)]}' { "log": [ { "commit": "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e", "tree": "b9e9f22cee46d79f64ee1d888a80ca0d04dd8df6", "parents": [ "d266640c6c760c9bc215bf5a3ece122ca488b6f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 13:55:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 13:55:01 2026 -0700" }, "message": "Linux 7.3-rc5\n" }, { "commit": "d266640c6c760c9bc215bf5a3ece122ca488b6f5", "tree": "985730170ea1f7e6591dbe6a6d69131424595519", "parents": [ "64d34cef2a32331fedabf25ea8fa8a30128af9f7", "77be3641f3e3a56e42a5ed889372ef395a933f3c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:57:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:57:03 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fix from Danilo Krummrich:\n\n - Suppress spurious \"debugfs is not initialized yet\" boot warnings when\n the caller passes an error parent to debugfs file creation; callers\n propagating an earlier failure should not trigger the warning\n\n* tag \u0027driver-core-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n debugfs: don\u0027t warn about uninitialized debugfs for an error parent\n" }, { "commit": "64d34cef2a32331fedabf25ea8fa8a30128af9f7", "tree": "1dad8ea478eb71dde53c7e093f26d100772bf4e6", "parents": [ "104484baf7484266fa0cb8b26362b105cf2d6a10", "cb97bf3d4f91453b881acaf8e9f0cc47bb40b604" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:26:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 09:26:10 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fix from Andi Shyti:\n\n - qcom-geni: select the correct source clock table entry\n\n* tag \u0027i2c-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL\n" }, { "commit": "104484baf7484266fa0cb8b26362b105cf2d6a10", "tree": "383026782405c26ea1e260cdc55510a3b7728171", "parents": [ "b1fa457bddf009907b023bc0c09ba4eca3191a8e", "db6365ced4d5855e321f772b240c0e473bcfcdd5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:55:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:55:24 2026 -0700" }, "message": "Merge tag \u0027wq-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fix from Tejun Heo:\n\n - Fix a NULL dereference in the flush dependency check when a worker\n flushes outside a work item, such as from the OOM path during worker\n creation\n\n* tag \u0027wq-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: Fix NULL current_pwq deref in flush dependency check\n" }, { "commit": "b1fa457bddf009907b023bc0c09ba4eca3191a8e", "tree": "f4f64520b9dd4558c7a26a045651fb3ca8ea61af", "parents": [ "7cdf91542e1ed03aa8f5ab029702b3abde5be6d5", "31c88350b7dd1522792f726f79607f31bb55c50f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:51:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:51:45 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fix from Tejun Heo:\n\n - A cpuset partition could claim CPUs an ancestor partition already\n held exclusively. Restore the rejection an earlier change had turned\n into a warning.\n\n* tag \u0027cgroup-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n" }, { "commit": "7cdf91542e1ed03aa8f5ab029702b3abde5be6d5", "tree": "cb8513755a9ac84005cb9792f0eae2cfc0dcc889", "parents": [ "efb44d93a620c294c049db37c810c8ab7ee1122d", "94480606a677deb68d5622cf0ded88626514b3f2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:50:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:50:25 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fix from Tejun Heo:\n\n - The CPU topology helper for BPF schedulers took no buffer size, so\n its structure couldn\u0027t grow without breaking schedulers built against\n the older layout. Add a size argument.\n\n* tag \u0027sched_ext-for-7.3-rc4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Add a size argument to scx_bpf_cid_topo() so struct scx_cid_topo can grow\n" }, { "commit": "efb44d93a620c294c049db37c810c8ab7ee1122d", "tree": "095d326e3948f0fc217652bfb3545702831c8f49", "parents": [ "673dab7eac1618b6622bbee9eb2aaa47817631e3", "b8d1d5b63a8ef532038eebd9d97d406860385668" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:44:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:44:12 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix preemption bugs in the SVSM vTPM guest implementation\n (Melody Wang)\n\n - Fix MCE-triggered hardware debug register corruption on\n task migration (Masami Hiramatsu)\n\n* tag \u0027x86-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mce: Fix hardware debug register corruption on task migration\n x86/sev: Make vTPM SVSM calls preemption-safe\n" }, { "commit": "673dab7eac1618b6622bbee9eb2aaa47817631e3", "tree": "d0e914a549a5b6faa0b6ca1b11ec7a2cc2b6c952", "parents": [ "5ccda18d1ba2ecf436102a211baf1fbd5d81703f", "a0bb6fac53fa7cf1cadb487b43d4c9276a6b82e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:24:16 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:24:16 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n\n - Fix LLC mis-scheduling bugs (Tim Chen, Lu Wang)\n\n - Fix cache-grouping related scheduling statistics UAF bugs (Tim Chen)\n\n - Skip kernel threads for cache aware scheduling to rubustify the code\n (Chen Yu)\n\n - Refresh LLC capacity across CPU hotplug, to fix capacity\n underestimation bug (Davi Chaves Azevedo)\n\n - Account PSI IRQ time to the execution context, not the scheduling\n context, to fix proxy scheduling accounting bug (Zhan Xusheng)\n\n* tag \u0027sched-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/core: Account PSI IRQ time to the execution context, not the scheduling context\n sched/cache: Refresh LLC capacity across CPU hotplug, to fix capacity underestimation bug\n sched/cache: Skip kernel threads for cache aware scheduling to rubustify the code\n sched/cache: Introduce task_struct-\u003esched_cache_grp to fix UAF\n sched/cache: Decouple sched_cache_group from mm to fix UAF\n sched/cache: Honor migrate_llc_task semantics in active load balance, to fix LLC mis-scheduling bug\n sched/cache: Keep nr_pref_llc_running in the runnable domain, to fix LLC mis-scheduling bug\n" }, { "commit": "5ccda18d1ba2ecf436102a211baf1fbd5d81703f", "tree": "adc457d112f1f87ef0fe8c97f9ad7ccf54c3de0d", "parents": [ "fd179f8a05be3ccae366b9b96e176b51fbe54aab", "24b620729e53d978b3e425f55bc66efd3bab1f59" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:15:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Sep 27 08:15:58 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fixes for KVM guest PEBS virtualization (Sean Christopherson)\n\n - Fixes for various Intel PMUs related to PEBS data-source (Dapeng Mi)\n\n - Fix Intel Panther Cove event scheduling constraints (Dapeng Mi)\n\n - Fix Intel DMR/NVL OMR extra registers event scheduling (Dapeng Mi)\n\n - Rename two confusingly named PMU attributes (Dapeng Mi)\n\n - Fix a refcount leak in attach_perf_ctx_data() (Namhyung Kim)\n\n - Fix NULL pointer dereference crash in __perf_pmu_sched_task()\n (Puranjay Mohan)\n\n - Fix CPU-wide event scheduling (Puranjay Mohan)\n\n - Fix x86 LBR branch entry generation (Puranjay Mohan)\n\n* tag \u0027perf-urgent-2026-09-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fill branch entries with a single assignment\n perf/core: Run sched_task() for PMUs with only CPU-wide events\n perf/core: Fix NULL pmu_ctx passed to pmu-\u003esched_task()\n perf/core: Fix a refcount leak in attach_perf_ctx_data()\n perf/x86/intel: Rename NVL offcore_rsp attribute to offmodule_rsp\n perf/x86/intel: Rename DMR offcore_rsp attribute to offmodule_rsp\n perf/x86/intel: Fix precise OMR event scheduling for DMR/NVL\n perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to PMCs 0-3\n perf/x86/intel: Delete dead NVL PEBS data-source initcall\n perf/x86/intel: Fix Panther Cove PEBS data-source snoop states\n perf/x86/intel: Remove incorrect Panther Cove PEBS data-source constraints\n perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints\n perf/x86/intel: Update arw_latency_data() mem-op direction handling\n perf/x86/intel: Fix DKT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Fix CMT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification\n perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()\n perf/x86/intel: Don\u0027t pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused\n perf/x86/intel: Don\u0027t write PEBS_ENABLED on host\u003c\u003d\u003eguest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED\n perf/x86/intel: Ensure KVM guest PEBS path doesn\u0027t set unwanted PERF_GLOBAL_CTRL bits\n" }, { "commit": "db6365ced4d5855e321f772b240c0e473bcfcdd5", "tree": "9fc275da334edaba7504c847b121b39664962660", "parents": [ "93e257938aa67a6c957217db94091d9d9e5d403f" ], "author": { "name": "Pavankumar Kondeti", "email": "pavan.kondeti@oss.qualcomm.com", "time": "Fri Sep 25 15:25:12 2026 +0530" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 22:18:50 2026 -1000" }, "message": "workqueue: Fix NULL current_pwq deref in flush dependency check\n\ncheck_flush_dependency() uses current_wq_worker() to determine whether\nthe caller is a workqueue worker and then dereferences worker-\u003ecurrent_pwq\nto test whether the current workqueue is WQ_MEM_RECLAIM.\n\ncurrent_wq_worker() only means that %current has PF_WQ_WORKER set. A\nkworker can reach check_flush_dependency() while it is not executing a\nwork item. One such path is worker_thread() acting as the pool manager,\nwhere create_worker() does GFP_KERNEL allocation and the allocation path\ninvokes the OOM notifier. In that state worker-\u003ecurrent_pwq is NULL\nbecause current_pwq is set only by process_one_work() and cleared again\nafter the work function returns.\n\n[ 416.760634][ T375] Call trace:\n[ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P)\n[ 416.760648][ T375] __flush_work+0x98/0x224\n[ 416.760657][ T375] flush_work+0x30/0x44\n[ 416.760665][ T375] ...\n[ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0\n[ 416.760719][ T375] out_of_memory+0xb4/0x458\n[ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8\n[ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c\n[ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4\n[ 416.760753][ T375] new_slab+0x12c/0x484\n[ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c\n[ 416.760765][ T375] __slab_alloc+0x74/0xd8\n[ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304\n[ 416.760779][ T375] alloc_worker+0x28/0x60\n[ 416.760785][ T375] create_worker+0x4c/0x20c\n[ 416.760790][ T375] worker_thread+0xe8/0x2b8\n[ 416.760796][ T375] kthread+0x1a8/0x200\n[ 416.760805][ T375] ret_from_fork+0x10/0x20\n\nGuard the WQ_MEM_RECLAIM-worker warning with worker-\u003ecurrent_pwq. If the\nkworker is not currently executing a work item, there is no current\nworkqueue to diagnose with that warning. The PF_MEMALLOC warning is left\nunchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target\nis still reported.\n\nFixes: fca839c00a12 (\"workqueue: warn if memory reclaim tries to flush !WQ_MEM_RECLAIM workqueue\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Pavankumar Kondeti \u003cpavan.kondeti@oss.qualcomm.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "94480606a677deb68d5622cf0ded88626514b3f2", "tree": "aea4107658e2745f85fe4af1e3d396183feeea5d", "parents": [ "4409a85735cdca5c4c400c0dad1feee091872eee" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 09:23:02 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 10:09:12 2026 -1000" }, "message": "sched_ext: Add a size argument to scx_bpf_cid_topo() so struct scx_cid_topo can grow\n\nscx_bpf_cid_topo() copies struct scx_cid_topo into a buffer the BPF program\nsized from its own vmlinux.h while the verifier sizes the write from the\nrunning kernel\u0027s BTF. The struct may grow and each growth then breaks every\nscheduler built against the older layout, rejected at load or written past\nits buffer. This is the usual hole for a struct handed to BPF, closed\nelsewhere with a size argument, and it was missed here.\n\nTake the buffer size, copy the smaller of it and the kernel\u0027s struct and set\nthe rest to -1. Accesses to the copy are CO-RE relocated, so the struct can\ngrow by appending fields, which its comment now states. The kfunc changes in\nplace: the cid interface is still being finalized and no released scheduler\nuses the current form.\n\nFixes: e9b55af47edf (\"sched_ext: Add topological CPU IDs (cids)\")\nCc: stable@vger.kernel.org # v7.2+\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\n" }, { "commit": "fd179f8a05be3ccae366b9b96e176b51fbe54aab", "tree": "6fd0a86c6653717c718ee2a67d43f45c5e25ac53", "parents": [ "fddfc3ec31799a932bb92f1b8a84cb3d1f963be9", "113dcdfadf30ea11fbbdfcd4f6ea87687655cc5b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 11:14:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 11:14:35 2026 -0700" }, "message": "Merge tag \u0027ata-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - Extend the quirk \"no LPM on ATI\" quirk, that is currently only\n applied for Samsung drives, to include AMD controllers as well.\n\n The AMD AHCI controllers are newer versions of the ATI AHCI\n controllers, and these controllers still have LPM issues with\n Samsung drives - LPM works with drives from other vendors (me)\n\n - Fix errors in the libata.force parameter documentation (me)\n\n - Verify the sense data descriptor lengths for ATA PASS-THROUGH\n command, so that a malicious device cannot write past the buffer\n length (Matthias)\n\n - Mention the libata for-next branch in MAINTAINERS such that the\n git ls-remote command done by get_maintainer.pl --self-test\u003dscm\n can verify it (Matthias)\n\n* tag \u0027ata-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n MAINTAINERS: name the libata/linux for-next branch\n ata: libata-scsi: bound the ATA passthru sense descriptor writes\n ata: libata: Correct libata.force parameter documentation\n ata: libata-core: Extend Samsung LPM quirk to AMD controllers\n" }, { "commit": "31c88350b7dd1522792f726f79607f31bb55c50f", "tree": "178864e68d77a689ee0e94de38d977bedf6ea93e", "parents": [ "1765a153d985c231357145e26798f9408db10e42" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Thu Sep 24 04:27:27 2026 +0000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Sat Sep 26 08:07:26 2026 -1000" }, "message": "cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees\nparent-\u003epartition_root_state \u003d\u003d PRS_MEMBER and calls\nremote_partition_enable().\n\nCommit 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency\nin exclusive CPUs\") replaced the cpumask_intersects(tmp-\u003enew_cpus,\nsubpartitions_cpus) error check in remote_partition_enable() with\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning\nand proceeds to enable the remote partition on CPUs that are already\nowned by the ancestor local partition in subpartitions_cpus.\n\nThis can be reproduced on Linux 7.3.0-rc3 with:\n\n mkdir -p /tmp/cg1\n mount -t cgroup2 none /tmp/cg1\n echo \"+cpuset\" \u003e /tmp/cg1/cgroup.subtree_control\n\n mkdir /tmp/cg1/A\n echo 1 \u003e /tmp/cg1/A/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/cpuset.cpus.exclusive\n echo root \u003e /tmp/cg1/A/cpuset.cpus.partition\n echo \"+cpuset\" \u003e /tmp/cg1/A/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B\n echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/B/cpuset.cpus.exclusive\n echo \"+cpuset\" \u003e /tmp/cg1/A/B/cgroup.subtree_control\n\n mkdir /tmp/cg1/A/B/D\n echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus\n echo 1 \u003e /tmp/cg1/A/B/D/cpuset.cpus.exclusive\n echo root \u003e /tmp/cg1/A/B/D/cpuset.cpus.partition\n\nwhich triggers:\n\n WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300\n\nand leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions\nclaiming exclusive CPU 1.\n\nFix this by returning PERR_NOCPUS when tmp-\u003enew_cpus intersects\nsubpartitions_cpus in remote_partition_enable(), matching the error code\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and\nadd a regression test case to\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nTested in QEMU on Linux 7.3.0-rc3 using the reproducer above and\ntools/testing/selftests/cgroup/test_cpuset_prs.sh.\n\nFixes: 86888c7bd117 (\"cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs\")\nSuggested-by: Guopeng Zhang \u003cguopeng.zhang@linux.dev\u003e\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nReviewed-by: Waiman Long \u003clongman@redhat.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "fddfc3ec31799a932bb92f1b8a84cb3d1f963be9", "tree": "e58931420843a71d64cd014fdc7c9b4d34ba16ca", "parents": [ "efb27d47677397961c9017c0f8f469eb25a15d68", "4fde448225123442c5796f54b7a4400e2d3cbaf6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 09:59:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 09:59:59 2026 -0700" }, "message": "Merge tag \u0027pci-v7.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Make BAR resize work even for devices where no upstream bridge is\n visible to the OS, which fixes an amdgpu regression on SolidRun\n HoneyComb, which doesn\u0027t expose Root Ports to the OS (Liz Fong-Jones)\n\n - Omit bus properties in dynamic OF nodes when a bridge has no\n subordinate bus, which fixes early boot hangs caused by NULL pointer\n dereferences with CONFIG_PCI_DYNAMIC_OF_NODES enabled (Angel J)\n\n - Disable enhanced atomics on AMD NBIO 7.7 and 7.11 to avoid silent\n data corruption on 64-bit DMAs (Mario Limonciello)\n\n* tag \u0027pci-v7.3-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11\n PCI: of_property: Omit bus properties without a subordinate bus\n PCI: Fix BAR resize for devices on a root bus\n" }, { "commit": "efb27d47677397961c9017c0f8f469eb25a15d68", "tree": "b12031100ff54150265aca97defb079968d1a6d9", "parents": [ "eff8d2791c086388ba5bae36385afd9bc6f0507e", "5bfa9f1a9dcb6ecb607adbc1c0226605c972935b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:36:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:36:29 2026 -0700" }, "message": "Merge tag \u0027probes-fixes-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull probe fixes from Masami Hiramatsu:\n\n - kprobes: Fix permanent hang when flushing the kprobe optimizer\n\n Fix a deadlock when disabling kprobe optimization via sysctl or\n debugfs where flushers hung waiting for optimizer_completion.\n Replaced the completion with an optimizer_passes counter and\n wait_var_event_mutex() under kprobe_mutex so concurrent flushers can\n wait and wake up safely.\n\n - fprobe: Terminate the fgraph_data list when the reservation is not\n filled\n\n Fix an issue where unused shadow stack data left uninitialized by\n fprobe_fgraph_entry() was misparsed as stale fprobe headers on\n return. Explicitly write a zero word to terminate the list and update\n read_fprobe_header() to handle the zeroed slot properly.\n\n - ftracetest: Fix unique symbol check in kprobe_non_uniq_symbol.tc\n\n Fix false test failures in kprobe_non_uniq_symbol.tc on architectures\n like s390 where a symbol exists once in core kernel but also in\n modules. Anchor the /proc/kallsyms search regex to the end of the\n line so that module symbols are not incorrectly counted.\n\n* tag \u0027probes-fixes-v7.3-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n kprobes: Fix permanent hang when flushing the kprobe optimizer\n fprobe: Terminate the fgraph_data list when the reservation is not filled\n selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc\n" }, { "commit": "eff8d2791c086388ba5bae36385afd9bc6f0507e", "tree": "98f599bf0edf5f3ab510c7d2cc8cf11a969fcdc4", "parents": [ "6812ce4e4379ffc99c52401ec28f0d7ffbc36206", "c2f24f140c2ee6c00775c2a93c6ac931acec2b60" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:26:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 26 08:26:12 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Arm:\n\n - Invalidate the ITS translation cache when the guest changes the\n base address of the ITS tables (Fuad Tabba)\n\n - Skip saving ITS devices with device IDs that are out-of-bounds\n rather than failing the entire ITS save ioctl (Fuad Tabba)\n\n - Close race between VM teardown and invalidations of nested MMUs\n when handling MMU operations that are allowed to block (Lorenzo\n Stoakes)\n\n - Various fixes for the handling of the host\u0027s untrusted SVE\n configuration in pKVM (Fuad Tabba)\n\n - Make sure that empty SMCCC ranges based at 0 are rejected by the\n kvm_smccc_set_filter() (Karl Mehltretter)\n\n - Revoke the host mapping for pKVM\u0027s private stack pages, along with\n a new sanity check that all mappings in the hyp\u0027s private VA range\n have been correctly marked as hyp-owned (Fuad Tabba)\n\n - Lifetime fixes for the array of shadow stage-2 MMUs, ensuring that\n concurrent vCPU initialization cannot relocate in-use MMUs. Defer\n the freeing of shadow stage-2 MMUs to the point that no other users\n (e.g. MMU notifier) could reference them (Marc Zyngier)\n\n - Drop useless WARN when rejecting an unsupported ioctl for pKVM\n (Fuad Tabba)\n\n - Fix the steal_time selftest to install correctly-sized mappings for\n non-4K hosts (Sebastian Ott)\n\n - Correct mapping of fine-grained trap for GCSPOPX instruction (Mark\n Brown)\n\n - Fix KVM_BUG_ON() due to missing handling of DBGBXVR\u003cn\u003e from 32-bit\n guests (Karl Mehltretter)\n\n RISC-V:\n\n - Synchronize hrtimer during VCPU teardown\n\n - Fix the conversion between vsip and hvip values\n\n - Serialize IMSIC attributes with vCPU migration\n\n - Release unused page after MMU invalidation\n\n - Propagate interrupted G-stage faults to KVM user-space as EINTR\n\n - Fix nested acceleration hfence entry update order\n\n - Fix sdata leak and stale snapshot_addr in snapshot_set_shmem\n\n - Preserve firmware counter value across PMU counter stop/start\n\n - Report PMU snapshot write failure to the guest\n\n - Fix perf-backed counter accounting across PMU stop and read\n\n - Correctly propagate error of a hart status SBI call\n\n s390:\n\n - Ensure that accesses through kvm_arch_set_irq_inatomic mark as\n dirty the pages that contain indicator and summary bits\n\n - Fix compile warning for kvm_s390_update_cmma_dirty()\n\n - Fix incorrect propagation of ENOENT from _gaccess_shadow_fault() to\n userspace\n\n - Move s390_kvm_mmu_commit_memory_region() into\n s390_kvm_mmu_prepare_memory_region() so that it can fail instead of\n WARN\n\n - Add missing srcu in kvm_s390_set_irq_state()\n\n - Fix potential races in storage functions\n\n - Fix race in _destroy_pages_crste()\n\n - Fix issues in the handling of KVM interrupt and page resources,\n when a queue that is assigned to a mediated device (mdev) is\n removed from the host\u0027s AP configuration\n\n - Fix loop condition in uv_find_secrets\n\n - Prevent potential out-of-bounds read\n\n x86:\n\n - Fix a brown paper bag bug where KVM would incorrectly treat Intel\n PMU MSRs as valid on AMD\n\n - Fix a regression in the hardware disable selftest where it checked\n the wrong macro when detecting glibc support (breaks at least musl)\n\n - Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is\n especially important for KVM_BUG_ON() flows, which often guard more\n dangerous bugs\n\n - Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a\n bug where KVM would let userspace run a broken setup with stale\n vmcs12 pages\n\n - Fix a class of bugs where KVM would fail to fill kvm_run exit\n fields if getting nested pages failed\n\n - Treat reserved entries in the memory attributes xarray as \"no\n attributes\", to fix false positives when checking for mixed\n attributes\n\n - Fix memcg accounting for the memory attributes xarray (the xarray\n library subtly requires the xarray to be configured for accounting\n upfront; the gfp flags taken at runtime are used only rarely)\n\n - Don\u0027t pre-reserve xarray entries when storing empty attributes, as\n storing NULL must not require memory allocation (KVM and other\n subsystems heavily rely on this behavior)\n\n - Fix a memory leak and a cache maintenance issue related to doing\n intra-host migration on an SEV guest\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (54 commits)\n KVM: SEV: Do cache maintenance on the source VM during intra-host migration\n KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n KVM: Don\u0027t pre-reserve xarray entries when storing empty/NULL attributes\n KVM: Ensure memory attributes xarray nodes are accounted to the caller\u0027s memcg\n KVM: Don\u0027t treat reserved xarray entries as having memory attributes\n KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths\n KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n KVM: arm64: Fix AArch32 DBGBXVR\u003cn\u003e handling\n KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP\n KVM: selftests: fix steal_time for arm64 with host page size \u003e 4K\n KVM: arm64: Don\u0027t WARN on an unknown VM ioctl in protected mode\n KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n KVM: arm64: nv: Fix life cycle of the nested_mmus array\n KVM: arm64: Check every private mapping is hyp-owned at pKVM init\n KVM: arm64: Move the private VA allocation cursor to __io_map_next\n KVM: arm64: Match hyp text by physical address in fix_host_ownership()\n KVM: arm64: Transfer the hyp stack pages out of the host stage-2\n KVM: arm64: selftests: Test empty SMCCC filter range at base 0\n KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0\n KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2\n ...\n" }, { "commit": "c2f24f140c2ee6c00775c2a93c6ac931acec2b60", "tree": "fd13802556683cc72528d35173ccbc4429742f73", "parents": [ "93de2a6a4b91b72607136dd656edf03fb399d27f", "119e9db233ad0f4cbd4cfb9f9385a7bca378b37d" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:40:07 2026 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:40:07 2026 -0400" }, "message": "Merge tag \u0027kvm-x86-fixes-7.3-rc5\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM fixes for 7.3-rcN\n\n - Fix a brown paper bag bug where KVM would incorrectly treat Intel PMU MSRs\n as valid on AMD.\n\n - Fix a regression in the hardware disable selftest where it checked the wrong\n macro when detecting glibc support (breaks at least musl).\n\n - Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is especially\n important for KVM_BUG_ON() flows, which often guard more dangerous bugs.\n\n - Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a bug\n where KVM would let userspace run a broken setup with stale vmcs12 pages.\n\n - Fix a class of bugs where KVM would fail to fill kvm_run exit fields if\n getting nested pages failed.\n\n - Treat reserved entries in the memory attributes xarray as \"no attributes\",\n to fix false positives when checking for mixed attributes.\n\n - Fix memcg accounting for the memory attributes xarray (the xarray library\n subtly requires the xarray to be configured for accounting upfront; the gfp\n flags taken at runtime are used only rarely).\n\n - Don\u0027t pre-reserve xarray entries when storing empty attributes, as storing\n NULL must not require memory allocation (KVM and other subsystems heavily\n rely on this behavior).\n" }, { "commit": "93de2a6a4b91b72607136dd656edf03fb399d27f", "tree": "9220c76eb23cb39a146fac9692ee69afa4aa3135", "parents": [ "12c1f6e03f944e399bd2c88441dca5dc702b95a5" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Wed Sep 23 09:37:21 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:39:55 2026 -0400" }, "message": "KVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed. Because the source VM is \"converted\" to a non-SEV VM, KVM\u0027s\nmemory reclaim flows won\u0027t trigger cache maintenance, e.g. when all guest\nmemory is reclaimed in response to detaching from the mmu_notifier.\n\nNote, relying on the destination VM to do cache maintenance isn\u0027t an option\nas KVM doesn\u0027t require identical guest memory configurations, i.e. the\nsource VM may have access to memory that the destination VM does not.\nEnforcing equivalent memory configurations is infeasible, as it would\nrequire a *deep* comparison of memslots, e.g. to verify that not only are\nthe memslot identical, but what the memslots point at is also identical.\n\nFixes: b56639318bb2 (\"KVM: SEV: Add support for SEV intra host migration\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Teodorescu \u003cfane@google.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260923163721.1584779-3-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "12c1f6e03f944e399bd2c88441dca5dc702b95a5", "tree": "0e0a8ad1e1198d422be6c98a2d8aacdc0e261cfe", "parents": [ "072b2abae978b57291d1db31a7f75e8db5f9ff85" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Wed Sep 23 09:37:20 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat Sep 26 00:39:55 2026 -0400" }, "message": "KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n\nUnconditionally free SEV\u0027s \"have run CPUs\" cpumask in the VM destroy path,\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV\nVM if its state is intra-host migrated. Alternatively, the mask could be\nfreed in sev_migrate_from() when \"converting\" the source VM, but that gets\nannoying because ideally KVM would nullify the mask to guard against UAF,\nand nullifying the mask would need be conditioned on CPUMASK_OFFSTACK\u003dy.\n\nFreeing the mask during sev_migrate_from() is also not robust against other\nKVM bugs, though that\u0027s kind of a moot point since any such bugs would show\nup even if sev-\u003eactive is never set. I.e. KVM must get that side of things\ncorrect. But, that\u0027s not a great reason to add more code just to make\nthings marginally less robust.\n\nFixes: 6f38f8c57464 (\"KVM: SVM: Flush cache only on CPUs running SEV guest\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Teodorescu \u003cfane@google.com\u003e\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260923163721.1584779-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "6812ce4e4379ffc99c52401ec28f0d7ffbc36206", "tree": "f4c39d343f774530caa4466f2386205e9a31557a", "parents": [ "75467f60a3d14f08f86f2b353298d2826382ff23", "a9ed3aa9b87ee41e8ab3ff471b1331c154767e45" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 16:00:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 16:00:18 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-09-26\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"While most of this is AI inspired fixes for error handling paths,\n leaks and use after frees, there are some normal things.\n\n nouveau has probably the biggest changes with some fixes to stabilise\n runtime suspend/resume on 570 firmware which regressed after we moved\n from 535, there are some fixes to stackframe issues seen with amdgpu,\n and otherwise the usual bunch of i915/xe/amdgpu fixes, and some\n virtio-gpu fixes.\n\n Hopefully it will start to quiten down a bit from here.\n\n client:\n - fix restore of partially initialized client\n\n i915:\n - Fix incorrect RCU teardown order leading to endless loop\n - Fix DP MST TU and FEC handling for disconnected streams\n - Fix selective fetch disable, again\n - Fix export namespace for kunit helpers\n - Workaround eDP flicker on a specific laptop model\n\n xe:\n - CRI throttle reasons report\n - TLB invalidation at wedge\n - SVM eviction and VM close\n - Display corruption on LNL on Xen PV\n - W/a fix and addition\n\n amdgpu:\n - Display ref count fix\n - Userq fixes\n - VCN 4, 5 reset fixes\n - Fixes for various error paths\n - Stack frame size fixes for various combinations of compilers and\n configs\n\n amdkfd:\n - Possible UAF fix\n\n nouveau:\n - runtime suspend/resume fixes for newer firmware\n - rcu free the scheduler\n - fix VRAM pinning\n - fix double free\n - fix reference leaks\n - fix runtime PM leak\n - fix cursor list usage problems\n - fix HDMI config rejection without SCDC\n\n virtio:\n - fix a bunch of object/memory leaks in failure paths\n - add pixel blend mode property to cursor plane\n - revert prime buffers import\n - sync shmem backing on guest transfers\n\n imagination:\n - propogate map failures properly\n - fix page count in map interface\n - clamp freelist reconstruction requests\n\n ivpu:\n - use separate flag for job timeout\n\n bridge:\n - samsung-dsim: fix TE GPIO lifetime for host attach\"\n\n* tag \u0027drm-fixes-2026-09-26\u0027 of https://gitlab.freedesktop.org/drm/kernel: (60 commits)\n drm/amd/display: Bump frame warning limit for all builds of dml\n drm/imagination: clamp freelist reconstruction requests\n drm/imagination: Fix page count for page table for map() interface\n drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()\n drm/amd/display: Bump frame warning limit for clang builds of dml\n drm/amd/display: Relax DML frame limit with UBSAN\n drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()\n drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()\n drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()\n drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()\n drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait\n drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait\n drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout\n drm/amdgpu: move userq fence wait out of signalling section\n drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()\n drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms\n drm/xe: harden adjust_idledly() against divide-by-zero and overflow\n drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV\n drm/i915: fix incorrect RCU teardown order\n ...\n" }, { "commit": "75467f60a3d14f08f86f2b353298d2826382ff23", "tree": "acd8a7d5b5a675042449386efa5b42ec44d8bf81", "parents": [ "049380360ca6f4cc22ac2f67fe95b98967c887f0", "2776e9c28513a1c855a94792b292cbcc533418c8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 15:55:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 15:55:03 2026 -0700" }, "message": "Merge tag \u0027ipe-pr-20260925\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe\n\nPull IPE fixes from Fan Wu:\n \"Two fixes for use-after-free issues found by recent LLM-assisted code\n analysis.\n\n - move successful policy load auditing under the new policy\n directory\u0027s inode lock, preventing a concurrent policy deletion\n from freeing the policy while it is still being audited\n\n - protect the dm-verity root hash with RCU, preventing policy\n evaluation from racing with root hash replacement during preresume\"\n\n* tag \u0027ipe-pr-20260925\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:\n ipe: protect the dm-verity root hash with RCU\n ipe: fix use-after-free when auditing a newly loaded policy\n" }, { "commit": "a9ed3aa9b87ee41e8ab3ff471b1331c154767e45", "tree": "cc62d74e0eb4905246978674461e78e2f9df2afd", "parents": [ "0f50dab8b4265e42e8719c2998c908a9d79a589e", "45585c3aa285854face65293acc95eff73063d6d" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Sep 26 07:57:59 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat Sep 26 07:58:24 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA number of fixes:\n - bridge:\n - samsung-dsim: fix GPIO lifetime\n - client: Null pointer dereference fix\n - imagination: error handling fix, page handling fix\n - nouveau: fix reference leaks, double-frees, out-of-bounds accesses,\n use-after-frees, don\u0027t reject config without SCDC, a number of\n workarounds\n - virtio: fix memory leak, reference leaks, null pointer dereference,\n add pixel blend mode, cache coherency fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cself@mripard.dev\u003e\nLink: https://patch.msgid.link/arU22zzqUGDEco1y@houat\n" }, { "commit": "049380360ca6f4cc22ac2f67fe95b98967c887f0", "tree": "1868b58c95de695689a2298c228d11264b0fef37", "parents": [ "f14572c203d57492e1d4e5d7851a3b143e083b82", "42d1221d321e55afc7bba9109a77aaf5a817c8a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 14:41:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 14:41:52 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Mostly small driver fixes. The biggest fix is the one to the block\n zone handling which might trip for real or virtual hardware if the\n number of zones is \u003e 2^32\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()\n scsi: sd_zbc: Reject disks with too many zones\n scsi: block: Fix zones_cond out-of-bounds write on zone report\n scsi: leapraid: Avoid -Wformat-security warning\n scsi: devinfo: Add BLIST_SKIP_IO_HINTS for EMC Symmetrix\n scsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n scsi: ufs: pltfrm: Add quirk for R-Car S4 lacking lanes-per-direction\n scsi: ufs: core: Keep internal commands dispatchable during error handling\n" }, { "commit": "2776e9c28513a1c855a94792b292cbcc533418c8", "tree": "4e397474f21da51145f5e2cf2ce7d62366348fe2", "parents": [ "9814077275eca36ebf8d510d2f076d235ff9f51a" ], "author": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Tue Sep 22 20:13:49 2026 -0700" }, "committer": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Fri Sep 25 13:30:27 2026 -0700" }, "message": "ipe: protect the dm-verity root hash with RCU\n\nipe_bdev_setintegrity() frees the old root hash when dm-verity publishes\na new one on -\u003epreresume, while policy evaluation can still be\ndereferencing it.\n\nProtect the root hash with RCU. The evaluation path already runs under\nrcu_read_lock().\n\nFixes: e155858dd995 (\"ipe: add support for dm-verity as a trust provider\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\n[FW: remove model name according to latest guideline]\nSigned-off-by: Fan Wu \u003cwufan@kernel.org\u003e\n\n" }, { "commit": "9814077275eca36ebf8d510d2f076d235ff9f51a", "tree": "326132c295ffab42b268b487bd3bee604f964ed1", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Tue Sep 22 20:13:48 2026 -0700" }, "committer": { "name": "Fan Wu", "email": "wufan@kernel.org", "time": "Fri Sep 25 13:30:27 2026 -0700" }, "message": "ipe: fix use-after-free when auditing a newly loaded policy\n\nnew_policy() audits the policy after ipe_new_policyfs_node() publishes it\nand drops the new directory\u0027s inode lock. A concurrent delete can free\nthe policy while ipe_audit_policy_load() is still using it.\n\nAudit the successful load under that lock.\n\nFixes: f44554b5067b (\"audit,ipe: add IPE auditing support\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\n[FW: remove model name according to latest guideline]\nSigned-off-by: Fan Wu \u003cwufan@kernel.org\u003e\n\n" }, { "commit": "f14572c203d57492e1d4e5d7851a3b143e083b82", "tree": "3e509947147565629021a557b21e272d585bbb45", "parents": [ "aa98230e410f0ed212b6788c46b1e4d49e0ff7ca", "e66cf1625ec4a3fe68346119f371def713fd0a4d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 13:30:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 13:30:04 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc5\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - Fix leaked server handles and dropped errors in the SMB2 compound\n create path: a parsing error reported as success, an earlier CREATE\n left open when a later command fails, the cached directory open\n losing the FID needed for cleanup, and SMB2_open() not closing the\n handle after a create-context parse failure\n\n - Fix out-of-bounds reads when parsing create contexts from a\n malicious server: bound each context by its Next field, parse the\n lease and QFid contexts from their declared offsets and validate\n the POSIX create context length\n\n - Fix a double credit decrement, and its warning, when a compound\n send fails and triggers a reconnect; found by syzbot\n\n - Fix a dentry and server handle leak in cifs_atomic_open() when an\n O_CREAT open resolves to a symlink or other non-regular inode\n\n - Use GFP_KERNEL in the DFS get_targets() path\n\n - Minor update to the POSIX extension specification references\n\n* tag \u0027cifs-fixes-7.3-rc5\u0027 of https://git.manguebit.org/linux:\n smb: client: use finish_no_open() for non-regular inodes\n smb: client: use GFP_KERNEL in get_targets()\n smb: client: update POSIX extension specification references\n smb: client: preserve create-context parsing errors\n smb: client: close completed creates on compound wait errors\n smb: client: clean up failed cached directory opens\n smb: client: close handle after create-context parsing failure\n smb: client: validate POSIX create context length\n smb: client: fix create context out-of-bounds reads\n smb: client: delete compound mids on send failure before unlock\n" }, { "commit": "aa98230e410f0ed212b6788c46b1e4d49e0ff7ca", "tree": "6db874088ac0592753eb0abd503cc45d51c72bd5", "parents": [ "a2ff1b626e1c9e65c9d384cfb3da3d292025cb4b", "b78b728e21c32ec4c330b299f657fb1eb02dffc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:12:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:12:06 2026 -0700" }, "message": "Merge tag \u0027vfs-7.3-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Revert \"put_mnt_ns(): leave mounts connected\". This allows the\n creation of reference count cycles in a very trivial way. We can\u0027t\n bring this in until we have fixed the underlying cause\n\n - vfs: Don\u0027t create the private nullfs instance for kthreads under\n namespace_sem to avoid false lockdeps complaints\n\n - binfmt_misc:\n - Copy the name into a stack buffer and look up the copy in\n bpf_binprm_select_interp()\n - bpf_binprm_set_interp() and bpf_binprm_set_interp_arg(): Check\n the private copy instead so the string that gets staged is the\n kstring that was checked\n\n - netfs:\n - Make netfs_read_gaps() use separate sink folios rather than one\n reused sink folio to discard unwanted data so that cifs checksum\n checking sees all the data that was fetched\n - Trim reads down to i_size so afs symlinks read correctly from the\n cache\n - Wrap the direct mempool -\u003ealloc() calls the GFP_KERNEL paths make\n in alloc_hooks() via a new mempool_alloc_noreserve() helper\n\n - iov_iter: Use iov_iter_alignment() for the start and length check\n added to iov_iter_extract_bvecs() this cycle. It used iter_iov_addr()\n and iter_iov_len() which are only valid for ITER_UBUF and ITER_IOVEC\n iterators\n\n - super: Make iterate_supers_type() deletion-safe\n\n - inode: Stop evict_inodes() from rescanning the same inodes\n\n - writeback: Bound the cleanup_offline_cgwb() rescans\n\n - ntfs3: Use d_instantiate_new() in ntfs_create_inode()\n\n - ovl: Fix a use-after-free in the ovl_do_mkdir() debug print\n\n - dcache: Unpoison the inline name buffer in __d_alloc() for KMSAN\n\n - autofs: Fix a pipe file reference leak in autofs_kill_sb()\n\n - bpf: Drop the path_unlink and path_rmdir hooks from the list of hooks\n for which the verifier rewrites bpf_{set,remove}_dentry_xattr() to\n the _locked variants\n\n - squashfs: Range check the xz dictionary size before shifting by it\n\n - selftests: Add the missing eventfd, open_tree_ns, openat2 and xattr\n filesystems selftests to TARGETS and drop the stale openat2 entry\n left behind when those tests moved\n\n* tag \u0027vfs-7.3-rc5.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:\n netfs: Fix missing alloc tagging of direct mempool allocations\n bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n autofs: fix sbi-\u003epipe file reference leak in autofs_kill_sb()\n dcache: unpoison the inline name buffer in __d_alloc()\n ovl: fix UAF in ovl_do_mkdir() debug print\n super: make iterate_supers_type() deletion-safe\n Revert \"put_mnt_ns(): leave mounts connected\"\n Revert \"selftests/filesystems: add mntns cleanup test\"\n binfmt_misc: fix racy checks in bpf set_interp kfuncs\n binfmt_misc: fix OOB read in bpf_binprm_select_interp()\n fs: don\u0027t create the private nullfs mount under namespace_sem\n writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes\n fs: avoid repeated scans in evict_inodes()\n netfs, afs: Fix symlink reading\n netfs: Fix netfs_read_gaps() to use separate sink folios\n squashfs: Add dictionary size range check to prevent shift-out-of-bounds\n fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot\u0027s \"WARNING in do_new_mount\" saga\n selftests/filesystems: fix missing and stale TARGETS entries\n block: Fix start and length check added to iov_iter_extract_bvecs()\n" }, { "commit": "a2ff1b626e1c9e65c9d384cfb3da3d292025cb4b", "tree": "5db771ff43585e1235c681286fdca86735a4bcb8", "parents": [ "b9dbb658e2101ea37ad6953eb4e2ea234dd9681a", "883b776abe48fed8ef615f4ff7e91113a6c4dffb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:07:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 11:07:44 2026 -0700" }, "message": "Merge tag \u0027fs_for_v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull isofs fix from Jan Kara:\n \"A fix for reading tightly packed isofs directories\"\n\n* tag \u0027fs_for_v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n isofs: Fix handling of directories with tight blocks\n" }, { "commit": "b9dbb658e2101ea37ad6953eb4e2ea234dd9681a", "tree": "3029c670e9327d576c95f86f8490e4bc4ad44809", "parents": [ "4ba51ef66a7773c2ce4a5356e2f97f5c291463ca", "ec0d89150a9381d591344a9f6f5428655c227a7f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 10:11:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 10:11:15 2026 -0700" }, "message": "Merge tag \u0027thermal-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull thermal control fix from Rafael Wysocki:\n \"Fix a step-wise thermal governor issue that causes thermal mitigation\n to contiune forever after the temperature has dropped below the trip\n point threshold in some cases (Manaf Meethalavalappu Pallikunhi)\"\n\n* tag \u0027thermal-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds\n" }, { "commit": "4ba51ef66a7773c2ce4a5356e2f97f5c291463ca", "tree": "1766ab31d3452701ba61576c2afd3c3eaa364dcd", "parents": [ "547463efb935dec67c476f90917a0ff4baf6d0b5", "41112a787f9182c7f2d27122817861e3f22ef928" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:47:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:47:05 2026 -0700" }, "message": "Merge tag \u0027pm-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fix from Rafael Wysocki:\n \"Address a hibernation regression introduced during the 7.2 development\n cycle that causes the image memory preallocation to deadlock if it\n depends on frozen kernel threads (Florian Schmaus)\"\n\n* tag \u0027pm-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n PM: hibernate: Freeze kernel threads after image preallocation\n" }, { "commit": "547463efb935dec67c476f90917a0ff4baf6d0b5", "tree": "1959fb847274893c3f1c432b0fd92874686fe27c", "parents": [ "80e466f0c8acc545159a1f1fcca62512bf848413", "5b76268dac968612f7283d59b539036de955b7d9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:39:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:39:33 2026 -0700" }, "message": "Merge tag \u0027s390-7.3-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Heiko Carstens:\n\n - Fix several bugs in PCI error recovery SCLP reporting: don\u0027t report\n success on skipped recovery, report errors when no pdev is\n associated, add missing device lock, and fix struct pci_dev reference\n leak in zpci_report_status()\n\n - Fix several bugs in CIO code: fix use of invalid SCHIB data, guard\n PMCW field accesses, check device number valid bit in PMWC before\n accessing other fields, and fix NULL pointer dereference in\n ccw_device_get_util_str()\n\n - Fix virtual vs physical address confusion in channel measurement\n facility code on kernels with CONFIG_RANDOMIZE_IDENTITY_BASE\u003dy\n\n - Fix couple of bugs in s390dbf: fix copy of failed static debug areas,\n skip view registration on failure, and reject NULL pointer in\n debug_dump()\n\n - Fix sriov_numvfs attribute name in zPCI documentation\n\n - Fix typos in comments\n\n* tag \u0027s390-7.3-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()\n s390/debug: Fix NULL pointer dereference in debug_info_copy()\n s390/debug: Do not register views for failed static debug areas\n s390/debug: Reject NULL debug info in debug_dump()\n s390/cmf: Fix virtual vs physical address confusion\n s390/pci: Don\u0027t report recovery success on skipped recovery\n s390/pci: Report SCLP status on error events when no pdev is associated\n s390/pci: Fix missing device lock in zpci_report_status()\n s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()\n s390/cio: Guard PMCW field accesses with dnv check\n s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points\n s390/cio: Fix cio_update_schib() to not cache invalid schib\n s390/pci/docs: Fix sriov_numvfs attribute name\n s390: Fix typos in comments\n" }, { "commit": "80e466f0c8acc545159a1f1fcca62512bf848413", "tree": "cb868fc26f5814c2dcd33899024df6cf122202ba", "parents": [ "165768bb70265b5c38cf0b73fafd75be235f8b14", "270437f3fe62516f16482742a7762a075e7a9457" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:35:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Sep 25 09:35:07 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix a regression introduced by moving GPIO hog handling into GPIOLIB\n core where of_node_name was used if line name property was missing on\n DT systems\n\n - fix kernel stack leak to user-space in error path in GPIO character\n device code\n\n - fix runtime PM leaks in gpio-xilinx and gpio-arizona\n\n - fix several register programming bugs in gpio-tps65219\n\n - fix interrupt storm on resume in gpio-mvebu\n\n* tag \u0027gpio-fixes-for-v7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: tps65219: Fix TPS65214 GPIO direction programming\n gpio: tps65219: Use the variant-specific direction callback\n gpio: tps65219: Fix GPIO input value reads\n gpio: zynq: fix runtime PM leak on request error path\n gpio: cdev: fix kernel stack leak to user-space in error path\n gpiolib: use of_node_name if line-name is missing\n gpio: mvebu: keep resume masks within the irqchip cache\n gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()\n" }, { "commit": "b78b728e21c32ec4c330b299f657fb1eb02dffc2", "tree": "febfa1c4b03d0eb2681391b77fe45fe64b16a2f8", "parents": [ "35d442ed1f86465e49df3119fb898f985186db13" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Wed Sep 23 14:37:59 2026 +0800" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 17:30:39 2026 +0200" }, "message": "netfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else. Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool\u0027s reserve and,\nif that runs empty, wait for elements to be returned. The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool\u0027s -\u003ealloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current-\u003ealloc_tag having been set by the caller. With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG\u003dy this leads to\n\n current-\u003ealloc_tag not set\n WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n alloc_tag was not set\n WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount. The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct -\u003ealloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc(). The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now.\n\nFixes: 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by adding a mempool\")\nReported-by: Erhard Furtner \u003cerhard_f@mailbox.org\u003e\nCloses: https://lore.kernel.org/all/0b004319-9ef7-437c-a4dd-174d6a9a83db@mailbox.org/\nTested-by: Erhard Furtner \u003cerhard_f@mailbox.org\u003e\nSuggested-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nLink: https://patch.msgid.link/20260923063759.34667-1-hao.ge@linux.dev\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "35d442ed1f86465e49df3119fb898f985186db13", "tree": "eebdeea823b5556aeeae19161db765660b4b62cf", "parents": [ "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e" ], "author": { "name": "Andrea Parri", "email": "parri.andrea@gmail.com", "time": "Tue Sep 22 16:55:30 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 17:22:09 2026 +0200" }, "message": "bpf: fs/xattr: don\u0027t assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode\u0027s i_rwsem. The path_unlink and\npath_rmdir hooks are listed, but security_path_unlink() and\nsecurity_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the\nvictim inode\u0027s i_rwsem, so a sleepable BPF LSM program attached to\neither hook mutates the victim\u0027s xattrs without the lock held.\n\nDrop the two path hooks from d_inode_locked_hooks so that the verifier\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take\nthe lock themselves.\n\nFixes: 56467292794b8 (\"bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Andrea Parri \u003cparri.andrea@gmail.com\u003e\nLink: https://patch.msgid.link/20260922145530.369775-1-parri.andrea@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e", "tree": "ab2c0b01f220db3998196cc71307f58a8a16fae9", "parents": [ "76d8e697242e7e4e30dd08eff7c278728f9dd8e2" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Sat Sep 19 20:48:08 2026 +0000" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 16:51:46 2026 +0200" }, "message": "autofs: fix sbi-\u003epipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -\u003e autofs_catatonic_mode(sbi).\n\nBecause AUTOFS_SBI_CATATONIC is still set in sbi-\u003eflags,\nautofs_catatonic_mode() returns early without calling fput(sbi-\u003epipe),\npermanently leaking the pipe struct file reference.\n\nExplicitly release sbi-\u003epipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode().\n\nFixes: ebc921ca9b92 (\"autofs: copy autofs4 to autofs\")\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260919204808.2812930-1-benquike@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "5bfa9f1a9dcb6ecb607adbc1c0226605c972935b", "tree": "63fff8ed565f0f96a893d0074c3abe3b417d54fe", "parents": [ "1d653a183973f5283a3db5a38cd5e195eb152244" ], "author": { "name": "Andrea Parri", "email": "parri.andrea@gmail.com", "time": "Thu Sep 24 11:21:39 2026 +0200" }, "committer": { "name": "Masami Hiramatsu (Google)", "email": "mhiramat@kernel.org", "time": "Fri Sep 25 23:35:23 2026 +0900" }, "message": "kprobes: Fix permanent hang when flushing the kprobe optimizer\n\nWriting 0 to /proc/sys/debug/kprobes-optimization while a kprobe is\njump-optimized never returns. The writer sleeps in D state forever with\nkprobe_sysctl_mutex held, so any later read or write of that sysctl\nhangs as well. For example, with vfs_read+9 as an optimizable address\nin this build:\n\n # cd /sys/kernel/tracing\n # echo \u0027p:myprobe vfs_read+9\u0027 \u003e\u003e kprobe_events\n # echo 1 \u003e events/kprobes/myprobe/enable\n # # wait until /sys/kernel/debug/kprobes/list shows [OPTIMIZED]\n # echo 0 \u003e /proc/sys/debug/kprobes-optimization\n\n INFO: task sh:246 blocked for more than 10 seconds.\n Call Trace:\n \u003cTASK\u003e\n __schedule+0x1176/0x4f70\n schedule+0xdc/0x2c0\n schedule_timeout+0x17b/0x260\n wait_for_completion+0x173/0x3c0\n wait_for_kprobe_optimizer_locked+0xbc/0x130\n proc_kprobes_optimization_handler+0x156/0x1b0\n proc_sys_call_handler+0x324/0x490\n vfs_write+0x52d/0xfe0\n ksys_write+0xff/0x200\n do_syscall_64+0x106/0x630\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n ...\n INFO: task cat:265 is blocked on a mutex likely owned by task sh:246.\n\nwait_for_kprobe_optimizer_locked() reinitializes optimizer_completion,\nasks the optimizer thread to flush and sleeps in wait_for_completion().\nThe thread drains the (un)optimizing lists, but calls complete() only\nif completion_done() is true, i.e. if the completion is already done,\nwhich never happens while someone waits. disarm_all_kprobes() and\nkprobe_trace_self_tests_init() wait the same way.\n\nCalling complete() unconditionally would not be enough: the waiter\ndrops kprobe_mutex while it sleeps, and nothing else serializes the\nsysctl handler against the debugfs \"enabled\" file. A second flusher\nthat still finds the lists non-empty, e.g. because a disabled probe is\nqueued for unoptimizing, reinitializes the completion under the first:\n\n sysctl write debugfs \"enabled\" write\n unoptimize_all_kprobes()\n wait_for_kprobe_optimizer_locked()\n init_completion(c)\n mutex_unlock(\u0026kprobe_mutex)\n wait_for_completion(c)\n disarm_all_kprobes()\n wait_for_kprobe_optimizer_locked()\n init_completion(c)\n // c-\u003ewait is reset, the first\n // waiter is off the queue\n mutex_unlock(\u0026kprobe_mutex)\n wait_for_completion(c)\n kprobe_optimizer()\n complete(c)\n // wakes the debugfs writer only\n\nwhere c is \u0026optimizer_completion. Lining up the two writes during an\noptimizer pass loses the sysctl writer this way.\n\nReplace the completion with a counter of optimizer passes, bumped at the\nend of each pass and signalled with wake_up_var_locked(), both under\nkprobe_mutex. A flusher samples the count and waits with\nwait_var_event_mutex(), which drops kprobe_mutex only while sleeping, so\na new count means a whole pass ran in the meantime. Nothing is\nreinitialized, so several flushers can sleep in the wait at once.\n\nLink: https://lore.kernel.org/all/20260924092142.199198-1-parri.andrea@gmail.com/\n\nFixes: 73c12f209462 (\"kprobes: Use dedicated kthread for kprobe optimizer\")\nCc: stable@vger.kernel.org\nAssisted-by: LLM\nSigned-off-by: Andrea Parri \u003cparri.andrea@gmail.com\u003e\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\n" }, { "commit": "76d8e697242e7e4e30dd08eff7c278728f9dd8e2", "tree": "f2c307436045e4a74fbcc8a8bba6e7ff7bd59b0e", "parents": [ "ae146bc1abdeb4607abf2975b858c053024e8ac1" ], "author": { "name": "Drif Abdelmalek Mohamed Said", "email": "drifabdelmalekmohamedsaid@gmail.com", "time": "Fri Sep 18 23:42:04 2026 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 15:54:23 2026 +0200" }, "message": "dcache: unpoison the inline name buffer in __d_alloc()\n\nsyzbot reported:\n\n BUG: KMSAN: uninit-value in dentry_string_cmp fs/dcache.c:291 [inline]\n BUG: KMSAN: uninit-value in dentry_cmp fs/dcache.c:322 [inline]\n BUG: KMSAN: uninit-value in __d_lookup_rcu+0x37d/0x5e0 fs/dcache.c:2522\n\n dentry_string_cmp fs/dcache.c:291 [inline]\n dentry_cmp fs/dcache.c:322 [inline]\n __d_lookup_rcu+0x37d/0x5e0 fs/dcache.c:2522\n lookup_fast+0x194/0xa40 fs/namei.c:1854\n lookup_fast_for_open fs/namei.c:4545 [inline]\n open_last_lookups fs/namei.c:4579 [inline]\n path_openat+0x9ef/0x6540 fs/namei.c:4856\n do_file_open+0x2aa/0x680 fs/namei.c:4888\n do_sys_openat2+0x17c/0x390 fs/open.c:1395\n do_sys_open fs/open.c:1401 [inline]\n __do_sys_openat fs/open.c:1417 [inline]\n __se_sys_openat fs/open.c:1412 [inline]\n __x64_sys_openat+0x240/0x300 fs/open.c:1412\n x64_sys_call+0x2445/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:258\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was stored to memory at:\n copy_name fs/dcache.c:3031 [inline]\n __d_move+0xd29/0x21f0 fs/dcache.c:3099\n d_move+0x71/0xf0 fs/dcache.c:3147\n vfs_rename+0x2619/0x2770 fs/namei.c:6085\n filename_renameat2+0xa59/0x1230 fs/namei.c:6188\n __do_sys_rename fs/namei.c:6232 [inline]\n __se_sys_rename+0xc5/0x5c0 fs/namei.c:6228\n __x64_sys_rename+0x78/0xb0 fs/namei.c:6228\n x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83\n do_syscall_x64 arch/x86/entry/syscall_64.c:63\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4617 [inline]\n slab_alloc_node mm/slub.c:4939 [inline]\n kmem_cache_alloc_lru_noprof+0x376/0x1230 mm/s\n __d_alloc+0x52/0x9f0 fs/dcache.c:1902\n d_alloc+0x57/0x300 fs/dcache.c:1981\n lookup_one_qstr_excl+0x19d/0x7a0 fs/namei.c:1806\n __start_renaming+0x341/0x850 fs/namei.c:3888\n filename_renameat2+0x625/0x1230 fs/namei.c:6163\n __do_sys_rename fs/namei.c:6232 [inline]\n __se_sys_rename+0xc5/0x5c0 fs/namei.c:6228\n __x64_sys_rename+0x78/0xb0 fs/namei.c:6228\n x64_sys_call+0x329/0x3ea0 arch/x86/include/generated/asm/syscalls_64.h:83\n do_syscall_x64 arch/x86/entry/syscall_64.c:63\n do_syscall_64+0x15d/0x3c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe race is between a concurrent open() and rename() of the same path.\n\n__d_alloc() only stores the name itself and its terminating NUL, so the\nrest of the inline buffer (d_shortname, DNAME_INLINE_LEN bytes) is left\nuninitialized. copy_name(), called from rename(), copies that buffer as a\nwhole, so the uninitialized tail is propagated into the dentry that is\nbeing moved. Meanwhile __d_lookup_rcu(), called from open(), is an\noptimistic lockless lookup: it checks d_name.hash_len first and leaves the\nseqcount retry to its caller, so it can end up comparing against a dentry\nwhose name a rename is rewriting in place, using a stale (longer) length.\nThe comparison then runs past the terminating NUL and reads bytes of the\nuninitialized tail, which KMSAN reports.\n\nThe read is harmless by design: it stays inside the buffer, the name is\nstill NUL-terminated, and the result is thrown away by the seqcount retry.\nIt is not specific to KMSAN either - with CONFIG_DCACHE_WORD_ACCESS\nenabled the very same bytes are read by read_word_at_a_time(), which is\n__no_sanitize_or_inline and therefore invisible to KMSAN. KMSAN builds\nonly see the instrumented byte-at-a-time dentry_string_cmp() because\nCONFIG_DCACHE_WORD_ACCESS is disabled when KMSAN is enabled on x86:\n\ncommit 7cf8f44a5a1c (\"x86: fs: kmsan: disable CONFIG_DCACHE_WORD_ACCESS\")\n\nZeroing the inline buffer would hide the report, but it would add a\nmemset() to a hot allocation path just to initialize bytes that are never\nused as part of a name. Instead, tell KMSAN the inline buffer is\ninitialized: kmsan_unpoison_memory() compiles to nothing unless\nCONFIG_KMSAN is set, and doing it at allocation time is enough for every\ndentry, because copy_name() and swap_names() copy the whole buffer and\nthus propagate its shadow.\n\nReported-by: syzbot+7ff3adde89dd795ad4c4@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d7ff3adde89dd795ad4c4\nSigned-off-by: Drif Abdelmalek Mohamed Said \u003cdrifabdelmalekmohamedsaid@gmail.com\u003e\n\nChanges in v3:\n- Annotate for KMSAN instead of zeroing, as suggested in review: the read\n is harmless, so unpoison the inline buffer in __d_alloc() with\n kmsan_unpoison_memory() (a no-op unless CONFIG_KMSAN) rather than adding\n a memset() to the dentry allocation path.\n- Document why only KMSAN builds report this at all: with\n CONFIG_DCACHE_WORD_ACCESS the same read goes through\n read_word_at_a_time(), which KMSAN does not instrument.\n- Rewrite the commit message; the previous one had several truncated\n lines.\n\nLink: https://patch.msgid.link/20260918224204.3056-1-drifabdelmalekmohamedsaid@gmail.com\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "ae146bc1abdeb4607abf2975b858c053024e8ac1", "tree": "4c722a805ae2e7c1636d8c0182eb14b2f008a621", "parents": [ "2d2a2d7aa98741b58f54cacc99b52024e4d865f9" ], "author": { "name": "Amir Goldstein", "email": "amir73il@gmail.com", "time": "Mon Sep 21 12:40:13 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Fri Sep 25 15:52:26 2026 +0200" }, "message": "ovl: fix UAF in ovl_do_mkdir() debug print\n\novl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().\nSince commit fe497f0759e0 (\"VFS: change vfs_mkdir() to unlock on\nfailure.\"), vfs_mkdir() calls end_creating() on the input dentry on\nfailure and may replace it on success, so the post-call %pd can\nuse-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.\n\nPrint the dentry before the call and only the result afterward.\n\nReported-by: syzbot+ced26b784bf977d223dd@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dced26b784bf977d223dd\nFixes: fe497f0759e0 (\"VFS: change vfs_mkdir() to unlock on failure.\")\nSigned-off-by: Amir Goldstein \u003camir73il@gmail.com\u003e\nLink: https://patch.msgid.link/20260921104013.40475-1-amir73il@gmail.com\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "113dcdfadf30ea11fbbdfcd4f6ea87687655cc5b", "tree": "667a2ee587f8351d2fc8ea333f5641d8c8082bf5", "parents": [ "80320b278fea07ffcda3f57b67b61658e0a4e1ca" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Sep 25 13:23:29 2026 +0800" }, "committer": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Fri Sep 25 11:08:37 2026 +0200" }, "message": "MAINTAINERS: name the libata/linux for-next branch\n\nThe T: entry for LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)\nnames libata/linux without a branch. The repository\u0027s HEAD pointer\npoints to branch master, which has no active development. Active\ndevelopment is on the for-next branch. Name the branch so the entry\nidentifies where development happens.\n\nDocumentation/process/submitting-patches.rst sends contributors to the\nT: entry to find the tree to prepare patches against, so a branch-less\nentry whose HEAD is already in mainline points them to the wrong branch.\n\nReviewed-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260925052329.2683619-1-matthias.goergens@gmail.com\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n" }, { "commit": "0f50dab8b4265e42e8719c2998c908a9d79a589e", "tree": "e5017d73939a2aee0ecdf91081d84514f5d8024c", "parents": [ "c5d1690ff144fce4b7cebe877d2ef1d1b5eb6aa2", "15814c01ac57643edf1662a076d2961332f277a5" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:54:43 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 18:04:49 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.3-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes\n\namd-drm-fixes-7.3-2026-09-24:\n\namdgpu:\n- Display ref count fix\n- Userq fixes\n- VCN 4, 5 reset fixes\n- Fixes for various error paths\n- Stack frame size fixes for various combinations of compilers and configs\n\namdkfd:\n- Possible UAF fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260924172938.634777-1-alexander.deucher@amd.com\n" }, { "commit": "c5d1690ff144fce4b7cebe877d2ef1d1b5eb6aa2", "tree": "3be950a4d69d141665fa622733e1fbca2c298875", "parents": [ "fd0ba310f9ab6faa0059d9649564ac97e67ad137", "cc319238e3f6668f867beb381ce93727c69b7317" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:50:02 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 16:50:21 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nFixes in:\n - CRI throttle reasons report (Sk)\n - TLB invalidation at wedge (Shuicheng)\n - SVM eviction and VM close (Brost)\n - Display corruption on LNL on Xen PV (Szymon)\n - W/a fix and addition (Tilak)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/arUoUf9LpsJpJouN@intel.com\n" }, { "commit": "165768bb70265b5c38cf0b73fafd75be235f8b14", "tree": "214b14a6bf18f87a07ed067feb7cf8eab2582eff", "parents": [ "ee9c669f9bf5fd2c24206746ded9382fe810df89", "c6b51091cafff9ce6c03c1416aa13864d17ab97c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 17:09:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 17:09:56 2026 -0700" }, "message": "Merge tag \u0027firewire-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394\n\nPull firewire fix from Takashi Sakamoto:\n \"Fix a race in the cdev layer that can cause a fw_iso_resource_auto\n object to transition back to a previous state. This can happen when a\n file descriptor is closed while the work item for the object is\n running. The race can leak several memory objects, including client\n object itself\"\n\n* tag \u0027firewire-fixes-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:\n firewire: cdev: fix back-transition for iso_resource_auto client resource\n" }, { "commit": "fd0ba310f9ab6faa0059d9649564ac97e67ad137", "tree": "701a596139fc4f36c1b52213f11f8eb52292f292", "parents": [ "93f51579e7df248780214094418f205253383cc5", "d2da6696e0c4e60414706e607029d0bb0330c67e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 09:47:45 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Sep 25 09:47:46 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-09-24\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\ndrm/i915 fixes for v7.3-rc5:\n- Fix incorrect RCU teardown order leading to endless loop\n- Fix DP MST TU and FEC handling for disconnected streams\n- Fix selective fetch disable, again\n- Fix export namespace for kunit helpers\n- Workaround eDP flicker on a specific laptop model\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: https://patch.msgid.link/9b8ff50ad5c3ff9ca120207b1e7aa95d5a16423f@intel.com\n" }, { "commit": "ee9c669f9bf5fd2c24206746ded9382fe810df89", "tree": "dfc46791f0ed3fb6455e9144f8245456486ed2fe", "parents": [ "e8dfd03a1c51c4e84fbf2e5ef5cd7d33cc8b7578", "4409a85735cdca5c4c400c0dad1feee091872eee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 15:04:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 15:04:11 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - A task reenqueued while its dispatch was still completing had its\n queued state clobbered by the dispatcher, dropping every later\n dispatch of the task. Wait for the in-flight dispatch to settle\n first\n\n - A wakeup activation on another CPU marked the destination runqueue as\n mid-wakeup, stranding a pending local reenqueue. If the scheduler was\n unloaded first, the stale request pointed into freed memory that the\n next scheduler dereferenced\n\n - ops.dequeue() ran with the source dispatch queue\u0027s lock held, so a\n scheduler iterating that queue from the callback deadlocked the CPU\n\n - Schedulers with their own CPU ID mapping had no way to learn a task\u0027s\n initial CPU mask and rebuilt it themselves, which went wrong across\n sub-scheduler enable and re-home. Pass it to ops.enable()\n\n - A bypass dispatch event counter missed the dispatches made by the\n end-of-dispatch fallback and under-reported\n\n - Selftests for the dequeue locking and initial mask changes\n\n* tag \u0027sched_ext-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Count SCX_EV_SUB_BYPASS_DISPATCH in the dispatch fallback\n selftests/sched_ext: Check the cmask cid-form ops.enable() receives\n sched_ext: Pass the initial cmask to cid-form ops.enable()\n selftests/sched_ext: Test that ops.dequeue() can iterate the consumed DSQ\n sched_ext: Don\u0027t run ops.dequeue() with a DSQ lock held\n sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags\n sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task\n" }, { "commit": "e8dfd03a1c51c4e84fbf2e5ef5cd7d33cc8b7578", "tree": "4eb94e7cc6d3b5bbae07209efa19816a87b377fd", "parents": [ "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de", "1765a153d985c231357145e26798f9408db10e42" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 14:26:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 14:26:12 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - With local event accounting, a fork rejected by the pids controller\n updated pids.events without notifying its pollers\n\n - A cgroup selftest failed to compile with fortification enabled\n because an O_TMPFILE open lacked its mode argument\n\n* tag \u0027cgroup-for-7.3-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/pids: Restore pids.events notifications in local mode\n selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode\n" }, { "commit": "cb97bf3d4f91453b881acaf8e9f0cc47bb40b604", "tree": "01255366ffbc8f4b3d2b27a194ed3acca3eec810", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Viken Dadhaniya", "email": "viken.dadhaniya@oss.qualcomm.com", "time": "Mon Sep 21 17:17:01 2026 +0530" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Thu Sep 24 22:52:30 2026 +0200" }, "message": "i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL\n\nqcom_geni_i2c_conf() writes a hardcoded 0 to SE_GENI_CLK_SEL, which\nselects an index from the hardware clock performance table. This always\npicks the first table entry regardless of the actual source clock\nconfiguration. On platforms where the matching entry is not at index 0,\nthe wrong source clock divider is active and the I2C bus runs at an\nincorrect frequency.\n\nUse geni_se_clk_freq_match() in geni_i2c_clk_map_idx() to find the\nperformance table index for the source clock (32 MHz or 19.2 MHz). Store\nthe resolved index in a new clk_idx field in geni_i2c_dev and write it\nto SE_GENI_CLK_SEL instead of the hardcoded 0.\n\nFixes: 37692de5d523 (\"i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller\")\nSigned-off-by: Viken Dadhaniya \u003cviken.dadhaniya@oss.qualcomm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v4.19+\nReviewed-by: Mukesh Kumar Savaliya \u003cmukesh.savaliya@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260921-i2c-fix-se-clk-conf-v2-1-8b5537ceff2d@oss.qualcomm.com\n" }, { "commit": "f2c53ea949c5048f96b3dbb5a5ee7131ce4ff2de", "tree": "dd635091fe8fde9c898b9e9a1a4c51e49d6161df", "parents": [ "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "fc6d80eb504458d6416b75a94188b268c95c6533" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 11:45:33 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, NFC and Netfilter.\n\n Every week in this release is record-setting for number of posted\n patches. It doesn\u0027t seem like we\u0027re creating any regressions with all\n these fixes, three \u0027Fixes\u0027 tags here point to 7.2 commits but none are\n true regression fixes. We\u0027re trying to keep the count down,\n nonetheless.\n\n Previous releases - regressions:\n\n - net: don\u0027t require the hwtstamp NDOs when a PHY provides\n timestamping\n\n - ipv6: fix dst leak for uncached routes\n\n - vrf: stop corrupting skb-\u003ecsum when capturing CHECKSUM_COMPLETE\n packets\n\n Previous releases - always broken:\n\n - packet: use ubuf_info completion for TX_RING packets\n\n - arp: terminate device name before lookup\n\n - ipv6: do not let ipv6_find_hdr() return an offset past the packet\n end\n\n - udp: remove a disconnected socket from the 4-tuple hash table\n\n - sctp: discard the rest of the packet on a stale-cookie error\n\n - eth: mlx5: Bridge, fix remaining switchdev ownership gaps on merged\n eswitch\"\n\n[ And lots of other random network driver fixes ]\n\n* tag \u0027net-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (189 commits)\n tcp: prevent collapsing skbs across boundary in rtx queue\n vlan: ensure sufficient headroom in vlan_dev_hard_header()\n net/sched: sch_teql: fix shadowed err in __teql_resolve()\n bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n llc: reserve device headroom for allocated frames\n gve: DQO: reject TSO packets with an out of range MSS\n gve: fix TX drop when GSO MSS is too small for hw\n gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n net: flush skb_defer_nodes in dev_cpu_dead()\n net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n net/smc: fix UAF on lgr list traversal in smcr_port_err()\n net/rds: size a connection\u0027s path set by the transport it ends up with\n nfp: hold IPsec RX state under the XArray lock\n net: ena: fix MMIO read buffer leak on probe failure\n net: ena: fix PHC cleanup on probe failure\n net/sched: act_ct: fix helper UAF due to extensions realloc\n ...\n" }, { "commit": "fc6d80eb504458d6416b75a94188b268c95c6533", "tree": "5487970b2bfe7b6d0737e3c7059af732ca493d41", "parents": [ "1078a38344a852eefafcc61c42dcc333b53c7478" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Thu Sep 24 11:44:12 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:03:42 2026 -0700" }, "message": "tcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)-\u003eeor \u003d 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe fence is a no-op if all earlier data has already been transmitted\nwhen the switch happens: sk-\u003esk_write_queue is empty. The not yet\nacknowledged earlier skbs wait in sk-\u003etcp_rtx_queue with eor 0.\n\nOn a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or\ntcp_shift_skb_data() can then merge an skb queued after the switch into\none queued before it.\n\nBoth users of the fence are affected:\n\n- psp: devices only encrypt skbs with skb-\u003edecrypted set. The merged skb\n keeps decrypted \u003d 0 from the earlier skb, so merged data sent after\n psp_sock_assoc_set_tx() is retransmitted in cleartext.\n\n- tls device offload: the merged skb straddles the start marker set in\n tls_set_device_offload(). The software fallback (fill_sg_in() returns\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an\n skb and drop it. Every retransmit rebuilds the same skb, so the\n connection stalls.\n\nFix this in two places, for defense in depth:\n\n1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()\n when tcp_write_queue_tail(sk) is NULL.\n\n2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this\n condition.\n\nFixes: e8f69799810c (\"net/tls: Add generic NIC offload infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20260924154427.953800-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1078a38344a852eefafcc61c42dcc333b53c7478", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52", "cd5dd68267c4238795fadaf02b3575ca3f8a6500" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:01:04 2026 -0700" }, "message": "Merge branch \u0027vlan-ensure-sufficient-headroom-in-vlan_dev_hard_header\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less, or skbs allocated before\ndynamic device/headroom changes (such as toggling VLAN_FLAG_REORDER_HDR\nor bonding/team switching slaves), can reach vlan_dev_hard_header() with\ninsufficient headroom and trigger skb_under_panic().\n\nWhen vlan_dev_hard_header() returns -ENOMEM upon skb_cow_head() failure,\na few callers of dev_hard_header() / llc_mac_hdr_init() had pre-existing\nerror-handling bugs:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924082951.1599377-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cd5dd68267c4238795fadaf02b3575ca3f8a6500", "tree": "cf29dc84fc6d0c1cbece69f4e01f183a8db49ae2", "parents": [ "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "vlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),\nor skbs allocated before dynamic device/headroom changes (e.g. toggling\nVLAN_FLAG_REORDER_HDR or bonding/team switching slaves), can reach\nvlan_dev_hard_header() with insufficient headroom and trigger\nskb_under_panic().\n\nUse skb_cow_head() in vlan_dev_hard_header() when VLAN_FLAG_REORDER_HDR\nis not set to ensure sufficient headroom for the VLAN header(s) and the\nunderlying device hard header.\n\nUse READ_ONCE() to read dev-\u003ehard_header_len and dev-\u003eneeded_headroom as\nthey can be updated concurrently under RTNL (e.g. in\nvlan_transfer_features()) while vlan_dev_hard_header() runs locklessly on\nthe transmit path. Also avoid LL_RESERVED_SPACE(dev) here so that the\nextra HH_DATA_MOD alignment padding does not trigger unnecessary\npskb_expand_head() reallocations on inner stacked VLAN devices after the\nouter VLAN header has been pushed.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/cover.1789987105.git.petalzu987@gmail.com/\nLink: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "907b978e82cb4c1c245fc2985bb27c5d5c88c8f6", "tree": "99c10e831fdd7b59ce532cdc840640aae27ad3ca", "parents": [ "ac704ff08e511c87643799c385f55ecd69b85e03" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:50 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "net/sched: sch_teql: fix shadowed err in __teql_resolve()\n\n__teql_resolve() declares an inner \u0027int err;\u0027 inside the\n\u0027if (neigh_event_send(n, skb_res) \u003d\u003d 0)\u0027 block, shadowing the outer\n\u0027int err \u003d 0;\u0027. As a result, a negative return from dev_hard_header()\nis written to the inner variable and __teql_resolve() still returns 0.\n\nRemove the shadowed variable and set the outer err to -EINVAL when\ndev_hard_header() returns a negative error.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac704ff08e511c87643799c385f55ecd69b85e03", "tree": "5f38ad6d4b85abd248210eec244ab86ed2bb3621", "parents": [ "72f9dd522f8d6c5a00be9695c7bb74631eb5069e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:49 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "bridge: check llc_mac_hdr_init() return value in br_send_bpdu()\n\nIf llc_mac_hdr_init() fails (for instance if the port device type does\nnot support LLC or dev_hard_header() fails), br_send_bpdu() should drop\nthe skb instead of resetting the mac header to the LLC payload and\ntransmitting a malformed frame.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nCc: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nCc: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: bridge@lists.linux.dev\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72f9dd522f8d6c5a00be9695c7bb74631eb5069e", "tree": "bac4f4f9105b9f14cd11c4f6c5d44cca3a88cc33", "parents": [ "72b5b9a28b996e09b8b5b944370c79851bb68f52" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 08:29:48 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 11:00:59 2026 -0700" }, "message": "llc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed skb via LLC_I_GET_NR(pdu),\nand double-frees skb when llc_conn_state_process() drops its reference.\n\nIn llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(), nskb is\nleaked if llc_mac_hdr_init() returns an error.\n\nFree nskb in all three error paths.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCloses: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924082951.1599377-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72b5b9a28b996e09b8b5b944370c79851bb68f52", "tree": "80b7fa56b5820d1f2be01da4399dda48eb003ab1", "parents": [ "488089055b61be8f7e97817d4608844f0fba2648" ], "author": { "name": "Zixuan Chai", "email": "petalzu987@gmail.com", "time": "Thu Sep 24 09:26:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:58:16 2026 -0700" }, "message": "llc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before the lower\ndevice\u0027s Ethernet header. An LLC response on such a device can\ntherefore underflow skb headroom in eth_header().\n\nUse LL_RESERVED_SPACE() to account for the device\u0027s actual required\nheadroom while preserving the existing LLC device-type check.\n\nFixes: bf9ae5386bca (\"llc: use dev_hard_header\")\nCc: stable@vger.kernel.org\nReported-by: VEGA \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260924012613.2533934-1-weir@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "488089055b61be8f7e97817d4608844f0fba2648", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d", "296c83b5ccc808c080865eb20fd7a477b0355bb7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:57:01 2026 -0700" }, "message": "Merge branch \u0027gve-dqo-fix-handling-of-out-of-range-tso-mss\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngve: DQO: fix handling of out of range TSO MSS\n\nThe DQO TX path assumes that the MSS of a TSO packet is within the\nrange supported by the device, [88, 9728].\n\nThis holds for locally generated traffic, but not for packets coming\nfrom a tap or from a packet socket: virtio_net_hdr_to_skb() takes\ngso_size from user space and only enforces a minimum, layer 2\nforwarding does not check the MTU of GSO packets, and\ngso_features_check() bounds skb-\u003elen and gso_segs but never gso_size.\n\nPatch 1, from Eddie Phillips, deals with the lower bound. It moves the\nexisting test out of gve_prep_tso() into gve_features_check_dqo(), so\nthat these packets are segmented in software instead of being dropped.\n\nPatch 2 deals with the upper bound, which is currently not checked at\nall. gve_tx_fill_tso_ctx_desc() stores gso_size into a 14 bits wide\nfield, so that an MSS of 16384 silently becomes zero. Falling back to\nsoftware segmentation is not an option here, because skb_segment()\nsplits at gso_size regardless of the MTU, and would only replace an\ninvalid TSO packet by non TSO packets larger than the 9728 bytes the\ndevice supports. These packets are dropped instead.\n\nAs noted in patch 2, oversized non TSO packets can still reach the\ndevice whenever the stack segments in software. This is not specific\nto gve and is better fixed in the core, so a patch for\n__is_skb_forwardable() will be sent separately for net-next.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924004252.1196328-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "296c83b5ccc808c080865eb20fd7a477b0355bb7", "tree": "886115a15dd1a17818339673d5b7ea0c3b4a2d16", "parents": [ "3b430ea6234087957b0d3cd181e3116722b59819" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Sep 24 00:42:52 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: DQO: reject TSO packets with an out of range MSS\n\ngve_prep_tso() notes that the device requires the MSS to be \u003c\u003d 9728,\nbut does not enforce it, assuming the 9K MTU enforced by the hypervisor\nand the 64KB limit on TSO sizes are enough.\n\nThis does not hold for packets that were not generated locally.\nA guest behind a tap, or any packet socket user, can provide an\narbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check\nthe MTU for GSO packets (is_skb_forwardable()), and gso_features_check()\nonly bounds skb-\u003elen and gso_segs, never gso_size.\n\nSuch a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size\ninto the mss field of the TSO context descriptor. This field is 14 bits\nwide, so a gso_size of 16384 is silently turned into an MSS of zero.\n\nDrop these packets from gve_prep_tso(), and make sure that\ngve_features_check_dqo() leaves their GSO bits alone: skb_segment()\nsplits at gso_size regardless of the MTU, so falling back to software\nsegmentation would give the device non TSO packets bigger than the\n9728 bytes it supports.\n\nNote that the device can still be given oversized non TSO packets when\nthe stack segments in software for other reasons, for instance after\nTSO has been disabled with ethtool. This is a generic issue, because\nthe MTU check is skipped for GSO packets in the forwarding path, and\nis addressed separately.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3b430ea6234087957b0d3cd181e3116722b59819", "tree": "0f861c1c8f08498ad4c8fc89fc79dfd0222ce039", "parents": [ "83769c23fb1879edc916a526ba424285033baf2d" ], "author": { "name": "Eddie Phillips", "email": "eddiephillips@google.com", "time": "Thu Sep 24 00:42:51 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:56:59 2026 -0700" }, "message": "gve: fix TX drop when GSO MSS is too small for hw\n\nThe device has a strict requirement that the minimum MSS\n(gso_size) for TSO/GSO packets must be at least 88 bytes. If a packet\nbelow this threshold is pushed to the hardware, it can cause\nhardware to silently drop the packet, leading to increased latency\nand retransmissions.\n\nCurrently, this is validated too late in the transmit pipeline\n(gve_prep_tso), leading to silent drops.\n\nFix this by moving the validation into the .ndo_features_check\ncallback (gve_features_check_dqo). If we detect a GSO packet with\na gso_size smaller than GVE_TX_MIN_TSO_MSS_DQO, we clear the GSO\nfeature flags for this packet.\n\nFixes: a57e5de476be (\"gve: DQO: Add TX path\")\nSigned-off-by: Eddie Phillips \u003ceddiephillips@google.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260924004252.1196328-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "415f2044228cc8b948dc04e079aaa86a4d1aa1d3", "tree": "71512a50ce57f1a72f253b74264dff7fde3de777", "parents": [ "5fc5768c7ca92895ccd1de94dc521e5a55ae7896", "e7e0a54300a896e731dffd3e2e8dae5631d6243d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 10:53:59 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fixes from Mickaël Salaün:\n \"This mainly fixes the Landlock tracepoint support merged this cycle so\n that denial and rule events report the intended policy context,\n whether through tracefs or BTF-visible callbacks.\n\n The size of this all is mainly from propagating the corrected contract\n through event definitions and producers, adding new tests for the\n reported context, and updating the documentation.\n\n Also improve annotation and fix a GCC 16 build warning\"\n\n* tag \u0027landlock-7.3-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Widen ruleset versions to 64 bits\n landlock: Add counted_by in landlock_domain\n landlock: Fix tracepoint contract documentation\n selftests/landlock: Test network denial context\n selftests/landlock: Test filesystem denial blockers\n landlock: Report the effective signal number\n landlock: Report the actual ptrace tracer\n landlock: Fix network denial trace context\n landlock: Fix rule tracepoint context\n landlock: Fix filesystem denial blocker reporting\n landlock: Fix tracepoint fixed-width type names\n landlock: Work around gcc-16 -Wuninitialized warning\n" }, { "commit": "83769c23fb1879edc916a526ba424285033baf2d", "tree": "ac3e133847e92e1be5420840455588279ccab477", "parents": [ "06e3f54e8b22040ada01a28343badf1990b4dd7d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 14:59:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:51:29 2026 -0700" }, "message": "gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.\n\nFixes: 014c607f86ab (\"gve: add support for UDP GSO for DQO format\")\nCloses: https://lore.kernel.org/netdev/CANn89i+MS4L60sFQ49\u003d-f-mibeveUfcrpVkD5X+Qy6SOnEpd6w@mail.gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Ankit Garg \u003cnktgrg@google.com\u003e\nCc: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nCc: Joshua Washington \u003cjoshwash@google.com\u003e\nCc: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Ankit Garg \u003cnktgrg@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260923145942.731365-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "06e3f54e8b22040ada01a28343badf1990b4dd7d", "tree": "9aef63ca855d0f5730db275590fac7c010bc317e", "parents": [ "8db67bb6a1fffa4df68fbbc22e39943aeeff9178" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Sep 23 13:03:18 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:48:10 2026 -0700" }, "message": "net: flush skb_defer_nodes in dev_cpu_dead()\n\nWhen a CPU goes offline, dev_cpu_dead() drains its softnet queues\n(completion_queue, output_queue, poll_list, process_queue, and\ninput_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched.\n\nIf oldcpu goes offline while holding pending skbs in its\nskb_defer_nodes lists (e.g. below the sysctl_skb_defer_max \u003e\u003e 1 IPI\nthreshold, or if the IPI races with CPU teardown), those skbs remain\nstranded until oldcpu is brought back online. If any of these skbs\nhold page_pool fragments, page_pool_destroy() will stall indefinitely\nwaiting for inflight pages to be returned when a netdev or driver is\ntorn down while oldcpu is offline.\n\nAdditionally, if smp_call_function_single_async() fails in\nkick_defer_list_purge() because the target CPU went offline, reset\ndefer_ipi_scheduled to 0 so future IPI kicks are not blocked when the\nCPU comes back online.\n\nAlso, if oldcpu was the last online CPU on its NUMA node, drain that\nnode\u0027s slot across all CPUs so no skbs deferred from that node remain\nstranded on idle remote CPUs (or if the node itself is subsequently\nofflined).\n\nFinally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and\nwhether the caller migrated CPUs after llist_add(), flushing the node\nlist if so, to close the preemption TOCTOU race against CPU/node\nteardown.\n\nFixes: 68822bdf76f1 (\"net: generalize skb freeing deferral to per-cpu lists\")\nFixes: 5628f3fe3b16 (\"net: add NUMA awareness to skb_attempt_defer_free()\")\nCloses: https://lore.kernel.org/netdev/20260916003430.3612956-1-kris.pan@intel.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kris Pan \u003ckris.pan@intel.com\u003e\nLink: https://patch.msgid.link/20260923130318.607255-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8db67bb6a1fffa4df68fbbc22e39943aeeff9178", "tree": "a2ce3f2b519033b14058d38935960be67ffe4a1e", "parents": [ "56d82862a0a243ac14ba11b6d7b57ddc2d064b95" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Wed Sep 23 20:37:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:47:24 2026 -0700" }, "message": "net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails\n\ngmac_clk_enable() enables the bulk clocks first and then the optional\nPHY clock. If clk_prepare_enable() on the PHY clock fails, the function\nreturns without rolling back the bulk clocks, and bsp_priv-\u003eclk_enabled\nstays false, so the later gmac_clk_enable(bsp_priv, false) becomes a\nno-op and the bulk clock references are leaked.\n\nAdd the missing clk_bulk_disable_unprepare() on that failure path.\n\nFixes: ea449f7fa0bf (\"net: ethernet: stmmac: dwmac-rk: rework optional clock handling\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20260923123713.3137146-1-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56d82862a0a243ac14ba11b6d7b57ddc2d064b95", "tree": "fe06631dbb251cf22f86807315d0aa8bd1b1258c", "parents": [ "8e1937fed6738460554ec123c64839e2445e7d53" ], "author": { "name": "Dairui Zhang", "email": "zhangdairui@gmail.com", "time": "Wed Sep 23 13:01:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:40:50 2026 -0700" }, "message": "af_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n\nprb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:\n\n mbits \u003d (blk_size_in_bytes * 8) / (1024 * 1024);\n\nIf I\u0027m reading the validation right, tp_block_size is user\ncontrolled and packet_set_ring() only rejects values that are \u003c\u003d 0\nas int or not page aligned, so a 256MiB block goes right through\n(and alloc_one_pg_vec_page() even has a vzalloc fallback for it).\n0x10000000 * 8 wraps to INT_MIN, and on a NIC reporting 1 Gbps\n(div \u003d\u003d 1) the function ends up returning -2047.\n\nThe condition is actually (8 * size) mod 2^32 \u003e\u003d 2^31 \u0026\u0026 div \u003d\u003d 1,\nso the trigger set is [256,512), [768,1024), [1280,1536) and\n[1792,2048) MiB. Other sizes wrap to non-negative values and faster\nlinks divide the unsigned value back below 2^31, which is why this\ndoesn\u0027t blow up for everyone.\n\nWhat makes it fatal is what happens next in init_prb_bdqc():\n\n p1-\u003einterval_ktime \u003d ms_to_ktime(prb_calc_retire_blk_tmo(...));\n hrtimer_start(\u0026p1-\u003eretire_blk_timer, p1-\u003einterval_ktime,\n HRTIMER_MODE_REL_SOFT);\n\nA negative relative timeout expires immediately. The callback\nunconditionally returns HRTIMER_RESTART, and hrtimer_forward() turns\nthe negative interval into hrtimer_resolution:\n\n if (interval \u003c hrtimer_resolution)\n interval \u003d hrtimer_resolution;\n\nSo the SOFT timer re-fires at the maximum rate forever, holding\nsk_receive_queue.lock each pass. One CPU spins in softirq until the\nsocket is closed. Repeat with more rings and the machine is gone.\n\nThe overflow itself is ancient - it was introduced together with\nTPACKET_V3 in f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer\nimplementation.\"). Its effect prior to f7460d2989fa (\"net:\naf_packet: Use hrtimer to do the retire operation\", v6.18) was not\nas clear-cut, though: the return value was stored into an unsigned\nshort retire_blk_tov, so a negative result was truncated, and a\n0-jiffy delay loop could be programmed as well. Neither is nearly\nas detrimental as the immediate maximum-rate spin the hrtimer\nconversion turned it into.\n\n(Unrelated to CVE-2019-20812 - that one was the ethtool failure path\nreturning 0, which now returns DEFAULT_PRB_RETIRE_TOV.)\n\nReproducer, needs CAP_NET_RAW (a --network host container has it by\ndefault) and a 1 Gbps NIC (QEMU e1000 works):\n\n int fd \u003d socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));\n bind(fd, ...);\n int v \u003d TPACKET_V3;\n setsockopt(fd, SOL_PACKET, PACKET_VERSION, \u0026v, sizeof(v));\n struct tpacket_req3 req \u003d {\n .tp_block_size \u003d 0x10000000,\n .tp_block_nr \u003d 1,\n .tp_frame_size \u003d 2048,\n .tp_frame_nr \u003d 0x10000000 / 2048,\n .tp_retire_blk_tov \u003d 0,\n };\n setsockopt(fd, SOL_PACKET, PACKET_RX_RING, \u0026req, sizeof(req));\n\nCompute in 64 bits instead. The operands are already bounded by the\nexisting validation, so nothing else changes. If you\u0027d prefer a\ndifferent fix, just say so and I\u0027ll respin.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dairui Zhang \u003czhangdairui@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260923050101.1510064-1-zhangdairui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e1937fed6738460554ec123c64839e2445e7d53", "tree": "5d10c6bd523256962d460cb9fc378f48216ffa8b", "parents": [ "b94773dc4df7026a6f29b2c65e96e88d29cdb576" ], "author": { "name": "Ginger Li", "email": "ginger.jzllee@gmail.com", "time": "Tue Sep 22 16:09:09 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:45 2026 -0700" }, "message": "tipc: Fix a data race on mon-\u003epeer_cnt in mon_timeout()\n\nmon_timeout() evaluates dom_size(mon-\u003epeer_cnt) before it takes mon-\u003elock,\nwhile mon-\u003epeer_cnt is updated under that lock by tipc_mon_add_peer() and\ntipc_mon_remove_peer(). The value can therefore be stale, and the decision\nwhether the local domain has to be recomputed can be based on an outdated\nmember count.\n\nRead mon-\u003epeer_cnt inside the write_lock_bh(\u0026mon-\u003elock) protected region.\n\nFixes: 35c55c9877f8 (\"tipc: add neighbor monitoring framework\")\nSigned-off-by: Ginger Li \u003cginger.jzllee@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260922080909.21123-1-ginger.jzllee@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b94773dc4df7026a6f29b2c65e96e88d29cdb576", "tree": "f33a3cffc1582c8a98067d7580d114efafaea961", "parents": [ "61cb282fe97b3b0ba32ca09417a693162bf4ae3f" ], "author": { "name": "Alexander Sverdlin", "email": "alexander.sverdlin@siemens.com", "time": "Tue Sep 22 09:52:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:21:20 2026 -0700" }, "message": "net: phy: intel-xway: workaround 100BASE-TX Link-Up issue\n\nMaxLinear GSW12x/GSW14x Ethernet Switch Errata Sheet states:\n\"An issue has been sporadically observed after device power-on on the first\nlink-up attempt in 100BASE-TX mode resulting in either the link-up taking a\nlong time, or failing to link-up altogether...\n\nWorkaround:\nAfter power-on, enable Cable Diagnostic Mode for all ports and disable\nit...\"\n\nImplement the proposed workaround unconditionally in the Intel XWAY driver\n(MaxLinear GSW1xx switches incorporate Intel XWAY PHYs) because the\ndiagnostic bits have the same meaning even in older integral PHYs such as\nGPY111/PEF7071/PHY11G. So it\u0027s not clear how to distinguish the affected\nnewer integrated PHYs, but the workaround should not hurt the older PHYs.\n\nCc: stable@vger.kernel.org\nFixes: 22335939ec90 (\"net: dsa: add driver for MaxLinear GSW1xx switch family\")\nSigned-off-by: Alexander Sverdlin \u003calexander.sverdlin@siemens.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260922075251.23386-1-alexander.sverdlin@siemens.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "61cb282fe97b3b0ba32ca09417a693162bf4ae3f", "tree": "d1214b84bb1f1773f609603d93bee4c9a07749b3", "parents": [ "ba3d1f480c7a3fba963e7867ad6cc557c197acbc" ], "author": { "name": "Sidraya Jayagond", "email": "sidraya@linux.ibm.com", "time": "Tue Sep 22 09:31:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:19:50 2026 -0700" }, "message": "net/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock.\n\nFixes: 541afa10c126 (\"net/smc: add smcr_port_err() and smcr_link_down() processing\")\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nSigned-off-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260922073149.474762-1-sidraya@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ba3d1f480c7a3fba963e7867ad6cc557c197acbc", "tree": "77e8369813a2d60c9464a9262a30b7e8938d9ad5", "parents": [ "1a983a4e14c635c40354be110cd9a1a5c94e01e6" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Mon Sep 21 14:50:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 10:03:23 2026 -0700" }, "message": "net/rds: size a connection\u0027s path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller\u0027s transport before\nit decides whether a connection to one of the host\u0027s own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport\u0027s RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller\u0027s transport; the unused entries are freed with it.\n\nFixes: 4716af3897e9 (\"net/rds: Give each connection path its own workqueue\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260921215027.174657-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a983a4e14c635c40354be110cd9a1a5c94e01e6", "tree": "34bab83130682d046ee59f149ea21b3e6ffcde0d", "parents": [ "5b49efa1e16228921ceeae68d34defc8a4548dcb" ], "author": { "name": "Sang-Hoon Choi", "email": "csh0052@gmail.com", "time": "Tue Sep 22 03:15:59 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:59:32 2026 -0700" }, "message": "nfp: hold IPsec RX state under the XArray lock\n\nnfp_net_ipsec_rx() drops the XArray lock before taking a reference to the\nxfrm_state it found. The delete path can erase the entry and drop the last\nstate reference in that interval. RX can then try to increment a zero\nrefcount after the state has been queued for destruction.\n\nThe driver queues firmware invalidation asynchronously; the delete path\ndoes not wait for the command to complete or drain pending RX processing.\n\nThe XFRM garbage collector waits for an RCU grace period before freeing\nthe state. That delays reclamation but does not make acquiring a reference\nfrom zero valid.\n\nTake the xfrm_state reference before releasing the XArray lock so\nxa_erase() cannot run between lookup and reference acquisition.\n\nFixes: 57f273adbcd4 (\"nfp: add framework to support ipsec offloading\")\nReported-by: Changyul Lee \u003clcy8047@gmail.com\u003e\nSigned-off-by: Sang-Hoon Choi \u003ccsh0052@gmail.com\u003e\nLink: https://patch.msgid.link/179001455912.44752.17153022439349797877.idr-bug-92@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5b49efa1e16228921ceeae68d34defc8a4548dcb", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "9476b4468862927297c94c440863cd8ed1e7cc83" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:57 2026 -0700" }, "message": "Merge branch \u0027net-ena-fix-resource-cleanup-on-probe-failure\u0027\n\nGuangshuo Li says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ena: fix resource cleanup on probe failure\n\nThis series fixes two resource leaks in the ena_probe() error path after\nena_device_init() has successfully initialized device resources.\n\nPatch 1 adds the missing PHC cleanup.\nPatch 2 adds the missing MMIO read request cleanup.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921154202.471662-1-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9476b4468862927297c94c440863cd8ed1e7cc83", "tree": "49ea2e553d48cb7c37bc2b3c297d2829d1b4bb2f", "parents": [ "0958ea4355e2e9220ad4e13da3b7d94f365ed34f" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:02 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases this buffer through\nena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails\nafter ena_device_init() succeeds, the error path destroys the admin\nresources and eventually frees ena_dev without destroying the MMIO read\nrequest, leaving the coherent DMA buffer allocated.\n\nCall ena_com_mmio_reg_read_request_destroy() in the probe error path\nbefore releasing the remaining device resources.\n\nThis issue was found by manual code inspection.\n\nFixes: 1738cd3ed342 (\"net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nLink: https://patch.msgid.link/20260921154202.471662-3-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0958ea4355e2e9220ad4e13da3b7d94f365ed34f", "tree": "e95c06fefb48b50ed31f2076c92801ab53e9a4c8", "parents": [ "a08b39c5d5735a3bf3932c50ae2cef41857077c6" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Mon Sep 21 23:42:01 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:57:55 2026 -0700" }, "message": "net: ena: fix PHC cleanup on probe failure\n\nena_probe() initializes the PHC as part of ena_device_init(), but the\nprobe failure path does not destroy it before freeing the PHC private\ndata.\n\nThe normal removal path calls ena_phc_destroy() through\nena_destroy_device() before ena_phc_free(). However, if probe fails\nafter ena_device_init() succeeds, the error path reaches ena_phc_free()\nwithout unregistering the PTP clock or destroying the device PHC\nresources.\n\nCall ena_phc_destroy() in the probe error path before freeing the PHC\nprivate data.\n\nThis issue was found by manual code inspection.\n\nCc: stable@vger.kernel.org tags and describe this as a consistency cleanup\nFixes: e0ea34158ee8 (\"net: ena: Add PHC support in the ENA driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nCc: stable\nLink: https://patch.msgid.link/20260921154202.471662-2-lgs201920130244@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a08b39c5d5735a3bf3932c50ae2cef41857077c6", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "dad19b59da050cb60d3f7023dac2a042a84bf0bd" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:04 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:05 2026 -0700" }, "message": "Merge branch \u0027ovs-net-sched-fixes-for-uaf-after-conntrack-extension-realloc\u0027\n\nIlya Maximets says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\novs, net/sched: fixes for UAF after conntrack extension realloc\n\nOne clean up change plus two fixes for the UAF on helper extension\nrealloc x 2. First half for OVS and the second half for the similar\ncode in act_ct. This should cover all the known cases of this problem\nin these two modules.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921145655.3167436-1-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dad19b59da050cb60d3f7023dac2a042a84bf0bd", "tree": "08bf9a0c01ce4367fafe9f6b81df3d572b9c8cdb", "parents": [ "00df72e39f306e2f7adb68528a5c92109da6a0a9" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-7-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "00df72e39f306e2f7adb68528a5c92109da6a0a9", "tree": "3756562aa8c9c3ed5be520af59077dca7bfed2f2", "parents": [ "f85009dfcd65e5969526b0db7a49b5413746e630" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-6-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f85009dfcd65e5969526b0db7a49b5413746e630", "tree": "fb3f76eda2d5e8748a669f6dba07a7242e1f81f7", "parents": [ "1a4151e6be57b098b7a5ebfbde58585e83200cdc" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:02 2026 -0700" }, "message": "net/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels or run NAT and adds the\n new extension for that breaking the pointer in the expectation\n list causing UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where we need to process both clones without\nmodifications in the same zone. So, let\u0027s just reset the entry in\ncase for some reason we got an skb with a shared one. This doesn\u0027t\naffect any known use cases, but avoids any potential problems with\nsharing and modification of the unconfirmed ct entry.\n\nUnlike openvswitch module, act_ct allows for NAT without commit.\nChanging that would be a uAPI break. So, act_ct needs to reset on NAT\nregardless of the commit flag to avoid reallocation of the extension\nspace. This, however, doesn\u0027t really change the picture for sensible\nnetworking cases as there should be no need to run the same packet\ntwice (before and after the clone) through conntrack without packet\nheader or zone changes and without commit.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: a21b06e73191 (\"net: sched: add helper support in act_ct\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-5-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a4151e6be57b098b7a5ebfbde58585e83200cdc", "tree": "7c4feed8cf53f38f69d6cdf6c54216d625b43ad7", "parents": [ "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -\u003e nf_ct_helper()\n -\u003e helper-\u003ehelp()\n -\u003e nf_ct_expect_related_report()\n -\u003e nf_ct_expect_insert()\n -\u003e hlist_add_head_rcu(\u0026exp-\u003elnode, \u0026master_help-\u003eexpectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that\u0027s not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-4-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e6c14dd42a1c1fe938e573dc6c9098145b2b0c4", "tree": "a51be25ec871fdbf14d524e15560acaf26de558b", "parents": [ "26b2bd70d22457556e2fa01cbf1192cb1a94d619" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:44 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: remove \u0027add_helper\u0027 dead code\n\nThis variable can only become \u0027true\u0027 when the connection is not\nconfirmed, but it is only checked when it is confirmed. So, it can be\ntreated as being always false and just removed.\n\nFixes: 3c1860543fcc (\"openvswitch: add nf_ct_is_confirmed check before assigning the helper\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-3-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26b2bd70d22457556e2fa01cbf1192cb1a94d619", "tree": "add4d4409a93d8e8e7ac9fc4522902413d8de5eb", "parents": [ "33a61f09232bbbc5db9ded09bf85f4b9b5744c04" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Mon Sep 21 16:55:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:56:01 2026 -0700" }, "message": "net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n for that breaking the pointer in the expectation list causing\n UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed. So, let\u0027s just reset the entry in case\nfor some reason we got an skb with a shared one during commit. This\ndoesn\u0027t affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that\u0027s the\nmain UAF trigger for the sharing.\n\nFixes: cae3a2627520 (\"openvswitch: Allow attaching helpers to ct action\")\nCc: stable@vger.kernel.org\nReported-by: Axel Mierczuk \u003caxel.mierczuk@1password.com\u003e\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nLink: https://patch.msgid.link/20260921145655.3167436-2-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "33a61f09232bbbc5db9ded09bf85f4b9b5744c04", "tree": "2d3503172121f63ef09798d7f62ea7c8400f55aa", "parents": [ "3173cba1170131816972ed2b6185cb970ba8b747", "006208026819d5e9e5ec07b3e73d95960a059327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:50:49 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncluded fixes:\n* add selftest coverage for peer VPN address validation\n* reject multicast, broadcast and loopback peer VPN addresses, which\n can never identify a peer\n* reject MP peers left with no usable VPN address, as they can never\n be selected for TX\n* reject duplicate peer VPN addresses, which made peer lookup return\n an arbitrary peer\n* fix stale entry left in the VPN address hashtable when an address\n is cleared\n* fix torn IPv6 address read on lockless TX when the unusable local\n source is cleared in place\n* fix torn IPv6 address read on lockless TX when a new local endpoint\n is learned in place\n* fix dst cache being populated with a route resolved from an already\n replaced bind\n* fix stale route being reused after the socket mark or UDP source\n port changed\n* fix bogus validation of an unspecified local source address, which\n must instead be left to route source autoselection\n* fix IPv6 link-local peer endpoints losing their scope id when\n configured via netlink, breaking route lookup\n\n* tag \u0027ovpn-net-20260921\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n selftests: ovpn: validate peer VPN addresses\n ovpn: reject invalid peer VPN addresses\n ovpn: reject multipeer peers without VPN addresses\n ovpn: reject duplicate peer VPN addresses\n ovpn: always unhash old VPN addresses before rehashing\n ovpn: replace bind when clearing stale local source\n ovpn: replace bind when learning local endpoint\n ovpn: validate peer state before caching UDP dst\n ovpn: track UDP socket route key for peer dst cache\n ovpn: skip UDP source validation for unspecified addresses\n ovpn: preserve IPv6 scope id for netlink peer endpoints\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260921102215.3599702-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3173cba1170131816972ed2b6185cb970ba8b747", "tree": "961e6baefb38b4633e6a0cc8352928bc62fcde9b", "parents": [ "a940003f44e7e441c228151dd212642152700ec8" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Mon Sep 21 15:15:49 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:40:29 2026 -0700" }, "message": "net: libwx: fix races in Tx timestamp handling\n\nwx-\u003eptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests, but does not serialize the worker\nagainst cleanup.\n\nAs a result, wx_ptp_clear_tx_timestamp() can free an skb after\nwx_ptp_tx_hwtstamp_work() has obtained its pointer. The worker may\nthen pass the freed skb to skb_tstamp_tx() and release the same\nreference again.\n\nThe cleanup path may also clear the in-progress bit while the worker\nis still processing the old skb. This allows the Tx path to publish a\nnew skb which the worker can subsequently overwrite with NULL,\nleaking its reference.\n\nAdd a dedicated spinlock to protect publication and consumption of\nthe Tx timestamp skb. Detach the skb and clear the in-progress bit\nwhile holding the lock, then deliver the timestamp and release the skb\nafter dropping it. Use the same locked cleanup in the quiesce path,\nbut keep the detach there free of register accesses: quiesce runs\nduring PCIe error recovery, where MMIO is not reliable, and it\ndeliberately did not touch the device before. The lock is taken with\ninterrupts disabled, because netpoll can call ndo_start_xmit() with\nhard interrupts already off.\n\nWhen handling a Tx DMA mapping failure, keep the transmit path\nreference until after comparing the skb under the lock. This prevents\nskb address reuse from making the error path mistake a newer timestamp\nrequest for the failed one.\n\nFixes: 06e75161b9d4 (\"net: wangxun: Add support for PTP clock\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/6C7EC12D69217315%2B20260818074721.45536-1-jiawenwu%40trustnetic.com\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/77431AF9A0E369F3+20260921071549.1141804-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a940003f44e7e441c228151dd212642152700ec8", "tree": "4e491ab33176cf4658363151cc3350da30c5b785", "parents": [ "f75f21ef36285e5f56ee0c428bd2909ee81165b9" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Mon Sep 21 01:20:44 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:36:05 2026 -0700" }, "message": "net: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl-\u003ephydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers\nunwind with phy_detach(), which knows nothing about pl-\u003ephydev, so a\npointer to a PHY that is no longer attached outlives the failed\nconnect.\n\nWhat that costs depends on how the caller got here.\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses\nto attach while pl-\u003ephydev is set, turning a transient MDIO error into\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()\nanswers the failure with phy_device_remove() and phy_device_free(), and\nit assigns sfp-\u003emod_phy only past that error return, so nothing clears\npl-\u003ephydev and it is left pointing at a freed phy_device that\nphylink_resolve() and the ethtool helpers go on reading.\nphylink_fwnode_phy_connect() has no such check, so a later connect\noverwrites the stale pointer and hides the problem. A disconnect does\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),\nand the second phy_detach() on the same PHY drops references the first\none already released.\n\nFound while making a DSA port survive a PHY whose driver arrives after\nthe switch probes: keeping the port across a failed connect and\nretrying is what makes this window reachable.\n\nPublish the pointer after the last call that can fail instead of\nunwinding it afterwards. Nothing between the two points reads\npl-\u003ephydev, and the registration that follows cannot fail:\nphy_request_interrupt() falls back to polling on its own. The PHY-side\nstate keeps the order it had, so no MDIO operation moves relative to\nanother.\n\nFixes: 03abf2a7c654 (\"net: phylink: add EEE management\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260920222044.1752860-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f75f21ef36285e5f56ee0c428bd2909ee81165b9", "tree": "a7311bba54a71a7f756e92f4df75dc0eb3c9a100", "parents": [ "fe99bbeee5c5dbd3abc30721a8079ced59649d97" ], "author": { "name": "Ming Wang", "email": "wangming01@loongson.cn", "time": "Sun Sep 20 15:44:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:27:47 2026 -0700" }, "message": "net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist\n\nThe MeiG Smart SRM821 5G module (0x2dee:0x4d53) crashes and drops off\nthe USB bus when it receives a Zero Length Packet (ZLP) after sending\nor receiving an NTB of exactly 16384 bytes (tx_max).\n\nAccording to the MBIM specification, devices do not require a ZLP\nif the NTB size is exactly dwNtbOutMaxSize. However, the cdc_mbim\ndriver defaults to sending ZLPs for devices not explicitly whitelisted\nto accommodate non-conformant hardware. This default behavior breaks\nthe strictly conformant MeiG SRM821 module.\n\nAdd this device to the ZLP conformance whitelist (cdc_mbim_info) so\nthe driver will pad the NTB to avoid sending ZLPs, preventing the\ndevice firmware from crashing.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Ming Wang \u003cwangming01@loongson.cn\u003e\nLink: https://patch.msgid.link/20260920074500.826121-1-wangming01@loongson.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1765a153d985c231357145e26798f9408db10e42", "tree": "912bac6b31e58ac675a62df8ba0064b2d13cdddc", "parents": [ "c774ec8f0a5d02a06d34c27f5a7de7e333b91265" ], "author": { "name": "Guopeng Zhang", "email": "zhangguopeng@kylinos.cn", "time": "Thu Sep 24 17:15:36 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Sep 24 06:22:11 2026 -1000" }, "message": "cgroup/pids: Restore pids.events notifications in local mode\n\nA fork rejected by the pids controller increments the counter reported by\npids.events. When local event accounting is selected, however, pids_event()\nreturns after notifying only events_local_file, leaving pids.events pollers\nasleep.\n\nOn legacy hierarchies, pids.events.local does not exist. With\npids_localevents, pids.events reports the same local counter. In both\ncases, pids.events changes without generating a notification.\n\nThis can be reproduced with a pids_localevents mount:\n\n mkdir /tmp/test\n mount -t cgroup2 -o pids_localevents none /tmp/test\n mkdir /tmp/test/t\n echo 1 \u003e /tmp/test/t/pids.max\n cat /tmp/test/t/pids.events # max 0\n timeout 3 inotifywait -e modify /tmp/test/t/pids.events \u0026\n sh -c \u0027echo $$ \u003e /tmp/test/t/cgroup.procs; (true \u0026)\u0027 2\u003e/dev/null\n wait\n cat /tmp/test/t/pids.events # max 1\n\nWithout this patch, inotifywait times out without reporting an event.\nNotify pids.events before returning from the local event path.\n\nFixes: 3f26a885a068 (\"cgroup/pids: Add pids.events.local\")\nCc: stable@vger.kernel.org # v6.11+\nSigned-off-by: Guopeng Zhang \u003czhangguopeng@kylinos.cn\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "fe99bbeee5c5dbd3abc30721a8079ced59649d97", "tree": "a983718e1dd5f2de4f05cfc58217735bea003abf", "parents": [ "26cc0e69cce062cd3aa6fae33074684669c35a71" ], "author": { "name": "Yilin Zhang", "email": "yilinzhang@moonshot.ai", "time": "Thu Sep 24 12:49:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:17:10 2026 -0700" }, "message": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy.\n\nFixes: c31b70c9968f (\"tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit\")\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nTested-by: Weiming Shi \u003cshiweiming@moonshot.ai\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/8a9dff4063a2745653b7e88ceb745d75efa16e68.1790224474.git.yilinzhang@moonshot.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26cc0e69cce062cd3aa6fae33074684669c35a71", "tree": "b3f83760ecd653ecac8511928c3da0d5ae809c40", "parents": [ "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Mon Sep 21 05:10:01 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 09:11:56 2026 -0700" }, "message": "mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns \u0026mns-\u003ekeys list\nand matches netid, req_tag, peer_addr, and manual_alloc, without\nchecking whether tmp-\u003esk \u003d\u003d \u0026msk-\u003esk. This allows any MCTP socket in the\nsame network namespace to use and consume another socket\u0027s preallocated\ntag.\n\nIterate the socket\u0027s own tag list (\u0026msk-\u003ekeys via sklist) instead of the\nnamespace-wide \u0026mns-\u003ekeys list in mctp_lookup_prealloc_tag(), ensuring\nthat only tags allocated by msk are matched.\n\nTested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A\u0027s\npreallocated tag succeeds (ret \u003d 4); with this patch applied,\nsendto(sock_b) fails with -ENOENT (errno \u003d 2) while sendto(sock_a)\nsucceeds (ret \u003d 4).\n\nFixes: 63ed1aab3d40 (\"mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control\")\nSuggested-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nLink: https://patch.msgid.link/20260921051002.1656692-1-benquike@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5fc5768c7ca92895ccd1de94dc521e5a55ae7896", "tree": "1cbd495c00e921b5ce48bce2040f92723a9a3979", "parents": [ "f49a343b305c0b6c19a3b50c0bbf10bcd0e2e8fd", "1b1dca56828f33bc5e39b930ebed062e77fbe3b2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 08:25:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 08:25:26 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix bpf_skb_change_tail() to drop the checksum offload instead of\n rejecting the trim of CHECKSUM_PARTIAL skbs (Daniel Borkmann)\n\n - Add KF_PERFMON kfunc flag and require CAP_PERFMON for kfuncs that\n read arbitrary memory and for untrusted read-only memory reads\n (Daniel Borkmann)\n\n - Clear scalar delta on narrowing stack spill (Daniel Borkmann)\n\n - Set up the frame pointer for the exception callback in arm64 JIT, and\n zero-fill other CPUs when BPF_F_CPU update creates a per-cpu hash\n element (Donggeun Yoo)\n\n - Various fixes (Emil Tsalapatis):\n - Fix bounds check underflow for skb-backed dynptrs\n - Fix rx_queue_mapping context access code generation in bpf_sock\n - Reject packet pointer arguments to subprogs that may mutate the\n packet\n - Reject ALU instructions that see arena and non-arena operands on\n different code paths\n\n - Fix copied_seq double-counting on sockmap self-redirect\n (Geliang Tang)\n\n - Fix divide-by-zero in btf_struct_walk() on a flexible array of\n zero-sized elements, fix out-of-bounds read of rtt_min in sock_ops\n (Jiayuan Chen)\n\n - Fix bpf_sock_destroy() out-of-bounds read of sk_protocol on TIME_WAIT\n and request socks, and sleeping under RCU when destroying a listener\n with pending children (Jiayuan Chen)\n\n - Fix JEQ/JNE with immediate operand in MIPS32 JIT and missing zero\n extension of BSWAP 16/32 in MIPS64 JIT (Johan Almbladh)\n\n - Avoid soft lockup in htab lookup[_and_delete] batch operations on\n large maps (Jose Fernandez)\n\n - Various fixes (Kumar Kartikeya Dwivedi):\n - Verify global subprogs in each sleepability context they are\n called from\n - Make post-verification instruction rewrites killable\n - Preserve packet pointer displacement in regsafe()\n - Apply CO-RE relocations before subprogram validation, restrict\n CO-RE poisoning to relocatable instructions, and reject truncated\n ldimm64 CO-RE relocations in libbpf\n - Assign lock identity to callback map values\n - Compare stack frames in regs_exact()\n - Bound ownership depth through local kptrs and graph roots\n\n - Fix u32 overflow in map batch operations when the map size exceeds\n 4GB (Masoud Aghasi)\n\n - Fix UAF in bpf memalloc due to concurrent consumption of ttrace lists\n in alloc_bulk() (Pu Lehui)\n\n - Allow gotox as the terminal instruction of a program or a subprogram\n (Siddharth Chintamaneni)\n\n - Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL, skip unsettled links\n in link iterator, and reject dev-bound-only programs on other devices\n (Weiming Shi)\n\n - Reject non-negative stack offsets in stack_slot_obj_get_spi()\n (Xu Yunxiang)\n\n - Check params size before reading reserved fields in\n bpf_crypto_ctx_create() (Yuqi Xu)\n\n - Reject max_entries \u003e INT_MAX in sock_map_alloc() (Zhao Gongyi)\n\n - Use a 32-bit compare in xsk_map_gen_lookup() (Zhiling Zou)\n\n - Use kvfree() in xdp_test_run_teardown() (Zhixing Chen)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (58 commits)\n selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element\n bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element\n bpf: Fix BSWAP 32 and 16 on MIPS64\n bpf: Fix immediate JMP JEQ/JNE on MIPS32\n bpf: Reject dev-bound-only programs on other devices\n bpf, sockmap: Reject max_entries \u003e INT_MAX in sock_map_alloc\n selftests/bpf: Test for mixed arena/nonarena code paths\n bpf: Prevent variable arena/non-arena register contents\n selftests/bpf: Test rejection of pkt args to mutating subprogs\n bpf: Reject pkt arguments in mutating subprogs\n selftests/bpf: Add selftests for rx_queue_mapping context access\n bpf: Fix bpf_sock context code generation\n selftests/bpf: Test dynptr slices past end of skb\n bpf: Fix bounds check for skb-backed dynptrs\n selftests/bpf: Reject iterator destruction through fp+0\n bpf: Reject non-negative offsets in stack_slot_obj_get_spi()\n bpf: Check params size before reading reserved fields\n selftests/bpf: Check local object ownership depth\n bpf: Bound ownership depth through local kptrs and graph roots\n selftests/bpf: Cover frame changes in bounded loops\n ...\n" }, { "commit": "0b2bbfee2bcb80017d4d47e94f8dc92151dcdd6f", "tree": "9892ecb81b45e3c167a52d22d17f3e851ed13f50", "parents": [ "7c9f391ec89cb621d7af375ace2eb9a6248e5b9d", "0d80ba0a204c6a16bd7778b50de578dff107c0fe" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:58 2026 -0700" }, "message": "Merge branch \u0027net-dsa-mt7530-fix-two-crashes-on-driver-unbind\u0027\n\nAleksei Sviridkin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: mt7530: fix two crashes on driver unbind\n\nUnbinding the MT7530 driver from an MT7531 dereferences NULL in\nregulator_disable(). On a Netcraze NC-1012 (MT7981B + MT7531, 6.18.44):\n\n # echo mdio-bus:1f \u003e /sys/bus/mdio_bus/drivers/mt7530-mdio/unbind\n\noopses there, and the build it was found on sets CONFIG_PANIC_ON_OOPS, so\nthe board goes down with it. Fix that and the same command gets as far as\nmt7530_remove_common(), which disposes interrupt mappings the switch\u0027s own\nregmap-irq chip still owns; the regmap-irq thread then faults in\nhandle_nested_irq() later in the same teardown. rmmod reaches both, since\nmdio_module_driver() calls .remove on module exit.\n\nPatch 1 is the regulator one. mt7530_probe() requests the core and io\nsupplies only for ID_MT7530 and mt7530_setup() enables them under the same\ntest, but mt7530_remove() disables them unconditionally, so on an MT7621 or\nan MT7531 both pointers are still NULL from devm_kzalloc(). It reaches the\nMDIO front end only.\n\nPatch 2 is the interrupt one, and it reaches further.\nmt7530_remove_common() disposes the per-PHY interrupt mappings by hand from\n.remove, while the regmap-irq chip that owns the domain is devm-registered\nand its parent interrupt is only freed once .remove has returned.\nregmap_del_irq_chip() disposes the same mappings itself, in an order that\ncannot race, so the driver\u0027s call adds nothing but a window. That helper is\ncalled from both front ends, so the defect also covers the MMIO parts -\nMT7988, EN7581, AN7583 and EN7528 - which have no regulators and never meet\nthe first defect at all.\n\nThe order is not arbitrary. On an MT7531 the regulator fault happens in the\nfirst thing mt7530_remove() does with the switch, so execution never\nreaches the interrupt defect. The second only became visible once the first\nwas fixed, which is also how both came to be found on one board.\n\nFound and verified there. Without patch 1 the unbind panics in\nregulator_disable(); with patch 1 alone the panic moves on to\nhandle_nested_irq(); with both, three unbind/bind cycles run, two back to\nback and a third after a pause. In the two whose dmesg was captured, each\nunbind removes the switch from the driver directory and takes lan1 to lan4\nwith it, each bind brings them back, and lan1 relinks at 1Gbps/full after\nboth binds, lan4 after the second. uptime rose from 58 to 202 seconds\nacross the three without resetting and pstore gained no new record. The\nthird cycle stayed unbound long enough to read the descriptors: no mt7530\nline in /proc/interrupts and no irq/79, irq/80 or irq/81 directory, and the\nnext bind reuses those three numbers - regmap-irq freeing and disposing\nwhat the driver no longer touches. The kernel under test was identified by\nthe sha256 of its ELF notes section, read from /sys/kernel/notes on the\nrunning board and computed in advance from the flashed image.\n\nWhat hardware could not answer here. There is no MT7530 or MT7621 part on\nthis bench, so the ID_MT7530 branch that patch 1 adds was checked by\nreading the generated code rather than by running it, and no MMIO part was\navailable to exercise patch 2 on that front end either. One unrelated WARN\nremains across the unbind, from sysfs_remove_link() under\ndsa_user_destroy(); it is a separate DSA teardown-ordering defect and is\nnot addressed here.\n\nv1: https://lore.kernel.org/20260914202421.2737079-1-f@lex.la\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260918015020.2518315-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0d80ba0a204c6a16bd7778b50de578dff107c0fe", "tree": "9892ecb81b45e3c167a52d22d17f3e851ed13f50", "parents": [ "c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 18 04:50:20 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:53 2026 -0700" }, "message": "net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq\n\nmt7530_remove_common() disposes the per-PHY interrupt mappings from\n.remove, but the regmap-irq chip that owns the domain is devm-registered,\nso its parent interrupt is only freed once .remove has returned. The\nswitch\u0027s own regmap-irq thread can therefore still dispatch on a mapping\nthat is already gone: irq_find_mapping() returns 0, irq_to_desc() returns\nNULL and handle_nested_irq() locks desc-\u003elock without checking it. The\nattached PHYs have not given those interrupts back yet either, which the\nkernel warns about a moment before the fault.\n\nregmap_del_irq_chip() disposes the same mappings itself, after freeing the\nparent interrupt and before removing the domain, so there is nothing left\nfor the driver to do here. Until it runs the descriptors stay alive, and a\nlate dispatch on one of them is harmless: dsa_unregister_switch() has freed\nthe PHY handlers by then, so handle_nested_irq() finds no action and\nreturns.\n\nFixes: 254f6b272e3b (\"dsa: mt7530: Utilize REGMAP_IRQ for interrupt handling\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260918015020.2518315-3-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c2cdef41e0b4d8ed23a5b41e6ad4e64594e055e4", "tree": "75d9088373b89abf48d6145d0f0e76a768256ab1", "parents": [ "7c9f391ec89cb621d7af375ace2eb9a6248e5b9d" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 18 04:50:19 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 24 08:16:53 2026 -0700" }, "message": "net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621\n\nThe core and io supplies are only requested for ID_MT7530: both the\ndevm_regulator_get() in probe and the regulator_enable() in\nmt7530_setup() are guarded by the switch id, but mt7530_remove()\ndisables them unconditionally. On an MT7621 or an MT7531 both pointers\nare still NULL from devm_kzalloc(), so rmmod or a sysfs unbind calls\nregulator_disable() on NULL.\n\nFixes: ddda1ac116c8 (\"net: dsa: mt7530: support the 7530 switch on the Mediatek MT7621 SoC\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260918015020.2518315-2-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1b1dca56828f33bc5e39b930ebed062e77fbe3b2", "tree": "b4c1f3429aa6f6e4dfb178c39ae2786165d031ad", "parents": [ "8110ba09777873443db286b3cbb89b0e6311c554", "3422808f4e959266ea7790101ac90b8341f48226" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:24:52 2026 +0000" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:25:01 2026 +0000" }, "message": "Merge branch \u0027bpf-fix-per-cpu-initialization-of-a-bpf_f_cpu-created-hash-element\u0027\n\nDonggeun Yoo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: fix per-cpu initialization of a BPF_F_CPU created hash element\n\nA BPF_F_CPU update that creates a [lru_]percpu_hash element writes the\nnamed CPU\u0027s slot and leaves the others holding the recycled element\u0027s\nvalues, so a lookup of the new key returns a deleted key\u0027s per-cpu\nvalues.\n\nPatch 1 zero-fills the other CPUs. Patch 2 adds the selftest: the\nexisting cpu_flag subtests always prime a key with BPF_F_ALL_CPUS\nfirst, so the create path is not covered today.\n\nv1: https://lore.kernel.org/bpf/20260920093153.439743-1-donggeunyoo.kernel@gmail.com/\nv2: https://lore.kernel.org/bpf/20260923000801.1764758-1-donggeunyoo.kernel@gmail.com/\n\nChanges in v3:\n - patch 1: key init_cpu on BPF_F_CPU rather than on onallcpus (Leon\n Hwang)\n - patch 1: re-flow the paragraph naming pcpu_copy_value() (BPF CI AI\n review)\n - patch 2: pin the thread across the delete and the create, and name a\n CPU other than the pinned one, so the BPF_F_NO_PREALLOC arm does not\n depend on staying put (BPF CI AI review)\n\nChanges in v2:\n - patch 1: cover the BPF_F_CPU entry condition in the block comment\n above pcpu_init_value() (BPF CI AI review, Alexei Starovoitov)\n - patch 2: skip the new subtests instead of failing them on a\n uniprocessor machine (Sashiko AI review)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924102321.2120434-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "3422808f4e959266ea7790101ac90b8341f48226", "tree": "b4c1f3429aa6f6e4dfb178c39ae2786165d031ad", "parents": [ "c3a66e5f5bab3912e9f84223c5a982bf4333d5a1" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 24 19:23:21 2026 +0900" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:24:52 2026 +0000" }, "message": "selftests/bpf: Test per-cpu initialization of a BPF_F_CPU created element\n\nThe existing cpu_flag subtests always prime a key with BPF_F_ALL_CPUS\nbefore any BPF_F_CPU write, so the create path is never covered.\n\nAdd a subtest that creates the element with BPF_F_CPU on a map with\nmax_entries 1, so the key can only reuse the element the previous key\nreleased, and check that the CPUs the update did not name read back\nzero. Run it for PERCPU_HASH preallocated and BPF_F_NO_PREALLOC,\nwhose per-cpu areas come from different allocators, and for\nLRU_PERCPU_HASH.\n\nUnder BPF_F_NO_PREALLOC the reuse is only guaranteed on the cpu that\nran the delete, so pin the thread across the pair, and name a cpu other\nthan that one in map_flags.\n\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20260924102321.2120434-3-donggeunyoo.kernel@gmail.com\n" }, { "commit": "c3a66e5f5bab3912e9f84223c5a982bf4333d5a1", "tree": "222763680363d57135022bf60c6df0bef44def13", "parents": [ "8110ba09777873443db286b3cbb89b0e6311c554" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 24 19:23:20 2026 +0900" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Sep 24 14:24:51 2026 +0000" }, "message": "bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element\n\npcpu_init_value() initializes the per-cpu area of a newly created\n[lru_]percpu_hash element. The area is recycled, so when the value\ncomes from a BPF program (onallcpus \u003d\u003d false) it writes the running\nCPU\u0027s slot and zeroes the rest.\n\nbpf_percpu_hash_update() passes onallcpus \u003d\u003d true, which delegates to\npcpu_copy_value(). pcpu_copy_value() writes only the CPU named in\nmap_flags when BPF_F_CPU is set, so on the create path the other slots\nkeep the recycled element\u0027s values:\n\n update(k1, 0xdeadc0de, BPF_F_ALL_CPUS) every CPU holds 0xdeadc0de\n delete(k1) element back on the freelist\n update(k2, 0xc0ffee, BPF_F_CPU | 0) creates, writes CPU 0 only\n lookup(k2) CPU 0 0xc0ffee, rest 0xdeadc0de\n\nZero-fill the other CPUs on that arm too.\n\nFixes: c6936161fd55 (\"bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_hash and lru_percpu_hash maps\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20260924102321.2120434-2-donggeunyoo.kernel@gmail.com\n" }, { "commit": "e66cf1625ec4a3fe68346119f371def713fd0a4d", "tree": "ca692ad7e28a1ee307092abeeeaa8cb766a8241d", "parents": [ "031fe051abb3c1f36c2ba6346931fcdb3cddaeae" ], "author": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Wed Sep 23 20:25:49 2026 +0900" }, "committer": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Thu Sep 24 10:50:39 2026 -0300" }, "message": "smb: client: use finish_no_open() for non-regular inodes\n\nAn O_CREAT open can find an existing symlink or another non-regular\ninode. cifs_atomic_open() calls finish_open() on it and attaches a\ncifsFileInfo. Symlink inodes have no CIFS release operation, so the\ndentry reference held by cifsFileInfo is leaked. FMODE_OPENED also\nprevents the VFS from following the symlink.\n\nTrack whether cifs_do_create() returned an open server handle. For\nnon-regular inodes, close the handle if present, remove the pending\nopen, and call finish_no_open() so the VFS can continue the lookup.\nDo not set FMODE_CREATED unless a regular file was opened. For\nO_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS\u0027s\n-EFTYPE check.\n\nDefer closing a legacy POSIX handle on a non-regular inode until\nafter inode lookup. This avoids closing it again if lookup fails.\n\nFixes: d2c127197dfc (\"cifs: implement i_op-\u003eatomic_open()\")\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "7c9f391ec89cb621d7af375ace2eb9a6248e5b9d", "tree": "1543b8314fbd9b0d5dca5d536ae5b93a98dab97a", "parents": [ "d6ec384c87cc851cfd13bb18c99ce351ccee6192" ], "author": { "name": "Christian Lamparter", "email": "chunkeey@gmail.com", "time": "Mon Sep 21 18:28:17 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 24 15:37:47 2026 +0200" }, "message": "net: emac: move setting of netops to fix crash\n\nfixes the following crash on driver initialization:\n\n|BUG: Kernel NULL pointer dereference on read at 0x00000158\n|Faulting instruction address: 0xc0566b40\n|Oops: Kernel access of bad area, sig: 11 [#1]\n|BE PAGE_SIZE\u003d4K PowerPC 44x Platform\n|Modules linked in:\n|CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1\n|Tainted: [W]\u003dWARN\n|Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform\n|NIP: c0566b40 LR: c05648f8 CTR: c04c1e9c\n|REGS: c1053a20 TRAP: 0300 Tainted: GW (7.3.0-rc3+)\n|MSR: 0002b000 \u003cCE,EE,FP,ME\u003e CR: 24008808 XER: 00000000\n|DEAR: 00000158 ESR: 00000000\n|GPR00: c05648f8 c1053b10 c1063600 c1030000 c5ab3000 00000000 [...]\n|GPR08: 00000002 00000000 00000000 c1053b40 84002808 00000000 [...]\n|GPR16: cfffd210 00000002 c0beafcc cfffc960 00000000 c1030644 [...]\n|GPR24: c0beafbc c1037000 00000000 0000000a 00000000 c1030000 [...]\n|NIP [c0566b40] phy_link_topo_add_phy+0x2c/0x1d0\n|LR [c05648f8] phy_attach_direct+0x1a4/0x368\n|Call Trace:\n|[c1053b10] [c0811e04] klist_put+0x54/0xb4 (unreliable)\n|[c1053b40] [c05648f8] phy_attach_direct+0x1a4/0x368\n|[c1053b70] [c0564ae8] phy_connect_direct+0x2c/0x60\n|[c1053b90] [c056c7a8] of_phy_connect+0x50/0x74\n|[c1053bc0] [c0572a88] emac_probe+0xd50/0x119c\n|[c1053c90] [c04cb770] platform_probe+0x74/0xa4\n|[c1053cb0] [c04c8f08] really_probe+0x120/0x2b0\n|[c1053cd0] [c04c9254] __driver_probe_device+0x1bc/0x1fc\n|[c1053d00] [c04c9334] driver_probe_device+0x38/0xa8\n|[c1053d30] [c04c9560] __driver_attach+0xf4/0x10c\n|[c1053d50] [c04c6af8] bus_for_each_dev+0x68/0xd0\n|[c1053d90] [c04c7c34] bus_add_driver+0xcc/0x1ec\n|[c1053dc0] [c04c9f6c] driver_register+0xcc/0x110\n|[c1053de0] [c0aa3f40] emac_init+0x1c4/0x200\n\nThis bug showed up starting with v7.3-rc1. At the NIP in\nphy_link_topo_add_phy() is a netdev_need_ops_lock() check.\nThis was added by the following\ncommit ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\n\nThe bug shows up because at the time of_phy_connect() was called, the\nnetdev_ops were *not yet* determined. My fix is to move the code that\nsets netdev_ops+commac.ops+ethtool_ops further up as emac_init_config()\nderives that by looking at the device-tree and sets the required\ndev-\u003ephy_mode accordingly.\n\nDuring review, the Sashiko bot\u0027s AI stated that the commac assignment\nbecame a dead store. Great catch! To keep the original behavior as-is,\none mentioned option \"set dev-\u003ecommac.ops \u003d \u0026emac_commac_ops only in\nthe non-gige case?\" sounded like a great plan. So the dev-\u003ecommac.ops\nassignment for the non-gige-case moves into the else block.\n\nThis patch was tested on a WD MyBook Live (RGMII). the device now works again.\n\nFixes: ded86da4bbb7 (\"net: ethtool: relax ethnl_req_get_phydev() locking assertion\")\nSigned-off-by: Christian Lamparter \u003cchunkeey@gmail.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/49cd7343bc0e507c022071f3e2b5662b053dca73.1790007431.git.chunkeey@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d6ec384c87cc851cfd13bb18c99ce351ccee6192", "tree": "e4776108a6d7583451372b370b9fdd0015903f79", "parents": [ "c2de369c5c5b8599ca10fd5ca8d11fcd845c1331" ], "author": { "name": "Fang Xieyan", "email": "fangxy@xiaopeng.com", "time": "Mon Sep 21 20:54:41 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 24 15:28:37 2026 +0200" }, "message": "net/sched: act_ife: validate metadata length before decoding\n\nskbmark_decode(), skbprio_decode() and skbtcindex_decode() read fixed-size\nvalues from the TLV payload without validating its length.\n\nA malformed IFE frame can declare a shorter payload, causing the decoders\nto consume bytes beyond the declared metadata value:\n\n[TLV type\u003dIFE_META_SKBMARK len\u003d4]\n-\u003e dlen \u003d\u003d 0, but decode reads 4 bytes\n\nThe decoder may therefore set skb metadata from unintended input.\n\nValidate the payload length before decoding and return -EINVAL for\ninvalid lengths. Read the values with get_unaligned_be32() and\nget_unaligned_be16(), as TLV payloads are not guaranteed to be\naligned. Teach tcf_ife_decode() to log a decoder error separately\nfrom an unknown metaid; both are counted as overlimits and decoding\ncontinues with the remaining metadata.\n\nThe metadata length issue was found by an automated audit of the IFE\ndecode path at v6.18-rc7 and reproduced with a userspace sanitizer\nmodel of the decode path. Compile-tested on x86_64 with defconfig and\nNET_ACT_IFE\u003dy: act_ife.o and the three act_meta_*.o build\nwarning-free.\n\nFixes: 084e2f6566d2 (\"Support to encoding decoding skb mark on IFE action\")\nFixes: 200e10f46936 (\"Support to encoding decoding skb prio on IFE action\")\nFixes: 408fbc22ef1e (\"net sched ife action: Introduce skb tcindex metadata encap decap\")\nAssisted-by: Hawkeye:GLM-5.3-flash\nAssisted-by: Qoder:Qwen3.8-Max\nSigned-off-by: Fang Xieyan \u003cfangxy@xiaopeng.com\u003e\nLink: https://patch.msgid.link/20260921125441.81459-1-fangxy@xiaopeng.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f49a343b305c0b6c19a3b50c0bbf10bcd0e2e8fd", "tree": "baa6547bc4721f032ed87e20c94aa17bb9af21bc", "parents": [ "e2936d228b96346d474f368f1bb0172582035577", "ae2c5bf969573708cd5b6bb6393631255d83c3fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:19:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:19:09 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Serialize the calls to pinctrl_generic_dt_nod_to_map()\n\n - Fix a typo in S4 group in the Meson driver\n\n - Fix bank width and regmap usage in the MPFS-SSIO driver\n\n - Data register output latch behavior and voltage encoding\n fixes in the Sunxi driver\n\n - Free the IRQ domain on the error path in the single driver\n\n - Fix some QUP1 SE2/SE3 groups and a missing OF module alias\n in the Qualcomm drivers\n\n - Fix up the register banks for AON (I guess always-on) pins\n in the Tegra238 driver\n\n* tag \u0027pinctrl-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl: tegra238: Fix register bank for AON pin groups\n pinctrl: qcom: ipq5210: Publish the OF module alias\n pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions\n pinctrl: single: free the IRQ on domain creation failure\n pinctrl: sunxi: A523: fix voltage withstand encoding\n pinctrl: sunxi: keep a shadow copy of the data register output latches\n pinctrl: mpfs-mssio: use correct regmap function to set bank voltage\n pinctrl: mpfs-mssio: fix width of unused bank voltage setting\n pinctrl: generic: serialise pinctrl_generic_dt_node_to_map()\n pinctrl: meson: Fix typo in s4 group name\n" }, { "commit": "15814c01ac57643edf1662a076d2961332f277a5", "tree": "bb3141c7f61d61a9e961459cd4f755dd86045d72", "parents": [ "18779dd84515db093fedb4ebaf0998c9b165a5fb" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Sep 23 21:44:30 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Thu Sep 24 09:17:58 2026 -0400" }, "message": "drm/amd/display: Bump frame warning limit for all builds of dml\n\nSome configs with gcc are also now affected.\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 76b9706e7fa1a6e374703170128b1be2f590cda7)\n" }, { "commit": "e2936d228b96346d474f368f1bb0172582035577", "tree": "b7ae81f282afec7cc49d7035067085b15385acc8", "parents": [ "ef33dd4e0a5290b1de0e64e30e738f005289e1f2", "ba13f1f32d96d7ce9069ae4f32404ecde8da89c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:16:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:16:19 2026 -0700" }, "message": "Merge tag \u0027fixes-2026-09-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock\n\nPull memblock fix from Mike Rapoport:\n \"The rework of HugeTLB bootmem allocation forgot to add the name for a\n new RSV_HUGETLB flag for proper display in debugfs.\n\n Add the flag name now\"\n\n* tag \u0027fixes-2026-09-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mm/memblock:\n mm: memblock: add missing HugeTLB flag name\n" }, { "commit": "c2de369c5c5b8599ca10fd5ca8d11fcd845c1331", "tree": "d4e9112dbaa9ef8ac1647dddb45b00a287951edf", "parents": [ "58eb1b3325edac42dc6df72c80962bd53a3c8ca7" ], "author": { "name": "Haseeb Malik", "email": "haseebulhaq55@gmail.com", "time": "Mon Sep 21 16:40:30 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 24 15:15:20 2026 +0200" }, "message": "macsec: initialize SecY before registering the netdevice\n\nCreating a MACsec device with MAC offload over an LRO-capable lower\ndevice triggers a warning in rtmsg_ifinfo_build_skb() when IPv4\nforwarding is enabled by default.\n\nregister_netdevice() invokes inetdev_init(), which disables LRO and emits\na NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before\nmacsec_add_dev() initializes the SecY. key_len is still zero, so\nmacsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in\nrtmsg_ifinfo_build_skb(), even though the skb has enough space.\n\nEven without the warning, notifications during registration can report\nuninitialized SecY attributes, including the SCI. This ordering has existed\nsince the driver was introduced.\n\nInitialize the SecY and apply the new-link attributes before registration.\nMove MAC address inheritance into macsec_newlink() so the SCI can also be\ninitialized before registration-time notifications report it. Move the\nper-CPU statistics and metadata destination allocation into ndo_init(),\nand release partial allocations on failure.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nReported-by: syzbot+f2f6312ad1b5a0bfe316@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003df2f6312ad1b5a0bfe316\nSuggested-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://lists.openwall.net/linux-kernel/2026/08/19/552\nSigned-off-by: Haseeb Malik \u003chaseebulhaq55@gmail.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260921-fix-macsec-net-v3-1-accf94f93f5e@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ef33dd4e0a5290b1de0e64e30e738f005289e1f2", "tree": "b9ee07a123422cf8594127c601e75a58215246db", "parents": [ "62f4c998b297cf233997a2b4cd6fc2d2df0319c9", "2bc6b218717b9d08f466f88209251d54bc09b207" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:08:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 24 06:08:15 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n\n - Fix the recently merged user ABI for the Arm CMN PMU driver filtering\n logic so that the ordering matches the hardware spec\n\n - Fix spurious warning when attempting to read PROT_NONE mappings of\n /dev/mem\n\n - Allow WFxT to be disabled on the command line, which is necessary for\n some configurations of recent Apple SoCs\n\n - Fix EL2 fine-grained trap configuration for the CPU PMU\n\n - Fix MIDR matching when applying CPU errata workarounds in a VM\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64/boot: Disable trapping of PMZR_EL0 writes to EL2\n arm64: errata: match the target implementation CPU\u0027s own MIDR\n arm64: Add override for WFxT\n arm64: io: Reject non-user protection in ioremap_prot()\n perf/arm-cmn: Fix multi-filter encoding\n" }, { "commit": "58eb1b3325edac42dc6df72c80962bd53a3c8ca7", "tree": "c4272625a4852a870eac51ab03c9d2a4fc9ce463", "parents": [ "77b1718e39e5c9f6956fb60807326af20baf889d" ], "author": { "name": "Dongliang Qin", "email": "cccccccccccc777777@gmail.com", "time": "Tue Sep 22 11:15:45 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 24 13:18:19 2026 +0200" }, "message": "rds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller\u0027s scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.\n\nFixes: 1659185fb4d0 (\"RDS: IB: Support Fastreg MR (FRMR) memory registration mode\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dongliang Qin \u003ccccccccccccc777777@gmail.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260922031546.3874605-1-cccccccccccc777777@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "77b1718e39e5c9f6956fb60807326af20baf889d" }