRISC DP1000 instance of the controller\"\n\n* tag \u0027spi-fix-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: snps,dw-apb-ssi: Add compatible for UltraRISC DP1000 SoC\n" }, { "commit": "525f0f99a4f775060288b3069e12b1d3e2b576da", "tree": "9886c73eb74988419d3aa4b5db805566551e45d8", "parents": [ "827751b699b79a6e569983359c02dce67f81b94c", "b1edd3a3e00369080012b2e4c665fc662b96ecbd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:50:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:50:47 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-09-12\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull, this seems relatively quiet for the new world,\n scattered fixes, mostly amdgpu leading the way, but lots of minor\n fixes in other drivers.\n\n drm_exec:\n - fix 0 object handling\n\n sched:\n - null ptr deref fix in kunit tests\n\n amdgpu:\n - Freesync fix\n - GPUVM fix\n - Debugfs fixes\n - HDMI fixes\n - IPS fix\n - GPU reset fix\n - RGB quantization fixes\n - SMU 13.0.x fixes\n\n xe:\n - runtime PM guard fix\n - cache flushing fix\n\n i915:\n - Fix a memleak on perf config query error path\n - Fix UHBR SST SDP splitting when sink doesn\u0027t support it\n\n bridge:\n - fix ti-sn65dsi83 error handling\n - tc358768: Enforce input bus flags via atomic_check\n\n ast:\n - fix blend mode property on cursor plane\n\n qxl:\n - fix blend mode property on primary/cursor planes\n\n virtio:\n - fix blend mode property on cursor plane\n\n vboxvideo:\n - fix blend mode property on planes\n\n rockchip:\n - fix endpoint name length\n - fix Kconfig issues\n\n ivpu:\n - limit firmware log prints to field size\n - validate buffer range in ivpu address translation\n - validate fw log buffers\n\n ethosu:\n - ensure SRAM sizing\n - ensure cmd stream formatting\n - drop IRQF_SHARED\n - fix open return value\n\n adp:\n - fix Kconfig\n\n logicvc:\n - fix Kconfig\"\n\n* tag \u0027drm-fixes-2026-09-12\u0027 of https://gitlab.freedesktop.org/drm/kernel: (38 commits)\n drm/amd/pm: report energy accumulator for smu 13.0.0\n drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7\n drm/amd/display: Rebuild InfoFrames on output color space changes\n drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output\n drm/amd/display: Propagate HDMI RGB quantization selectability\n Revert \"drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info\"\n drm/amdgpu: skip gfx switch_power_profile during GPU reset\n drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative\n drm/amd/display: Exit IPS before connector detection on resume\n drm/amd/display: Shorten hdmi_frl_status_polling_workqueue\n dm/amdgpu: fix malformed link_settings debugfs output\n drm/amdgpu: skip the VMID 0 flush for VRAM\n drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n drm/i915: Fix memory leak in query_perf_config_list()\n drm/i915/dp: Gate UHBR SST SDP splitting on sink capability\n drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches\n drm/xe: Guard page-fault worker with runtime PM check\n drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work()\n drm/bridge: tc358768: Enforce input bus flags via atomic_check\n drm/drm_exec: fix up contended obj when num_objects is 0\n ...\n" }, { "commit": "827751b699b79a6e569983359c02dce67f81b94c", "tree": "bb42ac375bb79d1ad6f73c5c6ef1bec0fae21e7b", "parents": [ "1235ff329981ecde9ccbf49b83bd4d71e827d541", "b94cec5761d22624d109d859467d7d4ce0a1b88b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:15:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 13:15:13 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"From a RISC-V point of view, there\u0027s one notable fix here, reverting\n an earlier bogus fix to the pointer masking code. Fortunately the\n practical impact appears to be small.\n\n - Revert a bad fix, likely LLM-generated, in the pointer masking code\n that confused the RISC-V hardware pointer masking implementation\n with the Linux kernel tagged address feature\n\n - Fix unexpected faults caused by kprobe instruction slot writes when\n !CONFIG_STRICT_MODULE_RWX\n\n - Fix unexpected faults on minimal configurations during runtime code\n patching on !CONFIG_STRICT_MODULE_RWX systems\n\n - Fix a misplaced variable clear causing incorrect reuse of previous\n values in the RISC-V hardware feature probing code\n\n - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather\n than BIT on 64-bit masks; and use a bitmap rather than an unsigned\n long on a quantity that can exceed 32 bits\n\n And a few miscellaneous cleanups:\n\n - Avoid a potential dereference-before-NULL-pointer-check bug in the\n PMU SBI perf driver\n\n - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug\n table code (like x86 and PPC)\n\n - Report the RISC-V standard ISA extensions Z[v]fhmin when support is\n claimed for the superset RISC-V standard ISA extensions Z[v]fh; and\n simplify our FPU test code to only check for the presence of the D\n extension\n\n - Use an existing kernel string helper in place of some open-coded\n code in kernel/usercfi.c\n\n - Fix some yamllint issues in the RISC-V DT bindings for CPUs\n\n - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into\n the RISC-V CFI selftest code\n\n - Update the translation for the simplified Chinese translation of\n the RISC-V kernel patch acceptance policy\"\n\n* tag \u0027riscv-for-linus-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS\n kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__\n docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation\n dt-bindings: riscv: cpus: Fix yamllint style issues\n riscv: hwprobe: simplify has_fpu() to check D extension only\n perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ\n riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present\n perf: RISC-V: store available counter mask as bitmap\n perf: RISC-V: use BIT_ULL for u64 overflow masks\n riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS\n riscv: hwprobe: initialize pair-\u003evalue in hwprobe_one_pair()\n riscv: use string helper in setup_global_riscv_enable()\n Revert \"riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set\"\n riscv: patch: skip fixmap mapping when kernel text is already writable\n riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX\n" }, { "commit": "1235ff329981ecde9ccbf49b83bd4d71e827d541", "tree": "3b3028c74f05f060ad143520b821ab9b603eb977", "parents": [ "707662b40a82c96e416fe17f3c116a4d648f1fdb", "d144a494d81fcf2d1c5cf58b01c655bb8bafc701" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:52:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:52:48 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmf: Fix build on !CONFIG_AMD_PMF_DEBUG\n\n - asus-laptop: Fix ACPI event handling\n\n - hp-wmi: Fix board_params typo for 8DD6 board\n\n - x86-android-tablets: Fix Arizona and Crystal Cove GPIO lookups\n\n* tag \u0027platform-drivers-x86-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n MAINTAINERS: fix sysfs-platform-ayaneo-ec documentation path\n platform/x86: x86-android-tablets: fix gpio_secondary_fwnode_init() not working\n platform/x86: x86-android-tablets: use shared battery swnode group on Yoga Tab 2\n platform/x86: x86-android-tablets: drop redundant swnode group on YT3\n platform/x86: x86-android-tablets: add Crystal Cove GPIO swnode support\n platform/x86: x86-android-tablets: pass node group to gpio_secondary_fwnode_init()\n platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown\n platform/x86: x86-android-tablets: fix Arizona GPIO swnode references\n platform/x86/amd/pmf: fix build on !CONFIG_AMD_PMF_DEBUG\n platform/x86: asus-laptop: Fix ACPI event handling\n platform/x86: hp-wmi: Fix board_params typo for 8DD6 board\n" }, { "commit": "707662b40a82c96e416fe17f3c116a4d648f1fdb", "tree": "e56a1a637446a7cc8317eb2b8737df2325b35fa5", "parents": [ "35ef102063fd6f39e045e6d4e92ac04d3d29c0bf", "a19d4f9b8befdcfcd5a87bab91312fe64af3bbb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:44:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:44:11 2026 -0700" }, "message": "Merge tag \u0027ata-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Drop documentation for no longer existing pata_legacy kernel\n parameters (Ethan)\n\n* tag \u0027ata-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: pata_legacy: remove documentation for removed module parameters\n" }, { "commit": "35ef102063fd6f39e045e6d4e92ac04d3d29c0bf", "tree": "c983305e3d61e027ee05f9617e7490e0619cbfb3", "parents": [ "42f961c42b6b29532c7c75e028b4192ed333fbcb", "94b1a3ca9b8db3151f1416263704c159a9470da5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:38:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:38:44 2026 -0700" }, "message": "Merge tag \u0027block-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Fix the start and length check added to iov_iter_extract_bvecs(),\n which used iter_iov_addr()/iter_iov_len() helpers that aren\u0027t safe\n for the ITER_BVEC/FOLIOQ/etc iterator types passed\n\n - sunvdc fixes for an -EIO issue from lack of retries, and unmapping\n LDC cookies when the descriptor send fails\n\n - Clear force_abort in ublk_queue_reset_io_flags()\n\n - ublk selftest install fix\n\n* tag \u0027block-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n selftests: ublk: add batch IO cases to recover_03\n ublk: clear force_abort in ublk_queue_reset_io_flags()\n sunvdc: fix -EIO issue due to lack of retries\n sunvdc: unmap LDC cookies when the descriptor send fails\n block: Fix start and length check added to iov_iter_extract_bvecs()\n selftests: ublk: install test_common.sh and trace/ scripts\n" }, { "commit": "42f961c42b6b29532c7c75e028b4192ed333fbcb", "tree": "47d493c32786d9df7124b4dd5b470b566d1ef1a0", "parents": [ "3026c6e4f223bdded6448fefe53ff85d9cbe51bd", "47ccc3f1c615a46c25cbf7f3ae60df30b40eb2e6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:36:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 12:36:13 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix a deadlock in the write path with superblock freezing\n\n - Fix an issue where a provided buffer ring would overconsume when\n using MSG_TRUNC\n\n - Keep the CQE flags on iopoll requests when adding kbuf flags\n\n* tag \u0027io_uring-7.3-20260911\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/rw: keep CQE flags on iopoll requests when adding kbuf flags\n io_uring/net: don\u0027t overconsume buffers when using MSG_TRUNC\n io_uring/net: let io_recv_buf_select return the length of the buffer region\n io_uring/rw: end write accounting from -\u003eki_complete\n" }, { "commit": "3026c6e4f223bdded6448fefe53ff85d9cbe51bd", "tree": "c35e30a6111540b43cabfe93db95c13a925ead3e", "parents": [ "576da3462c991923ee4aed4bcc22d94531beb0dd", "4a724bcf5d703e18957397914d79156fa2cf1174" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 11:56:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 11:56:33 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab\n\nPull slab fixes from Vlastimil Babka:\n\n - Stable fix for an ABA issue causing slab list corruption introduced\n in 7.2 (Harry Yoo, with big thanks to Hyunwoo Kim for the thorough\n report and initial version of the fix)\n\n - Fix for 7.3 regression of kvfree_rcu() on PREEMPT_RT which can cause\n a deadlock from the set_cpus_allowed_force() caller (Vlastimil Babka)\n\n* tag \u0027slab-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab:\n mm/slab: take n-\u003elist_lock in __slab_try_return_freelist() to avoid race\n mm/slab: disallow kfree_rcu_sheaf() on PREEMPT_RT again\n" }, { "commit": "576da3462c991923ee4aed4bcc22d94531beb0dd", "tree": "74eaded2954ec9736a953ad58d765a87e7a89f21", "parents": [ "d5d6c9d244c6d447c356df70d5c754b145dccd5c", "e10f2b7e28be3e1ce42a4be8fa9b0684d1d354ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 10:00:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 10:00:07 2026 -0700" }, "message": "Merge tag \u0027sound-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of device-specific small fixes. At this time, the\n majority of changes are about ASoC while we have usual suspects like\n HD- and USB-audio quirks. Some highlights below.\n\n ASoC Intel / SoundWire:\n - Fix bus and stream resource leaks at error path in avs and hda-ext\n - More fixes and refactoring in avs for constraining MSBs, async\n handling D0ix\n - Add support for TAC5xx2 SoundWire family and NVL MAX98360A RT5682\n machines\n - Fix uninitialized stream configurations in Realtek SoundWire codecs\n - Adjust latency control to fix no-sound issue on RT721-SDCA\n\n ASoC AMD:\n - Avoid binding for the acp-da7219-max98357a machine driver\n - Add quirks for Acer Nitro AN17-41 and HP 255R G10\n - Fix memory leaks in ACP6x\n\n ASoC Codecs \u0026 Platforms:\n - Fixes for cs35l56 to avoid deadlock, kexec race, and runtime PM\n imbalances\n - Split stereo streams across mono amps on tas2783-sdw\n - Fix pop noise on es8326 and enable_count underflow on es8389\n - Various fixes for fsl_micfil, sprd, sti, and publish OF module\n aliases\n - Fixes \u0026 cleanups for Ux500 (MSP/I2S) and AB8500 codecs\n\n HD-audio:\n - Fix for channel status notification changes\n - Quirks for HP laptops\n\n USB-audio:\n - Fix embedded URBs in caiaq, 6fire, hiface, and ua101 drivers\n - More hardening in usx2y and us122l drivers\n - Quirks for Behringer devices\n\n Misc:\n - Add PCI ID for RME HDSPe AIO PCI Express audio card in hdspm\n - Fix S/PDIF passthrough on CA20K2 in ctxfi\"\n\n* tag \u0027sound-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (65 commits)\n ALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI express audio\n ASoC: amd: acp-da7219-max98357a: don\u0027t bind on Raven/Picasso boards\n ALSA: hda: Report a change when only the channel status bytes move\n ALSA: us122l: Prevent write upgrades for read mappings\n ALSA: hda/realtek: Add quirk for HP Elite Dragonfly Max G2 speaker\n ASoC: cs35l56: Fix race between kexec and snd_soc_register_component()\n ASoC: amd: yc: add quirk for Acer Nitro AN17-41 internal mic\n ASoC: mt6351: Publish the OF module alias\n ASoC: Intel: SST: Publish the PCI module aliases\n ASoC: bcm: bcm63xx: Publish the OF module aliases\n ALSA: usb-audio: Add quirk flags for Behringer UV1\n ALSA: usb-audio: Add boot quirk for Behringer CM1A\n ALSA: hda/realtek: Add quirk for HP Omen 16-wd0xxx mute LED\n ALSA: usbusx2y: validate URB actual_length in interrupt callback\n ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf\n ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough\n ALSA: usb: 6fire: Avoid embedded URBs\n ALSA: usb: hiface: Avoid embedded URBs\n ALSA: usb: ua101: Avoid embedded URBs\n ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\n ...\n" }, { "commit": "d5d6c9d244c6d447c356df70d5c754b145dccd5c", "tree": "13cb9d05392a26f296b3a04dbe4e8753086880f7", "parents": [ "08df884136f1c1197bab2a27814404fd329d9aac", "37bef2170d4c88fc3d708eecf3ef0f4032bc1372" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 09:49:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 11 09:49:40 2026 -0700" }, "message": "Merge tag \u0027media/v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media fixes from Mauro Carvalho Chehab:\n \"Core:\n - add bounded tile-count helpers for HEVC stateless decoders\n - validate AV1 tile counts fits in array size\n - validate HEVC tile counts fits in array size\n - fix memcmp() size in B1 reference list comparison\n\n mediatek:\n - bound AV1 tile-start copy to fit in array size\n\n rockchip:\n - reject AV1 frames exceeding the tile size\n - guard VPU981 AV1 divisor and tile buffer\n\n hantro and rkvdec:\n - bound G2 HEVC tile loops and PPS id to the buffer size\n\n rppx1:\n - read the raw pattern from the PRE2 acquisition module\n - describe the MAIN_POST white balance gains block\"\n\n* tag \u0027media/v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity\n media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity\n media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer\n media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity\n media: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n media: hevc: add bounded tile-count helpers\n media: v4l2-ctrls: validate AV1 tile counts\n media: v4l2-ctrls: validate HEVC tile counts\n media: v4l2-h264: Fix memcmp() size in B1 reference list comparison\n media: rppx1: bls: read the raw pattern from the PRE2 acquisition module\n media: rppx1: describe the MAIN_POST white balance gains block\n" }, { "commit": "b63c3c26726576e2a87baeee80bc202a5a43c9e5", "tree": "72cbbe2c310da35c855276a4ba8fc6725a7718c8", "parents": [ "80a4e3ad8daba66915a9bdf0fcae5831cc8dbd5f" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:53 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:22 2026 +0200" }, "message": "iommu/amd: Remove unused macro\n\nRemove unsed device range capability related macros.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "80a4e3ad8daba66915a9bdf0fcae5831cc8dbd5f", "tree": "eaeb8ff2b9618753e64686fe3bcbd6fcf7074de8", "parents": [ "5e1afd4ea1d6a9bbaecf3e28707dac9c8b56bd45" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:52 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:22 2026 +0200" }, "message": "iommu/amd: Remove redundant checks from interrupt handler path\n\nPPR and GAlog interrupt is enabled only if buffer is allocated.\n(See amd_iommu_enable_ppr_log() and iommu_ga_log_enable()).\n\nThe duplicate check in interrupt hanlder path is unnecessary\nand can be removed.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "5e1afd4ea1d6a9bbaecf3e28707dac9c8b56bd45", "tree": "8093ca8ebf3feaff5b72fe083c5beb95e55aa410", "parents": [ "798514a25544d6978d0bd7fe7071c9bdb5503076" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:51 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:21 2026 +0200" }, "message": "iommu/amd: Remove redundant check in irq_remapping_select()\n\nThe amd_iommu_irq_remap flag is already validated during irq remapping\ndomain creation (before calling amd_iommu_create_irq_domain()). The\nduplicate check in irq_remapping_select() is unnecessary and can be\nremoved.\n\nAdditionally, mark amd_iommu_irq_remap as static.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "798514a25544d6978d0bd7fe7071c9bdb5503076", "tree": "c44e6cf5be1fda3b58b730d335566e321edc5075", "parents": [ "adbd8a08208dc64bb1381f51b4f11ffdce1343fa" ], "author": { "name": "Vasant Hegde", "email": "vasant.hegde@amd.com", "time": "Fri Sep 11 08:33:50 2026 +0000" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Sep 11 17:27:21 2026 +0200" }, "message": "iommu/amd: Make iommu_sva_set_dev_pasid as static\n\nIts used inside pasid.c only.\n\nNo functional changes.\n\nSigned-off-by: Vasant Hegde \u003cvasant.hegde@amd.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b1edd3a3e00369080012b2e4c665fc662b96ecbd", "tree": "21fb110c9aa269c3a73548021f25db520f580774", "parents": [ "e17b6f1307cabc1a5d142e6edaf92bae94472fda", "f3c6a8ae601abf2d8476d3f899283cc9a1001f7d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 17:59:56 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 18:42:13 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namdgpu:\n- Freesync fix\n- GPUVM fix\n- Debugfs fixes\n- HDMI fixes\n- IPS fix\n- GPU reset fix\n- RGB quantization fixes\n- SMU 13.0.x fixes\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260910202516.825788-1-alexander.deucher@amd.com\n" }, { "commit": "e17b6f1307cabc1a5d142e6edaf92bae94472fda", "tree": "e2de54f793065ca7b2ec871102c17edfbfdf9824", "parents": [ "a202936da8436f627a48d3e7db249e5318a73237", "cbd3dafc2003db679ccd2f6c6a2551db79657049" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:19 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:19 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc3:\n- Fix a memleak on perf config query error path\n- Fix UHBR SST SDP splitting when sink doesn\u0027t support it\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/27458ccc4d6be77a0d440f32279586711f3294f0@intel.com\n" }, { "commit": "ad4497a92caba4630f75c80d49cb947026213280", "tree": "e0396fc18d6fb0a2a3a75ba149973418d1ec933f", "parents": [ "69e10c2b4a51b4ff3c88a70e90f5180ad58c758f" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:06:08 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:45:11 2026 +0200" }, "message": "xfs: advance the findparent inode scan cursor while holding ILOCK\n\nLOLLM pointed out a race condition in xrep_findparent_scan -- the\ndirectory live update hook holds the directory ILOCK when it calls the\nxchk_iscan_want_live_update predicate to figure out if it needs to\nremember the live update, but xrep_findparent_scan drops the directory\nILOCK before advancing the cursor. Therefore, it\u0027s possible for a live\nupdate to check the scan cursor after the scan drops the ILOCK but\nbefore the scan updates its cursor. If this happens, we\u0027ll fail to\nrecord the live update. Fix this by moving the cursor update logic\ninside xrep_findparent_walk_directory.\n\nNote that for non-directories it\u0027s ok to advance the cursor without\nholding any ILOCK because the findparent scan only cares about directory\nparents, not the children.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: a07b45576264e7 (\"xfs: scan the filesystem to repair a directory dotdot entry\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "a202936da8436f627a48d3e7db249e5318a73237", "tree": "97cca6db3f15d47dc04c16acdbe38b7352d080db", "parents": [ "2991f9f794c9a9be699b2221f757662213d17514", "f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:13:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:45:01 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nA runtime_pm guard for page-fault worker and a cache flush fix.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/aqLD4xjzFF6ROxBu@intel.com\n" }, { "commit": "69e10c2b4a51b4ff3c88a70e90f5180ad58c758f", "tree": "1c7d3f1f943e66449be0359f8d875dbb6460fea9", "parents": [ "e854f9a28b1fa08dfa5bf18ee4184fae90106180" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:52 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:48 2026 +0200" }, "message": "xfs: reset parent pointer args before each dir tree unlink repair\n\nLOLLM noticed that xfs_parent_removename only partially initializes the\npassed-in parent pointer arguments object. In the directory tree repair\ncode, we could decide to remove multiple links to a file, so we don\u0027t\nwant state from one call to bleed into the next one. Zero the whole\nthing explicitly.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: 3f31406aef493b (\"xfs: fix corruptions in the directory tree\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "e854f9a28b1fa08dfa5bf18ee4184fae90106180", "tree": "b8ab8f3e5f3cf2389a2b9c6a2c0adcdb35ed8a68", "parents": [ "d3a6a35a220615c4f4578aedf3b1626b91d3acae" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:37 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:35 2026 +0200" }, "message": "xfs: fix replaying dirent removals into the temporary directory\n\nxrep_dir_replay_removename is the function that replays a directory\nentry removal from sc-\u003eip into the temporary directory so that when we\nswap the contents of sc-\u003etempip and sc-\u003eip, the directory is correct.\nLOLLM noticed that we were passing the wrong inode pointer into\nxrep_dir_init_args. It doesn\u0027t make sense to set rd-\u003eargs.dp to\nrd-\u003eargs.dp so let\u0027s fix this.\n\nCc: stable@vger.kernel.org # v6.10\nFixes: 8559b21a64d983 (\"xfs: implement live updates for directory repairs\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d3a6a35a220615c4f4578aedf3b1626b91d3acae", "tree": "0cee039a966cc140bb5b211a2b34c47f280f2397", "parents": [ "3bdbf472a608aeb7e8e4dc70ee86738ad5256356" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:21 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:44:16 2026 +0200" }, "message": "xfs: fix termination logic in xchk_bmap\n\nxchk_should_terminate can turn its @error argument into -EINTR if the\nuser is sitting on ^C. Unfortunately, this code here turns that into a\n0 return, which isn\u0027t quite correct. LOLLM complains about this, though\nI think it\u0027s a very minor matter because the only way -EINTR happens is\nif there\u0027s a fatal signal.\n\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "3bdbf472a608aeb7e8e4dc70ee86738ad5256356", "tree": "eec6015576188a40ed438c3e8a43d546a0313097", "parents": [ "1ee2ce797c360785a3813fef62c90f427f3aed34" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:05:06 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:43:55 2026 +0200" }, "message": "xfs: fix rtrmap cross-referencing elision logic\n\nLOLLM points out that xchk_bmap_xref_rmap_cow skips the cross-reference\nif the data-section rmapbt cursor is not present. However, this is\nbroken for realtime file data fork scanning, because they will have an\nrtrmapbt cursor and not an rmapbt cursor. Fix the behavior by removing\nthe cursor checks because xchk_bmap_get_rmap already accounts for that.\n\nCc: stable@vger.kernel.org # v6.14\nFixes: 037a44d8277adf (\"xfs: cross-reference the realtime rmapbt\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "1ee2ce797c360785a3813fef62c90f427f3aed34", "tree": "fb48f2f49c7894d148dcae21cb29421700355cf9", "parents": [ "4d3c07591534517c633945c8d8e6526f10e3fabc" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:04:50 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:43:24 2026 +0200" }, "message": "xfs: actually check internal-rtdev fields in the superblock\n\nLOLLM points out that the superblock scrubber doesn\u0027t check the new\nfields that were added for internal realtime volumes when we added zoned\ndevice support.\n\nCc: stable@vger.kernel.org # v6.15\nFixes: 2167eaabe2fadd (\"xfs: define the zoned on-disk format\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "4d3c07591534517c633945c8d8e6526f10e3fabc", "tree": "4da5aab2c9dba7a265e0ad569f8f205f8b0ef1e9", "parents": [ "e240919ca727776f16a468d3d90686dc82cfe9cb" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Thu Sep 10 21:42:28 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Fri Sep 11 08:37:30 2026 +0200" }, "message": "xfs: fix under-reservation of blocks when repairing sf directories\n\nWhilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS\u003d\"-n\nsize\u003d8192\", I observed the following (trimmed) dmesg splat:\n\n XFS: Assertion failed: args-\u003etotal \u003e\u003d dp-\u003ei_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387\n WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511\n CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8\n Tainted: [W]\u003dWARN\n RIP: 0010:assfail+0x46/0x4a [xfs]\n RSP: 0018:ffffc900010d7890 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1\n RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940\n R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0\n FS: 00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0\n Call Trace:\n \u003cTASK\u003e\n xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n __x64_sys_ioctl+0x76/0xc0\n do_syscall_64+0x7a/0x3b0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThis is a consequence of commit 0fe77e57588b98, which added the\nfollowing assertion to xfs_da_grow_inode_int:\n\n ASSERT(args-\u003etotal \u003e\u003d dp-\u003ei_nblocks - nblks);\n\nTracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args\nobject that\u0027s passed to xfs_dir2_sf_to_block sets args-\u003etotal to 1.\nThis is incorrect because mkfs set the directory block size to 8k and\nthe filesystem block size to 4k. In other words, args-\u003etotal should be\n2 here, not 1.\n\nDave Chinner tripped over the same problem with the same branch through\na different channel -- his test setup set the fs block size to 1k, in\nwhich case the directory block size is still set to 4k. Here,\nargs-\u003etotal should be 4.\n\nChanging the assignment of args-\u003etotal to sc-\u003emp-\u003em_dir_geo-\u003efsbcount\nmakes the assertion go away, but that isn\u0027t a complete fix. In\nxrep_tempexch_estimate, we also incorrectly assume that a shortform\nconversion requires 1 fsblock when it should be m_dir_geo-\u003efsbcount.\nWithout that, we can under-reserve space in the transaction and cause a\nfilesystem shutdown.\n\nNote that the xfs_dabuf_nfsb helper will compute the correct value for\ndirectories and xattr, so we use that instead of open-coding the logic.\nAlso fix xrep_xattr_swap_prep to assign args-\u003etotal via xfs_dabuf_nfsb\nto avoid one logic bomb if we ever support multi-fsblock attrs.\n\nCc: stable@vger.kernel.org # v6.10\nCc: floss@jetm.me\nReported-by: dgc@kernel.org\nFixes: 629fdaf5f5b1b7 (\"xfs: use atomic extent swapping to fix user file fork data\")\nTripped-by: 0fe77e57588b98 (\"xfs: assert the reservation covers each da fork growth\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "2991f9f794c9a9be699b2221f757662213d17514", "tree": "bb4bd66190a2a43a94197da32f76a809ebdbc4ed", "parents": [ "df2908090cda368b01ff43709f51890076c56157", "4600b4d1a9ee730d03ddac5ce409cd2730ce8c0c" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 10:55:23 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 11 16:13:01 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-09-10\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA fair amount of fixes this week as well:\n\n- create blend mode property for more driver planes\n- Kconfig cleanups across the board\n- sched: null pointer dereference fix in kunit tests\n- ethosu misc fixes about error handling and corner cases handling\n- ivpu fixes about buffer and metadata validation\n- rockchip: fixes around buffer overflow and kconfig\n- tc358768: fix bus flags and error handling\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/aqJd5TPXpwqwsM0F@houat\n" }, { "commit": "135d84c66f85426299db01a09d93a79a87af18ba", "tree": "f9b58e1a1f6e75188b0aab7e8d9f04f000ce2fdf", "parents": [ "96bf9831fbf423b8104f7948cd8fe7007ecfb46c" ], "author": { "name": "Binglei Wang", "email": "l3b2w1@gmail.com", "time": "Fri Sep 11 12:11:33 2026 +0800" }, "committer": { "name": "Gao Xiang", "email": "xiang@kernel.org", "time": "Fri Sep 11 12:16:20 2026 +0800" }, "message": "erofs: add missing buf-\u003eoff in erofs_bread()\n\nerofs_bread() locates the target folio with\n\n index \u003d (buf-\u003eoff + offset) \u003e\u003e PAGE_SHIFT;\n\nbut computes the in-folio offset without taking buf-\u003eoff into account:\n\n return buf-\u003ebase + (offset \u0026 ~PAGE_MASK);\n\nIf buf-\u003eoff is not page-aligned, the returned pointer misses the in-page\ncomponent of buf-\u003eoff, so callers end up fetching data from a wrong\noffset.\n\nbuf-\u003eoff is set to sbi-\u003edif0.fsoff in erofs_init_metabuf(), and fsoff can\nbe specified via the \"fsoffset\u003d\" mount option, which only requires\nblock-size alignment. Therefore, on an image with a sub-page block size\n(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,\nsince 512 is a multiple of the block size but not of PAGE_SIZE.\n\nIt can be reproduced by mounting an image that is placed at a\nnon-page-aligned offset:\n\n mkfs.erofs -b512 -zlz4hc sub.erofs src/\n # prepend 512 bytes of padding to the image\n mount -t erofs -o loop,fsoffset\u003d512 padded.erofs /mnt\n\nwhich fails with\n\n erofs (device loop0): cannot find valid erofs superblock\n\nbecause the on-disk superblock (at offset 1024 within the image, i.e.\n1536 within the padded file) is read from a wrong in-folio offset. With\nthis fixed, the very same image mounts successfully and its file contents\nmatch those read from the unpadded image.\n\nFix it by including buf-\u003eoff in the in-folio offset calculation, so that\nit is consistent with the folio index calculation.\n\nFixes: c36ec00d7f67 (\"erofs: add \u0027fsoffset\u0027 mount option to specify filesystem offset\")\nSigned-off-by: Binglei Wang \u003cl3b2w1@gmail.com\u003e\nReviewed-by: Gao Xiang \u003cxiang@kernel.org\u003e\nSigned-off-by: Gao Xiang \u003cxiang@kernel.org\u003e\n" }, { "commit": "94b1a3ca9b8db3151f1416263704c159a9470da5", "tree": "3d2e0735c7b7de6b6c38f30f52a301c6da286bf6", "parents": [ "8a14be55bdc6d5a25cd7b0ac5d4d884fcc727b49" ], "author": { "name": "Yang Xiuwei", "email": "yangxiuwei@kylinos.cn", "time": "Fri Aug 21 18:30:47 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 20:19:21 2026 -0600" }, "message": "selftests: ublk: add batch IO cases to recover_03\n\nAdd -b coverage for quiesce recover.\n\nSigned-off-by: Yang Xiuwei \u003cyangxiuwei@kylinos.cn\u003e\nReviewed-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260821103047.369522-3-yangxiuwei@kylinos.cn\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "8a14be55bdc6d5a25cd7b0ac5d4d884fcc727b49", "tree": "ac11167eee3c53406f5b18501d6be70920cd1505", "parents": [ "5067d4ba713961d8ccea1e06cd4c453793f3121e" ], "author": { "name": "Yang Xiuwei", "email": "yangxiuwei@kylinos.cn", "time": "Fri Aug 21 18:30:46 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 20:19:20 2026 -0600" }, "message": "ublk: clear force_abort in ublk_queue_reset_io_flags()\n\nQuiesce sets ubq-\u003eforce_abort for batch I/O. Recovery never clears\nit, so batch fetch keeps failing with -ENODEV and the device stays\nQUIESCED.\n\nFixes: a4d883755399 (\"ublk: add UBLK_U_IO_FETCH_IO_CMDS for batch I/O processing\")\nSigned-off-by: Yang Xiuwei \u003cyangxiuwei@kylinos.cn\u003e\nReviewed-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260821103047.369522-2-yangxiuwei@kylinos.cn\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "08df884136f1c1197bab2a27814404fd329d9aac", "tree": "8259a0bc106910d7c77c6cd53ac5abb013bcdd6c", "parents": [ "5897d0546f8abbe5d57ef1e65a096f5b9ed8312f", "5ad0af4f4367202b1bc71813052fe39b5116cdb9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:45:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:45:25 2026 -0700" }, "message": "Merge tag \u0027thermal-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fix from Rafael Wysocki:\n \"Replace snprintf() with scnprintf() in the thermal core sysfs code to\n avoid compiler warnings about potential truncation of the names of the\n sysfs attributes (Andy Shevchenko)\"\n\n* tag \u0027thermal-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: sysfs: switch to use scnprintf() to suppress truncation warning\n" }, { "commit": "5897d0546f8abbe5d57ef1e65a096f5b9ed8312f", "tree": "d4801a761787b20d779ad516afcb4883623bb534", "parents": [ "aa416593f363f9b290e21cdbb98e90a0d8c513e1", "13b3dcbcfed1d0c8c1d3b5dcfe306f9992452ae9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:42:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:42:46 2026 -0700" }, "message": "Merge tag \u0027pm-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These harden the cpufreq core against races with sysfs during policy\n creation, fix two issues in the OPP (Operating Performance Points)\n library, and make OPP print symbolic error names:\n\n - Zero-initialize the policy cpumask and initialize the policy rwsem\n before exposing the policy sysfs interface (Runyu Xiao and Zhongqiu\n Han)\n\n - Fix potential multiplication overflow when calculating freq in OPP\n core (Colin Ian King)\n\n - Fix use after free in _update_opp_table_clk() (Peter Griffin)\n\n - Use %pe to print symbolic error name in OPP (Sumeet Pawnikar)\"\n\n* tag \u0027pm-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n opp: fix use after free in _update_opp_table_clk()\n cpufreq: zero-initialize policy cpumask before sysfs publication\n cpufreq: initialize policy rwsem before sysfs publication\n opp: Use %pe to print symbolic error name\n OPP: of: Fix potential multiplication overflow when calculating freq\n" }, { "commit": "aa416593f363f9b290e21cdbb98e90a0d8c513e1", "tree": "3cfd5a3326607a6790a0a0670dc043eaf079b580", "parents": [ "78445023439506ebd83b86d40b1e428a3b309d4a", "c88a6338ae485e4d6210cc74cdb7664d6476c925" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:37:53 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:37:53 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - Core\n - Fix potential UAF in pec_store\n - Ensure that \u0027dev\u0027 passed to hwmon_notify_event() is a hwmon device\n - Document hwmon_notify_event()\n\n - applesmc: Fix key backlight workqueue leak on register failure\n\n - aspeed-pwm-tacho: Propagate reset deassert errors\n\n - asus_rog_ryujin: HID report fixes\n\n - chipcap2: Fix channels in humidity alarm notifications\n\n - corsair-cpro: debugfs fixes\n\n - gpd-fan: Documentation: replace full-width colon by a standard ASCII\n colon\n\n - gpio-fan: Take fan_data-\u003elock in gpio_fan_shutdown(), and fix\n use-after-free in alarm work\n\n - ina2xx: Fix in0 and curr1 alarm handling, and acquire hwmon_lock in\n shunt_resistor_show()\n\n - ltc4282: Fully initializeclk_init_data\n\n - mcp9982: Propagate one-shot polling errors\n\n - nct6694: Do not expose enable on DTIN temperature channels\n\n - PMBus core: Clear generic status alarms with CLEAR_FAULTS\n\n - sht4x: Fix return value from heater_enable_store(), and add missing\n locks\n\n* tag \u0027hwmon-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (24 commits)\n hwmon: (nct6694) do not expose enable on DTIN temperature channels\n hwmon: (asus_rog_ryujin) Synchronize HID command and report handling\n hwmon: (asus_rog_ryujin) Validate HID report lengths\n hwmon: (corsair-cpro) Remove debugfs entries when probe fails\n hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors\n hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown()\n hwmon: (corsair-cpro) Create debugfs entries after hwmon registration\n hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS\n hwmon: (chipcap2) fix channels in humidity alarm notifications\n hwmon: (applesmc) fix key backlight workqueue leak on register failure\n hwmon: (sht4x) Fix return value from heater_enable_store()\n hwmon: (sht4x) Add missing locks\n hwmon: (yogafan) fix non-kernel-doc comment\n Documentation: hwmon: replace full-width colon by a standard ASCII colon\n hwmon: (ina2xx) Decouple in0 and curr1 alarms\n hwmon: (ina2xx) Replace masks with enum in alert functions\n hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read()\n hwmon: Ensure that \u0027dev\u0027 passed to hwmon_notify_event() is a hwmon device\n hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show()\n hwmon: Fix potential UAF in pec_store\n ...\n" }, { "commit": "78445023439506ebd83b86d40b1e428a3b309d4a", "tree": "4be5947a504ab54bc7ec43697ea87cace94a962f", "parents": [ "0a96d0d726cd380423ac38e2c28f538db2940a1d", "5096947508b750bd4a65a8e61bd2083a44d61bfd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Nothing too exciting, usual stream of fixes. Including fixes from\n Netfilter, Bluetooth and WPAN.\n\n Current release - new code bugs:\n\n - Bluetooth: hci_sync: fix not setting CE length properly\n\n - eth: enic: match mailbox replies to request numbers\n\n Previous releases - regressions:\n\n - tunnels: drop stale dst when building an ICMP error for PMTUD\n\n - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n (bug in the rtnl_lock -\u003e RCU conversion)\n\n - eth: bnxt_en:\n - fix crashes on Thor2 due to OOB coalescing buffer accesses\n - prevent queue stop with deferred completions\n\n Previous releases - always broken:\n\n - eth:\n - ice: don\u0027t dereference pointers from TP_printk()\n - fix OOB writes on ethtool flow rule dump in 3 drivers\n - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD\n\n - dsa: tag_brcm: legacy FCS: request needed tailroom\n\n Misc:\n\n - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc\n\n - ipv6: flowlabel: cap duplicate leases per socket\"\n\n* tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)\n selftests: tc-testing: test action batch failure cleanup\n net/sched: act_api: release all action references on NEWACTION failure\n openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n ipmr: account multicast table and route memory\n net: phy: dp83td510: handle the active-high LED polarity mode\n net: macb: initialize PTP state before registering clock\n net: hsr: enable promiscuous mode on interlink port with fwd offload\n ipv6: fix fib6 walker UAF on seq stop\n net: stmmac: fix TX descriptor availability check for TSO traffic\n net/rds: fix tcp stream corruption with large pages\n net: mana: restore the XDP program pointer when pre-allocation fails\n net: phy: dp83867: handle the active-high LED polarity mode\n octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n tcp: reject non zerocopy devmem tx\n net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support\n net: dsa: mt7530: populate lpi_interfaces to fix EEE support\n net: hinic: fix mailbox segment buffer overflow\n net: sun4i-emac: fix missing of_node_put() for phy_node\n ...\n" }, { "commit": "0a96d0d726cd380423ac38e2c28f538db2940a1d", "tree": "5ca577a2941565211f3d9980bc05811b9a9f955a", "parents": [ "ad724d319c81475488794eccc11eb5e27242e1eb", "cb26524ef4ac28fcfa554c0656e8dc412c38a8ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - File type corruption fixes in reparse point handling: setting S_IFMT\n bits without clearing the existing type first corrupted the file mode\n (e.g. S_IFREG | S_IFCHR \u003d\u003d S_IFLNK). Fixed in the WSL, POSIX and\n native symlink reparse parsers. Also fixes an uninitialized SID\n structure in the POSIX readdir path when parsing fails.\n\n - Ownership mapping fixes: forceuid/forcegid mount options were\n ignored in several code paths (SID-to-id mapping, WSL extended\n attributes, POSIX extensions getattr), allowing an untrusted server\n to dictate local file ownership despite explicit mount overrides.\n\n - Heap overflow and overflow fixes in DACL rewriting: replacing short\n SIDs with long ones could overflow the DACL buffer, and the u16\n accumulator for DACL size could wrap around with enough ACEs.\n\n - Reference count leak fixes in oplock break and deferred close:\n duplicate oplock breaks on a queued work item leaked a\n cifsFileInfo reference, and deferred close had a similar leak when\n requeueing a running work item. Both cause busy-inode oopses on\n unmount.\n\n - DFS superblock use-after-free fix: the iterator callback stored a\n raw superblock pointer without pinning it, racing with automount\n expiry.\n\n - One-byte slab OOB read in the native symlink parser when handling\n share-root relative paths.\n\n - Hardening of legacy SMB1 input: reject userspace-crafted\n cifs.idmap key descriptions that bypass kernel origin checks, and\n validate DataOffset in CIFSSMBRead() to prevent heap info\n disclosure from a malicious server.\n\n - DFS cache fix: defer metadata updates until target copying\n succeeds to prevent partial-state cache entries on allocation\n failure.\n\n* tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux:\n smb: client: fix one-byte OOB read in smb2_parse_native_symlink()\n smb: client: fail DACL rewrite when the new DACL exceeds 64K\n smb: client: fix heap overflow in DACL owner/group rewrite\n smb: client: fix file type corruption in cifs_reparse_point_to_fattr()\n smb: client: fix file type corruption in posix_reparse_to_fattr()\n smb: client: fix file type corruption in wsl_to_fattr()\n smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n smb: client: fix WSL reparse point uid/gid override\n smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n smb: client: fix uid/gid override in getattr with posix extensions\n smb: client: fix cifsFileInfo reference leak in deferred close\n smb: client: avoid leaking refcount when cifs_sb_tlink() fails\n smb: client: avoid leaking refcount in cifs_queue_oplock_break()\n smb: client: fill cache fields after populating cache in copy_ref_data()\n smb: client: pin DFS superblock in iterator callback\n smb: client: reject userspace cifs.idmap descriptions\n smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()\n smb: client: reject short READ responses in CIFSSMBRead()\n" }, { "commit": "a0a34a40ed299c9c7cff6af163a5b883ee9d6d73", "tree": "e89f5fc41a58ecfc59deff6b87fdb72e52d6716b", "parents": [ "3934185ba63feca6e80cc8b90f7d7f01cde78223" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Thu Sep 10 03:10:23 2026 +0800" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Thu Sep 10 22:52:02 2026 +0200" }, "message": "fbdev: vfb: defer cleanup until the last reference\n\nFBIOGETCMAP takes a shallow snapshot of info-\u003ecmap and performs the\nusercopy after dropping info-\u003elock. vfb_remove() frees the colormap\nimmediately after unregistering the framebuffer, even when an open file\nstill holds a reference to fb_info. A concurrent driver unbind can\ntherefore free the colormap while the ioctl copies it to userspace.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in _copy_to_user\n Read of size 512 by task poc/125\n\n _copy_to_user (./include/linux/instrumented.h:129 ./include/linux/uaccess.h:201 lib/usercopy.c:24)\n fb_cmap_to_user (./include/linux/uaccess.h:230 drivers/video/fbdev/core/fbcmap.c:211)\n do_fb_ioctl (drivers/video/fbdev/core/fb_chrdev.c:114)\n\n Allocated by task 1:\n fb_alloc_cmap_gfp (./include/linux/slab.h:973 ./include/linux/slab.h:1290 drivers/video/fbdev/core/fbcmap.c:108)\n vfb_probe (drivers/video/fbdev/vfb.c:459)\n\n Freed by task 124:\n fb_dealloc_cmap (drivers/video/fbdev/core/fbcmap.c:151)\n vfb_remove (drivers/video/fbdev/vfb.c:489)\n\nunregister_framebuffer() drops the registration reference, and fbdev calls\nfb_destroy after the last put_fb_info(). Move the registered framebuffer\u0027s\ncleanup into an fb_destroy callback so its colormap and screen buffer stay\nalive until all file references have been released.\n\nFixes: 5e266e2e0e19 (\"vfb: fix memory leaks in removal path\")\nReported-by: co+c25629c98ba36ebe@bugs.sh\nCc: stable@kernel.org\nCloses: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/\nAssisted-by: Codex:gpt-5\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://lore.kernel.org/linux-fbdev/f2Kf9GYn1lKR5S1dbvGVtykMxK1RlgP5z8sW@bugs.sh/\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "5067d4ba713961d8ccea1e06cd4c453793f3121e", "tree": "87dbfa2a41dfadc455386a08bc1a1636e2144eb0", "parents": [ "0c6da21fa35e03fc74f09895433ccd6d4a9c3530" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Tue Sep 01 19:39:46 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 14:45:59 2026 -0600" }, "message": "sunvdc: fix -EIO issue due to lack of retries\n\nJohn reports that since commit:\n\na11f6ca9aef9 (\"sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN\")\n\nusers of Linux inside Solaris ldom see occasional -EIO errors because\nthe request send loop now times out. The current loop does 10 retries,\nand inside vio_ldc_send() a further 1000 1usec retries are done as well.\nEven with 10.5 msec of busy loop retries that\u0027s apparently not enough to\nalways succeed.\n\nRather than introduce continued busy looping, requeue the request and\nhave the delayed queue kicking retry the request after another 10ms.\nThis obviously isn\u0027t ideal, but there\u0027s seemingly no way to wait for\nthis type of event. And if 10ms of busy looping was not enough to make\nprogress, then presumably this is an edge condition and we just need to\nguarantee to make forward progress at some later point in time. That\u0027s\nmore suitably done through letting the CPU tend to other work, rather\nthan sitting in a tight loop retrying.\n\n[stian: rebased on top of the cookie-unmap fix, without which every\n requeued attempt leaks LDC map table entries; tested on an\n UltraSPARC T4 LDOM where the vdc_tx_trigger failure condition was\n reproduced and absorbed by the requeue with no I/O error]\n\nReported-by: John Paul Adrian Glaubitz \u003cglaubitz@physik.fu-berlin.de\u003e\nLink: https://lore.kernel.org/all/20251006100226.4246-2-glaubitz@physik.fu-berlin.de/\nLink: https://lore.kernel.org/all/418310b3-2b77-4534-b2fd-27dcc11e333c@kernel.dk/\nSigned-off-by: Stian Halseth \u003cstian@itx.no\u003e\nLink: https://patch.msgid.link/20260901173947.3292110-3-stian@itx.no\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "0c6da21fa35e03fc74f09895433ccd6d4a9c3530", "tree": "5edf206244ad126e0bd6df2fee2d685712f39a92", "parents": [ "b0d8d56b7c93ed767eb4f2be9988e7b9dc023566" ], "author": { "name": "Stian Halseth", "email": "stian@itx.no", "time": "Tue Sep 01 19:39:45 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 14:45:59 2026 -0600" }, "message": "sunvdc: unmap LDC cookies when the descriptor send fails\n\n__send_request() maps the request\u0027s pages into the LDC channel\u0027s map\ntable (ldc_map_sg()), fills in the descriptor and marks it\nVIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger().\nWhen the trigger fails, the error path only prints a message: the\ndescriptor stays READY and the cookies are never unmapped. The\nmapping is normally released in vdc_end_one() when the peer completes\nthe descriptor - but a descriptor whose doorbell was never sent will\nnever complete, and since dr-\u003eprod is not advanced on failure, the\nreset path (vdc_requeue_inflight(), which walks [cons, prod)) never\nvisits it either. The map table entries are leaked permanently.\n\nSince commit a11f6ca9aef9 (\"sunvdc: Do not spin in an infinite loop\nwhen vio_ldc_send() returns EAGAIN\") trigger failures occur in\npractice under load, so every resulting I/O error also leaks one\nrequest\u0027s worth of entries from the fixed-size (8192 entries per\nchannel) map table. Because the allocator hands out contiguous\nranges, fragmentation makes large multi-segment requests fail first\nas the table drains, until ldc_map_sg() fails permanently and the\ndisk is dead until reboot.\n\nIt also makes any retry-based recovery unusable: requeuing the\nrequest on -EAGAIN remaps the pages on every attempt, overwriting\ndesc-\u003ecookies and orphaning the previous mapping, so the table\ndrains at the retry rate. This is the memory exhaustion observed\nwhen the requeue approach was first tested in October 2025.\n\nRoll back on failure: unmap the cookies, mark the descriptor FREE\nagain and clear the request entry. If the trigger failed with\n-ENOTCONN, __vdc_tx_trigger() has already reset the port, which\ntears down and reallocates both the dring and the LDC channel\nincluding its map table - nothing to roll back, and the stale\ndescriptor must not be touched.\n\nFixes: a11f6ca9aef9 (\"sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN\")\nReported-by: John Paul Adrian Glaubitz \u003cglaubitz@physik.fu-berlin.de\u003e\nLink: https://github.com/sparclinux/issues/issues/2\nSigned-off-by: Stian Halseth \u003cstian@itx.no\u003e\nLink: https://patch.msgid.link/20260901173947.3292110-2-stian@itx.no\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "b0d8d56b7c93ed767eb4f2be9988e7b9dc023566", "tree": "47790f53349355f51ac83ee2f7628ddd5204250b", "parents": [ "c4fa55f85c47cd5d54d717fb8170746edb10292e" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Sep 09 09:06:31 2026 +0100" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 14:44:39 2026 -0600" }, "message": "block: Fix start and length check added to iov_iter_extract_bvecs()\n\nCommit 14b007e17881 added an address check using iter_iov_addr() and a\nlength check using iter_iov_len() to iov_iter_extract_bvecs(), but these\ncannot be used so and are unsafe in this circumstance as the functions have\nhardwired assumptions about the iterator type. They should only be used\nwith ITER_UBUF or ITER_IOVEC-type iterators; they shouldn\u0027t be used with\nITER_BVEC, ITER_KVEC, ITER_FOLIOQ, ITER_XARRAY or ITER_DISCARD iterators.\n\nThis proves to be a problem for cachefiles as an iterator of type\nITER_FOLIOQ is passed and iter_iov_addr() and iter_iov_len() both\nmalfunction because iter-\u003e__iov in iter_iov() is not pointing to an iovec\narray.\n\nFix this by using iov_iter_alignment() instead.\n\nFixes: 14b007e17881 (\"block: validate user space vectors during extraction\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Keith Busch \u003ckbusch@kernel.org\u003e\ncc: Hannes Reinecke \u003chare@kernel.org\u003e\ncc: Christoph Hellwig \u003chch@infradead.org\u003e\ncc: Jens Axboe \u003caxboe@kernel.dk\u003e\ncc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\ncc: Paulo Alcantara \u003cpc@manguebit.org\u003e\ncc: netfs@lists.linux.dev\ncc: linux-block@vger.kernel.org\ncc: linux-fsdevel@vger.kernel.org\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/1667275.1788941191@warthog.procyon.org.uk\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "c4fa55f85c47cd5d54d717fb8170746edb10292e", "tree": "54eb9c6896021e840fe5b4a1bd4ee74316456818", "parents": [ "00ef2248c5dae08548f7ceb6951b022f89905330" ], "author": { "name": "Mahmoud Nagy Adam", "email": "mngyadam@amazon.de", "time": "Wed Sep 09 15:26:03 2026 +0200" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Sep 10 14:43:09 2026 -0600" }, "message": "selftests: ublk: install test_common.sh and trace/ scripts\n\nEvery ublk test script sources test_common.sh from its own directory:\n\n . \"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"/test_common.sh\n\nand test_generic_02/12 additionally run bpftrace against the scripts in\ntrace/. Neither test_common.sh nor trace/ is listed in TEST_FILES, so\n\"make install\" does not copy them into the install directory and every\nublk test fails when run from there:\n\n ./test_generic_02.sh: line 4: .../kselftest_install/ublk/test_common.sh: No such file or directory\n ./test_generic_02.sh: line 8: _have_program: command not found\n\nThe bpftrace tests are affected even when bpftrace is installed: the\nmissing trace/*.bt makes bpftrace exit immediately, and the tests then\nreport a skip rather than a failure, which hides the problem.\n\nAdd both to TEST_FILES, matching how other selftests ship their sourced\nhelpers (see kexec/kexec_common_lib.sh and zram/zram_lib.sh).\n\nFixes: 6aecda00b7d1e1 (\"selftests: ublk: add kernel selftests for ublk\")\nFixes: 723977cab4c0fd (\"selftests: ublk: add generic_01 for verifying sequential IO order\")\nCc: stable@vger.kernel.org # v6.15+\nAssisted-by: Kiro:claude-opus-5\nSigned-off-by: Mahmoud Nagy Adam \u003cmngyadam@amazon.de\u003e\nReviewed-by: Ming Lei \u003ctom.leiming@gmail.com\u003e\nLink: https://patch.msgid.link/20260909132602.68852-2-mngyadam@amazon.de\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "3934185ba63feca6e80cc8b90f7d7f01cde78223", "tree": "3623f96cf5555517e6919c1c77952fadb1be6914", "parents": [ "3fb13d29cf8eb4502837bff06b2873c5435f6ffd" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Thu Aug 27 17:39:48 2026 +0800" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Thu Sep 10 22:36:31 2026 +0200" }, "message": "fbdev: atafb: Restrict SuperBlitter to supported formats\n\nThe SuperBlitter operations derive an integer byte count per pixel. The\naccelerated fill path handles only one-, two- and four-byte pixels.\nHowever, the operations are currently installed for every external\nframebuffer in SuperVidel RAM, including planar 1/2/4/8-bpp and 24-bpp\ntruecolor modes accepted by the external video parser.\n\nFor 1/2/4-bpp modes, the byte count becomes zero, so accelerated copies do\nnothing and fills fall through to 32-bit stores. Planar 8-bpp uses an\nincompatible memory layout. For 24-bpp modes, fills also use 32-bit stores\ndespite advancing addresses by three bytes per pixel. These cases can\ncorrupt the framebuffer beyond the requested rectangle.\n\nEnable the SuperBlitter operations only for the layouts they implement:\n8-bpp packed pixels and 16/32-bpp truecolor. Keep the existing software\noperations for all other external formats.\n\nFixes: d463633d63e6 (\"fbdev: atafb: Add support for SuperVidel\u0027s SuperBlitter\")\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nTested-by: Miro Kropáček \u003cmiro.kropacek@gmail.com\u003e\nReviewed-by: Michael Schmitz \u003cschmitzmic@gmail.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "3fb13d29cf8eb4502837bff06b2873c5435f6ffd", "tree": "abb290ff8745a32d8cb04d433f4d1488556b4358", "parents": [ "94e6a058b16820e02f25e1221a4c4e713ba23550" ], "author": { "name": "Yang Zi", "email": "2959243019@qq.com", "time": "Tue Aug 25 16:58:15 2026 +0800" }, "committer": { "name": "Helge Deller", "email": "deller@gmx.de", "time": "Thu Sep 10 21:57:59 2026 +0200" }, "message": "fbdev: ssd1307fb: fix NULL pointer dereference on missing match data\n\ndevice_get_match_data() can return NULL, e.g. when the device is matched\nthrough the I2C device ID table rather than the OF match table. The\nreturned value is stored in par-\u003edevice_info and later dereferenced when\ninitializing par-\u003evcomh, causing a NULL pointer dereference.\n\nCheck the return value right after the assignment and bail out with\n-ENODEV (releasing the already allocated framebuffer) before any\ndereference.\n\nSigned-off-by: Yang Zi \u003c2959243019@qq.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n" }, { "commit": "13b3dcbcfed1d0c8c1d3b5dcfe306f9992452ae9", "tree": "0c48c19b241d41d3775ab6721a813a491796cc58", "parents": [ "e06cb12e1ebf1a3bb3473e1b96991d71d4ba4489", "54d37bcf2f497140b9207968557ddb484058e749" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Sep 10 20:16:37 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Sep 10 20:16:37 2026 +0200" }, "message": "Merge branch \u0027pm-cpufreq\u0027\n\nMerge cpufreq fixes for 7.3-rc3:\n\n - Zero-initialize policy cpumask and initialize policy rwsem before\n exposing the policy sysfs interface (Runyu Xiao and Zhongqiu Han)\n\n* pm-cpufreq:\n cpufreq: zero-initialize policy cpumask before sysfs publication\n cpufreq: initialize policy rwsem before sysfs publication\n" }, { "commit": "a19d4f9b8befdcfcd5a87bab91312fe64af3bbb8", "tree": "79ff9cd17875e9e1098da6fa896440fb1906ce6c", "parents": [ "6d81700ad7c4871f94fb72e469cb0f3f55843ef7" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Sat Jun 06 23:40:49 2026 -0700" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Thu Sep 10 19:25:48 2026 +0200" }, "message": "ata: pata_legacy: remove documentation for removed module parameters\n\nCommit 3c4d783f6922 (\"ata: pata_legacy: remove VLB support\") removed\nseveral module parameters from the pata_legacy driver, but neglected to\nremove their documentation. Remove it.\n\nFixes: 3c4d783f6922 (\"ata: pata_legacy: remove VLB support\")\nCc: stable@vger.kernel.org # 7.0+\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nReviewed-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nLink: https://lore.kernel.org/r/20260607064053.195166-1-enelsonmoore@gmail.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "f3c6a8ae601abf2d8476d3f899283cc9a1001f7d", "tree": "f294f1ed80aeae9baae9509ea9c0734e51219625", "parents": [ "13ddcc7acb9adbed7627e952a61d1d62cd9546fc" ], "author": { "name": "Kevin Wang", "email": "kevin.wang@amd.com", "time": "Tue Sep 08 18:15:41 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:56:11 2026 -0400" }, "message": "drm/amd/pm: report energy accumulator for smu 13.0.0\n\nadd energy accumulator on pmfw 0x004e8600 and above version.\n\nSigned-off-by: Kevin Wang \u003ckevin.wang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 3a804a5b15c22e4d7a3906ff09035e539785813e)\n" }, { "commit": "13ddcc7acb9adbed7627e952a61d1d62cd9546fc", "tree": "65c8aef04a67bdb21628ca867f468cb48ab10efc", "parents": [ "8cfd9e22eb5c04b15b82985ff913944f84673d4f" ], "author": { "name": "Kevin Wang", "email": "kevin.wang@amd.com", "time": "Wed Aug 26 09:51:55 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:55:42 2026 -0400" }, "message": "drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7\n\nGPU metrics v1.3 defines energy_accumulator as a 64‑bit field.\nThe unsupported‑firmware code path assigns UINT_MAX, which is neither the\nfull‑width invalid value for this field nor its default value.\n\nFixes: 8de9edb35976 (\"drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x\")\nSigned-off-by: Kevin Wang \u003ckevin.wang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c2b948c4fe16eb13d98ff5d1371956cb2f55cdc6)\nCc: stable@vger.kernel.org\n" }, { "commit": "8cfd9e22eb5c04b15b82985ff913944f84673d4f", "tree": "0f492927d250cef161037b9001b78871969d5931", "parents": [ "7fca7acd60a228b62b4e9efa5f184738041e9564" ], "author": { "name": "Satyajit Roy", "email": "sroy14@alum.utk.edu", "time": "Sun Aug 30 03:52:13 2026 +0000" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:55:35 2026 -0400" }, "message": "drm/amd/display: Rebuild InfoFrames on output color space changes\n\nresource_build_info_frame() derives colorimetry and RGB quantization from\nstream-\u003eoutput_color_space. A Broadcast RGB-only atomic commit updates\nthat field and reprograms the output CSC, but none of the InfoFrame update\npredicates include output_color_space. The sink can therefore retain the\nprevious AVI InfoFrame range while the source starts transmitting a\ndifferent pixel range.\n\nTreat an output color space change as an InfoFrame change in update\nclassification and in both stream programming paths.\n\nHardware testing on an HDMI 2.1 television confirmed that its automatic\nblack-level selection follows Full to Limited and Limited to Full\ntransitions in SDR, HDR, and HDR with VRR active, without a modeset or\nvisible link blank.\n\nFixes: 6eb4c13a3845 (\"drm/amd/display: Support \"Broadcast RGB\" drm property\")\nSigned-off-by: Satyajit Roy \u003csroy14@alum.utk.edu\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit d6faca79f5720893843e649e70aeb19147ee0578)\nCc: stable@vger.kernel.org\n" }, { "commit": "7fca7acd60a228b62b4e9efa5f184738041e9564", "tree": "a1e7d15e8d8804fb03ed8b6567df50dfb18cd585", "parents": [ "bdcd0411d7d186225a52458fd42bb70d54ca917a" ], "author": { "name": "Satyajit Roy", "email": "sroy14@alum.utk.edu", "time": "Sun Aug 30 03:52:06 2026 +0000" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:55:28 2026 -0400" }, "message": "drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output\n\namdgpu_dm_get_output_color_space() applies the Broadcast RGB connector\nproperty to default RGB output, but always selects full-range output for\nBT.2020 RGB. Consequently, explicitly selecting Limited has no effect on\nthe output CSC or AVI InfoFrame when HDR uses BT.2020 RGB.\n\nSelect COLOR_SPACE_2020_RGB_LIMITEDRANGE when the output encoding is RGB\nand Broadcast RGB is Limited. Keep Automatic and Full at full range, and\nleave YCbCr output unchanged.\n\nAdd KUnit coverage for limited-range RGB output through both BT.2020\nconnector colorspace values.\n\nFixes: 6eb4c13a3845 (\"drm/amd/display: Support \"Broadcast RGB\" drm property\")\nSigned-off-by: Satyajit Roy \u003csroy14@alum.utk.edu\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 022236eaa63bbf65761aa8aec43f661451a94654)\nCc: stable@vger.kernel.org\n" }, { "commit": "bdcd0411d7d186225a52458fd42bb70d54ca917a", "tree": "a16249de7a63aa86871cdf976ef1c9923e6434fd", "parents": [ "829157e762ed043e28ecb2e9f3c7d22b54e5989e" ], "author": { "name": "Satyajit Roy", "email": "sroy14@alum.utk.edu", "time": "Sun Aug 30 03:51:58 2026 +0000" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:55:08 2026 -0400" }, "message": "drm/amd/display: Propagate HDMI RGB quantization selectability\n\nDC uses dc_edid_caps.qs_bit when constructing the HDMI AVI InfoFrame\nquantization-range field. Although DRM parses the sink capability into\ndrm_display_info, DM never copies it into the DC EDID capabilities. The\nfield therefore remains zero and the AVI quantization range stays at its\ndefault value.\n\nCopy rgb_quant_range_selectable for HDMI sinks and extend the existing\nEDID-capability KUnit test to cover it.\n\nFixes: 6eb4c13a3845 (\"drm/amd/display: Support \"Broadcast RGB\" drm property\")\nSigned-off-by: Satyajit Roy \u003csroy14@alum.utk.edu\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nTested-by: Daniel Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 892659399f64642e33072562a11ec1b2e7bd2263)\nCc: stable@vger.kernel.org\n" }, { "commit": "829157e762ed043e28ecb2e9f3c7d22b54e5989e", "tree": "e590656528dcdd5aaea82818805bd3747ed2455f", "parents": [ "1f1d43418d61c8511779e0f63a954a78b9433b43" ], "author": { "name": "Thadeu Lima de Souza Cascardo", "email": "cascardo@igalia.com", "time": "Tue Sep 08 16:59:51 2026 -0300" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:54:59 2026 -0400" }, "message": "Revert \"drm/amdgpu: debugfs: avoid extra EOLs in amdgpu_gem_info\"\n\nThis reverts commit c119d05a36a884482decc67e55944648f8cba97e.\n\nIt removes the newline even when there are no fences attached to a\nstruct dma_resv, leading to multiple BOs being output on the same line,\nmaking the debug file less readable, not more as the commit intended.\n\nSigned-off-by: Thadeu Lima de Souza Cascardo \u003ccascardo@igalia.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit a2aafaeb2be13ed3c893e6a44a3a5d26b251ae6a)\nCc: stable@vger.kernel.org\n" }, { "commit": "1f1d43418d61c8511779e0f63a954a78b9433b43", "tree": "b2f14f13d14ed5af7895bf1e1c9bfa94ac8c0404", "parents": [ "5d7e0cc4afda0cb25c0829dc7c1bb4bedd7886a5" ], "author": { "name": "Prike Liang", "email": "Prike.Liang@amd.com", "time": "Mon Aug 31 10:51:04 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:54:37 2026 -0400" }, "message": "drm/amdgpu: skip gfx switch_power_profile during GPU reset\n\nDuring resume from GPU reset, the gfx idle work may invoke switch_power_profile\nbefore the reset completes. This causes the following assert error because the\nregister access occurs without first releasing the GPU reset semaphore:\n\n[ 1576.768935] CR2: 0000559ea133ead0 CR3: 00000002e6c42000 CR4: 0000000000350ef0\n[ 1576.768940] Call Trace:\n[ 1576.768944] \u003cTASK\u003e\n[ 1576.768953] amdgpu_device_rreg+0x21/0x50 [amdgpu]\n[ 1576.769158] smu_msg_v1_send_msg+0x1a4/0x6e0 [amdgpu]\n[ 1576.769437] smu_cmn_send_smc_msg_with_params_ext+0xba/0x120 [amdgpu]\n[ 1576.769721] smu_cmn_send_smc_msg_with_param+0x33/0x40 [amdgpu]\n[ 1576.769993] smu_v13_0_0_set_power_profile_mode+0x192/0x2b0 [amdgpu]\n[ 1576.770267] smu_bump_power_profile_mode+0x5d/0x80 [amdgpu]\n[ 1576.770538] smu_switch_power_profile+0xa4/0xf0 [amdgpu]\n[ 1576.770839] amdgpu_dpm_switch_power_profile+0x6f/0x90 [amdgpu]\n[ 1576.771210] amdgpu_gfx_profile_idle_work_handler+0xe9/0x130 [amdgpu]\n[ 1576.771460] process_one_work+0x23e/0x6f0\n[ 1576.771491] worker_thread+0x1c4/0x380\n[ 1576.771506] kthread+0x10c/0x150\n[ 1576.771512] ? __pfx_worker_thread+0x10/0x10\n[ 1576.771518] ? __pfx_kthread+0x10/0x10\n[ 1576.771530] ret_from_fork+0x314/0x390\n[ 1576.771537] ? __pfx_kthread+0x10/0x10\n[ 1576.771546] ret_from_fork_asm+0x1a/0x30\n\nSigned-off-by: Prike Liang \u003cPrike.Liang@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit d93b1ff538ce9750c01e0dd0aa62575579c0fc08)\nCc: stable@vger.kernel.org\n" }, { "commit": "5d7e0cc4afda0cb25c0829dc7c1bb4bedd7886a5", "tree": "b182f80cec877271d79476b94ccb3973beb0dd6b", "parents": [ "3001d2073d6542a9e51fa5bca3a39a078094d3c6" ], "author": { "name": "Fangzhi Zuo", "email": "jerry.zuo@amd.com", "time": "Wed Aug 26 17:47:41 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:54:31 2026 -0400" }, "message": "drm/amd/display: Fix HF-VSDB DSC bpc detection to be cumulative\n\n[Why \u0026 How]\nThe HDMI Forum VSDB reports the maximum DSC color depth a sink supports.\nThis maximum is cumulative: a sink that reports 12 bpc also supports 10\nand 8 bpc.\n\nThe previous code used exact \"\u003d\u003d 10\" and \"\u003d\u003d 12\" comparisons chained with\nelse-if, so a 12 bpc sink only set frl_dsc_12bpc and never set\nfrl_dsc_10bpc, incorrectly narrowing the DSC bpc range usable with that\nsink.\n\nUse \"\u003e\u003d 10\" and a separate \"\u003e\u003d 12\" check so a sink advertising a higher\nmaximum also enables the lower DSC bit depths it supports.\n\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Fangzhi Zuo \u003cjerry.zuo@amd.com\u003e\nSigned-off-by: Ray Wu \u003cray.wu@amd.com\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 4523adbf4dca157aea96a6f28b4e7b7ebd4d5eda)\n" }, { "commit": "3001d2073d6542a9e51fa5bca3a39a078094d3c6", "tree": "629ea80fb126f52e6ce4ea7dc10cf62eef8e0495", "parents": [ "2e8ff3ac79eb09dccbd8f00ee5da1b61e53246be" ], "author": { "name": "Fangzhi Zuo", "email": "jerry.zuo@amd.com", "time": "Thu Aug 27 13:12:46 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:53:44 2026 -0400" }, "message": "drm/amd/display: Exit IPS before connector detection on resume\n\n[Why \u0026 How]\nOn resume, dm_resume() walks the connector list and, for each connector,\ncalls dc_link_detect_connection_type() at the top of the loop iteration\nbefore the per-connector dc_exit_ips_for_hw_access() that sits in the\ndetection branch. There is no dc_exit_ips_for_hw_access() before the loop,\nso the very first HW access relies on an earlier connector having already\ntaken the display out of IPS.\n\nCommit d1d51519bc3b (\"drm/amd/display: Skip eDP detection when no sink\")\nskips the eDP connector when no panel is present. On a DCN3.5 APU whose\neDP link has no sink, the eDP iteration - which used to bring the HW out\nof IPS first - is now skipped, so a downstream DP connector becomes the\nfirst one processed. Its initial DDC/AUX access then runs while the HW is\nstill idle, the AUX transfers time out (-ETIMEDOUT), and the EDID read\nfails:\n\n [drm:dm_helpers_read_local_edid [amdgpu]] *ERROR* EDID err: 2, on connector: DP-1\n amdgpu: [drm] *ERROR* No EDID read.\n\nTake the display out of IPS once before the detection loop so the first\nconnector processed no longer touches the AUX/DDC engine while the HW is\nstill in idle power state. This keeps the eDP-skip boot/resume\noptimization while fixing the DP EDID read failure.\n\nFixes: d1d51519bc3b (\"drm/amd/display: Skip eDP detection when no sink\")\nReviewed-by: Roman Li \u003croman.li@amd.com\u003e\nSigned-off-by: Fangzhi Zuo \u003cjerry.zuo@amd.com\u003e\nSigned-off-by: Ray Wu \u003cray.wu@amd.com\u003e\nTested-by: Dan Wheeler \u003cdaniel.wheeler@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 86420fe3093161971b4064e05be11ffff1df76aa)\nCc: stable@vger.kernel.org\n" }, { "commit": "2e8ff3ac79eb09dccbd8f00ee5da1b61e53246be", "tree": "c2eca3c4645ed1162bbb01bda4d4f036e1f23edf", "parents": [ "622b4e8505aa7453a53d17fa3a288871f270fc8b" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Thu Jun 18 09:52:14 2026 -0700" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:53:07 2026 -0400" }, "message": "drm/amd/display: Shorten hdmi_frl_status_polling_workqueue\n\nThere is a warning when creating the hdmi_frl_status_polling_wq\nworkqueue because \"hdmi_frl_status_polling_workqueue\" excceds\nWQ_NAME_LEN:\n\n workqueue: name exceeds WQ_NAME_LEN. Truncating to: hdmi_frl_status_polling_workque\n\nShorten the workqueue name to \"hdmi_frl_status_polling_wq\" like the\nstructure member to avoid the warning.\n\nFixes: 5c9b8b27a883 (\"drm/amd/display: Tie FRL support into amdgpu_dm\")\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@igalia.com\u003e\nLink: https://patch.msgid.link/20260618-amdgpu-fix-wq_name_len-warning-v2-1-ef0e2e6f5be7@kernel.org\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 767ae341b68193fda5fdbc510b2d77e3e8938039)\n" }, { "commit": "622b4e8505aa7453a53d17fa3a288871f270fc8b", "tree": "caf5e988687554efbfc060d34cc445de8cfed25b", "parents": [ "87ceb8cba73d0b3c4025ff42495bccd8164acaed" ], "author": { "name": "Harry Wentland", "email": "harry.wentland@amd.com", "time": "Tue Jun 16 13:39:21 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:52:59 2026 -0400" }, "message": "dm/amdgpu: fix malformed link_settings debugfs output\n\n[Why]\ndp_link_settings_read() passed strlen() of each format string as the size\nargument to snprintf() and then advanced rd_buf_ptr by that same fixed amount.\nThe format-string length has no relation to the formatted output length, so\nsnprintf() truncated each field at a NUL it wrote inside the buffer while the\npointer was advanced past it. The result is a buffer peppered with embedded NUL\nbytes and fields that are silently cut short, so the data read back from the\ndebugfs node does not reflect the actual link settings.\n\n[How]\nUse scnprintf() with the real remaining buffer size\n(rd_buf_size - (rd_buf_ptr - rd_buf)) and advance rd_buf_ptr by its return\nvalue, which is the number of characters actually written. This both bounds\neach write to the space left in rd_buf and keeps the output a single,\nproperly terminated string. The now-unused str_len local is removed.\n\nFixes: 41db5f1931ec (\"drm/amd/display: set-read link rate and lane count through debugfs\")\nAssisted-by: Copilot:claude-opus-4.8\nSigned-off-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 43b9f0f18693c7f7b75613f3aeae25fa2b4e2f76)\nCc: stable@vger.kernel.org\n" }, { "commit": "87ceb8cba73d0b3c4025ff42495bccd8164acaed", "tree": "308509ef9355888dad0ae37846f6816bba09fa22", "parents": [ "cfdcf5571c3107bf636002fc0c16ce93c19bd671" ], "author": { "name": "Arunpravin Paneer Selvam", "email": "Arunpravin.PaneerSelvam@amd.com", "time": "Wed Sep 02 18:33:48 2026 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:52:51 2026 -0400" }, "message": "drm/amdgpu: skip the VMID 0 flush for VRAM\n\nClear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches\nvia its direct MC address without programming a GART window, yet the wipe\nstill forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA\nflush can wedge the engine; only flush when a GART window is actually used.\n\nv2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed,\n and drive the clear and copy paths from that. (Christian)\nv3: Make the vm_needs_flush output parameter mandatory instead of\n allowing NULL. (Christian)\n\nFixes: a68c7eaa7a8f (\"drm/amdgpu: Enable clear page functionality\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5413\nCc: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Arunpravin Paneer Selvam \u003cArunpravin.PaneerSelvam@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nReviewed-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)\nCc: stable@vger.kernel.org\n" }, { "commit": "cfdcf5571c3107bf636002fc0c16ce93c19bd671", "tree": "bc9cfdebaf0efbc0dfe4794a686912f8cde33b23", "parents": [ "df2908090cda368b01ff43709f51890076c56157" ], "author": { "name": "Michel Dänzer", "email": "mdaenzer@redhat.com", "time": "Mon May 18 17:48:09 2026 +0200" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 10 12:52:39 2026 -0400" }, "message": "drm/amd/display: Consult MCCS FreeSync cap only if requested \u0026 supported\n\nWhen the do_mccs parameter is false, we don\u0027t call\ndm_helpers_read_mccs_caps, so sink-\u003emccs_caps.freesync_supported is\nunlikely to be true.\n\nFixes: 6f71d5dd3206 (\"drm/amd/display: Read sink freesync support via mccs\")\nBug: https://gitlab.freedesktop.org/drm/amd/-/work_items/5286\nSigned-off-by: Michel Dänzer \u003cmdaenzer@redhat.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ac3aea794fb4156467b4b3b92c3155d95bf435c9)\nCc: stable@vger.kernel.org\n" }, { "commit": "ad724d319c81475488794eccc11eb5e27242e1eb", "tree": "89a34a871f422f2e320eee99820218bc134cee34", "parents": [ "c9a8c0e393d6043fc29b0b527e654110ba523c36", "353a95f1cd8da8a5436a3f070be07d2f484486cd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fix from Joel Granados:\n \"This fell through the cracks during the latest merge window. There are\n no more CONFIG_PROC_SYSCTL uses after this fix:\n\n - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL\n\n CONFIG_SYSCTL is the config string that controls sysctl subsys\"\n\n* tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard\n" }, { "commit": "c9a8c0e393d6043fc29b0b527e654110ba523c36", "tree": "e01cbcc26ddef4915060d28cd77d4f0abcc6a789", "parents": [ "50d05c7c76c96b90462f24debacca971d2e86713", "01504d14e47b34779911250dd308a03f6ef681c2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "message": "Merge tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog fixes from Guenter Roeck:\n\n - core: Do not start hrtimer when pretimeout is zero\n\n - msc313e: Various fixes for issues reported by Sashiko\n\n - MAINTAINERS: Update URI for watchdog tree\n\n - sunxi_wdt: preserve boot-enabled watchdog\n\n* tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n watchdog: msc313e: Sync timeout value if WDT was running at boot\n watchdog: msc313e: Fix undefined behavior\n watchdog: msc313e: Fix spurious reset on suspend\n watchdog: msc313e: Enable clock before accessing hardware registers\n watchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n watchdog: msc313e: Avoid division by zero\n watchdog: fix hrtimer start when pretimeout is zero\n MAINTAINERS: Update URI for watchdog tree\n watchdog: msc313e: Fix NULL pointer dereference in PM callbacks\n watchdog: sunxi_wdt: preserve boot-enabled watchdog\n" }, { "commit": "5096947508b750bd4a65a8e61bd2083a44d61bfd", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae", "2a86bbed9f60702e97a8194e40f90f4db22d7795" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:08 2026 -0700" }, "message": "Merge branch \u0027net-sched-fix-action-batch-failure-cleanup\u0027\n\nXuanqiang Luo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: fix action batch failure cleanup\n\nFailed batched RTM_NEWACTION requests can leak action references and\nreserved IDR indices when cleanup encounters a filter-bound action.\n\nPatch 1 fixes the failure cleanup.\n\nPatch 2 adds tc-testing regression coverage.\n\nFailure reproduction (key output excerpts):\n\n python3 tdc.py -f tc-tests/actions/gact-rollback.json\n\nnot ok 1 e3b1 - Failed action batch releases a bound action reference\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 3 bind 1\n\nnot ok 2 e3b2 - Failed action batch releases entries after a bound action\n\tCommand exited with 255, expected 0\nRTNETLINK answers: Resource temporarily unavailable\nWe have an error talking to the kernel\n\nnot ok 3 e3b3 - Failed action batch releases repeated references to a bound action\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 4 bind 1\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909070336.32979-1-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2a86bbed9f60702e97a8194e40f90f4db22d7795", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "478eb5abb51931a152abab068f8a717b7ff480fd" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "selftests: tc-testing: test action batch failure cleanup\n\nAdd tests for cleanup after a batched RTM_NEWACTION request fails.\nReplace an existing gact action bound to a filter, then fail a later\nentry by requesting goto chain without a classifier context.\n\nCheck that the bound action\u0027s reference count returns to its original\nvalue. Also cover a successfully initialized new action between the\nbound action and the failing entry, verifying that its reserved index\ncan be reused. Repeat the bound action in another batch to check that\neach temporary reference to the same action is released.\n\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-3-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "478eb5abb51931a152abab068f8a717b7ff480fd", "tree": "00d7d67e4c0fb1ab2af4484bc8f6ab3c90eb1f03", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "net/sched: act_api: release all action references on NEWACTION failure\n\nWhen a batched RTM_NEWACTION request replaces an existing action,\ntcf_idr_check_alloc() takes a temporary reference on it. If a later\naction fails to initialize, tcf_action_destroy() uses strict release\nsemantics to clean up the actions initialized so far. For an action\nbound to a filter, the strict check returns -EPERM without dropping\nthe temporary reference.\n\nThis error also makes tcf_action_destroy() return before releasing\nsubsequent entries. Any new action initialized between the bound\naction and the failing entry is leaked together with its reserved\nIDR slot, preventing reuse of its index.\n\nUse tcf_idr_release() to drop each reference held by the batch without\nrejecting bound actions. This allows cleanup to continue through all\ninitialized entries and preserves the module reference release when\nan action is destroyed. Explicit action deletion and flushing retain\ntheir separate bind-count checks.\n\nFixes: 55334a5db5cd (\"net_sched: act: refuse to remove bound action outside\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-2-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fc266a5dd99c4584c985b8b687c750598500a7ae", "tree": "74cf39e5c4d1eaac74ae943720e2ec264c383555", "parents": [ "e184a4a6f423550a25adce867036cdb1ff471745", "b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:13 2026 -0700" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-09-08 (idpf, ice)\n\nFor idpf:\nMyeonghun Pak adds calls to disable DIM work and PTM to allow for proper\ncleanup.\n\nJosh adds check, and adjustment, for VLAN headers when processing RSC\npackets.\n\nFor ice:\nJake adds call to xa_destroy for xarray sched_node_ids; also moving it\nfrom port_info struct to ice_hw to simplify its lifecycle management.\n\nJakub Kicinski stores trace event data as scalars instead of\ndereferencing pointers in TP_printk(), preventing use-after-free issues\nduring event printing and eliminating double-dereference warnings.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n eth: ice: don\u0027t dereference pointers from TP_printk()\n ice: add missing xa_destroy for sched_node_ids\n idpf: account for VLAN header when parsing RSC packet header\n idpf: disable PTM on probe failure and on remove\n idpf: disable DIM work before freeing q_vectors\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908214502.528440-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e10f2b7e28be3e1ce42a4be8fa9b0684d1d354ac", "tree": "6616c98c803ff0a751a42180e7e5f15e9465944d", "parents": [ "6bb147bc470f36d9edd8f564dc952bb78c65fdbc" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Sep 10 16:41:50 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Sep 10 17:51:32 2026 +0200" }, "message": "ALSA: hdspm: Add a new PCI device ID (1d18:3fc6) for RME HDSPe AIO PCI express audio\n\nThe RME HDSPe AIO PCI express audio card has a new PCI vendor ID (1d18)\nwhile keeping the same device ID (3fc6). The card seems working fine by\njust adding the new ID.\n\nWhile we\u0027re at it, use the standard macro to cleann up the existing PCI\nID entry, too.\n\nReported-by: AtmanActive \u003calsa.atmanactive.3dfqt@slmail.me\u003e\nCloses: https://lore.kernel.org/178674392532.7.10140952469564861620.1550442282@slmail.me\nTested-by: AtmanActive \u003calsa.atmanactive.3dfqt@slmail.me\u003e\nLink: https://patch.msgid.link/20260910144204.973359-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "e184a4a6f423550a25adce867036cdb1ff471745", "tree": "81a226f509ca1643d3e04ee8dd923f342f75ac90", "parents": [ "b7ee18725f2292ab554aa96a101ae42d45f008bd" ], "author": { "name": "Eelco Chaudron", "email": "echaudro@redhat.com", "time": "Tue Sep 08 16:15:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:51:30 2026 -0700" }, "message": "openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n\nThe ESP and AH cases in get_ipv6_ext_hdrs() used IPPROTO_FRAGMENT instead\nof OFPIEH12_FRAG when checking for out-of-order extension headers, causing\nthe fragment header to not be recognised as a valid predecessor.\n\nThe original code used IPPROTO_FRAGMENT (44) as a bitmask constant where\nOFPIEH12_FRAG (1 \u003c\u003c 4 \u003d 16) was intended. IPPROTO_FRAGMENT encodes bits\n2, 3 and 5 (OFPIEH12_AUTH | OFPIEH12_DEST | OFPIEH12_ROUTER), but not\nbit 4 (OFPIEH12_FRAG). This caused incorrect OFPIEH12_UNSEQ verdicts in\nboth the ESP and AH arms: the ESP arm failed to whitelist OFPIEH12_FRAG,\nwhile the AH arm accidentally whitelisted OFPIEH12_AUTH.\n\nWith the fix, a packet with two AH headers now also gets OFPIEH12_UNSEQ\nin addition to OFPIEH12_UNREP, matching the ESP arm which already sets\nUNSEQ on a repeat, which is the intended behavior.\n\nFixes: 28a3f0601727 (\"net: openvswitch: IPv6: Add IPv6 extension header support\")\nReported-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: Eelco Chaudron \u003cechaudro@redhat.com\u003e\nLink: https://patch.msgid.link/1b1582eb07550d71f3cbe210e5cb31eeb8d0ad86.1788876917.git.echaudro@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7ee18725f2292ab554aa96a101ae42d45f008bd", "tree": "e9f27a905de4f01c5c44bf17c355c2bcc72477ce", "parents": [ "6ca81bbc31cdc964e4b74d17b86215d4a810a56f" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 11:58:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:48:44 2026 -0700" }, "message": "ipmr: account multicast table and route memory\n\nA netadmin in a user+net namespace can create many IPv4 and IPv6\nmulticast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen\nid allocates an mr_table via the shared mr_table_alloc(), links it\ninto the per-net list, and leaves it until netns teardown. Those\nobjects were not charged to memcg, so the host unreclaimable slab\ngrows with the table count.\n\nAccount mr_table allocations with GFP_KERNEL_ACCOUNT and mark the\nIPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established\nhandling of IP addresses, routes and alternate interface names.\n\nUnresolved MFC entries are still allocated from softIRQ with\nGFP_ATOMIC and are not charged. They expire after 10 seconds and are\nbounded by the socket receive queue; see commit 0079ad8e8dc3\n(\"ipmr: remove hard code cache_resolve_queue_len limit\").\n\nFixes: f0ad0860d01e (\"ipv4: ipmr: support multiple tables\")\nFixes: d1db275dd3f6 (\"ipv6: ip6mr: support multiple tables\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/050b58f7fc6b45da0fb12768ebb62d18fa46133d.1788784801.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ca81bbc31cdc964e4b74d17b86215d4a810a56f", "tree": "0179c0ec9b498bdde3b83f0db783e424b5891b69", "parents": [ "e1406330d70e56dd44fa6fbafc86e77e5c80c122" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 08 19:59:58 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:47:22 2026 -0700" }, "message": "net: phy: dp83td510: handle the active-high LED polarity mode\n\ndp83td510_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() returns it. A device tree marking\na DP83TD510 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus leaves the mdio device\nunbound, so phy_attach_direct() falls back to the genphy driver, which\ncannot drive this 10BASE-T1L single-mode PHY, so the interface has no\nusable link.\n\nThe callback initializes polarity to DP83TD510E_LED_POLARITY(index), which\nis the active-high setting, so the request is already satisfied and only\nthe case label is missing.\n\nCc: stable@vger.kernel.org\nFixes: 5b281fe7e396 (\"net: phy: dp83td510: introduce LED framework support\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908105959.70453-3-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e1406330d70e56dd44fa6fbafc86e77e5c80c122", "tree": "2291415b8da9eb8dcf3cdc335e1ad07c0b9c785e", "parents": [ "a2dc179481d18f6df7274522571b64dd50f31e81" ], "author": { "name": "Runyu Xiao", "email": "runyu.xiao@seu.edu.cn", "time": "Tue Sep 08 18:39:24 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:46:19 2026 -0700" }, "message": "net: macb: initialize PTP state before registering clock\n\ngem_ptp_init() registers the PTP clock before initializing\nbp-\u003etsu_clk_lock and the TSU hardware. Since ptp_clock_register()\npublishes the PTP character device, userspace may invoke PTP callbacks\nbefore the lock and hardware are ready.\n\nIn addition, gem_ptp_init() is called from both the interface open and\nresume paths. Reinitializing tsu_clk_lock there can reset the lock while\ntimestamp processing is using it.\n\nThis race is theoretical and has not been observed in practice.\n\nInitialize tsu_clk_lock once during probe and initialize the TSU before\nregistering the PTP clock.\n\nFixes: ab91f0a9b5f4 (\"net: macb: Add hardware PTP support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260904030439.3994047-1-runyu.xiao@seu.edu.cn/\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260908103924.607033-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a2dc179481d18f6df7274522571b64dd50f31e81", "tree": "627196c8b7c7dcdcde85e1ec1a31e74664f0a196", "parents": [ "19b4ed644d68098cc62ab612727f40d30f43476c" ], "author": { "name": "MD Danish Anwar", "email": "danishanwar@ti.com", "time": "Tue Sep 08 14:38:56 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:45:00 2026 -0700" }, "message": "net: hsr: enable promiscuous mode on interlink port with fwd offload\n\nhsr_portdev_setup() skips promiscuous mode on non-master ports when\nhsr-\u003efwd_offloaded is set. fwd_offloaded is derived only from the ring\nslaves\u0027 NETIF_F_HW_HSR_FWD bit, so this also skips it for the interlink\nport, which never gets forwarding offload. Without promiscuous mode,\nthe interlink NIC drops unicast frames addressed to hsr_dev\u0027s MAC\n(e.g. SAN traffic to the RedBox), breaking RedBox whenever the ring is\nHW-offloaded.\n\nFixes: 5055cccfc2d1 (\"net: hsr: Provide RedBox support (HSR-SAN)\")\nSigned-off-by: MD Danish Anwar \u003cdanishanwar@ti.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260908090856.2876114-1-danishanwar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19b4ed644d68098cc62ab612727f40d30f43476c", "tree": "40c1c6cb900b27e01b6bed9adfdc66ca2c36d60b", "parents": [ "5e38d732ec67a5b1f9a56e6c73add480c4b6030a" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 07:42:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:39:06 2026 -0700" }, "message": "ipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet-\u003eipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w-\u003enode check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race.\n\nFixes: 8d2ca1d7b5c3 (\"ipv6: avoid high order memory allocations for /proc/net/ipv6_route\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nCo-developed-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/89699735763f6c297584d7c2ff106239cc1e8ce0.1788837093.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a", "tree": "2bbcab25587be47331ea1a16c89d915de1c4da7f", "parents": [ "2ac09b5353fe6858411fdc8c6efa60d832e20f13" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Sep 07 23:46:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:07 2026 -0700" }, "message": "net: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb-\u003elen - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check.\n\nFixes: f748be531d70 (\"stmmac: support new GMAC4\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907-stmmac-fix-tso-nfrags-check-v1-1-328459906cdb@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ac09b5353fe6858411fdc8c6efa60d832e20f13", "tree": "59b37dc616b531c0fd1fae4800544096428c90b7", "parents": [ "4c46beb807efcc93f5899ebe1f5958248eb296c6" ], "author": { "name": "Greg Marsden", "email": "greg.marsden@oracle.com", "time": "Sat Sep 05 10:00:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:19:17 2026 -0700" }, "message": "net/rds: fix tcp stream corruption with large pages\n\nrds_message_map_pages() assigns PAGE_SIZE bytes to every\nscatterlist entry, even when total_len ends in a partial page. The RDS\ncongestion map is defined as 8192 bytes, so on systems with PAGE_SIZE\ngreater than 8192 the scatterlist maps bytes beyond the end of the\ncongestion map. RDS-TCP transmits the SG contents according to those\nlengths, so the extra bytes become part of the TCP RDS stream and are\ninterpreted as subsequent RDS message headers, corrupting the stream.\n\nLimit the final scatterlist mapping to the number of bytes remaining.\nThis has no effect on systems with a 4K page size and allows RDS-TCP to\nbe used on systems with 16K and larger page sizes.\n\nThe RDS selftest, which previously hung on 16K pages, now passes.\n\nFixes: 7875e18e0996 (\"RDS: Message parsing\")\nSigned-off-by: Greg Marsden \u003cgreg.marsden@oracle.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/apxJjxvStibPI0AS@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c46beb807efcc93f5899ebe1f5958248eb296c6", "tree": "1fb7e99e6821c49b9479a254786d54217fb0d027", "parents": [ "36a45facedd5c8e73bfb2403f8b0dbff05124c9c" ], "author": { "name": "Long Li", "email": "longli@microsoft.com", "time": "Fri Sep 04 13:26:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:06:07 2026 -0700" }, "message": "net: mana: restore the XDP program pointer when pre-allocation fails\n\nmana_xdp_set() publishes the new program into apc-\u003ebpf_prog before it\nallocates anything, because mana_pre_alloc_rxbufs() sizes the buffers\nfrom it via mana_get_rxbuf_cfg(). When that allocation fails the\nfunction returns the error directly, skipping the err_dealloc_rxbuffs\nlabel which is the only place that restores the previous pointer.\n\nThe attach is reported as failed, so the BPF core drops the reference it\nheld for the caller and the program can be freed, while apc-\u003ebpf_prog\nstill points at it. The next consumer of mana_xdp_get() - typically\nmana_chn_setxdp() from mana_alloc_queues() on the following ifup, or\nafter a TX timeout reset - then calls bpf_prog_add() on freed memory.\n\nThis is reachable from an ordinary \"ip link set dev ethX xdp obj ...\"\nwhenever the per-queue RX buffer pre-allocation cannot be satisfied.\n\nRestore the previous program on that error path.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nSigned-off-by: Long Li \u003clongli@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904202640.3900685-1-longli@microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "36a45facedd5c8e73bfb2403f8b0dbff05124c9c", "tree": "6d2ebc24e56c1531ba8573ae117681007a6ba286", "parents": [ "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 03 11:28:38 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "net: phy: dp83867: handle the active-high LED polarity mode\n\nCommit a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY\nLEDs\") added PHY_LED_ACTIVE_HIGH and made of_phy_led() set the matching\nbit in the modes mask when a LED node carries the \u0027active-high\u0027\nproperty. dp83867 was not part of that series.\n\ndp83867_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() fails. A device tree marking a\nDP83867 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus stops the PHY from\nprobing.\n\nActive high is what the function programs when no polarity mode is\nrequested at all, so the initial value of polarity already satisfies the\nrequest and only the case label is missing.\n\nThe same series updated mxl-gpy in commit eb89c79c1b8f (\"net: phy:\nmxl-gpy: correctly describe LED polarity\") and aquantia in\ncommit 9d55e68b19f2 (\"net: phy: aquantia: correctly describe LED\npolarity override\").\n\nFixes: a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY LEDs\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nLink: https://patch.msgid.link/20260903022839.4006614-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437", "tree": "7234cccade054ae2d9331ff8f8d2adeef5b05526", "parents": [ "985a663bf00799c1daf1c5789efa6406958780c8" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Fri Sep 04 14:21:13 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n\nrvu_dbg_rvu_pf_cgx_map_display() locates each RVU PF PCI device via\npci_get_domain_bus_and_slot() when printing the PF-to-CGX map. It\nassumed PF0 always sits on PCI bus 1 and derived other PF bus numbers\nas pf + 1, but the AF device can be enumerated on a different bus.\n\nUse rvu-\u003epdev-\u003ebus-\u003enumber as the base bus instead, so each PF lookup\nuses pf + start on systems where RVU functions are on contiguous buses\nbut do not start at bus 1.\n\nFixes: e2fb373038654 (\"octeontx2-af: Display CGX, NIX and PF map in debugfs.\")\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904085114.3385530-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e240919ca727776f16a468d3d90686dc82cfe9cb", "tree": "7fb87c7ec508e6a6b36984a4b385d4da017d38a2", "parents": [ "50ba24ccb9a94f61c707209442ca23d98c815052" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Sun Sep 06 20:16:29 2026 +0530" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:43:48 2026 +0200" }, "message": "xfs: take hm-\u003elock in xfs_ioc_health_monitor() before insert\n\n__xfs_healthmon_insert() asserts that hm-\u003elock is held\n(lockdep_assert_held), but xfs_ioc_health_monitor() called it right\nafter allocating hm, before ever taking the lock, triggering a\nlockdep warning.\n\nTake hm-\u003elock around the call.\n\nFixes: b3a289a2a9397 (\"xfs: create event queuing, formatting, and discovery infrastructure\")\nReported-by: syzbot+ccdf3469f5f653bff7ac@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dccdf3469f5f653bff7ac\nSigned-off-by: Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "50ba24ccb9a94f61c707209442ca23d98c815052", "tree": "e214b7827cab293175b9e9f820d327fc95aab770", "parents": [ "761e015e5a54851043c3b5bb7cfb6f539b01a35e" ], "author": { "name": "Anuj Gupta", "email": "anuj20.g@samsung.com", "time": "Mon Sep 07 10:27:39 2026 +0300" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: set IOMAP_F_INTEGRITY for zoned writes on integrity devices\n\nxfs_iomap_set_anon_write does not set IOMAP_F_INTEGRITY based on\nbdev_has_integrity_csum(), so file system PI generation is silently\nskipped for zoned writes on integrity-enabled devices, and left to\nthe block layer PI generation.\n\nFixes: 6bbb4d96f797 (\"xfs: support T10 protection information\")\nSigned-off-by: Anuj Gupta \u003canuj20.g@samsung.com\u003e\n[hch: ported to the recently introduced xfs_iomap_set_anon_write()]\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "761e015e5a54851043c3b5bb7cfb6f539b01a35e", "tree": "4535379feb592399e2ea9a8a1f502f7272ba433f", "parents": [ "c84455c683eb0b0397b0f5c5f5ce5cd82572a23f" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Mon Sep 07 10:33:09 2026 +0300" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: avoid extra cache flushes for multi-device file systems in xfs_fsync\n\nWhen xlog_force_lsn sets log_flushed, it has just called xlog_force_iclog\nthrough xlog_force_and_check_iclog, which sets XLOG_ICL_NEED_FLUSH before\nwriting out the head iclog. This means that we already flushed the log,\ndata, and (with the recent fix) RT devices before writing out the iclog\nstart record and no extra cache flushed is required.\n\nThis optimizes the external log case, and fixes a performance regression\ndue to double RT dev flushes with \"xfs: also flush the RT device cache in\nxlog_write_iclog\".\n\nThe explicit flush of the data that the device resides on when no iclog\nwas written out is still required.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "c84455c683eb0b0397b0f5c5f5ce5cd82572a23f", "tree": "fde1209ed22a43f395177ff7adec08644495e63b", "parents": [ "ad0033e2dbd3ecc063dfe613060da5cbab9a4970" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Mon Sep 07 10:33:08 2026 +0300" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: don\u0027t continue on error in xfs_fsync\n\nAs soon as we get an error from cache flushing or log forcing, there\nis no point in continuing as the data integrity is already impacted.\nReturn the error instead of continuing to do more work.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "ad0033e2dbd3ecc063dfe613060da5cbab9a4970", "tree": "426d0c4f4341c9e6eed004b05221731d0ff9570a", "parents": [ "eaf580538eb1be3d162400d04c4b7dc4c627296b" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Mon Sep 07 10:33:07 2026 +0300" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: also flush the RT device cache in xlog_write_iclog\n\nThe cache flush before writing the CIL start record no only needs to\nensure any metadata covered by the overwritten part of the log is on\nstable storage, but also that any data pointed to by metadata logged\nis on stable storage, as otherwise log recovery could created allocated\nblocks that point to stale data. Fortunately the code already\nhandles this right for the data device, but it also needs to flush\nthe RT device for this to work for data on the RT device.\n\nAlso update the comments to explicitly mention this case.\n\nThis omission goes back to the first days of cache control in XFS.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "eaf580538eb1be3d162400d04c4b7dc4c627296b", "tree": "d9c88a9705fb5b7db6231958196aca4ce6c08643", "parents": [ "3466dfef0a20f842363958deea55be9f1d26818a" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:04:19 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: bail out on bitmap errors in xrep_agfl_fill\n\nLOLLM also points out that the xagb_bitmap_set call in xrep_agfl_fill\ncan fail, but we don\u0027t check the result of xagb_bitmap_walk, so we\nsilently drop the error and proceed with inconsistent incore data.\nThat shouldn\u0027t be allowed.\n\nCc: stable@vger.kernel.org # v6.6\nFixes: 014ad53732d2ba (\"xfs: use per-AG bitmaps to reap unused AG metadata blocks during repair\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "3466dfef0a20f842363958deea55be9f1d26818a", "tree": "1de49ff48c9f1cc7c3537366f8bac4e2430ada15", "parents": [ "341f03865d0793e7df22c4661e04047c092e5ac2" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:04:04 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:37 2026 +0200" }, "message": "xfs: snapshot old AGFL before rewriting it\n\nLOLLM complains that we can\u0027t undo an attempt at fixing the AGFL if\nanything goes wrong during the rewrite, so take a snapshot of the whole\nbuffer so that we can restore it. Move the xrep_agfl_update_agf call so\nthat we only update the AGF if the AGFL update is 100% successful.\n\nWhile we\u0027re at it, fix leaking the used_extents bitmap if the disunion\noperation fails.\n\nCc: stable@vger.kernel.org # v4.19\nFixes: 0e93d3f43ec7d3 (\"xfs: repair the AGFL\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "341f03865d0793e7df22c4661e04047c092e5ac2", "tree": "8c8a69c3fa13cbdd3f025a3534a133fa71ab31e2", "parents": [ "d3dc979a49df6d48f8e137034d19d9b35afd07d8" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:03:48 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:36 2026 +0200" }, "message": "xfs: remove redundant function declaration\n\nRemove this useless code.\n\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "d3dc979a49df6d48f8e137034d19d9b35afd07d8", "tree": "ff7aa92ebe538a3a9dcc3ed59754a85985c68da6", "parents": [ "0ae61c331ec552ad0c278c5c48a1c4ccb90b4bab" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:03:33 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:36 2026 +0200" }, "message": "xfs: report runtime failures in scrub\n\nAdd a new counter so that we can track the number of runtime failures\nencountered during scrubs.\n\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "0ae61c331ec552ad0c278c5c48a1c4ccb90b4bab", "tree": "8105bf8e3c32bb354dfa2ecf60a73f6e41f01ba2", "parents": [ "568a1588b906780dc3e9be56a61217afb4f7800e" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:03:17 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:36 2026 +0200" }, "message": "xfs: report healthy filesystem events in scrub stats\n\nLOLLM also notices that I forgot to expose the \"clean bill of health\"\nscrub stats. Fix that.\n\nCc: stable@vger.kernel.org # v6.9\nFixes: a1f3e0cca41036 (\"xfs: update health status if we get a clean bill of health\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "568a1588b906780dc3e9be56a61217afb4f7800e", "tree": "6d3ba67670d32b288413e5bd0358823eecb1c47b", "parents": [ "157dcb8230a4e882e099ec4d1cb1957b0b2c9b26" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Tue Sep 08 23:03:02 2026 -0700" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Thu Sep 10 16:26:36 2026 +0200" }, "message": "xfs: snapshot scrub stats when rendering them\n\nLOLLM complains about concurrency problems in the scrub stats code\nbecause xchk_stats_format doesn\u0027t synchronize in any way with updates.\nThese stats are only reported through debugfs so I don\u0027t think it really\nmatters, but I guess I exist to make bots happy now.\n\nNote: We snapshot the entire stats object with a spinlock so that we\ndon\u0027t have to worry about users seeing slightly weird numbers (e.g.\ninvocations has incremented but none of the outcomes have been yet) if\nwe race with xchk_stats_merge_one. This isn\u0027t a hot path.\n\nCc: stable@vger.kernel.org # v6.6\nFixes: d7a74cad8f4513 (\"xfs: track usage statistics of online fsck\")\nSigned-off-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nAssisted-by: LOLLM # finding obvious bugs\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n" }, { "commit": "985a663bf00799c1daf1c5789efa6406958780c8", "tree": "82415db2760ff82b11dc69dd6e978fb5d92e4747", "parents": [ "ccbe7540e4aad0d1c3acc249697350b93ccb8025" ], "author": { "name": "Faicker Mo", "email": "faicker.mo@gmail.com", "time": "Tue Sep 08 12:06:29 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 15:19:06 2026 +0200" }, "message": "net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n\nThis is a sibling fix of commit\nb84c5632c7b3 (\"net: net_failover: Fix the deadlock in slave register\").\nThere is netdev_lock_ops() in the upper callers, so using netif_open()\ninstead of dev_open().\n\nCall Trace:\n __schedule+0x2bb/0x650\n schedule+0x27/0xb0\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x550/0xaf0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n dev_open+0x3b/0xe0\n net_failover_slave_name_change+0x22/0x40\n failover_event+0xd4/0x1e0\n notifier_call_chain+0x62/0xf0\n raw_notifier_call_chain+0x16/0x30\n call_netdevice_notifiers_info+0x50/0x80\n netif_change_name+0x200/0x330\n do_setlink.isra.0+0xb12/0xdf0\n ? security_capable+0x9a/0x1e0\n ? ns_capable+0x31/0x60\n rtnl_setlink+0x302/0x670\n ? netlink_recvmsg+0x296/0x340\n ? security_capable+0x9a/0x1e0\n ? __pfx_rtnl_setlink+0x10/0x10\n rtnetlink_rcv_msg+0x384/0x460\n ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x61/0x120\n rtnetlink_rcv+0x15/0x30\n netlink_unicast+0x28f/0x3c0\n netlink_sendmsg+0x216/0x450\n __sys_sendto+0x222/0x230\n __x64_sys_sendto+0x24/0x40\n x64_sys_call+0x1d5d/0x2390\n do_syscall_64+0x105/0x5a0\n ? do_syscall_64+0x140/0x5a0\n ? exc_page_fault+0x94/0x1e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFixes: 7e4d784f5810 (\"net: hold netdev instance lock during rtnetlink operations\")\nSigned-off-by: Faicker Mo \u003cfaicker.mo@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260908040708.3972058-1-faicker.mo@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ccbe7540e4aad0d1c3acc249697350b93ccb8025", "tree": "cc0ebd4dc7a32b9c8edf139baec73560be3df695", "parents": [ "125755776bc6d4dd53eaf551c87e3d460625d638" ], "author": { "name": "Vladislav Karmanov", "email": "vladislav.karmanov.dev@gmail.com", "time": "Tue Sep 08 17:52:13 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 14:48:21 2026 +0200" }, "message": "net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n\nThe MT7530 internal GE PHY advertises EEE by hardware default, but its\nEEE support is defective: with EEE advertised, some link partners fail\nto establish a stable link. On a 2-pair (4-wire) cable where both ends\nadvertise gigabit, 1000BASE-T training cannot succeed, and instead of\nfalling back to 100 Mbps the port loops, so no link or DHCP lease is\never obtained. MediaTek confirms the hardware is the root cause (Landen\nChao, 2021): \"EEE of the 10-year-old MT7530 internal gephy has many IOT\nproblems, so it is recommended to disable its EEE.\"\n\nmtk_gephy_config_init() used to clear the EEE advertisement early, but\ncommit af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE\nadvertisement\") removed that on the rationale that the DSA subdriver\nalready performs an early disable. That holds for MT7531, whose\nmt7531_setup() clears MDIO_AN_EEE_ADV on each switch PHY, but not for\nthe MT7530 PHY: neither the MT7621 integrated switch nor the dedicated\nMT7530 IC ever had such a loop, so removing it left those boards\nwithout any working early EEE disable and the link flapping came back.\n\nSince the broken hardware is the PHY, fix it in the PHY driver so it\ncovers all users of this PHY, integrated in a switch or standalone:\n\n - clear MDIO_AN_EEE_ADV in probe(), as early as possible, before\n anything can negotiate EEE with the link partner;\n - clear it again in config_init() and call phy_disable_eee() there.\n config_init() is what phy_init_hw() replays after a PHY reset, when\n the register is back at its EEE-advertising hardware default, and\n it runs after of_set_phy_eee_broken() in phy_probe(), so the\n eee_disabled_modes mask survives and neither phylib nor userspace\n can re-enable EEE. dp83867 disables broken EEE from config_init()\n the same way.\n\nAuto-negotiation then falls back to a stable 100 Mbps link instead of\nlooping at gigabit. Tested on ASUS RT-AX53U (MT7621): with a 2-pair\ncable on the WAN port, a single clean 100 Mbps link comes up and a\nDHCP lease is obtained, where the unpatched driver loops.\n\nFixes: af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE advertisement\")\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Vladislav Karmanov \u003cvladislav.karmanov.dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260908145213.3976508-1-vladislav.karmanov.dev@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "125755776bc6d4dd53eaf551c87e3d460625d638" }