)]}' { "log": [ { "commit": "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "tree": "3e6f6fc02705146ac1151cfb68029510396c3afd", "parents": [ "e5d505e3664bb31f59776b7b3873965228fe944f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 13:59:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 13:59:58 2026 -0700" }, "message": "Linux 7.1-rc4\n" }, { "commit": "e5d505e3664bb31f59776b7b3873965228fe944f", "tree": "7ef201030bfb993625582e10b16a881b2cea206a", "parents": [ "23e6a1ca04ae44806439a5a446e62e4d42e80bb4", "55a0005518195fdea1fd2991b07644f8dc97ea8e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 12:02:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 12:02:31 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Add more functions to the remote allowed list\n\n randconfig found more functions that are allowed for the remote code\n for s390 and arm. Add them to the allowed list.\n\n - Fix remote_test error path\n\n If one of the simple ring buffers fails to load, the code is supposed\n to rollback its initialized buffers. Instead of rolling back the\n buffers for the failed load, it uses the global variable and rolls\n back all the successfully loaded buffers.\n\n* tag \u0027trace-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix desc in error path for the trace remote test module\n ring-buffer remote: Avoid unexpected symbol warnings (arm, s390)\n" }, { "commit": "23e6a1ca04ae44806439a5a446e62e4d42e80bb4", "tree": "5a56958c66555bc3d55a4689f41082c0ac4aa319", "parents": [ "e7f24a388e703e505a7f8d014a428308b35e8f94" ], "author": { "name": "Carlos López", "email": "clopez@suse.de", "time": "Tue May 12 12:00:41 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:45:07 2026 -0700" }, "message": "virt: sev-guest: Do not use host-controlled page order in cleanup path\n\nWhen issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST),\nget_ext_report() allocates a buffer to retrieve a certificate blob from the\nhost, keeping track of its size in report_req-\u003ecerts_len.\n\nHowever, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating\nan invalid buffer size, as well as the expected length of such buffer.\nget_ext_report() subsequently updates report_req-\u003ecerts_len with the\nhost-controlled value, and cleans up the buffer by computing a page order\nfrom such value. This is incorrect, as the host-provided length may not\nmatch the page order of the original allocation, potentially resulting\nin corruption in the page allocator.\n\nFix this by using alloc_pages_exact() instead, and reusing @npages to\ncompute the size passed to free_pages_exact(). For consistency, also\nuse @npages to compute the size when allocating the pages, even though\nthis last change has no functional effect.\n\nFixes: 3e385c0d6ce8 (\"virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex\")\nSigned-off-by: Carlos López \u003cclopez@suse.de\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nTested-by: Michael Roth \u003cmichael.roth@amd.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e7f24a388e703e505a7f8d014a428308b35e8f94", "tree": "4bea6bab9b976c75bc8e156af145e52d756311f3", "parents": [ "46cd5b22e58805b5651dfc732cd23615e940ac8d", "786a45757dcdf8f2beb9d4a6db605db16c18b2b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:40:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:40:18 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Ingo Molnar:\n\n - Fix x86 boot crash for non-kjump kexecs (David Woodhouse)\n\n* tag \u0027x86-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/kexec: Push kjump return address even for non-kjump kexec\n" }, { "commit": "46cd5b22e58805b5651dfc732cd23615e940ac8d", "tree": "df4529fa17faa92a55b5d7b725519a549d7792ad", "parents": [ "c97481ab7973ef21084e71b8e965b51e69b574df", "602d60ebae0f10bfbc7ba90eee026fdbd0203df3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:07:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 11:07:09 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix potential garbage reads in the vDSO gettimeofday code\n (Thomas Weißschuh)\n\n* tag \u0027timers-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n vdso/gettimeofday: Reload sequence counter after switch to time page in do_aux()\n" }, { "commit": "c97481ab7973ef21084e71b8e965b51e69b574df", "tree": "f53d8b6a3527bda6f877c8faf21fb735aeb7f091", "parents": [ "daa3de23f9e8a60cc817b0b714f6ba3b70799de2", "411c1cf430392c905e39f12bc305dd994da0b426" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:59:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:59:32 2026 -0700" }, "message": "Merge tag \u0027sched-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n\n - Fix ARM64-specific rseq regressions (Mark Rutland)\n\n* tag \u0027sched-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n arm64/entry: Fix arm64-specific rseq brokenness\n" }, { "commit": "daa3de23f9e8a60cc817b0b714f6ba3b70799de2", "tree": "049443438ba7aa514941dba31a77a832cf48dba5", "parents": [ "ec296ebf6d6dffef27ab1f01b7fd8bdd9d097a4f", "ea324444ece9f301b5c4ff71b258cc68990c4d61" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:50:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:50:13 2026 -0700" }, "message": "Merge tag \u0027ras-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull MCE fix from Ingo Molnar:\n\n - Fix an MCE polling interval adjustment regression (Borislav Petkov)\n\n* tag \u0027ras-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mce: Restore MCA polling interval halving\n" }, { "commit": "ec296ebf6d6dffef27ab1f01b7fd8bdd9d097a4f", "tree": "3761ce2daa948da1edefb4d66659edb0fdadb8ea", "parents": [ "f7c79949bef47ff93167c8ae85a07ac006ed7139", "91840be8f710370607f949a627e070896faeddb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:34:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 10:34:15 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull IRQ fixes from Ingo Molnar:\n\n - Fix use-after-free in irq_work_single() on PREEMPT_RT (Jiayuan Chen)\n\n - Don\u0027t call add_interrupt_randomness() for NMIs in\n handle_percpu_devid_irq() (Mark Rutland)\n\n - Remove unused function in the ath79-cpu irqchip driver causing LKP\n CI build warnings (Rosen Penev)\n\n - Fix IRQ allocation/teardown leakage regressions in the GICv5 irqchip\n driver (Sascha Bischoff)\n\n - Fix an IRQ trigger type regression in the Meson S4 SoC irqchip driver\n (Xianwei Zhao)\n\n - Fix CPU offlining regression in the RiscV IMSIC irqchip driver\n (Yong-Xuan Wang)\n\n* tag \u0027irq-urgent-2026-05-17\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\n irqchip/riscv-imsic: Clear interrupt move state during CPU offlining\n irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()\n irqchip/ath79-cpu: Remove unused function\n genirq/chip: Don\u0027t call add_interrupt_randomness() for NMIs\n irqchip/gic-v5: Allocate ITS parent LPIs as a range\n irqchip/gic-v5: Support range allocation for LPIs\n irqchip/gic-v5: Move LPI allocation into the LPI domain\n" }, { "commit": "f7c79949bef47ff93167c8ae85a07ac006ed7139", "tree": "48915021634358f3027164c8acbfd4c1a17322aa", "parents": [ "1405a07192a3c5420c5fd7437f7945ebe1e71ad7", "b69bcb13ed7024a84d6cd8ad330f1e32782fcf28" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:33:49 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:33:49 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"Relatively low-impact fixes. Probably the most notable one is that we\n no longer ask the monitor-mode firmware to delegate misaligned access\n handling to the kernel by default, since the kernel code needs\n significant improvement to match the functionality of the firmware.\n This change avoids functional problems at some cost in performance,\n but shouldn\u0027t affect any system with misaligned access handling in\n hardware.\n\n - Disable satp register probing when no5lvl is specified on the\n kernel command line\n\n - Fix a CFI-related issue with the misaligned access speed\n measurement code\n\n - Reduce the CFI shadow stack size limit from 4GB to 2GB (following\n ARM64 GCS)\n\n - Prevent the kernel from requesting delegation of misaligned access\n faults unless a new Kconfig option, RISCV_SBI_FWFT_DELEGATE_MISALIGNED,\n is enabled. This will depend on CONFIG_NONPORTABLE until the\n deficiencies of the kernel misaligned access fixup code are fixed\n\n - Fix some potential uninitialized memory accesses in error paths in\n compat_riscv_gpr_set() and compat_restore_sigcontext()\n\n - Fix a bug in the RISC-V MIPS vendor errata patching code where a\n logical-and was used in place of a bitwise-and\n\n - Drop some unnecessary code in riscv_fill_hwcap_from_isa_string()\n\n - Use macros for isa2hwcap indices in riscv_fill_hwcap(), rather than\n open-coding them\n\n - Fix some documentation typos (one affecting \u0027make htmldocs\u0027)\"\n\n* tag \u0027riscv-for-linus-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n riscv: misaligned: Make enabling delegation depend on NONPORTABLE\n riscv: Docs: fix unmatched quote warning\n riscv: cfi: reduce shadow stack size limit from 4GB to 2GB\n riscv: cpufeature: Use pre-defined ISA ext macros to index isa2hwcap\n riscv: mm: Fixup no5lvl failure when vaddr is invalid\n riscv: Fix register corruption from uninitialized cregs on error\n riscv: errata: Fix bitwise vs logical AND in MIPS errata patching\n Documentation: riscv: cmodx: fix typos\n riscv: cpufeature: Drop this_hwcap clear in T-Head vector workaround\n riscv: Define __riscv_copy_{,vec_}{words,bytes}_unaligned() using SYM_TYPED_FUNC_START\n" }, { "commit": "1405a07192a3c5420c5fd7437f7945ebe1e71ad7", "tree": "6dbce05e49a466650da16355b4b9c63484b78510", "parents": [ "fe6f8e913df9319db03fd107671ff02f104ca38c", "873e919e3101063a7a75989510ccfc125a4391cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:23:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 17 09:23:28 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - asus_atk0110, acpi_power_meter: Add missing NULL pointer checks\n\n - lm90: Fix locking and UAF issues\n\n - sy7636a: Fix sysfs attribute name in documentation\n\n* tag \u0027hwmon-for-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (lm90) Add lock protection to lm90_alert\n hwmon: (lm90) Stop work before releasing hwmon device\n docs: hwmon: sy7636a: fix temperature sysfs attribute name\n hwmon: (asus_atk0110) Check ACPI_COMPANION() against NULL\n hwmon: (acpi_power_meter) Check ACPI_COMPANION() against NULL\n" }, { "commit": "55a0005518195fdea1fd2991b07644f8dc97ea8e", "tree": "2ec0f9f1024e3977336636259651beea1886a505", "parents": [ "96350db80e0acd733e9b9ef61c0d910790b27289" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Fri May 15 21:16:16 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Sat May 16 16:11:04 2026 -0400" }, "message": "tracing: Fix desc in error path for the trace remote test module\n\nDuring initialisation in remote_test_load(), if one of the\nsimple_ring_buffer fails to initialise, the error path attempts to\nrollback initialised buffers. However, the rollback incorrectly uses the\nglobal pointer to the trace descriptor, which is only set upon\nsuccessful load completion. Fix the error path by using the local\npointer to the descriptor.\n\nLink: https://patch.msgid.link/20260515201616.337469-1-vdonnefort@google.com\nFixes: ea908a2b79c8 (\"tracing: Add a trace remote module for testing\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\n\nbase-commit: 5d6919055dec134de3c40167a490f33c74c12581\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "fe6f8e913df9319db03fd107671ff02f104ca38c", "tree": "4395f89beaf01f11c567bad5e08696546a25e4fb", "parents": [ "b6a08b017f8c7723c7e4c3fc460a3a7bf5870b2c", "31467b23823ffec1f6fff407f8e3ca9af8b7491a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:53:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:53:14 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n\n - Fix preempt count leak in sysfs show paths\n\n - Fix error handling in pika_dtm_thread\n\n - Remove pmac_low_i2c_{lock,unlock}()\n\n - Enable all windfarms by default\n\n - Fix dead default for GUEST_STATE_BUFFER_TEST\n\n - Remove redundant preempt_disable|enable() calls from\n arch_irq_work_raise()\n\nThanks to Aboorva Devarajan, Ally Heev, Amit Machhiwal, Bart Van Assche,\nChristophe Leroy, Christophe Leroy (CS GROUP), Dan Carpenter, Gautam\nMenghani, Harsh Prateek Bora, Julian Braha, Krzysztof Kozlowski, Linus\nWalleij, Ma Ke, Ritesh Harjani (IBM), and Sayali Patil\n\n* tag \u0027powerpc-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n powerpc/hv-gpci: fix preempt count leak in sysfs show paths\n powerpc: fix dead default for GUEST_STATE_BUFFER_TEST\n powerpc/powermac: Remove pmac_low_i2c_{lock,unlock}()\n powerpc/warp: Fix error handling in pika_dtm_thread\n powerpc: 82xx: fix uninitialized pointers with free attribute\n powerpc/g5: Enable all windfarms by default\n" }, { "commit": "b6a08b017f8c7723c7e4c3fc460a3a7bf5870b2c", "tree": "88e9377bf22c941fa795430b4259da754c767d9f", "parents": [ "6916d5703ddf9a38f1f6c2cc793381a24ee914c6", "6fd9f6e870ea285f05102e8e00e6a7f4495a9a02" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:32:30 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 16 09:32:30 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes. All device-specific small changes:\n\n HD-audio:\n - Fix NULL pointer dereference in snd_hda_ctl_add()\n - ACPI and Kconfig fixes for Cirrus drivers\n - A regression fix CA0132 codec\n - Various device-specific quirks for HP, Lenovo, Samsung, Framework etc\n - Documentation path fix\n\n USB-audio:\n - Boundary checks for MIDI endpoint descriptors\n - Offload mapping error handling for Qualcomm\n - A new device quirk for TTGK Technology USB-C Audio\n - A fix for Focusrite Scarlett2 mixer\"\n\n* tag \u0027sound-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/ca0132: Disable auto-detect on manual output select\n ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx\n ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio\n ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()\n ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone\n ALSA: hda/cs35l56: Drop malformed default N from Kconfig\n ALSA: hda/realtek: fix mic boost on Framework PTL\n ALSA: hda/realtek: Limit mic boost on Positivo DN50E\n ALSA: doc: cs35l56: Update path to HDA driver source\n ALSA: usb-audio: qcom: Check offload mapping failures\n ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding\n ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio\n ALSA: scarlett2: Add missing error check when initialise Autogain Status\n ALSA: hda: cs35l41: Put ACPI device on missing physical node\n ALSA: hda: cs35l56: Put ACPI device after setting companion\n ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans\n ALSA: usb-audio: Bound MIDI endpoint descriptor scans\n ALSA: hda/realtek: Add codec SSID quirk for Lenovo Yoga Pro 9 16IMH9 (17aa:38d5)\n" }, { "commit": "873e919e3101063a7a75989510ccfc125a4391cf", "tree": "9d8b479869595016bdd607103e305cb5098b7027", "parents": [ "b09a45601094c7f4ec4db8090b825fa61e169d93" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 14:41:00 2026 -0700" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Sat May 16 08:10:33 2026 -0700" }, "message": "hwmon: (lm90) Add lock protection to lm90_alert\n\nSashiko reports:\n\nlm90_alert() executes in the smbus alert context and calls\nlm90_update_confreg() to disable the hardware alert line, without\nacquiring hwmon_lock.\n\nConcurrently, sysfs write operations (such as lm90_write_convrate) hold\nthe hwmon_lock, temporarily modify data-\u003econfig, and then restore it.\n\nIf an alert interrupt occurs concurrently with a sysfs write, the sysfs\npath will overwrite the alert handler\u0027s modifications to data-\u003econfig\nand the hardware register.\n\nThis unintentionally re-enables the hardware alert line while the alarm is\nstill active, causing an interrupt storm.\n\nAdd the missing lock to lm90_alert() to solve the problem.\n\nFixes: 7a1d220ccb0cc (\"hwmon: (lm90) Introduce function to update configuration register\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "b09a45601094c7f4ec4db8090b825fa61e169d93", "tree": "07b6c47b639461cfabaf34117b00fd9f2662c51b", "parents": [ "51f57607e30bee282a1d40845f89a311cbb26481" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 14:31:49 2026 -0700" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Sat May 16 08:09:55 2026 -0700" }, "message": "hwmon: (lm90) Stop work before releasing hwmon device\n\nSashiko reports:\n\nIn lm90_probe(), the devm action to cancel the alert_work and report_work\n(lm90_restore_conf) is registered in lm90_init_client() before\ndevm_hwmon_device_register_with_info() is called.\n\nBecause devm executes cleanup actions in reverse order during module\nunbind or probe failure, the hwmon device is unregistered and freed first.\n\nIf lm90_alert_work() or lm90_report_alarms() runs in the window between\nthe hwmon device being freed and the delayed works being cancelled,\nlm90_update_alarms() will dereference the freed data-\u003ehwmon_dev here.\n\nFix the problem by canceling the workers separately after registering\nthe hwmon device and before registering the interrupt handler. This ensures\nthat the workers are canceled after interrupts are disabled and before\nthe hwmon device is released. Add \"shutdown\" flag to indicate that device\nshutdown is in progress to prevent workers from being re-armed.\n\nFixes: f6d0775119fb9 (\"hwmon: (lm90) Rework alarm/status handling\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "6916d5703ddf9a38f1f6c2cc793381a24ee914c6", "tree": "1fb4d4a4203c08f683ab24ad56c4e405ce74e90d", "parents": [ "36343a8ff328efd3eb5604e3567d63e6c7906deb", "dc366607c41c45fd0ae6f3db090f31dd611b644a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 17:00:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 17:00:45 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-16\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull, small and all over fixes, mostly xe and amdgpu,\n with some ttm and a core fix for the handle change pain.\n\n core:\n - fix for the fix for the handle change race\n\n ttm:\n - avoid infinite loop in swap out\n - avoid infinite loop in BO shrinking\n - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n\n bridge:\n - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n\n i915:\n - Skip __i915_request_skip() for already signaled requests\n - Fix VSC dynamic range signaling for RGB formats [dp]\n\n xe:\n - Madvise fix around purgeability tracking\n - Restore engine mask for specific blitter style\n - Couple UAF fixes\n - Drop unused ggtt_balloon field\n\n amdgpu:\n - Userq fixes\n - DCN 3.2 fix\n - RAS fix\n - GC 12 fix\n\n gma500:\n - oaktrail_lvds: fix i2c handling\n\n loongson:\n - use managed cleanup for connector polling\n\n panfrost:\n - handle results from reservation locking correctly\n\n qaic:\n - check for integer overflows in mmap logic\n\n rocket:\n - handle results from reservation locking correctly\"\n\n* tag \u0027drm-fixes-2026-05-16\u0027 of https://gitlab.freedesktop.org/drm/kernel: (26 commits)\n drm: Replace old pointer to new idr\n drm/loongson: Use managed KMS polling\n drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure\n drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init\n drm/gma500/oaktrail_lvds: fix hang on init failure\n drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup\n drm/xe: Drop unused ggtt_balloon field\n accel/qaic: Add overflow check to remap_pfn_range during mmap\n drm/i915/dp: Fix VSC dynamic range signaling for RGB formats\n drm/i915: skip __i915_request_skip() for already signaled requests\n drm/bridge: imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n drm/amdgpu/gfx_v12_0: set gfx.rs64_enable from PFP header on GFX12\n drm/amd/ras: Fix CPER ring debugfs read overflow\n drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n drm/amdgpu: fix userq hang detection and reset\n drm/amdgpu: remove almost all calls to amdgpu_userq_detect_and_reset_queues\n drm/amdgpu: rework amdgpu_userq_signal_ioctl v3\n drm/amdgpu: remove deadlocks from amdgpu_userq_pre_reset\n drm/xe/dma-buf: fix UAF with retry loop\n ...\n" }, { "commit": "dc366607c41c45fd0ae6f3db090f31dd611b644a", "tree": "d5e6bb97b8533f124fab699170844134dc34f832", "parents": [ "396db75a1f7fb7b34b0b6101e3802bc418c4e868" ], "author": { "name": "Edward Adam Davis", "email": "eadavis@qq.com", "time": "Wed May 13 12:30:50 2026 +0800" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 09:32:43 2026 +1000" }, "message": "drm: Replace old pointer to new idr\n\nCommit 5e28b7b94408 introduced a logical error by failing to replace the\nnewly generated IDR pointer to old id\u0027s pointer at the correct location\nwithin the \"change handle\" logic; this resulted in the issue reported by\nsyzbot [1].\n\nSpecifically, the new IDR object pointer is intended to replace the original\nid\u0027s pointer during the normal execution flow.\n\nAdditionally, an unnecessary conditional check for the ret exit path has\nbeen removed.\n\n[1]\n!RB_EMPTY_ROOT(\u0026prime_fpriv-\u003edmabufs)\nWARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833\nCall Trace:\n drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269\n drm_file_free drivers/gpu/drm/drm_file.c:237 [inline]\n drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290\n drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438\n\nFixes: 5e28b7b94408 (\"drm: Set old handle to NULL before prime swap in change_handle\")\nReported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dd7c9eed171647e421013\nCc: stable@vger.kernel.org\nTested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/tencent_C267296443AAA4567771176886DFF364A305@qq.com\n" }, { "commit": "36343a8ff328efd3eb5604e3567d63e6c7906deb", "tree": "2fe5960dd65f153476b9ef155ab6bb751499a915", "parents": [ "30e0ff6d6a83586486674c343db5e9d933bd92e0", "6ccbb613b42a1f1ba7bfd547a148f644a902a25c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:40:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:40:25 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 MPAM fixes from Catalin Marinas:\n\n - Fix NULL dereference and a false-positive warning when the driver\n probes hardware with surprising version numbers\n\n - Fix writing values to the wrong registers when probing\n cache-utilisation counters. Replace \u0027NRDY\u0027 probing with a version\n that is robust for platforms where the bit is writeable by both\n hardware and software\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm_mpam: Check whether the config array is allocated before destroying it\n arm_mpam: Fix false positive assert failure during mpam_disable()\n arm_mpam: Improve check for whether or not NRDY is hardware managed\n arm_mpam: Pretend that NRDY is always hardware managed\n arm_mpam: Fix monitor instance selection when checking for hardware NRDY\n" }, { "commit": "30e0ff6d6a83586486674c343db5e9d933bd92e0", "tree": "3f693f74f843af955fc6b7aa5cfe206f69789f22", "parents": [ "3bf83e47b497d2630d2dcb408ec14ad95050cead", "1bb54043ff309795c90ccadd8a6e6b13ac40ec4e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:22:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:22:26 2026 -0700" }, "message": "Merge tag \u0027iommu-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"This is probably the largest fixes pull-request ever sent for IOMMU. I\n partially blame it on AI code review which found some issues but there\n is also some rework in here to fix issues in the iommu parts of PCI\n device reset.\n\n AMD-Vi:\n - Add bounds checks to debugfs and table lookups\n\n Intel VT-d:\n - Apply an existing quirk for Q35 graphic device\n - Skip dev_pasid teardown for the blocked domain to avoid\n out-of-bounds access\n - Return early if dev_pasid is missing to prevent NULL dereference\n or UAF\n\n Core:\n - Fix bugs and corner cases in pci_dev_reset_iommu_prepare/done()\n - Fix various issues found by AI in iommupt code\n\n MAINTAINERS email address update for RISCV IOMMU\"\n\n* tag \u0027iommu-fixes-v7.1-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n MAINTAINERS: update Tomasz Jeznach\u0027s email address\n iommupt: Fix the end_index calculation in __map_range_leaf()\n iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n iommu: Handle unmap error when iommu_debug is enabled\n iommu: Fix up map/unmap debugging for iommupt domains\n iommu: Fix loss of errno on map failure for classic ops\n iommu/vt-d: Avoid NULL pointer dereference or refcount corruption\n iommu/vt-d: Fix oops due to out of scope access\n iommu/vt-d: Disable DMAR for Intel Q35 IGFX\n iommu: Warn on premature unblock during DMA aliased sibling reset\n iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset\n iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid()\n iommu: Fix nested pci_dev_reset_iommu_prepare/done()\n iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done()\n iommu: Replace per-group resetting_domain with per-gdev blocked flag\n iommu: Fix kdocs of pci_dev_reset_iommu_done()\n iommu: Fix NULL group-\u003edomain dereference in pci_dev_reset_iommu_done()\n iommu/amd: Bounds-check devid in __rlookup_amd_iommu()\n iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs\n" }, { "commit": "3bf83e47b497d2630d2dcb408ec14ad95050cead", "tree": "d9fb350f33550a2e95dc81f44f4783ce5b0a3e69", "parents": [ "b0662be9131d87d8858d34d6134500e109dff958", "702809dabdecca807bdd50cfdcc1c980feb2ba62" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:13:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 15:13:02 2026 -0700" }, "message": "Merge tag \u0027vfio-v7.1-rc4\u0027 of https://github.com/awilliam/linux-vfio\n\nPull VFIO fixes from Alex Williamson:\n\n - Convert vfio-pci BAR resource requests and iomaps initialization\n from a lazy, on-demand model to an eager pre-allocation model to\n avoid races while preserving legacy error behavior. Fix unchecked\n barmap access in dma-buf export path (Matt Evans)\n\n - Introduce an implicit unsigned cast in converting vfio-pci device\n offsets to region indexes, closing a potential out-of-bounds\n access through the vfio_pci_ioeventfd() interface (Matt Evans)\n\n - Fix a dma-buf kref underflow and stuck wait_for_completion() when\n closing a previously revoked dma-buf (Alex Williamson)\n\n* tag \u0027vfio-v7.1-rc4\u0027 of https://github.com/awilliam/linux-vfio:\n vfio/pci: Check BAR resources before exporting a DMABUF\n vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()\n vfio/pci: Make VFIO_PCI_OFFSET_TO_INDEX() return unsigned\n vfio/pci: fix dma-buf kref underflow after revoke\n" }, { "commit": "396db75a1f7fb7b34b0b6101e3802bc418c4e868", "tree": "294fa960e301e419c54713654634a10a077dba98", "parents": [ "96f34d185cce4dd0967acce8830775374821f9bc", "0a9c56dd387605d17dabeedd9fdd2c4c1d0bab7b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:55:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:56:32 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-15\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\nbridge:\n- imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup\n\ngma500:\n- oaktrail_lvds: fix i2c handling\n\nloongson:\n- use managed cleanup for connector polling\n\npanfrost:\n- handle results from reservation locking correctly\n\nqaic:\n- check for integer overflows in mmap logic\n\nrocket:\n- handle results from reservation locking correctly\n\nttm:\n- avoid infinite loop in swap out\n- avoid infinite loop in BO shrinking\n- convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260515070816.GA88575@2a02-2455-9062-2500-7dec-552d-233d-9fe0.dyn6.pyur.net\n" }, { "commit": "b0662be9131d87d8858d34d6134500e109dff958", "tree": "c7c43b4a9c96c309c924a8d7a3cc9270be6daefe", "parents": [ "fcbf68d32ff732b78122690e862d260b000e19e2", "c207f1d785044667f87cc8c72355e33f3981f2d6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:52:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:52:17 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix integer overflow in read\n\n - Fix smbdirect error cleanup\n\n - Multichannel reconnect fix\n\n - Add some missing defines and correct some references to protocol spec\n\n - Fix oob symlink read\n\n* tag \u0027v7.1-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter()\n smb: client: avoid integer overflow in SMB2 READ length check\n cifs: client: stage smb3_reconfigure() updates and restore ctx on failure\n smb/client: fix possible infinite loop and oob read in symlink_data()\n SMB3.1.1: add missing QUERY_DIR info levels\n" }, { "commit": "fcbf68d32ff732b78122690e862d260b000e19e2", "tree": "6097e6e296bc13edb9133ec04cd5977d24607e84", "parents": [ "a8b0b72255d09bb12ada5620cd6ced91adde5ac8", "28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:48:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 14:48:09 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc4\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"An important patch from Hristo that squashes a folio reference leak\n that could lead to OOM kills in CephFS and a number of miscellaneous\n fixes from Raphael and Slava.\n\n All but two are marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc4\u0027 of https://github.com/ceph/ceph-client:\n libceph: Fix potential null-ptr-deref in decode_choose_args()\n libceph: handle rbtree insertion error in decode_choose_args()\n libceph: Fix potential out-of-bounds access in osdmap_decode()\n ceph: put folios not suitable for writeback\n ceph: add ceph_has_realms_with_quotas() check to ceph_quota_update_statfs()\n libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size\n ceph: fix a buffer leak in __ceph_setxattr()\n libceph: Fix unnecessarily high ceph_decode_need() for uniform bucket\n libceph: Fix potential out-of-bounds access in crush_decode()\n" }, { "commit": "96f34d185cce4dd0967acce8830775374821f9bc", "tree": "6bdad78178c7abd85789fac15b9c6043ddc0c332", "parents": [ "68055b285428a09f098861a702024e9d8f1370c8", "8fb70afe671cc8c1f6237a39aabd50714fcd1189" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:47:06 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 16 07:48:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-14\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Madvise fix around purgeability tracking (Arvind)\n- Restore engine mask for specific blitter style (Roper)\n- Couple UAF fixes (Auld)\n- Drop unused ggtt_balloon field (Wajdeczko)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/agXWkM3Y98bqt6TG@intel.com\n" }, { "commit": "a8b0b72255d09bb12ada5620cd6ced91adde5ac8", "tree": "8c52d11b3767e123c14783d94cf857a9ef6a5b7a", "parents": [ "663ea69540c8d7ba332c9a3129d7f3cf5de50d9b", "c562ba61fc5e11798720acc1b172862158f1fa0b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:22:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:22:07 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fixup warning when allocating memory for readahead, __GFP_NOWARN was\n accidentally dropped when setting mapping constraints\n\n - in tracepoint of file sync, fix sleeping in atomic context when\n handling dentries\n\n - harden initial loading of block group on crafted/fuzzed images,\n iterate all chunk mapping entries unconditionally\n\n - fix freeing pages of submitted io after checking for errors\n\n - fix incorrect inode size after remount when using fallocate KEEP_SIZE\n mode (also requires disabled \u0027no-holes\u0027 feature)\n\n* tag \u0027for-7.1-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix incorrect i_size after remount caused by KEEP_SIZE prealloc gap\n btrfs: only release the dirty pages io tree after successful writes\n btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()\n btrfs: always pass __GFP_NOWARN from add_ra_bio_pages()\n btrfs: fix check_chunk_block_group_mappings() to iterate all chunk maps\n" }, { "commit": "663ea69540c8d7ba332c9a3129d7f3cf5de50d9b", "tree": "89a20c56660885e1af613418e77ffc4914838b4f", "parents": [ "56ec2b646de6349c8c8c05c8df17b4d8998c467a", "509fdeb3326be0db055e88d0f689a3888f147f90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:17:46 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:17:46 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"A few bug fixes, nothing really special stands out\"\n\n* tag \u0027xfs-fixes-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: Fix typo in comment\n xfs: fix the \"limiting open zones\" message\n xfs: flush delalloc blocks on ENOSPC in xfs_trans_alloc_icreate\n xfs: check da node block pad field during scrub\n xfs: fix memory leak for data allocated by xfs_zone_gc_data_alloc()\n xfs: fix memory leak on error in xfs_alloc_zone_info()\n xfs: check directory data block header padding in scrub\n xfs: zero directory data block padding on write verification\n xfs: zero entire directory data block header region at init\n xfs: remove the meaningless XFS_ALLOC_FLAG_FREEING\n" }, { "commit": "56ec2b646de6349c8c8c05c8df17b4d8998c467a", "tree": "0fb30cfedd511450d45bf374176b20cac3bd7c9d", "parents": [ "d458a240344c4369bf6f3da203f2779515177738", "4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:11:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 13:11:41 2026 -0700" }, "message": "Merge tag \u0027nfsd-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fixes from Chuck Lever:\n \"Fixes for this release:\n - Correctness fix for the new sunrpc cache netlink protocol\n\n Marked for stable:\n - Correctness fixes for delegated attributes\n - Prevent an infinite loop when revoking layouts\"\n\n* tag \u0027nfsd-7.1-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n NFSD: Fix infinite loop in layout state revocation\n sunrpc: start cache request seqno at 1 to fix netlink GET_REQS\n nfsd: update mtime/ctime on COPY in presence of delegated attributes\n nfsd: update mtime/ctime on CLONE in presense of delegated attributes\n nfsd: fix file change detection in CB_GETATTR\n nfsd: fix GET_DIR_DELEGATION when VFS leases are disabled\n" }, { "commit": "d458a240344c4369bf6f3da203f2779515177738", "tree": "eae2d12d85f7290dbf5d4cbe7666cb070762266e", "parents": [ "ee7226b2ae3beff5d8feffa94e5fd06af6965e52", "4141f46daa4cf1f8caa14129f8b6db86f17452f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:47:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:47:00 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe merge request via Keith:\n - Fix memory leak on a passthrough integrity mapping failure (Keith)\n - Hide secrets behind debug option (Hannes)\n - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)\n - Fix tcp taregt use-after-free for data digest (Sagi)\n - Revert a mistaken quirk (Alan Cui)\n - Fix uevent and controller state race condition (Maurizio)\n - Fix apple submission queue re-initialization (Nick Chan)\n\n - Three fixes for blk-integrity, fixing an issue with the user data\n mapping and two problems with recomputing number of segments\n\n - Two fixes for the iov_iter bounce buffering\n\n - Fix for the handling of dead zoned write plugs\n\n - ublk max_sectors validation fix, with associated selftest addition\n\n* tag \u0027block-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n nvme-apple: Reset q-\u003esq_tail during queue init\n block: align down bounces bios\n block: pass a minsize argument to bio_iov_iter_bounce\n selftests: ublk: cap nthreads to kernel\u0027s actual nr_hw_queues\n block: fix handling of dead zone write plugs\n block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()\n block: recompute nr_integrity_segments in blk_insert_cloned_request\n block: don\u0027t overwrite bip_vcnt in bio_integrity_copy_user()\n nvme: fix race condition between connected uevent and STARTED_ONCE flag\n Revert \"nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808\"\n nvmet-tcp: Fix potential UAF when ddgst mismatch\n nvme-pci: fix use-after-free in nvme_free_host_mem()\n nvmet-auth: Do not print DH-HMAC-CHAP secrets\n nvme: fix bio leak on mapping failure\n nvme: make prp passthrough usage less scary\n ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation\n" }, { "commit": "ee7226b2ae3beff5d8feffa94e5fd06af6965e52", "tree": "879de35d9f4e791daae5f8588775d553888601c3", "parents": [ "78e8370033bfe08481212ceead113ccb668b83cb", "f44d38a31f1802b7222adaea9ee69f9d280f698a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:34:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:34:02 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Small series sanitizing the locking done for either modifying or\n reading a chain of requests\n\n - If the application has a pid namespace, ensure that the sqthread pid\n is correctly printed in fdinfo\n\n - Fix for a hashing issue in the io-wq thread pool, which could lead to\n a use-after-free\n\n - Kill dead argument from io_prep_rw_pi()\n\n - Fix for a missed validation of the CQ ring head, affecting CQE refill\n\n* tag \u0027io_uring-7.1-20260515\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring: validate user-controlled cq.head in io_cqe_cache_refill()\n io-wq: check that the predecessor is hashed in io_wq_remove_pending()\n io_uring/rw: drop unused attr_type_mask from io_prep_rw_pi()\n io_uring: hold uring_lock across io_kill_timeouts() in cancel path\n io_uring: defer linked-timeout chain splice out of hrtimer context\n io_uring: hold uring_lock when walking link chain in io_wq_free_work()\n io_uring/fdinfo: translate SqThread PID through caller\u0027s pid_ns\n" }, { "commit": "78e8370033bfe08481212ceead113ccb668b83cb", "tree": "81b31f56c39b441af5dabc33d11d588c0f9e3582", "parents": [ "36d49bba19f2c19c933d13b25dcf4eb607a030b3", "905c559e51497b8bfdbb68df8be56d2f70f0de8e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:27:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:27:03 2026 -0700" }, "message": "Merge tag \u0027hardening-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening fix from Kees Cook:\n\n - gcc-plugins: Fix GCC 16 removal of CONST_CAST macros\n\n* tag \u0027hardening-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE\n" }, { "commit": "36d49bba19f2c19c933d13b25dcf4eb607a030b3", "tree": "a5ba0f9ca1515dea250e8b558012e0013d120d1c", "parents": [ "4844e7c4c2697afe63f2b925e2384e0c724cb2be", "f2e65e4e5b4b4b9ecf43f03c3fdbe8c9a8a43a9e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:24:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 12:24:09 2026 -0700" }, "message": "Merge tag \u0027docs-7.1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux\n\nPull documentation fixes from Jonathan Corbet:\n \"This is Willy Tarreau\u0027s new document clarifying the definition and\n handling of security-related bugs, which we\u0027re trying to get out there\n quickly on the theory that some of the bug reporters might actually\n read and pay attention to it\"\n\n* tag \u0027docs-7.1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:\n docs: threat-model: don\u0027t limit root capabilities to CAP_SYS_ADMIN\n docs: security-bugs: add a link to the threat-model documentation\n Documentation: security-bugs: clarify requirements for AI-assisted reports\n Documentation: security-bugs: explain what is and is not a security bug\n Documentation: security-bugs: do not systematically Cc the security team\n" }, { "commit": "96350db80e0acd733e9b9ef61c0d910790b27289", "tree": "a4dc1133932e48b8ac4e576e6eeb01c0bc274051", "parents": [ "5d6919055dec134de3c40167a490f33c74c12581" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Fri May 15 12:57:09 2026 +0200" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri May 15 14:59:30 2026 -0400" }, "message": "ring-buffer remote: Avoid unexpected symbol warnings (arm, s390)\n\nThe now more verbose check found more architecture specific symbol\nmissing from the whitelist, during randconfig testing on s390\nand 32-bit arm:\n\nUnexpected symbols in kernel/trace/simple_ring_buffer.o:\n U __aeabi_unwind_cpp_pr1\n\nUnexpected symbols in kernel/trace/simple_ring_buffer.o:\n U __s390_indirect_jump_r1\n U __s390_indirect_jump_r10\n U __s390_indirect_jump_r14\n U __s390_indirect_jump_r2\n U __s390_indirect_jump_r5\n U __s390_indirect_jump_r7\n U __s390_indirect_jump_r8\n U __s390_indirect_jump_r9\nmake[6]: *** [/home/arnd/arm-soc/kernel/trace/Makefile:160: kernel/trace/simple_ring_buffer.o.checked] Error 1\n\nAdd these to the list and keep it roughly sorted into sanitizer\nand architecture symbols.\n\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Marc Zyngier \u003cmaz@kernel.org\u003e\nCc: Nathan Chancellor \u003cnathan@kernel.org\u003e\nCc: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nLink: https://patch.msgid.link/20260515105717.1023007-1-arnd@kernel.org\nFixes: 1211907ac0b5 (\"tracing: Generate undef symbols allowlist for simple_ring_buffer\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "4844e7c4c2697afe63f2b925e2384e0c724cb2be", "tree": "f4e79ccbe0d67371408955da746f8464e6ff8555", "parents": [ "4c2cd91bff6371b58e672e8791c3bfa70c1b821f", "4594437880ce347ac8438758fd91543f70da1aa9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:24:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:24:51 2026 -0700" }, "message": "Merge tag \u0027for-linus-7.1b-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip\n\nPull xen fixes from Juergen Gross:\n\n - one simple cleanup\n\n - a fix for a corner case when running as Xen PV dom0\n\n - a fix of a regression for Xen PV guests, introduced in 7.0\n\n* tag \u0027for-linus-7.1b-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:\n x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving\n x86/xen: Fix xen_e820_swap_entry_with_ram()\n xen/arm: Replace __ASSEMBLY__ with __ASSEMBLER__ in interface.h\n" }, { "commit": "4c2cd91bff6371b58e672e8791c3bfa70c1b821f", "tree": "ca8d13e9a0d70c0ccb684e3b0ff5d583c482c0a8", "parents": [ "fd6b56615696c2addca7b43c862b21a9a386c116", "2997606dd17729404cef9821ce66dd037b6019eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:12:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 11:12:54 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - asus-nb-wmi:\n - Use existing keyboard quirk for ASUS Zenbook Duo UX8407AA\n\n - hp-wmi:\n - Add support for Victus 16-r0xxx (8BC2)\n\n - intel/vsec_tpmi:\n - Move debugfs register before creating devices\n - Prevent fault during unbind\n\n - lenovo-wmi-*:\n - Fix memory leak in lwmi_dev_evaluate_int()\n - Balance IDA id allocation and free\n - Balance component bind and unbind\n - Prevent sending uninitialized WMI arguments to the device\n - Decouple lenovo-wmi-gamezone and lenovo-wmi-other to simplify\n module dependency graph\n - Limit adding attributes to supported devices\n\n - samsung-galaxybook:\n - Handle kbd backlight, mic mute and camera block hotkeys\n\n* tag \u0027platform-drivers-x86-v7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo UX8407AA\n platform/x86: lenovo-wmi-other: Limit adding attributes to supported devices\n platform/x86: lenovo-wmi-other: Add Attribute ID helper functions\n platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers\n platform/x86: lenovo: Decouple lenovo-wmi-gamezone and lenovo-wmi-other\n platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members\n platform/x86: lenovo-wmi-other: Zero initialize WMI arguments\n platform/x86: lenovo-wmi-other: Balance component bind and unbind\n platform/x86: lenovo-wmi-other: Balance IDA id allocation and free\n platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()\n platform/x86: hp-wmi: Add support for Victus 16-r0xxx (8BC2)\n platform/x86/intel/tpmi/plr: Prevent fault during unbind\n platform/x86: intel: Add notifiers support\n platform/x86: intel: Move debugfs register before creating devices\n platform/x86: samsung-galaxybook: Handle ACPI hotkey notifications\n platform/x86: samsung-galaxybook: Refactor camera lens cover input device\n" }, { "commit": "fd6b56615696c2addca7b43c862b21a9a386c116", "tree": "e3cceceed21b32d89f2f1d3ae903d66b88c60c4f", "parents": [ "70eda68668d1476b459b64e69b8f36659fa9dfa8", "d1fa83ecac31093a550534a79a33bc7f4ba8fc10" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 10:38:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 15 10:38:37 2026 -0700" }, "message": "Merge tag \u0027v7.1-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fixes from Herbert Xu:\n\n - Fix potential dead-lock in rhashtable when used by xattr\n\n - Avoid calling kvfree on atomic path in rhashtable\n\n* tag \u0027v7.1-p4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n rhashtable: Add bucket_table_free_atomic() helper\n mm/slab: Add kvfree_atomic() helper\n rhashtable: drop ht-\u003emutex in rhashtable_free_and_destroy()\n" }, { "commit": "6fd9f6e870ea285f05102e8e00e6a7f4495a9a02", "tree": "2a2039b23f00ece6b4e609899257e2fcdce228ba", "parents": [ "7d1051ad68df3d584b5f24bfa1fb19f3a24db278" ], "author": { "name": "Matt DeVillier", "email": "matt.devillier@gmail.com", "time": "Thu May 07 09:58:41 2026 -0500" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 11:19:48 2026 +0200" }, "message": "ALSA: hda/ca0132: Disable auto-detect on manual output select\n\nCommit 778031e1658d (\"ALSA: hda/ca0132: Set HP/Speaker\nauto-detect default from headphone pin verb\") enables HP/Speaker\nauto-detect by default when the headphone pin supports presence detect.\n\nWith auto-detect enabled, ca0132_select_out() and ca0132_alt_select_out()\nchoose the output from jack presence instead of the manual HP/Speaker\nselection. This means selecting speaker output while headphones are\nplugged in updates the control state, but audio still routes to the\nheadphones.\n\nTreat an explicit manual output selection as a request to leave\nauto-detect mode. Clear the HP/Speaker auto-detect switch before applying\nthe manual selection, and notify userspace so the auto-detect control\nstate is updated in mixers. Do this for both the normal HP/Speaker\nPlayback Switch and the alternate Output Select control used by desktop\ncards.\n\nThis keeps auto-detect enabled by default for devices with jack presence\ndetection, while preserving the expected behavior that a manual output\nchoice takes effect immediately.\n\nFixes: 778031e1658d (\"ALSA: hda/ca0132: Set HP/Speaker auto-detect default from headphone pin verb\")\nSigned-off-by: Matt DeVillier \u003cmatt.devillier@gmail.com\u003e\nLink: https://lore.kernel.org/CAFTm+6AfeXKf\u003db2frG4xC5yC4jjM9TkD6c8+dOWWFw6BDjDESw@mail.gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "7d1051ad68df3d584b5f24bfa1fb19f3a24db278", "tree": "11c750dd871645bf4e3f31ba589e0584797e560a", "parents": [ "83dca2530fb3ba63f47bad339d890bc30aa06ab5" ], "author": { "name": "Adrien Burnett", "email": "an.arctic.pigeon@gmail.com", "time": "Thu May 14 18:59:05 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:11:04 2026 +0200" }, "message": "ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx\n\nAdd a SND_PCI_QUIRK entry for the HP Pavilion Laptop 16-ag0xxx\n(subsystem 0x103c:0x8cbc, Realtek ALC245). The\nALC245_FIXUP_HP_X360_MUTE_LEDS fixup is already used by the\nneighbouring HP Pavilion Aero Laptop 13-bg0xxx (0x103c:0x8cbd);\nit chains the master-mute COEF handler with the GPIO mic-mute\nLED handler, which is what this machine needs.\n\nTested on the affected hardware: both the mute and mic-mute key\nLEDs respond correctly to the keyboard hotkeys after this change.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Adrien Burnett \u003can.arctic.pigeon@gmail.com\u003e\nLink: https://patch.msgid.link/20260514165905.21175-1-an.arctic.pigeon@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "83dca2530fb3ba63f47bad339d890bc30aa06ab5", "tree": "94242307e4c954ab7fbbe35e3396e3bdcb22d4e9", "parents": [ "9921941929ab014038c357b30567d93d20393a94" ], "author": { "name": "Jackie Dong", "email": "xy-jackie@139.com", "time": "Thu May 14 23:39:40 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:09:57 2026 +0200" }, "message": "ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Pro 7 15ASH111 audio\n\nVolume control for the speakers on the Lenovo Yoga Pro 7 15ASH11 laptop\ndoesn\u0027t work.\nThe DAC routing is the same as on the ThinkPad X1 Gen7 function, so reuse\nthe alc285_fixup_thinkpad_x1_gen7 to get it working.\n\nSigned-off-by: Jackie Dong \u003cxy-jackie@139.com\u003e\nLink: https://patch.msgid.link/20260514153940.7320-1-xy-jackie@139.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "9921941929ab014038c357b30567d93d20393a94", "tree": "3f8997aa0a5344207920f87d8ed9c48307c0fd3b", "parents": [ "fd87b510f5f543125ecf51e7c706a9f4bc3352be" ], "author": { "name": "Quan Sun", "email": "2022090917019@std.uestc.edu.cn", "time": "Thu May 14 21:22:45 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:09:07 2026 +0200" }, "message": "ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()\n\nsnd_hda_ctl_add() dereferences kctl-\u003eid.subdevice without checking\nwhether kctl is NULL. Multiple callers in sound/hda/codecs/ca0132.c\npass the return value of snd_ctl_new1() directly to snd_hda_ctl_add()\nwithout a NULL check:\n\n return snd_hda_ctl_add(codec, nid, snd_ctl_new1(\u0026knew, codec));\n\nsnd_ctl_new1() returns NULL when the underlying snd_ctl_new() fails\non memory allocation (kzalloc_flex),which can occur under memory\npressure or via fault injection.\n\nAdd a NULL check at the entry of snd_hda_ctl_add(), matching the\npattern already used by snd_ctl_add_replace() at the same call\npath (sound/core/control.c:515). Return -EINVAL to let callers\nhandle the error gracefully.\n\nFixes: 44f0c9782cc6 (\"ALSA: hda/ca0132: Add tuning controls\")\nSigned-off-by: Quan Sun \u003c2022090917019@std.uestc.edu.cn\u003e\nLink: https://patch.msgid.link/20260514132245.3062884-1-2022090917019@std.uestc.edu.cn\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "fd87b510f5f543125ecf51e7c706a9f4bc3352be", "tree": "7014531ab4084a5b7d19f3c423a872a098048c0a", "parents": [ "2891bb13ef158281736b6314b1ceaef6d08d57f4" ], "author": { "name": "Markus Kramer", "email": "linux@markus-kramer.de", "time": "Thu May 14 00:28:18 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:08:41 2026 +0200" }, "message": "ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone\n\nThe Samsung Galaxy Book5 360 (NP750QHA, PCI subsystem ID 0x144d:0xc902)\nhas severe audio distortion on the 3.5mm headphone jack. Applying\nALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET corrects the output path\nconfiguration, consistent with fixes already applied to other Samsung\nGalaxy Book models using the same ALC256 codec.\n\nCc: stable@vger.kernel.org\nLink: https://github.com/thesofproject/linux/issues/5648\nSigned-off-by: Markus Kramer \u003clinux@markus-kramer.de\u003e\nLink: https://patch.msgid.link/20260513222818.14351-1-linux@markus-kramer.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2891bb13ef158281736b6314b1ceaef6d08d57f4", "tree": "acab10b851c512db4ebe6a4c5d368bc11b03196d", "parents": [ "67c73815220784074ff13ec07df955911caf1b73" ], "author": { "name": "Andy Shevchenko", "email": "andriy.shevchenko@linux.intel.com", "time": "Wed May 13 18:27:58 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:08:04 2026 +0200" }, "message": "ALSA: hda/cs35l56: Drop malformed default N from Kconfig\n\nFirst of all, it has to be \u0027default n\u0027 (small letter n), otherwise\nit looks for CONFIG_N which is absent and in case of appearance\nwill enable something unrelated. Second and most important is that\n\u0027n\u0027 *is* the default \u0027default\u0027 already. Hence just drop malformed\nline.\n\nSigned-off-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260513162758.365972-1-andriy.shevchenko@linux.intel.com\n" }, { "commit": "67c73815220784074ff13ec07df955911caf1b73", "tree": "3af3125ded8bb496c29c160ebd0e1bf44bd2a003", "parents": [ "d02d2d51a50d1bbf44a50eda094aa2b10fecf023" ], "author": { "name": "Daniel Schaefer", "email": "dhs@frame.work", "time": "Wed May 13 23:55:13 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 09:07:24 2026 +0200" }, "message": "ALSA: hda/realtek: fix mic boost on Framework PTL\n\nIn addition to the mic jack fix, also need to avoid boosting the\ninternal mic too much, otherwise \u003e50% input volume clips a lot.\n\nAlso add a second SSID. We have one for the classic chassis/speaker and\none for the new Pro chassis/speaker.\n\nTo: Jaroslav Kysela \u003cperex@perex.cz\u003e\nTo: Takashi Iwai \u003ctiwai@suse.com\u003e\nTo: linux-sound@vger.kernel.org\nCc: Dustin L. Howett \u003cdustin@howett.net\u003e\nCc: linux@frame.work\nSigned-off-by: Daniel Schaefer \u003cdhs@frame.work\u003e\nLink: https://patch.msgid.link/20260513155513.11683-1-dhs@frame.work\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "d02d2d51a50d1bbf44a50eda094aa2b10fecf023", "tree": "8f4580fbde98d30ca64be0f417e74280073e24cd", "parents": [ "74e8409821ac8cda70bf23eb593f2c7f6e3b5a2f" ], "author": { "name": "Edson Juliano Drosdeck", "email": "edson.drosdeck@gmail.com", "time": "Mon May 11 15:15:58 2026 -0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:54:15 2026 +0200" }, "message": "ALSA: hda/realtek: Limit mic boost on Positivo DN50E\n\nThe internal mic boost on the Positivo DN50E is too high.\nFix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine\nto limit the gain.\n\nSigned-off-by: Edson Juliano Drosdeck \u003cedson.drosdeck@gmail.com\u003e\nLink: https://patch.msgid.link/20260511181558.670563-1-edson.drosdeck@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "74e8409821ac8cda70bf23eb593f2c7f6e3b5a2f", "tree": "bc6048ae957e0194c74f726779765fe15ee15148", "parents": [ "814b2c9b30e56074e11fc0a6e5419b3fee0639bc" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Mon May 11 11:41:48 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:53:34 2026 +0200" }, "message": "ALSA: doc: cs35l56: Update path to HDA driver source\n\nThe HDA drivers were moved to sound/hda/... so update a Documentation\nreference that still pointed to the old location.\n\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260511104148.36382-1-rf@opensource.cirrus.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "814b2c9b30e56074e11fc0a6e5419b3fee0639bc", "tree": "02625ee8ad4b983b26d4832b6dfe64db32c7449d", "parents": [ "dd074f04e04648d89d9d10ae9846cd057c97b385" ], "author": { "name": "Cássio Gabriel", "email": "cassiogabrielcontato@gmail.com", "time": "Mon May 11 01:36:37 2026 -0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:51:46 2026 +0200" }, "message": "ALSA: usb-audio: qcom: Check offload mapping failures\n\nuaudio_transfer_buffer_setup() calls dma_get_sgtable() and then passes\nthe sg_table to uaudio_iommu_map_xfer_buf() without checking whether sg\ntable construction succeeded. If dma_get_sgtable() fails, the sg_table\ncontents are not valid.\n\nuaudio_iommu_map_pa() also ignores iommu_map() failures for the event and\ntransfer rings and still returns the allocated IOVA to the QMI response.\nThat can expose an unmapped IOVA to the audio DSP. For transfer rings,\nthe failed mapping also leaves the IOVA allocator state marked in use.\n\nCheck both operations. Free the coherent transfer buffer when sg table\nconstruction fails, free the sg table when transfer-buffer IOMMU mapping\nfails, and release the transfer-ring IOVA if iommu_map() fails. Also\nreturn the existing event-ring IOVA when the event ring is already mapped,\nmatching the pre-split helper behavior.\n\nFixes: 326bbc348298 (\"ALSA: usb-audio: qcom: Introduce QC USB SND offloading support\")\nFixes: 44499ecb4f28 (\"ALSA: usb: qcom: Fix false-positive address space check\")\nCc: stable@vger.kernel.org\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nLink: https://patch.msgid.link/20260511-alsa-usb-qcom-offload-map-errors-v1-1-6502695e58bc@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "0a9c56dd387605d17dabeedd9fdd2c4c1d0bab7b", "tree": "fcc858dc1da068c7a87b5641850f7db976c6a9f2", "parents": [ "1d59f36e95f7f7134db0e313c9d787cb0adb2153" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Wed May 13 15:57:00 2026 +0900" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Fri May 15 08:50:54 2026 +0200" }, "message": "drm/loongson: Use managed KMS polling\n\nlsdc_pci_probe() initializes KMS polling before setting up vblank support,\nrequesting the IRQ and registering the DRM device. If any of those later\nsteps fails, probe returns without finalizing polling. The driver also\nnever finalizes polling on regular removal.\n\nUse drmm_kms_helper_poll_init() so polling is tied to the DRM device\nlifetime and automatically finalized on probe failure and device removal.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.\n\nFixes: f39db26c5428 (\"drm: Add kms driver for loongson display controller\")\nCc: stable@vger.kernel.org\nCo-developed-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Ijae Kim \u003cae878000@gmail.com\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nAcked-by: Jianmin Lv \u003clvjianmin@loongson.cn\u003e\nReviewed-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260513065706.23803-1-mhun512@gmail.com\n" }, { "commit": "dd074f04e04648d89d9d10ae9846cd057c97b385", "tree": "06b26f8beeec9f4308299ee6a91c9a249100389a", "parents": [ "2149c011510cbdcf183a13b26756e4a02071f0f2" ], "author": { "name": "Nicholas Bonello", "email": "hadobedo@gmail.com", "time": "Fri May 08 18:55:07 2026 -0400" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:37:33 2026 +0200" }, "message": "ALSA: hda/realtek: Fix Legion 7 16ITHG6 speaker amp binding\n\nThe Lenovo Legion 7 16ITHG6 uses codec SSID 17aa:3855, but its PCI\nSSID is 17aa:3811. The latter is now also used by the Legion S7 15IMH05\nquirk, which is matched before codec SSID fallback and incorrectly\nroutes Legion 7 16ITHG6 machines to ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS.\n\nThat fixup does not bind the CLSA0101 CS35L41 companion amplifiers,\nmaking the built-in speakers silent even though playback appears to be\nactive.\n\nAdd a codec SSID quirk for 17aa:3855 before the conflicting PCI SSID\nquirk so that the Legion 7 16ITHG6 uses ALC287_FIXUP_LEGION_16ITHG6.\nThis restores CS35L41 firmware loading and binds both speaker\namplifiers.\n\nFixes: 67f4c61a73e9 (\"ALSA: hda/realtek: Add quirk for Legion S7 15IMH\")\nCc: stable@vger.kernel.org\nTested-by: Nicholas Bonello \u003chadobedo@gmail.com\u003e\nAssisted-by: Codex:GPT-5\nSigned-off-by: Nicholas Bonello \u003chadobedo@gmail.com\u003e\nLink: https://patch.msgid.link/20260508225507.47667-1-hadobedo@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2149c011510cbdcf183a13b26756e4a02071f0f2", "tree": "a2ca81bcfe0e28b7dfe4ba54668445c1606654e9", "parents": [ "c0e4fffc0f474b7ed10adee4ab2bc1a66d36fc72" ], "author": { "name": "Lianqin Hu", "email": "hulianqin@vivo.com", "time": "Fri May 08 12:49:34 2026 +0000" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:34:37 2026 +0200" }, "message": "ALSA: usb-audio: Add iface reset and delay quirk for TTGK Technology USB-C Audio\n\nSetting up the interface when suspended/resumeing fail on this card.\nAdding a reset and delay quirk will eliminate this problem.\n\nusb 1-1: new full-speed USB device number 2 using xhci-hcd\nusb 1-1: New USB device found, idVendor\u003d3302, idProduct\u003d17c2\nusb 1-1: New USB device strings: Mfr\u003d1, Product\u003d2, SerialNumber\u003d3\nusb 1-1: Product: USB-C Audio\nusb 1-1: Manufacturer: TTGK Technology\nusb 1-1: SerialNumber: 170120210706\n\nSigned-off-by: Lianqin Hu \u003chulianqin@vivo.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/TYUPR06MB621720E4E8F99A42E162FD51D23D2@TYUPR06MB6217.apcprd06.prod.outlook.com\n" }, { "commit": "c0e4fffc0f474b7ed10adee4ab2bc1a66d36fc72", "tree": "a617644280c8c0e565a9bf1852c17dc060eb09b3", "parents": [ "fca7401fe37f7abc6e54147ea560f37279231137" ], "author": { "name": "Robertus Diawan Chris", "email": "robertusdchris@gmail.com", "time": "Fri May 08 10:39:14 2026 +0700" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 15 08:33:12 2026 +0200" }, "message": "ALSA: scarlett2: Add missing error check when initialise Autogain Status\n\nWhen initialise new control with scarlett2_add_new_ctl() function for\nAutogain Status, scarlett2_add_new_ctl() might throw an error. So, add\nerror check after initialise new control for Autogain Status.\n\nThis is reported by Coverity Scan with CID 1598781 as UNUSED_VALUE.\n\nFixes: 0a995e38dc44 (\"ALSA: scarlett2: Add support for software-controllable input gain\")\nSigned-off-by: Robertus Diawan Chris \u003crobertusdchris@gmail.com\u003e\nLink: https://patch.msgid.link/20260508033914.111596-1-robertusdchris@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "1bb54043ff309795c90ccadd8a6e6b13ac40ec4e", "tree": "c3e8da629248d4fb01066dcfca8e79234d744bea", "parents": [ "58829512ad461af8f35941069c209941e3a97b65" ], "author": { "name": "Tomasz Jeznach", "email": "tomasz.jeznach@linux.dev", "time": "Tue May 12 10:37:44 2026 -0700" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:30:28 2026 +0200" }, "message": "MAINTAINERS: update Tomasz Jeznach\u0027s email address\n\nSwitch from the previous work address to a linux.dev account,\nas the work address is no longer actively monitored.\n\nSigned-off-by: Tomasz Jeznach \u003ctomasz.jeznach@linux.dev\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "58829512ad461af8f35941069c209941e3a97b65", "tree": "b821e62afb5ebd5b8d7a711eac69f26cbc025175", "parents": [ "8ef3f77c440005c7f04229a75976bfc078364247" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:17 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommupt: Fix the end_index calculation in __map_range_leaf()\n\nSashiko noticed a mismatch of units in this math: num_leaves is\nactually the number of leaf *entries* (so a 16-item contiguous leaf\nis one num_leaves), while index is in items. The mismatch in maths\ncauses __map_range_leaf() to exit early instead of efficiently\nfilling a larger range of contiguous PTEs.\n\nThe early exit is caught by the functions above and then\n__map_range_leaf() is re-invoked, so there is no functional issue.\n\nCorrect the misuse of units by adjusting num_leaves with the leaf\nsize and avoid the performance cost of looping externally.\n\nThere are also some mismatched types for num_leaves; simplify\nthings to remove the duplicated calculations.\n\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewd-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "8ef3f77c440005c7f04229a75976bfc078364247", "tree": "cf30c786140a75162579b2384a220f73f5430c4c", "parents": [ "0735c54804c709d1b292f3b6947cfb560b2ce552" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:16 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap\n\nSashiko pointed out that the driver could drop PAGE_SIZE from the\npgsize_bitmap. That is technically allowed but nothing does it, and\nsuch an iommu_domain would not be used with the DMA API today.\n\nStill, it is against the design and it is trivial to fix up. Lift\nthe PT_WARN_ON to the if branch and just skip the fast path.\n\nFixes: dcd6a011a8d5 (\"iommupt: Add map_pages op\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "0735c54804c709d1b292f3b6947cfb560b2ce552", "tree": "0234d43ca5bb7d0b91744e7567a80ec90642183f", "parents": [ "b948a87228482235afbaf5f4d8037860b5c470fd" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:15 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:16 2026 +0200" }, "message": "iommu: Handle unmap error when iommu_debug is enabled\n\nSashiko noticed a latent bug where the map error flow called iommu_unmap()\nwhich calls iommu_debug_unmap_begin()/iommu_debug_unmap_end() however\nsince this is an error path the map flow never actually established the\noriginal iommu_debug_map() it will malfunction.\n\nLift the unmap error handling into iommu_map_nosync() and reorder it so\nthe trace_map()/iommu_debug_map() records the partial mapping and then\nimmediately unmaps it. This avoid creating the unbalanced tracking and\nprovides saner tracing instead of a unmap unmatched to any map.\n\nFixes: ccc21213f013 (\"iommu: Add calls for IOMMU_DEBUG_PAGEALLOC\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "b948a87228482235afbaf5f4d8037860b5c470fd", "tree": "4d47d3dd296cbf6000b2c35336d05ec0ae12b5a1", "parents": [ "6fc7e8a3b8115294f60f5c89de27330bf1b9c98e" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:14 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:15 2026 +0200" }, "message": "iommu: Fix up map/unmap debugging for iommupt domains\n\nSashiko noticed a few issues in this path, and a few more were\nfound on review. Tidy them up further. These are intertwined\nbecause the debug code depends on some of the WARN_ONs to function\nright:\n\nLift into iommu_map_nosync():\n- The might_sleep_if()\n- 0 pgsize_bitmap WARN_ON\n- Promote the illegal domain-\u003etype to a WARN_ON\n- WARN_ON for illegal gfp flags\n\nThen remove the return 0 since it is now safe to call\niommu_debug_map().\n\nLift into __iommu_unmap():\n- 0 pgsize_bitmap WARN_ON\n- Promote the illegal domain-\u003etype to a WARN_ON\n- iommu_debug_unmap_begin()\n\nThis now pairs with the unconditional iommu_debug_map() on the\nmapping side. Thus iommu debugging now works for iommupt along\nwith some of the other debugging features.\n\nFixes: 99fb8afa16ad (\"iommupt: Directly call iommupt\u0027s unmap_range()\")\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "6fc7e8a3b8115294f60f5c89de27330bf1b9c98e", "tree": "cba7a7fa221bf5abd079ce9bbf61ca144c98ee92", "parents": [ "79ea2feb917b05366b49d85573c9c5331f043b2c" ], "author": { "name": "Jason Gunthorpe", "email": "jgg@nvidia.com", "time": "Tue May 12 13:46:13 2026 -0300" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri May 15 07:29:15 2026 +0200" }, "message": "iommu: Fix loss of errno on map failure for classic ops\n\nA typo, likely from a rebase, inverted the condition and caused\nerrors to be lost. Fix it to be \"if (ret)\".\n\nThis was breaking iommu_create_device_direct_mappings() on drivers\nthat don\u0027t use iommupt and don\u0027t fully set up their domain in\nalloc_pages() (i.e., SMMUv2). In this case the first call of\niommu_create_device_direct_mappings() should fail due to the\nincompletely initialized domain. Since it wrongly returns success,\nthe second call to iommu_create_device_direct_mappings() doesn\u0027t\nhappen and IOMMU_RESV_DIRECT is never set up.\n\nCc: stable@vger.kernel.org\nFixes: d6c65b0fd621 (\"iommupt: Avoid rewalking during map\")\nReported-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nCloses: https://lore.kernel.org/all/321c2e57-6a17-4aef-ba42-d2ebd577e472@solid-run.com/\nSigned-off-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nReviewed-by: Pranjal Shrivastava \u003cpraan@google.com\u003e\nReviewed-by: Samiullah Khawaja \u003cskhawaja@google.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Josua Mayer \u003cjosua@solid-run.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "4141f46daa4cf1f8caa14129f8b6db86f17452f5", "tree": "4f3ec45337d58c36915f539f6fd6e00a7e4751f3", "parents": [ "e7b8b3c5b2a65595d506ffedafac66f0a11fbdc2", "a6ab75639e23169a741b0b2e12191fd8acb32c73" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 14 19:14:33 2026 -0600" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 14 19:14:33 2026 -0600" }, "message": "Merge tag \u0027nvme-7.1-2026-05-14\u0027 of git://git.infradead.org/nvme into block-7.1\n\nPull NVMe fixes from Keith:\n\n\"- Fix memory leak on a passthrough integrity mapping failure (Keith)\n - Hide secrets behind debug option (Hannes)\n - Fix pci use-after-free for host memory buffer (Chia-Lin Kao)\n - Fix tcp taregt use-after-free for data digest (Sagi)\n - Revert a mistaken quirk (Alan Cui)\n - Fix uevent and controller state race condition (Maurizio)\n - Fix apple submission queue re-initialization (Nick Chan)\"\n\n* tag \u0027nvme-7.1-2026-05-14\u0027 of git://git.infradead.org/nvme:\n nvme-apple: Reset q-\u003esq_tail during queue init\n nvme: fix race condition between connected uevent and STARTED_ONCE flag\n Revert \"nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808\"\n nvmet-tcp: Fix potential UAF when ddgst mismatch\n nvme-pci: fix use-after-free in nvme_free_host_mem()\n nvmet-auth: Do not print DH-HMAC-CHAP secrets\n nvme: fix bio leak on mapping failure\n nvme: make prp passthrough usage less scary\n" }, { "commit": "51f57607e30bee282a1d40845f89a311cbb26481", "tree": "a4bb1b211efea8e979f6b2dd540a6352656664b6", "parents": [ "f06035ab324e52a845079c2e5f2380fa3cebde9b" ], "author": { "name": "Chen-Shi-Hong", "email": "eric039eric@gmail.com", "time": "Thu May 14 23:39:13 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu May 14 15:48:57 2026 -0700" }, "message": "docs: hwmon: sy7636a: fix temperature sysfs attribute name\n\nThe hwmon sysfs naming convention uses\ntemp[1-*]_input for temperature channels.\n\nDocumentation/hwmon/sy7636a-hwmon.rst currently documents\ntemp0_input, while the driver uses the standard hwmon\ntemperature channel interface.\n\nUpdate the documentation to use temp1_input.\n\nSigned-off-by: Chen-Shi-Hong \u003ceric039eric@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260514154108.1937-1-eric039eric@gmail.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "70eda68668d1476b459b64e69b8f36659fa9dfa8", "tree": "26fe996ae3fd74753bac73ea6f08e724b4f604a9", "parents": [ "48f76a12713253f3abaa39c4ff7606d6fed05a7e", "64ffa2e5e02ff54b23221d0282155f37283fabea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:30:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:30:01 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026051401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee\n Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz\n Pakuła)\n\n - more general sanitation of input data, dealing with potentially\n malicious hardware in hid-core (Benjamin Tissoires)\n\n - a few device-specific quirks and fixups\n\n* tag \u0027hid-for-linus-2026051401\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits)\n HID: logitech-hidpp: Add support for newer Bluetooth keyboards\n HID: pidff: Fix integer overflow in pidff_rescale\n HID: i2c-hid: add reset quirk for BLTP7853 touchpad\n HID: core: introduce hid_safe_input_report()\n HID: pass the buffer size to hid_report_raw_event\n HID: google: hammer: stop hardware on devres action failure\n HID: appletb-kbd: run inactivity autodim from workqueues\n HID: appletb-kbd: fix UAF in inactivity-timer cleanup path\n HID: playstation: Clamp num_touch_reports\n HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID\n HID: mcp2221: fix OOB write in mcp2221_raw_event()\n HID: quirks: really enable the intended work around for appledisplay\n HID: hid-sjoy: race between init and usage\n HID: uclogic: Fix regression of input name assignment\n HID: intel-thc-hid: Intel-quickspi: Fix some error codes\n HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle\n HID: elan: Add support for ELAN SB974D touchpad\n HID: sony: add missing size validation for Rock Band 3 Pro instruments\n HID: sony: add missing size validation for SMK-Link remotes\n HID: sony: remove unneeded WARN_ON() in sony_leds_init()\n ...\n" }, { "commit": "48f76a12713253f3abaa39c4ff7606d6fed05a7e", "tree": "a08ad3f86cce228139b48afd9c89e3687f3ddb05", "parents": [ "66182ca873a4e87b3496eca79d57f86b76d7f52d", "af149b667b9472bf981591a6d27efdecd331005a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:06:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 14:06:31 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These fix several platform drivers that use the ACPI companion of the\n given platform device without checking its presence, which may lead to\n a NULL pointer dereference or other kind of malfunction if the driver\n is forced to match a device without an ACPI companion via driver\n override, and restore debug log level for some messages in the ACPI\n CPPC library:\n\n - Check ACPI_COMPANION() against NULL during probe in several core\n ACPI device drivers (Rafael Wysocki)\n\n - Restore log level of messages in amd_set_max_freq_ratio() (Mario\n Limonciello)\"\n\n* tag \u0027acpi-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: PAD: xen: Check ACPI_COMPANION() against NULL\n ACPI: driver: Check ACPI_COMPANION() against NULL during probe\n Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\"\n" }, { "commit": "af149b667b9472bf981591a6d27efdecd331005a", "tree": "1ae11e0cd72fabc406be2a77e0325b774ead66f9", "parents": [ "b7cdd59de5ae8062d2cb0121c429a271eb70daec", "db5dadb562cabb6da49959b473ed0d9645b6f2da" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu May 14 22:46:33 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu May 14 22:46:33 2026 +0200" }, "message": "Merge branch \u0027acpi-cppc\u0027\n\nMerge a revert of an ACPI CPPC commit that increased the log level of\nsome debug messages which turned out to be a bad idea:\n\n - Restore log level of messages in amd_set_max_freq_ratio() (Mario\n Limonciello)\n\n* acpi-cppc:\n Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\"\n" }, { "commit": "c207f1d785044667f87cc8c72355e33f3981f2d6", "tree": "d1ceb720445dfeebe1fa5194387f6efed8962e93", "parents": [ "81a874233c305d29e37fdb70b691ff4254294c0b" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed May 13 19:50:02 2026 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 13:21:00 2026 -0500" }, "message": "smbdirect: Fix error cleanup in smbdirect_map_sges_from_iter()\n\nFix smbdirect_map_sges_from_iter() to use pre-decrement, not post-decrement\nso that it cleans up the correct slots.\n\nFixes: e5fbdde43017 (\"cifs: Add a function to build an RDMA SGE list from an iterator\")\nCloses: https://sashiko.dev/#/patchset/20260326104544.509518-1-dhowells%40redhat.com\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: Stefan Metzmacher \u003cmetze@samba.org\u003e\ncc: Paulo Alcantara \u003cpc@manguebit.org\u003e\ncc: Tom Talpey \u003ctom@talpey.com\u003e\ncc: linux-cifs@vger.kernel.org\ncc: linux-fsdevel@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "702809dabdecca807bdd50cfdcc1c980feb2ba62", "tree": "dbbe83b2e8867cd6415020c4a7ab68960fb06a0f", "parents": [ "05f2a68b407a6817fe141dd64972c6ab8725312d" ], "author": { "name": "Matt Evans", "email": "mattev@meta.com", "time": "Mon May 11 07:58:24 2026 -0700" }, "committer": { "name": "Alex Williamson", "email": "alex@shazbot.org", "time": "Thu May 14 11:39:03 2026 -0600" }, "message": "vfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it\u0027s possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path.\n\nFixes: 5d74781ebc86c (\"vfio/pci: Add dma-buf export support for MMIO regions\")\nSigned-off-by: Matt Evans \u003cmattev@meta.com\u003e\nLink: https://lore.kernel.org/r/20260511145829.2993601-3-mattev@meta.com\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n" }, { "commit": "05f2a68b407a6817fe141dd64972c6ab8725312d", "tree": "b871dad49283bcdb17cc3bfa7f7df1ae75680c90", "parents": [ "df733ddc263dbe5f471e7c80c8b669532f56bf76" ], "author": { "name": "Matt Evans", "email": "mattev@meta.com", "time": "Mon May 11 07:58:23 2026 -0700" }, "committer": { "name": "Alex Williamson", "email": "alex@shazbot.org", "time": "Thu May 14 11:38:04 2026 -0600" }, "message": "vfio/pci: Set up BAR resources and maps in vfio_pci_core_enable()\n\nPreviously BAR resource requests and the corresponding pci_iomap()\nwere performed on-demand and without synchronisation, which was racy.\nRather than add synchronisation, it\u0027s simplest to address this by\ndoing both activities from vfio_pci_core_enable().\n\nThe resource allocation and/or pci_iomap() can still fail; their\nstatus is tracked and existing calls to vfio_pci_core_setup_barmap()\nwill fail in a similar way to before. This keeps the point of failure\nas observed by userspace the same, i.e. failures to request/map unused\nBARs are benign.\n\nFixes: 89e1f7d4c66d (\"vfio: Add PCI device driver\")\nSigned-off-by: Matt Evans \u003cmattev@meta.com\u003e\nLink: https://lore.kernel.org/r/20260511145829.2993601-2-mattev@meta.com\n[ERR_PTR -\u003e IOMEM_ERR_PTR per lkp report]\nSigned-off-by: Alex Williamson \u003calex@shazbot.org\u003e\n" }, { "commit": "4594437880ce347ac8438758fd91543f70da1aa9", "tree": "7ace2881e34f807aeacf76f91b3ca4ec215a1553", "parents": [ "28e03f78e69cf6628b81f24777799778528a84c1" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Fri May 08 16:39:33 2026 +0200" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu May 14 18:33:05 2026 +0200" }, "message": "x86/xen: Tolerate nested XEN_LAZY_MMU entering/leaving\n\nWith the support of nested lazy mmu sections it can happen that\narch_enter_lazy_mmu_mode() is being called twice without a call of\narch_leave_lazy_mmu_mode() in between, as the lazy_mmu_*() helpers\nare not disabling preemption when checking for nested lazy mmu\nsections.\n\nThis is a problem when running as a Xen PV guest, as\nxen_enter_lazy_mmu() and xen_leave_lazy_mmu() don\u0027t tolerate this\ncase.\n\nFix that in xen_enter_lazy_mmu() and xen_leave_lazy_mmu() in order\nnot to hurt all other lazy mmu mode users.\n\nFixes: 291b3abed657 (\"x86/xen: use lazy_mmu_state when context-switching\")\nTested-by: Marek Marczykowski-Górecki \u003cmarmarek@invisiblethingslab.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nMessage-ID: \u003c20260508143933.493013-1-jgross@suse.com\u003e\n" }, { "commit": "28e03f78e69cf6628b81f24777799778528a84c1", "tree": "29866430b9ca9024c7d46cb72c85417424e586f2", "parents": [ "11f152c0acaa924d93339000cb785d34e003aff5" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Tue May 05 12:24:17 2026 +0200" }, "committer": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu May 14 18:33:05 2026 +0200" }, "message": "x86/xen: Fix xen_e820_swap_entry_with_ram()\n\nWhen swapping a not page-aligned E820 map entry with RAM, the start\naddress of the modified entry is calculated wrong (the offset into the\npage is subtracted instead of being added to the page address).\n\nFixes: be35d91c8880 (\"xen: tolerate ACPI NVS memory overlapping with Xen allocated memory\")\nReported-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nReviewed-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nMessage-ID: \u003c20260505102417.208138-1-jgross@suse.com\u003e\n" }, { "commit": "905c559e51497b8bfdbb68df8be56d2f70f0de8e", "tree": "780a054ea7e9ba6baaf748f37803c61ac6b1c72a", "parents": [ "7fd2df204f342fc17d1a0bfcd474b24232fb0f32" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Sat Mar 14 14:24:56 2026 +0100" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu May 14 09:24:32 2026 -0700" }, "message": "gcc-plugins: Always define CONST_CAST_GIMPLE and CONST_CAST_TREE\n\nFor gcc-16, the CONST_CAST macro family was removed. Add back what\nwe were using in gcc-common.h, as they are simple wrappers.\n\nSee GCC commits:\n c3d96ff9e916c02584aa081f03ab999292efbb50\n 458c7926d48959abcb2c1adaa22458e27459a551\n\nSuggested-by: Ingo Saitz \u003cingo@hannover.ccc.de\u003e\nLink: https://lore.kernel.org/lkml/ab6OKoay0OWkywjK@spatz.zoo\nFixes: 6b90bd4ba40b (\"GCC plugin infrastructure\")\nTested-by: Ivan Bulatovic \u003ccombuster@archlinux.us\u003e\nTested-by: Christopher Cradock \u003cchristopher@cradock.myzen.co.uk\u003e\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\n" }, { "commit": "66182ca873a4e87b3496eca79d57f86b76d7f52d", "tree": "de7036ccfa0347ce8a6476132497d401b1bbdf42", "parents": [ "eb5441518fba295bd97b59dc54914f89dfaa107d", "c78bdba7b9666020c0832150a4fc4c0aebc7c6ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:57:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:57:43 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Previous releases - regressions:\n\n - ethtool: fix NULL pointer dereference in phy_reply_size\n\n - netfilter:\n - allocate hook ops while under mutex\n - close dangling table module init race\n - restore nf_conntrack helper propagation via expectation\n\n - tcp:\n - fix potential UAF in reqsk_timer_handler().\n - fix out-of-bounds access for twsk in tcp_ao_established_key().\n\n - vsock: fix empty payload in tap skb for non-linear buffers\n\n - hsr: fix NULL pointer dereference in hsr_get_node_data()\n\n - eth:\n - cortina: fix RX drop accounting\n - ice: fix locking in ice_dcb_rebuild()\n\n Previous releases - always broken:\n\n - napi: avoid gro timer misfiring at end of busypoll\n\n - sched:\n - dualpi2: initialize timer earlier in dualpi2_init()\n - sch_cbs: Call qdisc_reset for child qdisc\n\n - shaper:\n - fix ordering issue in net_shaper_commit()\n - reject handle IDs exceeding internal bit-width\n\n - ipv6: flowlabel: enforce per-netns limit for unprivileged callers\n\n - tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\n - smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint\n\n - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\n - batman-adv:\n - reject new tp_meter sessions during teardown\n - purge non-released claims\n\n - eth:\n - i40e: cleanup PTP registration on probe failure\n - idpf: fix double free and use-after-free in aux device error paths\n - ena: fix potential use-after-free in get_timestamp\"\n\n* tag \u0027net-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (88 commits)\n net: phy: DP83TC811: add reading of abilities\n net: tls: prevent chain-after-chain in plain text SG\n net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot\n macsec: use rcu_work to defer TX SA crypto cleanup out of softirq\n macsec: use rcu_work to defer RX SA crypto cleanup out of softirq\n macsec: introduce dedicated workqueue for SA crypto cleanup\n net: net_failover: Fix the deadlock in slave register\n MAINTAINERS: update atlantic driver maintainer\n selftests/tc-testing: Add QFQ/CBS qlen underflow test\n net/sched: sch_cbs: Call qdisc_reset for child qdisc\n FDDI: defza: Sanitise the reset safety timer\n net: ethernet: ravb: Do not check URAM suspension when WoL is active\n ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics\n net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint\n net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS\n net: atm: fix skb leak in sigd_send() default branch\n net: ethtool: phy: avoid NULL deref when PHY driver is unbound\n net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled\n net: shaper: reject QUEUE scope handle with missing id\n ...\n" }, { "commit": "81a874233c305d29e37fdb70b691ff4254294c0b", "tree": "93641904d65f50d44d3ce0151c71f5a0cb398d66", "parents": [ "ab26dfeba278b0efbcea012f1698cf524d9b5695" ], "author": { "name": "Jeremy Erazo", "email": "mendozayt13@gmail.com", "time": "Thu May 14 12:03:34 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 10:55:28 2026 -0500" }, "message": "smb: client: avoid integer overflow in SMB2 READ length check\n\nSMB2 READ response validation in cifs_readv_receive() and\nhandle_read_data() checks data_offset + data_len against the received\nbuffer length. Both values are attacker-controlled fields from the\nserver response and are stored as unsigned int, so the addition can\nwrap before the bounds check:\n\n\tfs/smb/client/transport.c:1259\n\t\tif (!use_rdma_mr \u0026\u0026 (data_offset + data_len \u003e buflen))\n\n\tfs/smb/client/smb2ops.c:4839\n\t\telse if (buf_len \u003e\u003d data_offset + data_len)\n\nA malicious SMB server can use this to bypass validation. In the\nnon-encrypted receive path the client attempts an oversized socket\nread and stalls for the SMB response timeout (180 seconds) before\nreconnecting. In the SMB3 encrypted path, runtime testing shows the\nmalformed length can reach copy_to_iter() in handle_read_data() with\nattacker-controlled size, where usercopy hardening stops the oversized\ncopy before bytes reach userspace.\n\nGuard both call sites with check_add_overflow(), which is already\nused elsewhere in this subsystem (smb2pdu.c). On overflow, treat the\nresponse as malformed and reject with -EIO.\n\nSigned-off-by: Jeremy Erazo \u003cmendozayt13@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "eb5441518fba295bd97b59dc54914f89dfaa107d", "tree": "b4460e2c9613bb470f58c8f5d7e7a13bc9c96bfb", "parents": [ "31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "f9e1c1324b4d98d591a6f7568fdebf5cf456dfc2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:53:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:53:24 2026 -0700" }, "message": "Merge tag \u0027audit-pr-20260513\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n\n - Correctly log the inheritable capabilities\n\n - Honor AUDIT_LOCKED in the AUDIT_TRIM and AUDIT_MAKE_EQUIV commands\n\n* tag \u0027audit-pr-20260513\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV\n audit: fix incorrect inheritable capability in CAPSET records\n" }, { "commit": "31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a", "tree": "f8805677487dadc415fb6008d8f995023f7b94cb", "parents": [ "59a62ea4583e0f740bb3576ec210b23f39754327" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 13 11:37:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 14 08:32:11 2026 -0700" }, "message": "ptrace: slightly saner \u0027get_dumpable()\u0027 logic\n\nThe \u0027dumpability\u0027 of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don\u0027t have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses \u0027dumpable\u0027 to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt\u0027s not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn\u0027t make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don\u0027t have a\nMM pointer, we\u0027ll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.\n\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Kees Cook \u003ckees@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ab26dfeba278b0efbcea012f1698cf524d9b5695", "tree": "626397cdbe6169f0f3651e361e5ea8c8f6b32eac", "parents": [ "7d9a7f1f96cd617ee9e75bb22217c709038e26b8" ], "author": { "name": "DaeMyung Kang", "email": "charsyam@gmail.com", "time": "Wed May 13 22:26:22 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 09:41:00 2026 -0500" }, "message": "cifs: client: stage smb3_reconfigure() updates and restore ctx on failure\n\nsmb3_reconfigure() moves strings out of cifs_sb-\u003ectx before the\nmultichannel update, so a later failure can leave the live context\nwith NULL strings or options that do not match the session.\n\nStage the new ctx separately, commit it only on success, and restore\nthe snapshot on failure. Also make smb3_sync_session_ctx_passwords()\nall-or-nothing.\n\nCommit session passwords before channel updates so newly added channels\nauthenticate with the staged credentials.\n\nFixes: ef529f655a2c (\"cifs: client: allow changing multichannel mount options on remount\")\nReported-by: RAJASI MANDAL \u003crajasimandalos@gmail.com\u003e\nCloses: https://lore.kernel.org/lkml/CAEY6_V1+dzW3OD5zqXhsWyXwrDTrg5tAMGZ1AJ7_GAuRE+aevA@mail.gmail.com/\nLink: https://lore.kernel.org/lkml/xkr2dlvgibq5j6gkcxd3yhhnj4atgxw2uy4eug2pxm7wy7nbms@iq6cf5taa65v/\nReviewed-by: Henrique Carvalho \u003chenrique.carvalho@suse.com\u003e\nSigned-off-by: DaeMyung Kang \u003ccharsyam@gmail.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "a6ab75639e23169a741b0b2e12191fd8acb32c73", "tree": "b2099f09d1e9ac597d5b0a6d406d015a265cdad1", "parents": [ "37953cec775ed34e59cf9a7d7bb9b0610daa3f3e" ], "author": { "name": "Nick Chan", "email": "towinchenmi@gmail.com", "time": "Thu May 14 21:16:01 2026 +0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 14 07:40:35 2026 -0700" }, "message": "nvme-apple: Reset q-\u003esq_tail during queue init\n\nFixes a \"duplicate tag error for tag 0\" firmware crash during controller\nreset while setting up a queue on Apple A11 / T8015 caused by stale\nentries in the submission queue due to an invalid sq_tail offset after\nreset.\n\nFixes: 04d8ecf37b5e (\"nvme: apple: Add Apple A11 support\")\nCc: stable@vger.kernel.org\nSuggested-by: Yuriy Havrylyuk \u003cyhavry@gmail.com\u003e\nReviewed-by: Sven Peter \u003csven@kernel.org\u003e\nSigned-off-by: Nick Chan \u003ctowinchenmi@gmail.com\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "7d9a7f1f96cd617ee9e75bb22217c709038e26b8", "tree": "cb5305e6305afc4c9f33b7d3422206166b53376f", "parents": [ "603ab5ea6482c723216b59cb733e8ba248619ee9" ], "author": { "name": "Ye Bin", "email": "yebin10@huawei.com", "time": "Thu May 14 21:14:18 2026 +0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 14 09:40:17 2026 -0500" }, "message": "smb/client: fix possible infinite loop and oob read in symlink_data()\n\nOn 32-bit architectures, the infinite loop is as follows:\n\n len \u003d p-\u003eErrorDataLength \u003d\u003d 0xfffffff8\n u8 *next \u003d p-\u003eErrorContextData + len\n next \u003d\u003d p\n\nOn 32-bit architectures, the out-of-bounds read is as follows:\n\n len \u003d p-\u003eErrorDataLength \u003d\u003d 0xfffffff0\n u8 *next \u003d p-\u003eErrorContextData + len\n next \u003d\u003d (u8 *)p - 8\n\nReported-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nFixes: 76894f3e2f71 (\"cifs: improve symlink handling for smb2+\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ye Bin \u003cyebin10@huawei.com\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "1d59f36e95f7f7134db0e313c9d787cb0adb2153", "tree": "030f65760acf0e87b29245c59e574c4d4ef54a0f", "parents": [ "591711b32681a04b57d00c2a404658f8419a081c" ], "author": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Mon May 11 18:24:43 2026 +0200" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu May 14 15:32:29 2026 +0200" }, "message": "drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure\n\nApply the same fix as b2ed01e7ad (\"drm/ttm: Fix ttm_bo_swapout()\ninfinite LRU walk on swapout failure\") to the ttm_bo_shrink() path.\n\nMove del_bulk_move from before the backup to after success only,\nusing ttm_resource_del_bulk_move_unevictable() since the resource\nis now unevictable once fully backed up.\n\nFixes: 70d645deac98 (\"drm/ttm: Add helpers for shrinking\")\nCc: Christian König \u003cchristian.koenig@amd.com\u003e\nCc: Huang Rui \u003cray.huang@amd.com\u003e\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Dave Airlie \u003cairlied@redhat.com\u003e\nCc: dri-devel@lists.freedesktop.org\nCc: stable@vger.kernel.org # v6.15+\nAssisted-by: GitHub_Copilot:claude-opus-4.6\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260511162443.24352-1-thomas.hellstrom@linux.intel.com\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "c78bdba7b9666020c0832150a4fc4c0aebc7c6ac", "tree": "66343406f27a0f62aa7c29fc8259ad8ea5d5ba58", "parents": [ "ff26a0e8377dec07e4a7230db7675bed1b9a6d03" ], "author": { "name": "Sven Schuchmann", "email": "schuchmann@schleissheimer.de", "time": "Tue May 12 09:19:47 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 14 15:17:12 2026 +0200" }, "message": "net: phy: DP83TC811: add reading of abilities\n\nAt this time the driver is not listing any speeds\nit supports. This should be ETHTOOL_LINK_MODE_100baseT1_Full_BIT\nfor DP83TC811. Add the missing call for phylib to read the abilities.\n\nFixes: b753a9faaf9a (\"net: phy: DP83TC811: Introduce support for the DP83TC811 phy\")\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Sven Schuchmann \u003cschuchmann@schleissheimer.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260512071949.6218-1-schuchmann@schleissheimer.de\n[pabeni@redhat.com: dropped revision history]\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2e65e4e5b4b4b9ecf43f03c3fdbe8c9a8a43a9e", "tree": "81d5c0986869097529aa91d7f9f74d8948c3d074", "parents": [ "561458db0d6b08b4e4956c6e4456d7781b18676f" ], "author": { "name": "Jonathan Corbet", "email": "corbet@lwn.net", "time": "Wed May 13 14:58:53 2026 -0600" }, "committer": { "name": "Jonathan Corbet", "email": "corbet@lwn.net", "time": "Thu May 14 06:23:44 2026 -0600" }, "message": "docs: threat-model: don\u0027t limit root capabilities to CAP_SYS_ADMIN\n\nThe threat-model document says that only users with CAP_SYS_ADMIN can carry\nout a number of admin-level tasks, but there are numerous capabilities that\ncan confer that sort of power. Generalize the text slightly to make it\nclear that CAP_SYS_ADMIN is not the only all-powerful capability.\n\nAcked-by: Willy Tarreau \u003cw@1wt.eu\u003e\nSigned-off-by: Jonathan Corbet \u003ccorbet@lwn.net\u003e\n" }, { "commit": "561458db0d6b08b4e4956c6e4456d7781b18676f", "tree": "61a5bddd7d4897be2491938cc0b52e494ff3e8f6", "parents": [ "4bf85afb9f3ecd7c3b5d15a85b0902f8e725cd06" ], "author": { "name": "Jonathan Corbet", "email": "corbet@lwn.net", "time": "Wed May 13 14:51:29 2026 -0600" }, "committer": { "name": "Jonathan Corbet", "email": "corbet@lwn.net", "time": "Thu May 14 06:23:06 2026 -0600" }, "message": "docs: security-bugs: add a link to the threat-model documentation\n\nRather than make readers search for this document, just a link to it where\nit is referenced.\n\n(While I was at it, I removed the unused and unneeded _threatmodel label\nfrom the top of threat-model.rst).\n\nAcked-by: Willy Tarreau \u003cw@1wt.eu\u003e\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Jonathan Corbet \u003ccorbet@lwn.net\u003e\n" }, { "commit": "ff26a0e8377dec07e4a7230db7675bed1b9a6d03", "tree": "8bc0a138c709db67d13e3eb65d879562f666ad75", "parents": [ "285943c6e7ca309bbea84b253745154241d9788a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon May 11 10:49:18 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 14 13:18:40 2026 +0200" }, "message": "net: tls: prevent chain-after-chain in plain text SG\n\nSashiko points out that if end \u003d 0 (start !\u003d 0) the current\ncode will create a chain link to content type right after\nthe wrap link:\n\n This would create a chain where the wrap link points directly\n to another chain link. The scatterlist API sg_next iterator\n does not recursively resolve consecutive chain links.\n\nmeaning this is illegal input to crypto.\n\nThe wrapping link is unnecessary if end \u003d 0. end is the entry after\nthe last one used so end \u003d 0 means there\u0027s nothing pushed after\nthe wrap:\n\n end start i\n v v v\n [ ]...[ ][ d ][ d ][ d ][ d ][rsv for wrap]\n\nSkip the wrapping in this case.\n\nTLS 1.3 can use the \"wrapping slot\" for it\u0027s chaining if end \u003d 0.\nThis avoids the chain-after-chain.\n\nMove the wrap chaining before marking END and chaining off content\ntype, that feels like more logical ordering to me, but should not\nmatter from functional perspective.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nFixes: 9aaaa56845a0 (\"bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20260511174920.433155-3-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "285943c6e7ca309bbea84b253745154241d9788a", "tree": "4d4a71303844868517814ad5ad802316bb062b2c", "parents": [ "277740023def559a4a2ddc3e8e784ee37a0f16a9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon May 11 10:49:17 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 14 13:18:40 2026 +0200" }, "message": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\nWhen an sk_msg scatterlist ring wraps (sg.end \u003c sg.start),\ntls_push_record() chains the tail portion of the ring to the head\nusing sg_chain(). An extra entry in the sg array is reserved for\nthis:\n\n struct sk_msg_sg {\n [...]\n /* The extra two elements:\n * 1) used for chaining the front and sections when the list becomes\n * partitioned (e.g. end \u003c start). The crypto APIs require the\n * chaining;\n * 2) to chain tailer SG entries after the message.\n */\n struct scatterlist data[MAX_MSG_FRAGS + 2];\n\nThe current code uses MAX_SKB_FRAGS + 1 as the ring size:\n\n sg_chain(\u0026msg_pl-\u003esg.data[msg_pl-\u003esg.start],\n MAX_SKB_FRAGS - msg_pl-\u003esg.start + 1,\n msg_pl-\u003esg.data);\n\nThis places the chain pointer at\n\n sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. \u003d\n \u0026data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 \u003d\n data[start + (MAX_SKB_FRAGS - start + 1) - 1] \u003d\n data[MAX_SKB_FRAGS]\n\ninstead of the true last entry. This is likely due to a \"race\" of\nthe commit under Fixes landing close to\ncommit 031097d9e079 (\"bpf: sk_msg, zap ingress queue on psock down\")\n\nConvert to ARRAY_SIZE and drop the data[start] / - start (as suggested\nby Sabrina).\n\nReported-by: 钱一铭 \u003cyimingqian591@gmail.com\u003e\nFixes: 9aaaa56845a0 (\"bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260511174920.433155-2-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "591711b32681a04b57d00c2a404658f8419a081c", "tree": "82efe7cc452f651e7acc288e35a4469efe15aa16", "parents": [ "84d1c9b416d54afe760ca4c378bd95c89261254c" ], "author": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Fri May 08 18:09:20 2026 +0200" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu May 14 13:12:57 2026 +0200" }, "message": "drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC\n\ndmem_cgroup_try_charge() returns -EAGAIN when the cgroup limit is\nhit and the charge fails. TTM has no concept of -EAGAIN from resource\nallocation; -ENOSPC is the canonical error meaning \"no space, try\neviction\". Convert at the source in ttm_resource_alloc() so no caller\nneeds to handle an unexpected error code, and clean up the now-redundant\n-EAGAIN check in ttm_bo_alloc_resource().\n\nWithout this, -EAGAIN escaping ttm_resource_alloc() during an eviction\nwalk causes the walk to terminate early instead of continuing to the\nnext candidate.\n\nCc: Friedrich Vock \u003cfriedrich.vock@gmx.de\u003e\nCc: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Maxime Ripard \u003cmripard@kernel.org\u003e\nCc: Christian Koenig \u003cchristian.koenig@amd.com\u003e\nCc: dri-devel@lists.freedesktop.org\nCc: \u003cstable@vger.kernel.org\u003e # v6.14+\nFixes: 2b624a2c1865 (\"drm/ttm: Handle cgroup based eviction in TTM\")\nAssisted-by: GitHub_Copilot:claude-sonnet-4.6\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nReviewed-by: Maarten Lankhorst \u003cdev@lankhrost.se\u003e\nLink: https://patch.msgid.link/20260508160920.230339-1-thomas.hellstrom@linux.intel.com\n" }, { "commit": "602d60ebae0f10bfbc7ba90eee026fdbd0203df3", "tree": "630776a88be5c1c984d15c3d9fb852b1bffe4746", "parents": [ "5d6919055dec134de3c40167a490f33c74c12581" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Wed Apr 22 11:42:32 2026 +0200" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Thu May 14 12:30:53 2026 +0200" }, "message": "vdso/gettimeofday: Reload sequence counter after switch to time page in do_aux()\n\nAfter switching to the real data pages, the sequence counter needs to be\nreloaded from there. The code using vdso_read_begin_timens() assumed\nthis worked by \u0027continue\u0027 jumping to the *beginning* of the do-while\nretry loop. However the \u0027continue\u0027 jumps to the *end* of said loop,\nevaluating the exit condition. If the data page has a sequence counter\nof \u00271\u0027 it will match the one from the time namespace page and prematurely\nexit the retry loop. This would result in garbage returned to the caller.\n\nReload the sequence counter after switching the pages by using an inner\nwhile loop again, which will loop at most once.\n\nThe loop generates slightly better code than an explicit reload through\n\u0027seq \u003d vdso_read_begin()\u0027.\n\nFixes: ed78b7b2c5ae (\"vdso/gettimeofday: Add a helper to read the sequence lock of a time namespace aware clock\")\nReported-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nTested-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nReviewed-by: Christophe Leroy (CS GROUP) \u003cchleroy@kernel.org\u003e\nLink: https://patch.msgid.link/20260422-vdso-aux-timens-loop-v1-1-e2dd8c7164cc@linutronix.de\nCloses: https://lore.kernel.org/lkml/CANiDSCsOy0P1if-gJZqOM5pTJ0RDcwVfru1B7KFbTOEMqjPKJw@mail.gmail.com/\n" }, { "commit": "277740023def559a4a2ddc3e8e784ee37a0f16a9", "tree": "9e2e4bf311a892c0ffd4446de5aec748e3361e19", "parents": [ "cc21150cdea8813fc9677ff61a3cbe9995801aa0" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sun May 10 23:21:38 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu May 14 12:20:06 2026 +0200" }, "message": "net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot\n\nOn the SMC-D client, slot 0 of ini-\u003eism_dev[]/ini-\u003eism_chid[] is\nreserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()\npopulates V2 entries starting at index 1, so when no V1 device is\nselected slot 0 is left in its kzalloc()\u0027ed state with ism_dev[0] \u003d\u003d\nNULL and ism_chid[0] \u003d\u003d 0.\n\nsmc_v2_determine_accepted_chid() then matches the peer\u0027s CHID against\nthe array starting from index 0 using the CHID alone. A malicious\npeer replying to a SMC-Dv2-only proposal with d1.chid \u003d\u003d 0 matches\nthe empty slot, ini-\u003eism_selected becomes 0, and the subsequent\nism_dev[0]-\u003elgr_lock dereference in smc_conn_create() faults at\noffsetof(struct smcd_dev, lgr_lock) \u003d\u003d 0x68:\n\n BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0\n Write of size 4 at addr 0000000000000068 by task exploit/144\n Call Trace:\n _raw_spin_lock_bh\n smc_conn_create (net/smc/smc_core.c:1997)\n __smc_connect (net/smc/af_smc.c:1447)\n smc_connect (net/smc/af_smc.c:1720)\n __sys_connect\n __x64_sys_connect\n do_syscall_64\n\nRequire ism_dev[i] to be non-NULL before accepting a CHID match.\n\nFixes: a7c9c5f4af7f (\"net/smc: CLC accept / confirm V2\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nLink: https://patch.msgid.link/20260511062138.2839584-1-xmei5@asu.edu\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6ccbb613b42a1f1ba7bfd547a148f644a902a25c", "tree": "b891f723e8e4d9d8d6119f620e3241d803a6ded0", "parents": [ "f1caff3335ea6eab88cdc84ec8f2e3c45ca05486" ], "author": { "name": "James Morse", "email": "james.morse@arm.com", "time": "Fri May 08 17:23:39 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu May 14 09:52:05 2026 +0100" }, "message": "arm_mpam: Check whether the config array is allocated before destroying it\n\n__destroy_component_cfg() is called to free the configuration array.\nIt uses the embedded \u0027garbage\u0027 structure, which means the array has\nto be allocated.\n\nIf __destroy_component_cfg() is called from mpam_disable() before the\nconfiguration was ever allocated, then a NULL pointer is dereferenced.\n\nCheck for this case and return early if the configuration is not\nallocated.\n\n__destroy_component_cfg() also frees the mbwu_state as this is allocated\nby __allocate_component_cfg(). As the mbwu_state is allocated after\ncomp-\u003ecfg is set, and is also under mpam_list_lock, only the first\npointer needs checking.\n\nFixes: 3bd04fe7d807 (\"arm_mpam: Extend reset logic to allow devices to be reset any time\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: James Morse \u003cjames.morse@arm.com\u003e\nReviewed-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "f1caff3335ea6eab88cdc84ec8f2e3c45ca05486", "tree": "1110ebe97a0e96e28acdb0117adb81b98a1e545e", "parents": [ "ccad6001be5c38426ccf45790c411467ad3c03c6" ], "author": { "name": "James Morse", "email": "james.morse@arm.com", "time": "Fri May 08 17:23:38 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu May 14 09:52:00 2026 +0100" }, "message": "arm_mpam: Fix false positive assert failure during mpam_disable()\n\nmpam_assert_partid_sizes_fixed() is used to document that the caller\ndoesn\u0027t expect the discovered PARTID size to change while it is walking\na list sized by PARTID. Typically the MSC state is not written to until\nall the MSC have been discovered and this value is set.\n\nHowever, if discovering the MSC fails and schedules mpam_disable(),\nthen the MSC state is written to reset it. In this case the\ndiscovered PARTID size may be become smaller - but only PARTID 0\nwill be used once resctrl_exit() has been called.\n\nSkip the WARN_ON_ONCE() if mpam_disable_reason has been set.\n\nFixes: 3bd04fe7d807 (\"arm_mpam: Extend reset logic to allow devices to be reset any time\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: James Morse \u003cjames.morse@arm.com\u003e\nReviewed-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "ccad6001be5c38426ccf45790c411467ad3c03c6", "tree": "322c4a3f37f3ab82a088cfe00e3da7dd21bcdd89", "parents": [ "4387970bbd84fd14e0c49c3089c5061ccd86b98a" ], "author": { "name": "Ben Horgan", "email": "ben.horgan@arm.com", "time": "Thu May 07 16:28:14 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu May 14 09:51:55 2026 +0100" }, "message": "arm_mpam: Improve check for whether or not NRDY is hardware managed\n\nmpam_ris_hw_probe_csu_nrdy() sets and clears MSMON_CSU.NRDY and checks\nwhether it\u0027s configuration sticks. However, hardware isn\u0027t given a chance\nto disagree. Based on rule LRTGP, in MPAM specification IHI0099 version\nB.b, the hardware will set NRDY if it needs time to establish a count after\na configuration change.\n\nEnable the monitor so that NRDY becomes relevant and change the\nconfiguration after clearing NRDY to try and coax the hardware into setting\nit.\n\nFixes: 8c90dc68a5de (\"arm_mpam: Probe the hardware features resctrl supports\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nReviewed-by: James Morse \u003cjames.morse@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "4387970bbd84fd14e0c49c3089c5061ccd86b98a", "tree": "e40b7a8172b908265957cf559c555fbe865ef371", "parents": [ "1ef2a89584b7b788b2603590d886db076b2f24cc" ], "author": { "name": "Ben Horgan", "email": "ben.horgan@arm.com", "time": "Thu May 07 16:28:13 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu May 14 09:51:50 2026 +0100" }, "message": "arm_mpam: Pretend that NRDY is always hardware managed\n\nRule ZTXDS of the MPAM specification, IHI009 version B.b, states: \"If a\nmonitor does not support automatic updates of NRDY, software can use that\nbit for any purpose.\"\n\nAs software is not reliably informed whether or not the monitor supports\nautomatic updates of NRDY always assume that hardware may manage NRDY but\ndon\u0027t rely on it. When NRDY is truly untouched by hardware then, as it is\nwritten to 0 on configuration, it will always read 0.\n\nAt probe it\u0027s checked if MSMON_CSU.NRDY and MSMON_MBWU.NRDY are hardware\nmanaged but not MSMON_MBWU_L.NDRY. Specialize the checking for hardware\nmanaged NRDY to CSU counters as this is the only case where hardware\nmanagement makes sense. Continue to inform the user if MSMON_CSU.NRDY\nappears to be hardware managed but the firmware doesn\u0027t provide the\nassociated time limit for the automatic clearing of NRDY. Remove the NRDY\nfeature flags as they are now unused.\n\nFixes: 8c90dc68a5de (\"arm_mpam: Probe the hardware features resctrl supports\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nReviewed-by: James Morse \u003cjames.morse@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "1ef2a89584b7b788b2603590d886db076b2f24cc", "tree": "eb4c97aae9ee71b5b208dbdd54e3774aa5ba54e7", "parents": [ "5cbb61bf4168859d97c068d88d364f4f1f440325" ], "author": { "name": "Ben Horgan", "email": "ben.horgan@arm.com", "time": "Thu May 07 16:28:12 2026 +0100" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Thu May 14 09:51:41 2026 +0100" }, "message": "arm_mpam: Fix monitor instance selection when checking for hardware NRDY\n\nIn _mpam_ris_hw_probe_hw_nrdy() a new register value to select the first\nmonitor and relevant RIS is prepared in mon_sel. However, it is written to\nthe monitor value register, e.g. MSMON_CSU, rather than MSMON_CFG_MON_SEL.\n\nAs MSMON_CFG_MON_SEL is a 32 bit register update the type of mon_sel to\nu32. Write mon_sel to the intended register, MSMON_CFG_MON_SEL.\n\nFixes: 8c90dc68a5de (\"arm_mpam: Probe the hardware features resctrl supports\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Ben Horgan \u003cben.horgan@arm.com\u003e\nReviewed-by: James Morse \u003cjames.morse@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "31467b23823ffec1f6fff407f8e3ca9af8b7491a", "tree": "bce12f3f1ed27aaff1fcefa841e9be867c4fca23", "parents": [ "dbc30a57bd8e026995e9fa8e8c31cffd18542c01" ], "author": { "name": "Sayali Patil", "email": "sayalip@linux.ibm.com", "time": "Wed May 13 13:44:13 2026 +0530" }, "committer": { "name": "Madhavan Srinivasan", "email": "maddy@linux.ibm.com", "time": "Thu May 14 11:15:26 2026 +0530" }, "message": "powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n\nA kernel panic is observed when handling machine check exceptions from\nreal mode.\n\n BUG: Unable to handle kernel data access on read at 0xc00000006be21300\n Oops: Kernel access of bad area, sig: 11 [#1]\n MSR: 8000000000001003 \u003cSF,ME,RI,LE\u003e CR: 88222248 XER: 00000005\n CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0\n NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70\n LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150\n Call Trace:\n [c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150\n [c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0\n\nThe crash occurs because arch_irq_work_raise() calls preempt_disable()\nfrom machine check exception (MCE) handlers running in real mode. In\nthis context, accessing the preempt_count can fault, leading to the panic.\n\nThe preempt_disable()/preempt_enable() pair in arch_irq_work_raise()\nwas originally added by commit 0fe1ac48bef0 (\"powerpc/perf_event: Fix\noops due to perf_event_do_pending call\") to avoid races while raising\nirq work from exception context.\n\nLater, commit 471ba0e686cb (\"irq_work: Do not raise an IPI when\nqueueing work on the local CPU\") added preemption protection in\nirq_work_queue() path, while commit 20b876918c06 (\"irq_work: Use per\ncpu atomics instead of regular atomics\") added equivalent\nprotection in irq_work_queue_on() before reaching arch_irq_work_raise():\n\n irq_work_queue() / irq_work_queue_on()\n -\u003e preempt_disable()\n -\u003e __irq_work_queue_local()\n -\u003e irq_work_raise()\n -\u003e arch_irq_work_raise()\n\nAs a result, callers other than mce_irq_work_raise() already execute\nwith preemption disabled, making the additional\npreempt_disable()/preempt_enable() pair in arch_irq_work_raise()\nredundant.\n\nThe arch_irq_work_raise() function executes in NMI context when called\nfrom MCE handler. Hence we will not be preempted or scheduled out since\nwe are in NMI context with MSR[EE]\u003d0. Therefore, it is safe to remove\nthe preempt_disable()/preempt_enable() calls from here.\n\nRemove it to avoid accessing preempt_count from real mode context.\n\nFixes: cc15ff327569 (\"powerpc/mce: Avoid using irq_work_queue() in realmode\")\nSuggested-by: Mahesh Salgaonkar \u003cmahesh@linux.ibm.com\u003e\nAcked-by: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nReviewed-by: Ritesh Harjani (IBM) \u003critesh.list@gmail.com\u003e\nSigned-off-by: Sayali Patil \u003csayalip@linux.ibm.com\u003e\n[Maddy: Fixed the commit title]\nSigned-off-by: Madhavan Srinivasan \u003cmaddy@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260513081413.222490-1-sayalip@linux.ibm.com\n" }, { "commit": "b69bcb13ed7024a84d6cd8ad330f1e32782fcf28", "tree": "58e580f9fcf7dda18a0dd98883a1c8689b7934b4", "parents": [ "50da1c9ccb70fc5250c37ac474b54ee072732ea3" ], "author": { "name": "Vivian Wang", "email": "wangruikang@iscas.ac.cn", "time": "Wed Apr 01 09:53:17 2026 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed May 13 22:26:32 2026 -0600" }, "message": "riscv: misaligned: Make enabling delegation depend on NONPORTABLE\n\nThe unaligned access emulation code in Linux has various deficiencies.\nFor example, it doesn\u0027t emulate vector instructions [1] [2], and doesn\u0027t\nemulate KVM guest accesses. Therefore, requesting misaligned exception\ndelegation with SBI FWFT actually regresses vector instructions\u0027 and KVM\nguests\u0027 behavior.\n\nUntil Linux can handle it properly, guard these sbi_fwft_set() calls\nbehind RISCV_SBI_FWFT_DELEGATE_MISALIGNED, which in turn depends on\nNONPORTABLE. Those who are sure that this wouldn\u0027t be a problem can\nenable this option, perhaps getting better performance.\n\nThe rest of the existing code proceeds as before, except as if\nSBI_FWFT_MISALIGNED_EXC_DELEG is not available, to handle any remaining\naddress misaligned exceptions on a best-effort basis. The KVM SBI FWFT\nimplementation is also not touched, but it is disabled if the firmware\nemulates unaligned accesses.\n\nCc: stable@vger.kernel.org\nFixes: cf5a8abc6560 (\"riscv: misaligned: request misaligned exception from SBI\")\nReported-by: Songsong Zhang \u003cU2FsdGVkX1@gmail.com\u003e # KVM\nLink: https://lore.kernel.org/linux-riscv/38ce44c1-08cf-4e3f-8ade-20da224f529c@iscas.ac.cn/ [1]\nLink: https://lore.kernel.org/linux-riscv/b3cfcdac-0337-4db0-a611-258f2868855f@iscas.ac.cn/ [2]\nSigned-off-by: Vivian Wang \u003cwangruikang@iscas.ac.cn\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260401-riscv-misaligned-dont-delegate-v2-1-5014a288c097@iscas.ac.cn\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "50da1c9ccb70fc5250c37ac474b54ee072732ea3", "tree": "194602ee13eb7c16a09fcbb806bf1d7759e8e21a", "parents": [ "6c7674b5b7ae513cecae22aa9dcdcf533862cf5c" ], "author": { "name": "Randy Dunlap", "email": "rdunlap@infradead.org", "time": "Mon Apr 06 16:23:04 2026 -0700" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed May 13 22:21:32 2026 -0600" }, "message": "riscv: Docs: fix unmatched quote warning\n\n\u0027make htmldocs\u0027 complains about ``prctrl` -- so add a second \u0027`\u0027 to\navoid the warning.\n\nDocumentation/arch/riscv/zicfilp.rst:79: WARNING: Inline literal start-string without end-string. [docutils]\n\nFixes: 08ee1559052b (\"prctl: cfi: change the branch landing pad prctl()s to be more descriptive\")\nSigned-off-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nLink: https://patch.msgid.link/20260406232304.1892528-1-rdunlap@infradead.org\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "f44d38a31f1802b7222adaea9ee69f9d280f698a", "tree": "9f836b5a33519a0385aeeff1d51d44470d786e10", "parents": [ "d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc" ], "author": { "name": "Zizhi Wo", "email": "wozizhi@huawei.com", "time": "Thu May 14 10:18:47 2026 +0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Wed May 13 21:44:57 2026 -0600" }, "message": "io_uring: validate user-controlled cq.head in io_cqe_cache_refill()\n\nA fuzzing run reproduced an unkillable io_uring task stuck at ~100% CPU:\n\n[root@fedora io_uring_stress]# ps -ef | grep io_uring\nroot 1240 1 99 13:36 ? 00:01:35 [io_uring_stress] \u003cdefunct\u003e\n\nThe task loops inside io_cqring_wait() and never returns to userspace,\nand SIGKILL has no effect.\n\nThis is caused by the CQ ring exposing rings-\u003ecq.head to userspace as\nwritable, while the authoritative tail lives in kernel-private\nctx-\u003ecached_cq_tail. io_cqe_cache_refill() computes free space as an\nunsigned subtraction:\n\n free \u003d ctx-\u003ecq_entries - min(tail - head, ctx-\u003ecq_entries);\n\nIf userspace keeps head within [0, tail], the subtraction is well\ndefined and min() just acts as a defensive clamp. But if userspace\nadvances head past tail, (tail - head) wraps to a huge value, free\nbecomes 0, and io_cqe_cache_refill() fails. The CQE is pushed onto the\noverflow list and IO_CHECK_CQ_OVERFLOW_BIT is set.\n\nThe wait loop in io_cqring_wait() relies on an invariant: refill() only\nfails when the CQ is *physically* full, in which case rings-\u003ecq.tail has\nbeen advanced to iowq-\u003ecq_tail and io_should_wake() returns true. The\ntampered head breaks this: refill() fails while the ring is not full, no\nOCQE is copied in, rings-\u003ecq.tail never catches up, io_should_wake()\nstays false, and io_cqring_wait_schedule() keeps returning early because\nIO_CHECK_CQ_OVERFLOW_BIT is still set. The result is a tight retry loop\nthat never returns to userspace.\n\nIntroduce io_cqring_queued() as the single point that converts the\n(tail, head) pair into a trustworthy queued count. Since the real\nhead/tail distance is bounded by cq_entries (far below 2^31), a signed\ncomparison reliably detects userspace moving head past tail; in that\ncase treat the queue as empty so callers see the full cache as free and\nforward progress is preserved.\n\nSuggested-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Zizhi Wo \u003cwozizhi@huawei.com\u003e\nLink: https://patch.msgid.link/20260514021847.4062782-1-wozizhi@huaweicloud.com\n[axboe: fixup commit message, kill \u0027queued\u0027 var, and keep it all in\nio_uring.c]\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "68055b285428a09f098861a702024e9d8f1370c8", "tree": "8bcee9bf7f0be21ea693dda03b7aff0506a79224", "parents": [ "9e20b4b8ff099e63a8e8d83de62d6e40a7b84be5", "5d08559c910cc37673b965a0d4e8d004444d0332" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu May 14 12:04:08 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu May 14 12:04:14 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.1-2026-05-13\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.1-2026-05-13:\n\namdgpu:\n- Userq fixes\n- DCN 3.2 fix\n- RAS fix\n- GC 12 fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260513224053.40670-1-alexander.deucher@amd.com\n" }, { "commit": "cc21150cdea8813fc9677ff61a3cbe9995801aa0", "tree": "873d43259e428b340f6dd02e6538323674bae4c2", "parents": [ "b84c5632c7b31f8910167075a8128cfb9e50fcfe", "552cc2306c3d87632f44a655737d1d367c2a3295" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:03:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:03:07 2026 -0700" }, "message": "Merge branch \u0027macsec-use-rcu_work-to-fix-crypto-cleanup-in-softirq-context\u0027\n\nJinliang Zheng says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmacsec: use rcu_work to fix crypto cleanup in softirq context\n\nFrom: Jinliang Zheng \u003calexjlzheng@tencent.com\u003e\n\ncrypto_free_aead() can internally call vunmap() (e.g. via dma_free_attrs()\nin hardware crypto drivers like hisi_sec2), which must not be invoked from\nsoftirq context. Both free_rxsa() and free_txsa() are RCU callbacks that\nrun in softirq, causing a kernel crash on affected hardware.\n\nThis series fixes the issue by deferring the actual cleanup to a workqueue\nusing rcu_work, which combines the RCU grace period and workqueue dispatch\ninto a single primitive.\n\nTwo design decisions worth noting:\n\n1. rcu_work instead of schedule_work() + synchronize_rcu()\n\n An alternative would be to call schedule_work() directly from\n macsec_rxsa_put()/macsec_txsa_put(), then call synchronize_rcu() at\n the start of the work handler to replace the grace period previously\n provided by call_rcu(). However, synchronize_rcu() blocks the worker\n thread for the duration of a full RCU grace period. Under high SA\n churn (e.g. tearing down an interface with many SAs), each SA would\n occupy a worker thread while waiting, and multiple concurrent calls\n cannot share the same grace period — leading to unnecessary latency\n and resource waste.\n\n rcu_work uses call_rcu_hurry() internally, which is fully asynchronous:\n the worker thread is only dispatched after the grace period has elapsed,\n and multiple concurrent queue_rcu_work() calls naturally batch under the\n same grace period via the RCU subsystem\u0027s existing coalescing mechanism.\n\n2. Dedicated workqueue instead of system_wq\n\n Using a dedicated workqueue (macsec_wq) allows macsec_exit() to drain\n exactly the work items belonging to this module — by calling\n destroy_workqueue() after rcu_barrier(). If system_wq were used,\n flush_scheduled_work() would drain all pending work items across the\n entire system, creating unnecessary coupling with unrelated subsystems\n and potentially causing unexpected delays. The dedicated workqueue\n provides a clean, contained teardown path.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260511153102.2640368-1-alexjlzheng@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "552cc2306c3d87632f44a655737d1d367c2a3295", "tree": "873d43259e428b340f6dd02e6538323674bae4c2", "parents": [ "6624bba469a325ecd699feae400b77cd11c76b98" ], "author": { "name": "Jinliang Zheng", "email": "alexjlzheng@tencent.com", "time": "Mon May 11 23:31:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:03:05 2026 -0700" }, "message": "macsec: use rcu_work to defer TX SA crypto cleanup out of softirq\n\nfree_txsa() is an RCU callback running in softirq context, but calls\ncrypto_free_aead() which can invoke vunmap() internally on hardware\ncrypto drivers (e.g. hisi_sec2), triggering a kernel crash.\n\nUse rcu_work to defer the cleanup to a workqueue, for the same reasons\nas the analogous fix to free_rxsa() in the previous patch.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nSigned-off-by: Jinliang Zheng \u003calexjlzheng@tencent.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260511153102.2640368-4-alexjlzheng@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6624bba469a325ecd699feae400b77cd11c76b98", "tree": "65ce055ca2419c650ac1d1201243cff9c2464013", "parents": [ "c6690a9030d784d3f099850800b6d5323771ca37" ], "author": { "name": "Jinliang Zheng", "email": "alexjlzheng@tencent.com", "time": "Mon May 11 23:30:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:03:05 2026 -0700" }, "message": "macsec: use rcu_work to defer RX SA crypto cleanup out of softirq\n\ncrypto_free_aead() can internally invoke vunmap() (e.g. via\ndma_free_attrs() in hardware crypto drivers such as hisi_sec2).\nvunmap() must not be called from softirq context, but free_rxsa()\nis an RCU callback that runs in softirq, leading to a kernel crash:\n\n vunmap+0x4c/0x70\n __iommu_dma_free+0xd0/0x138\n dma_free_attrs+0xf4/0x100\n sec_aead_exit+0x64/0xb8 [hisi_sec2]\n crypto_destroy_tfm+0x98/0x110\n free_rxsa+0x28/0x50 [macsec]\n rcu_do_batch+0x184/0x460\n rcu_core+0xf4/0x1f8\n handle_softirqs+0x118/0x330\n\nUse rcu_work to defer the cleanup to a workqueue. rcu_work dispatches\nthe worker asynchronously after the RCU grace period, so no thread\nblocks waiting, and concurrent releases of multiple SAs naturally\nshare the same grace period.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nSigned-off-by: Jinliang Zheng \u003calexjlzheng@tencent.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260511153102.2640368-3-alexjlzheng@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c6690a9030d784d3f099850800b6d5323771ca37", "tree": "3bdf79bdbcbad14264828a7680b1a2822155fa63", "parents": [ "b84c5632c7b31f8910167075a8128cfb9e50fcfe" ], "author": { "name": "Jinliang Zheng", "email": "alexjlzheng@tencent.com", "time": "Mon May 11 23:30:58 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:03:05 2026 -0700" }, "message": "macsec: introduce dedicated workqueue for SA crypto cleanup\n\nIntroduce a dedicated ordered workqueue, macsec_wq, which will be used\nby subsequent patches to defer SA crypto cleanup (crypto_free_aead and\nrelated teardown) out of softirq context.\n\nUsing a dedicated workqueue instead of system_wq allows macsec_exit()\nto drain exactly the work items belonging to this module via\ndestroy_workqueue(), without interfering with unrelated work items on\nsystem_wq or causing unexpected delays elsewhere.\n\nrcu_barrier() in macsec_exit() ensures all in-flight rcu_work callbacks\nhave enqueued their work items before destroy_workqueue() drains and\ndestroys the queue, making the two-step teardown correct and complete.\nThe same sequence is kept in the error path of macsec_init() as a\nprecaution, to mirror macsec_exit() and stay safe if work ever becomes\nqueueable before this point in the future.\n\nWhile at it, rename the error labels in macsec_init() from the\nresource-named style (rtnl:, notifier:, wq:) to the err_xxx: style\n(err_rtnl:, err_notifier:, err_destroy_wq:) to align with the broader\nkernel convention.\n\nSigned-off-by: Jinliang Zheng \u003calexjlzheng@tencent.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260511153102.2640368-2-alexjlzheng@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b84c5632c7b31f8910167075a8128cfb9e50fcfe", "tree": "93f8348aed93e8d2921a14468aeed5b511d6eb33", "parents": [ "9a390d34d55cb4ecbca4981c660dd95440827c70" ], "author": { "name": "Faicker Mo", "email": "faicker.mo@gmail.com", "time": "Mon May 11 22:05:51 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 19:01:03 2026 -0700" }, "message": "net: net_failover: Fix the deadlock in slave register\n\nThere is netdev_lock_ops() before the NETDEV_REGISTER notifier\nin register_netdevice(), so use the non-locking functions\nin net_failover_slave_register().\nfailover_slave_register() in failover_existing_slave_register() adds lock\nand unlock ops too.\n\nCall Trace:\n \u003cTASK\u003e\n __schedule+0x30d/0x7a0\n schedule+0x27/0x90\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x538/0x9e0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n dev_set_mtu+0x40/0xe0\n net_failover_slave_register+0x24/0x280\n failover_slave_register+0x103/0x1b0\n failover_event+0x15e/0x210\n ? dropmon_net_event+0xac/0xe0\n notifier_call_chain+0x5e/0xe0\n raw_notifier_call_chain+0x16/0x30\n call_netdevice_notifiers_info+0x52/0xa0\n register_netdevice+0x5f4/0x7c0\n register_netdev+0x1e/0x40\n _mlx5e_probe+0xe2/0x370 [mlx5_core]\n mlx5e_probe+0x59/0x70 [mlx5_core]\n ? __pfx_mlx5e_probe+0x10/0x10 [mlx5_core]\n\nFixes: 4c975fd70002 (\"net: hold instance lock during NETDEV_REGISTER/UP\")\nSigned-off-by: Faicker Mo \u003cfaicker.mo@gmail.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e20b4b8ff099e63a8e8d83de62d6e40a7b84be5", "tree": "4f9547569fe378ed98ed256491ee072303834eb7", "parents": [ "5d6919055dec134de3c40167a490f33c74c12581", "1ae15b6c7965d137eef21f2cc7d367b29cb88369" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu May 14 11:53:09 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Thu May 14 11:53:11 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-05-13\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Skip __i915_request_skip() for already signaled requests (Sebastian Brzezinka)\n- Fix VSC dynamic range signaling for RGB formats [dp] (Chaitanya Kumar Borah)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Tvrtko Ursulin \u003ctursulin@igalia.com\u003e\nLink: https://patch.msgid.link/agSVZmNC_qV4G6jQ@linux\n" }, { "commit": "9a390d34d55cb4ecbca4981c660dd95440827c70", "tree": "d2746e8321cea714cdbf23a26d829930600b3bfb", "parents": [ "59afae20080a9681014bdc87897cbfd30bedd261" ], "author": { "name": "Sukhdeep Singh", "email": "sukhdeeps@marvell.com", "time": "Tue May 12 18:27:11 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed May 13 18:09:52 2026 -0700" }, "message": "MAINTAINERS: update atlantic driver maintainer\n\nIgor Russkikh and Egor Pomozov have left Marvell.\nTake over maintenance of the atlantic driver and its PTP subsystem.\n\nSigned-off-by: Sukhdeep Singh \u003csukhdeeps@marvell.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c7674b5b7ae513cecae22aa9dcdcf533862cf5c", "tree": "56ab946b7fbf352e6b04375f01d8d3cbca3db7a0", "parents": [ "41337097f2823e99478d7cbe68d4893582ed0b18" ], "author": { "name": "Zong Li", "email": "zong.li@sifive.com", "time": "Mon Apr 27 19:41:05 2026 -0700" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Wed May 13 19:07:12 2026 -0600" }, "message": "riscv: cfi: reduce shadow stack size limit from 4GB to 2GB\n\nFollow the ARM64 GCS (Guarded Control Stack) implementation approach\nby reducing the shadow stack size allocation from min(RLIMIT_STACK, 4GB)\nto min(RLIMIT_STACK/2, 2GB). See commit 506496bcbb42 (\"arm64/gcs: Ensure\nthat new threads have a GCS\")\n\nRationale:\n\n1. Shadow stacks only store return addresses (8 bytes per entry), not\n local variables, function parameters, or saved registers. A 2GB\n shadow stack is far more than sufficient for any practical\n application, even with extremely deep recursion. Using half the size\n maintains adequate margin while being more resource-efficient.\n\n2. On memory-constrained systems (e.g., platforms with only 4GB of\n physical memory, which is a common configuration), allocating 4GB\n of virtual address space for shadow stack per process/thread can\n lead to virtual memory allocation failures when the overcommit mode\n is set to OVERCOMMIT_GUESS or OVERCOMMIT_NEVER:\n Error: \"__vm_enough_memory: not enough memory for the allocation\"\n\nThis reduces virtual address space consumption by 50% while maintaining\nmore than adequate space for return address storage.\n\nSigned-off-by: Zong Li \u003czong.li@sifive.com\u003e\nLink: https://patch.msgid.link/20260428024105.645162-1-zong.li@sifive.com\n[pjw@kernel.org: clean up patch description]\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" } ], "next": "59afae20080a9681014bdc87897cbfd30bedd261" }