)]}' { "log": [ { "commit": "8aed2ef1cfeedf4115cd0d3367d02c7e85b62253", "tree": "9752a5cc43359d40e26246a70d31cc0d2ef718fa", "parents": [ "05f7e89ab9731565d8a62e3b5d1ec206485eeb0b" ], "author": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Tue Sep 17 15:00:30 2019 -0400" }, "committer": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Wed Feb 18 11:16:43 2026 -0500" }, "message": "audit: add a Linux Audit specific README.md and SECURITY.md\n\nDO NOT SUBMIT UPSTREAM\n" }, { "commit": "05f7e89ab9731565d8a62e3b5d1ec206485eeb0b", "tree": "41c647acd5b476f7d5e38437d1d62c72b716d1f8", "parents": [ "e98f34af61167aee238e666bfbc97d1620afd88a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 08 13:03:27 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 08 13:03:27 2026 -0800" }, "message": "Linux 6.19\n" }, { "commit": "e98f34af61167aee238e666bfbc97d1620afd88a", "tree": "64e0bbc6a2f1b7cbd42633c60a4b8d90114aa14c", "parents": [ "e7aa57247700733e52a8e2e4dee6a52c2a76de02", "b126097b0327437048bd045a0e4d273dea2910dd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 08 09:17:46 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 08 09:17:46 2026 -0800" }, "message": "Merge tag \u0027i2c-for-6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fix from Wolfram Sang:\n\n - imx: preserve error state during SMBus block read length handling\n\n* tag \u0027i2c-for-6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: imx: preserve error state in block data length handler\n" }, { "commit": "e7aa57247700733e52a8e2e4dee6a52c2a76de02", "tree": "e0ab6f0656284e0b8e17577e8e72cd7049c7cf40", "parents": [ "142fdd7bb7095c114d027b1ee36878a67b869228", "a0a75b40c919b9f6d3a0b6c978e6ccf344c1be5a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:37:34 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:37:34 2026 -0800" }, "message": "Merge tag \u0027spi-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"One final batch of fixes for the Tegra SPI drivers, the main one is a\n batch of fixes for races with the interrupts in the Tegra210 QSPI\n driver that Breno has been working on for a while\"\n\n* tag \u0027spi-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: tegra114: Preserve SPI mode bits in def_command1_reg\n spi: tegra: Fix a memory leak in tegra_slink_probe()\n spi: tegra210-quad: Protect curr_xfer check in IRQ handler\n spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer\n spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer\n spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one\n spi: tegra210-quad: Move curr_xfer read inside spinlock\n spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer\n" }, { "commit": "142fdd7bb7095c114d027b1ee36878a67b869228", "tree": "c6a5d9102795f7fa98712b30f43ac9714d25eb1e", "parents": [ "b0e7d3f88e563b5ca793fca23c7d7fa1352c1079", "41399c5d476156635c9a58de870d39318e22fa09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:34:49 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:34:49 2026 -0800" }, "message": "Merge tag \u0027regulator-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"One last fix for v6.19: the voltages for the SpaceMIT P1 were not\n described correctly\"\n\n* tag \u0027regulator-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: spacemit-p1: Fix n_voltages for BUCK and LDO regulators\n" }, { "commit": "b0e7d3f88e563b5ca793fca23c7d7fa1352c1079", "tree": "3359d75a0233c5595182b6f953066ba65a8297ec", "parents": [ "dda5df9823630a26ed24ca9150b33a7f56ba4546", "ec4ddc90d201d09ef4e4bef8a2c6d9624525ad68" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:27:57 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:27:57 2026 -0800" }, "message": "Merge tag \u0027char-misc-6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull binder fixes from Greg KH:\n \"Here are some small, last-minute binder C and Rust driver fixes for\n reported issues. They include a number of fixes for reported crashes\n and other problems.\n\n All of these have been in linux-next this week, and longer\"\n\n* tag \u0027char-misc-6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:\n binderfs: fix ida_alloc_max() upper bound\n rust_binderfs: fix ida_alloc_max() upper bound\n binder: fix BR_FROZEN_REPLY error log\n rust_binder: add additional alignment checks\n binder: fix UAF in binder_netlink_report()\n rust_binder: correctly handle FDA objects of length zero\n" }, { "commit": "dda5df9823630a26ed24ca9150b33a7f56ba4546", "tree": "d2454c9a2b01b47dfd33cb35d66322e6be58a38b", "parents": [ "7e0b172c80ad797061dfa32e18bf908c81ceab0e", "4463c7aa11a6e67169ae48c6804968960c4bffea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:10:42 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 09:10:42 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-02-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fixes from Ingo Molnar:\n \"Miscellaneous MMCID fixes to address bugs and performance regressions\n in the recent rewrite of the SCHED_MM_CID management code:\n\n - Fix livelock triggered by BPF CI testing\n\n - Fix hard lockup on weakly ordered systems\n\n - Simplify the dropping of CIDs in the exit path by removing an\n unintended transition phase\n\n - Fix performance/scalability regression on a thread-pool benchmark\n by optimizing transitional CIDs when scheduling out\"\n\n* tag \u0027sched-urgent-2026-02-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/mmcid: Optimize transitional CIDs when scheduling out\n sched/mmcid: Drop per CPU CID immediately when switching to per task mode\n sched/mmcid: Protect transition on weakly ordered systems\n sched/mmcid: Prevent live lock on task to CPU mode transition\n" }, { "commit": "7e0b172c80ad797061dfa32e18bf908c81ceab0e", "tree": "9dbf433b40624ba65cb2d5401ba3997e4b854743", "parents": [ "2687c848e57820651b9f69d30c4710f4219f7dbf", "f495054bd12e2abe5068e243bdf344b704c303c6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 08:21:21 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 07 08:21:21 2026 -0800" }, "message": "Merge tag \u0027objtool-urgent-2026-02-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull objtool fixes from Ingo Molnar::\n\n - Bump up the Clang minimum version requirements for livepatch\n builds, due to Clang assembler section handling bugs causing\n silent miscompilations\n\n - Strip livepatching symbol artifacts from non-livepatch modules\n\n - Fix livepatch build warnings when certain Clang LTO options\n are enabled\n\n - Fix livepatch build error when CONFIG_MEM_ALLOC_PROFILING_DEBUG\u003dy\n\n* tag \u0027objtool-urgent-2026-02-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n objtool/klp: Fix unexported static call key access for manually built livepatch modules\n objtool/klp: Fix symbol correlation for orphaned local symbols\n livepatch: Free klp_{object,func}_ext data after initialization\n livepatch: Fix having __klp_objects relics in non-livepatch modules\n livepatch/klp-build: Require Clang assembler \u003e\u003d 20\n" }, { "commit": "2687c848e57820651b9f69d30c4710f4219f7dbf", "tree": "68ff6955be565c32a0c6b97ea7d99b0b426e1a67", "parents": [ "3dc58c9ce1c5802fec680cb8e95962f1430d5771" ], "author": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Fri Feb 06 14:24:55 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 14:51:03 2026 -0800" }, "message": "x86/vmware: Fix hypercall clobbers\n\nFedora QA reported the following panic:\n\n BUG: unable to handle page fault for address: 0000000040003e54\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.fc43 11/19/2025\n RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90\n ..\n Call Trace:\n vmmouse_report_events+0x13e/0x1b0\n psmouse_handle_byte+0x15/0x60\n ps2_interrupt+0x8a/0xd0\n ...\n\nbecause the QEMU VMware mouse emulation is buggy, and clears the top 32\nbits of %rdi that the kernel kept a pointer in.\n\nThe QEMU vmmouse driver saves and restores the register state in a\n\"uint32_t data[6];\" and as a result restores the state with the high\nbits all cleared.\n\nRDI originally contained the value of a valid kernel stack address\n(0xff5eeb3240003e54). After the vmware hypercall it now contains\n0x40003e54, and we get a page fault as a result when it is dereferenced.\n\nThe proper fix would be in QEMU, but this works around the issue in the\nkernel to keep old setups working, when old kernels had not happened to\nkeep any state in %rdi over the hypercall.\n\nIn theory this same issue exists for all the hypercalls in the vmmouse\ndriver; in practice it has only been seen with vmware_hypercall3() and\nvmware_hypercall4(). For now, just mark RDI/RSI as clobbered for those\ntwo calls. This should have a minimal effect on code generation overall\nas it should be rare for the compiler to want to make RDI/RSI live\nacross hypercalls.\n\nReported-by: Justin Forbes \u003cjforbes@fedoraproject.org\u003e\nLink: https://lore.kernel.org/all/99a9c69a-fc1a-43b7-8d1e-c42d6493b41f@broadcom.com/\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3dc58c9ce1c5802fec680cb8e95962f1430d5771", "tree": "abf2ef84eae8e08b2e9828fa7f39319ab13a3256", "parents": [ "bab849a908496a593af61a9832eea26f1ec3e279", "ae9fd76c111bb4a5293c2831a1ad373605251dd6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 13:07:47 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 13:07:47 2026 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-02-06-12-37\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull hotfixes from Andrew Morton:\n \"A couple of late-breaking MM fixes. One against a new-in-this-cycle\n patch and the other addresses a locking issue which has been there for\n over a year\"\n\n* tag \u0027mm-hotfixes-stable-2026-02-06-12-37\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/memory-failure: reject unsupported non-folio compound page\n procfs: avoid fetching build ID while holding VMA lock\n" }, { "commit": "bab849a908496a593af61a9832eea26f1ec3e279", "tree": "355b54fa8bb9a7b3d07d0b3c4b6ab6e7474f681f", "parents": [ "240b8d8227468344e814c6bc7eb8ae532e3b8a09", "033c55fe2e326bea022c3cc5178ecf3e0e459b82" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 12:37:28 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 12:37:28 2026 -0800" }, "message": "Merge tag \u0027trace-v6.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fix from Steven Rostedt:\n\n - Fix event format field alignments for 32 bit architectures\n\n The fields in the event format files are used to parse the raw binary\n buffer data by applications. If they are incorrect, then the\n application produces garbage.\n\n On 32 bit architectures, the function graph 64bit calltime and\n rettime were off by 4bytes. That\u0027s because the actual fields are in a\n packed structure but the macros used by the ftrace events did not\n mark them as packed, and instead, gave them their natural alignment\n which made their offsets off by 4 bytes.\n\n There are macros to have a packed field within an embedded structure\n of an event, but there\u0027s no macro for normal fields within a packed\n structure of the event. The macro __field_packed() was used for the\n packed embedded structure field. Rename that to __field_desc_packed()\n (to match the non-packed embedded field macro __field_desc()), and\n make __field_packed() for fields that are in a packed event structure\n (which matches the unpacked __field() macro).\n\n Switch the calltime and rettime fields of the function graph event to\n use the new __field_packed() and this makes the offsets correct.\n\n* tag \u0027trace-v6.19-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Fix ftrace event field alignments\n" }, { "commit": "240b8d8227468344e814c6bc7eb8ae532e3b8a09", "tree": "1df93f5b69ef9fec16c6d36d51e4c7f67f51d862", "parents": [ "23b0d2f7c2864099fba140672017e3e69ddf88a0", "7987cce375ac8ce98e170a77aa2399f2cf6eb99f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:34:17 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:34:17 2026 -0800" }, "message": "Merge tag \u0027ceph-for-6.19-rc9\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fixes from Ilya Dryomov:\n \"One RBD and two CephFS fixes which address potential oopses.\n\n The RBD thing is more of a rare edge case that pops up in our CI,\n while the two CephFS scenarios are regressions that were reported by\n users and can be triggered trivially in normal operation. All marked\n for stable\"\n\n* tag \u0027ceph-for-6.19-rc9\u0027 of https://github.com/ceph/ceph-client:\n ceph: fix NULL pointer dereference in ceph_mds_auth_match()\n ceph: fix oops due to invalid pointer for kfree() in parse_longname()\n rbd: check for EOD after exclusive lock is ensured to be held\n" }, { "commit": "23b0d2f7c2864099fba140672017e3e69ddf88a0", "tree": "36f5315168c8647eb97261ce11974c2b64039157", "parents": [ "fe70b3260e39ce4915a01cf3556a3ffe5b7f8817", "c33efdfcfa6f80e05ce1ee33694c1bad4994cd78" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:27:42 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:27:42 2026 -0800" }, "message": "Merge tag \u0027dma-mapping-6.19-2026-02-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two minor fixes for the DMA-mapping subsystem:\n\n - check for the rare case of the allocation failure of the global CMA\n pool (Shanker Donthineni)\n\n - avoid perf buffer overflow when tracing large scatter-gather lists\n (Deepanshu Kartikey)\"\n\n* tag \u0027dma-mapping-6.19-2026-02-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma: contiguous: Check return value of dma_contiguous_reserve_area()\n tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow\n" }, { "commit": "fe70b3260e39ce4915a01cf3556a3ffe5b7f8817", "tree": "785d944ffc8bb3471547da23a99e40b10903fd8e", "parents": [ "0dbc3577107008883a9d4275e4b67cd3b4dfacf5", "02f9d76a76adb5ea16b4e3b403496c42033f8fd1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:19:54 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:19:54 2026 -0800" }, "message": "Merge tag \u0027iommu-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fix from Joerg Roedel:\n\n - Fix wrong definition of PASID_FLAG_PWSNP bit. This caused DMAR errors\n on Arrow Lake platforms.\n\n* tag \u0027iommu-fix-v6.19-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n iommu/vt-d: Treat PAGE_SNOOP and PWSNP separately\n" }, { "commit": "0dbc3577107008883a9d4275e4b67cd3b4dfacf5", "tree": "9dcabb19f1582b453dced4a044532f0185f4fd57", "parents": [ "8aa3041808b5dcf43f4964a5b58cd44652d772a8", "e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:10:39 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:10:39 2026 -0800" }, "message": "Merge tag \u0027pmdomain-v6.19-rc3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - imx:\n - Fix system wakeup support for imx8mp power domains\n - Fix potential out-of-range access for imx8m power domains\n - Fix the imx8mm gpu hang\n\n - qcom: Fix off-by-one error for highest state in rpmpd\n\n* tag \u0027pmdomain-v6.19-rc3-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup\n pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup\n pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc-\u003edomains\n pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset\n pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state\n" }, { "commit": "8aa3041808b5dcf43f4964a5b58cd44652d772a8", "tree": "6101316cca00185a971b4dbde4af1ac7a0032c66", "parents": [ "8770bd8f91749dfd05714447dfbd511147cb9576", "e34f77b09080c86c929153e2a72da26b4f8947ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:05:35 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 10:05:35 2026 -0800" }, "message": "Merge tag \u0027gpio-fixes-for-v6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix incorrect retval check in gpio-loongson-64bit\n\n - fix GPIO counting with ACPI\n\n* tag \u0027gpio-fixes-for-v6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()\n gpiolib: acpi: Fix gpio count with string references\n" }, { "commit": "8770bd8f91749dfd05714447dfbd511147cb9576", "tree": "d97f1810a507b288f3233f407bf291f30a1a7d3e", "parents": [ "5ca98c22b5c4507fad4513a504d7c5ec46cd0386", "51db05283f7c9c95a3e6853a3044cd04226551bf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:59:40 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:59:40 2026 -0800" }, "message": "Merge tag \u0027sound-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes. It became a bit larger than wished, but\n all of them are device-specific small fixes, and it should be still\n fairly safe to take at the last minute.\n\n Included are a few quirks and fixes for Intel, AMD, HD-audio, and\n USB-audio, as well as a race fix in aloop driver and corrections of\n Cirrus firmware kunit test\"\n\n* tag \u0027sound-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek: Enable headset mic for Acer Nitro 5\n ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()\n ASoC: dt-bindings: ti,tlv320aic3x: Add compatible string ti,tlv320aic23\n ASoC: amd: fix memory leak in acp3x pdm dma ops\n ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update()\n ALSA: aloop: Fix racy access at PCM trigger\n ASoC: rt1320: fix intermittent no-sound issue\n ASoC: SOF: Intel: use hdev-\u003einfo.link_mask directly\n firmware: cs_dsp: rate-limit log messages in KUnit builds\n ASoC: amd: yc: Add quirk for HP 200 G2a 16\n ASoC: cs42l43: Correct handling of 3-pole jack load detection\n ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9\n ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43\n" }, { "commit": "5ca98c22b5c4507fad4513a504d7c5ec46cd0386", "tree": "52b6e26489d448d86a59570ca616d6418f084064", "parents": [ "f896d1c03e8dba2178c14d717d188ea43db016e6", "e6c53ead2d8fa73206e0a63e9cd9aea6bc929837" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:56:03 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:56:03 2026 -0800" }, "message": "Merge tag \u0027slab-for-6.19-rc8-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n \"A stable fix for memory allocation profiling tag not being cleared\n when aborting an allocation due to memcg charge failure (Hao Ge)\"\n\n* tag \u0027slab-for-6.19-rc8-fix\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single\n" }, { "commit": "f896d1c03e8dba2178c14d717d188ea43db016e6", "tree": "46608b7f1b7e7db39666ad512e511bc9e9ea8d5d", "parents": [ "b7ff7151e653aa296ab6c5495b2c1ab7c21eb250", "23ea2a4c72323feb6e3e025e8a6f18336513d5ad" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:21:38 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 06 09:21:38 2026 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull ARM fix from Russell King:\n \"Just one fix for memset64() on big endian 32-bit ARM systems\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9468/1: fix memset64() on big-endian\n" }, { "commit": "02f9d76a76adb5ea16b4e3b403496c42033f8fd1", "tree": "b5b407a519373509f63a47673131986b2ded212a", "parents": [ "18f7fcd5e69a04df57b563360b88be72471d6b62" ], "author": { "name": "Viktor Kleen", "email": "viktor@kleen.org", "time": "Thu Feb 05 16:49:41 2026 +0800" }, "committer": { "name": "Joerg Roedel", "email": "joerg.roedel@amd.com", "time": "Fri Feb 06 11:01:00 2026 +0100" }, "message": "iommu/vt-d: Treat PAGE_SNOOP and PWSNP separately\n\nThe PASID_FLAG_PAGE_SNOOP and PASID_FLAG_PWSNP constants are identical.\nThis will cause the pasid code to always set both or neither of the\nPGSNP and PWSNP bits in PASID table entries. However, PWSNP is a\nreserved bit if SMPWC is not set in the IOMMU\u0027s extended capability\nregister, even if SC is supported.\n\nThis has resulted in DMAR errors when testing the iommufd code on an\nArrow Lake platform. With this patch, those errors disappear and the\nPASID table entries look correct.\n\nFixes: 101a2854110fa (\"iommu/vt-d: Follow PT_FEAT_DMA_INCOHERENT into the PASID entry\")\nCc: stable@vger.kernel.org\nSigned-off-by: Viktor Kleen \u003cviktor@kleen.org\u003e\nReviewed-by: Jason Gunthorpe \u003cjgg@nvidia.com\u003e\nLink: https://lore.kernel.org/r/20260202192109.1665799-1-viktor@kleen.org\nSigned-off-by: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nSigned-off-by: Joerg Roedel \u003cjoerg.roedel@amd.com\u003e\n" }, { "commit": "e6c53ead2d8fa73206e0a63e9cd9aea6bc929837", "tree": "31388071998b3d3e4027a827458db0185fc970db", "parents": [ "99a3e3a1cfc93b8fe318c0a3a5cfb01f1d4ad53c" ], "author": { "name": "Hao Ge", "email": "hao.ge@linux.dev", "time": "Wed Feb 04 18:14:01 2026 +0800" }, "committer": { "name": "Vlastimil Babka", "email": "vbabka@suse.cz", "time": "Fri Feb 06 09:51:08 2026 +0100" }, "message": "mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single\n\nWhen CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled, the following warning\nmay be noticed:\n\n[ 3959.023862] ------------[ cut here ]------------\n[ 3959.023891] alloc_tag was not cleared (got tag for lib/xarray.c:378)\n[ 3959.023947] WARNING: ./include/linux/alloc_tag.h:155 at alloc_tag_add+0x128/0x178, CPU#6: mkfs.ntfs/113998\n[ 3959.023978] Modules linked in: dns_resolver tun brd overlay exfat btrfs blake2b libblake2b xor xor_neon raid6_pq loop sctp ip6_udp_tunnel udp_tunnel ext4 crc16 mbcache jbd2 rfkill sunrpc vfat fat sg fuse nfnetlink sr_mod virtio_gpu cdrom drm_client_lib virtio_dma_buf drm_shmem_helper drm_kms_helper ghash_ce drm sm4 backlight virtio_net net_failover virtio_scsi failover virtio_console virtio_blk virtio_mmio dm_mirror dm_region_hash dm_log dm_multipath dm_mod i2c_dev aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]\n[ 3959.024170] CPU: 6 UID: 0 PID: 113998 Comm: mkfs.ntfs Kdump: loaded Tainted: G W 6.19.0-rc7+ #7 PREEMPT(voluntary)\n[ 3959.024182] Tainted: [W]\u003dWARN\n[ 3959.024186] Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n[ 3959.024192] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n[ 3959.024199] pc : alloc_tag_add+0x128/0x178\n[ 3959.024207] lr : alloc_tag_add+0x128/0x178\n[ 3959.024214] sp : ffff80008b696d60\n[ 3959.024219] x29: ffff80008b696d60 x28: 0000000000000000 x27: 0000000000000240\n[ 3959.024232] x26: 0000000000000000 x25: 0000000000000240 x24: ffff800085d17860\n[ 3959.024245] x23: 0000000000402800 x22: ffff0000c0012dc0 x21: 00000000000002d0\n[ 3959.024257] x20: ffff0000e6ef3318 x19: ffff800085ae0410 x18: 0000000000000000\n[ 3959.024269] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[ 3959.024281] x14: 0000000000000000 x13: 0000000000000001 x12: ffff600064101293\n[ 3959.024292] x11: 1fffe00064101292 x10: ffff600064101292 x9 : dfff800000000000\n[ 3959.024305] x8 : 00009fff9befed6e x7 : ffff000320809493 x6 : 0000000000000001\n[ 3959.024316] x5 : ffff000320809490 x4 : ffff600064101293 x3 : ffff800080691838\n[ 3959.024328] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d5bcd640\n[ 3959.024340] Call trace:\n[ 3959.024346] alloc_tag_add+0x128/0x178 (P)\n[ 3959.024355] __alloc_tagging_slab_alloc_hook+0x11c/0x1a8\n[ 3959.024362] kmem_cache_alloc_lru_noprof+0x1b8/0x5e8\n[ 3959.024369] xas_alloc+0x304/0x4f0\n[ 3959.024381] xas_create+0x1e0/0x4a0\n[ 3959.024388] xas_store+0x68/0xda8\n[ 3959.024395] __filemap_add_folio+0x5b0/0xbd8\n[ 3959.024409] filemap_add_folio+0x16c/0x7e0\n[ 3959.024416] __filemap_get_folio_mpol+0x2dc/0x9e8\n[ 3959.024424] iomap_get_folio+0xfc/0x180\n[ 3959.024435] __iomap_get_folio+0x2f8/0x4b8\n[ 3959.024441] iomap_write_begin+0x198/0xc18\n[ 3959.024448] iomap_write_iter+0x2ec/0x8f8\n[ 3959.024454] iomap_file_buffered_write+0x19c/0x290\n[ 3959.024461] blkdev_write_iter+0x38c/0x978\n[ 3959.024470] vfs_write+0x4d4/0x928\n[ 3959.024482] ksys_write+0xfc/0x1f8\n[ 3959.024489] __arm64_sys_write+0x74/0xb0\n[ 3959.024496] invoke_syscall+0xd4/0x258\n[ 3959.024507] el0_svc_common.constprop.0+0xb4/0x240\n[ 3959.024514] do_el0_svc+0x48/0x68\n[ 3959.024520] el0_svc+0x40/0xf8\n[ 3959.024526] el0t_64_sync_handler+0xa0/0xe8\n[ 3959.024533] el0t_64_sync+0x1ac/0x1b0\n[ 3959.024540] ---[ end trace 0000000000000000 ]---\n\nWhen __memcg_slab_post_alloc_hook() fails, there are two different\nfree paths depending on whether size \u003d\u003d 1 or size !\u003d 1. In the\nkmem_cache_free_bulk() path, we do call alloc_tagging_slab_free_hook().\nHowever, in memcg_alloc_abort_single() we don\u0027t, the above warning will be\ntriggered on the next allocation.\n\nTherefore, add alloc_tagging_slab_free_hook() to the\nmemcg_alloc_abort_single() path.\n\nFixes: 9f9796b413d3 (\"mm, slab: move memcg charging to post-alloc hook\")\nCc: stable@vger.kernel.org\nSuggested-by: Hao Li \u003chao.li@linux.dev\u003e\nSigned-off-by: Hao Ge \u003chao.ge@linux.dev\u003e\nReviewed-by: Hao Li \u003chao.li@linux.dev\u003e\nReviewed-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nReviewed-by: Harry Yoo \u003charry.yoo@oracle.com\u003e\nLink: https://patch.msgid.link/20260204101401.202762-1-hao.ge@linux.dev\nSigned-off-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\n" }, { "commit": "b7ff7151e653aa296ab6c5495b2c1ab7c21eb250", "tree": "320565a8d80aa43e8d19269a2acc802b683ddc67", "parents": [ "8185461e531c39d67aa4705d7f94873feb87adfd", "831a2b27914cc880130ffe8fb8d1e65a5324d07f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 21:33:22 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 21:33:22 2026 -0800" }, "message": "Merge tag \u0027hwmon-for-v6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - occ: Mark occ_init_attribute() as __printf to avoid build failure due\n to \u0027-Werror\u003dsuggest-attribute\u003dformat\u0027\n\n - gpio-fan: Allow to stop fans when CONFIG_PM is disabled, and fix\n set_rpm() return value\n\n - acpi_power_meter: Fix deadlocks related to acpi_power_meter_notify()\n\n - dell-smm: Add Dell G15 5510 to fan control whitelist\n\n* tag \u0027hwmon-for-v6.19-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (occ) Mark occ_init_attribute() as __printf\n hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled\n hwmon: (gpio-fan) Fix set_rpm() return value\n hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()\n hwmon: (dell-smm) Add Dell G15 5510 to fan control whitelist\n" }, { "commit": "8185461e531c39d67aa4705d7f94873feb87adfd", "tree": "36b250cd7ee83a3e1bc1abdbeb3dce69f66ff0cb", "parents": [ "06bc4e26310f9f2c0dd2fbf4885483306c5235cb", "7ef92d2ecef7486d46eda0f911dc53b873fdf567" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 19:56:47 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 19:56:47 2026 -0800" }, "message": "Merge tag \u0027drm-fixes-2026-02-06\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"The usual xe/amdgpu selection, and a couple of misc changes for\n gma500, mgag200 and bridge. There is a nouveau revert, and also a set\n of changes that fix a regression since we moved to 570 firmware.\n Suspend/resume was broken on a bunch of GPUs. The fix looks big, but\n it\u0027s mostly just refactoring to pass an extra bit down the nouveau\n abstractions to the firmware command.\n\n amdgpu:\n - MES 11 old firmware compatibility fix\n - ASPM fix\n - DC LUT fixes\n\n amdkfd:\n - Fix possible double deletion of validate list\n\n xe:\n - Fix topology query pointer advance\n - A couple of kerneldoc fixes\n - Disable D3Cold for BMG only on specific platforms\n - Fix CFI violation in debugfs access\n\n nouveau:\n - Revert adding atomic commit functions as it regresses pre-nv50\n - Fix suspend/resume bugs exposed by enabling 570 firmware\n\n gma500:\n - Revert a regression caused by vblank changes\n\n mgag200:\n - Replace a busy loop with a polling loop to fix that blocking 1 cpu\n for 300 ms roughly every 20 minutes\n\nbridge:\n - imx8mp-hdmi-pa: Use runtime pm to fix a bug in channel ordering\"\n\n* tag \u0027drm-fixes-2026-02-06\u0027 of https://gitlab.freedesktop.org/drm/kernel:\n drm/xe/guc: Fix CFI violation in debugfs access.\n drm/bridge: imx8mp-hdmi-pai: enable PM runtime\n drm/xe/pm: Disable D3Cold for BMG only on specific platforms\n drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep\n drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early\n drm/xe: Fix kerneldoc for xe_migrate_exec_queue\n drm/xe/query: Fix topology query pointer advance\n drm/mgag200: fix mgag200_bmc_stop_scanout()\n nouveau/gsp: fix suspend/resume regression on r570 firmware\n nouveau: add a third state to the fini handler.\n nouveau/gsp: use rpc sequence numbers properly.\n drm/amdgpu: Fix double deletion of validate_list\n drm/amd/display: remove assert around dpp_base replacement\n drm/amd/display: extend delta clamping logic to CM3 LUT helper\n drm/amd/display: fix wrong color value mapping on MCM shaper LUT\n Revert \"drm/amd: Check if ASPM is enabled from PCIe subsystem\"\n drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52\n Revert \"drm/gma500: use drm_crtc_vblank_crtc()\"\n Revert \"drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)\"\n" }, { "commit": "7ef92d2ecef7486d46eda0f911dc53b873fdf567", "tree": "8a2dfe6763a7f8220dc09c6e4b99a1f49374569d", "parents": [ "cb8455cbf343791eea3c9fa142807a99c186b323", "6b61a54e684006ca0d92d684a1d3c3a00f077d8f" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:44:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:44:54 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.19-2026-02-05\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.19-2026-02-05:\n\namdgpu:\n- MES 11 old firmware compatibility fix\n- ASPM fix\n- DC LUT fixes\n\namdkfd:\n- Fix possible double deletion of validate list\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260205182017.2409773-1-alexander.deucher@amd.com\n" }, { "commit": "cb8455cbf343791eea3c9fa142807a99c186b323", "tree": "546c4ac47994a1ec56b6d2dd72ee32132d89524f", "parents": [ "4e3b2f0db48ebc277855dace4b4b746f166fecb3", "4cb1b327135dddf3d0ec2544ea36ed05ba2252bc" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:41:35 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:41:41 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-02-05\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- Fix topology query pointer advance (Shuicheng)\n- A couple of kerneldoc fixes (Shuicheng)\n- Disable D3Cold for BMG only on specific platforms (Karthik)\n- Fix CFI violation in debugfs access (Daniele)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/aYS2v12R8ELQoTiZ@fedora\n" }, { "commit": "4e3b2f0db48ebc277855dace4b4b746f166fecb3", "tree": "423aa97e757691765a9640a77651b721686a697a", "parents": [ "18f7fcd5e69a04df57b563360b88be72471d6b62", "40b24d9cdd4141ef43eeaa7e57c3efc07a567473" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:24:38 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 06 12:24:39 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-02-05\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v6.19 final:\n\nnouveau\n-------\nRevert adding atomic commit functions as it regresses pre-nv50.\nFix bugs exposed by enabling 570 firmware.\n\ngma500\n------\nRevert a regression caused by vblank changes.\n\nmgag200\n-------\nReplace a busy loop with a polling loop to fix that blocking 1 cpu for 300 ms roughly every 20 minutes.\n\nbridge\n------\nimx8mp-hdmi-pa: Use runtime pm to fix a bug in channel ordering.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/c0077ea5-faeb-4b0c-bd4a-ea2384d6dc0c@linux.intel.com\n" }, { "commit": "06bc4e26310f9f2c0dd2fbf4885483306c5235cb", "tree": "cef2f9fcf1f02b7c1c4b9359ea0a82c10a83cefc", "parents": [ "92f778a0b17a3d4d0b0200a5fb164c5107063044", "a6abd64e145ca3084b6a567e06517a7c2dbfd38d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 15:00:53 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 15:00:53 2026 -0800" }, "message": "Merge tag \u0027block-6.19-20260205\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Revert of a change for loop, which caused regressions for some users\n (Actually revert of two commits, where one is just an existing fix\n for the offending commit)\n\n - NVMe pull via Keith:\n - Fix NULL pointer access setting up dma mappings\n - Fix invalid memory access from malformed TCP PDU\n\n* tag \u0027block-6.19-20260205\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n loop: revert exclusive opener loop status change\n nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n nvme-pci: handle changing device dma map requirements\n" }, { "commit": "92f778a0b17a3d4d0b0200a5fb164c5107063044", "tree": "35547b1b9ee60aa08208121768a371945c3e69c5", "parents": [ "49233c41cf8546b94d213a5dd877ef07e61b1f3f", "38cfdd9dd279473a73814df9fd7e6e716951d361" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 14:40:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 14:40:06 2026 -0800" }, "message": "Merge tag \u0027io_uring-6.19-20260205\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Two small fixes for zcrx\n\n - Two small fixes for fdinfo - one is just killing a superflous newline\n\n* tag \u0027io_uring-6.19-20260205\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/fdinfo: be a bit nicer when looping a lot of SQEs/CQEs\n io_uring/fdinfo: kill unnecessary newline feed in CQE32 printing\n io_uring/zcrx: fix rq flush locking\n io_uring/zcrx: fix page array leak\n" }, { "commit": "ae9fd76c111bb4a5293c2831a1ad373605251dd6", "tree": "2421a17847cff8322e571289a99b88a0f473a618", "parents": [ "b5cbacd7f86f4f62b8813688c8e73be94e8e1951" ], "author": { "name": "Miaohe Lin", "email": "linmiaohe@huawei.com", "time": "Thu Feb 05 15:53:28 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu Feb 05 14:10:00 2026 -0800" }, "message": "mm/memory-failure: reject unsupported non-folio compound page\n\nWhen !CONFIG_TRANSPARENT_HUGEPAGE, a non-folio compound page can appear in\na userspace mapping via either vm_insert_*() functions or\nvm_operatios_struct-\u003efault(). They are not folios, thus should not be\nconsidered for folio operations like split. To reject these pages, make\nsure get_hwpoison_page() is always called as HWPoisonHandlable() will do\nthe right work.\n\n[Some commit log borrowed from Zi Yan. Thanks.]\n\nLink: https://lkml.kernel.org/r/20260205075328.523211-1-linmiaohe@huawei.com\nFixes: 689b8986776c (\"mm/memory-failure: improve large block size folio handling\")\nSigned-off-by: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nReported-by: 是参差 \u003cshicenci@gmail.com\u003e\nCloses: https://lore.kernel.org/all/PS1PPF7E1D7501F1E4F4441E7ECD056DEADAB98A@PS1PPF7E1D7501F.apcprd02.prod.outlook.com/\nReviewed-by: Zi Yan \u003cziy@nvidia.com\u003e\nTested-by: Zi Yan \u003cziy@nvidia.com\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Jane Chu \u003cjane.chu@oracle.com\u003e\nCc: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nCc: Naoya Horiguchi \u003cnao.horiguchi@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "b5cbacd7f86f4f62b8813688c8e73be94e8e1951", "tree": "3a5f8ee70152904be074d3ea73611d9557ab6908", "parents": [ "1a47837bfafed7e9ef93f5dfdea6d70869b0c3ab" ], "author": { "name": "Andrii Nakryiko", "email": "andrii@kernel.org", "time": "Thu Jan 29 13:53:40 2026 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu Feb 05 14:10:00 2026 -0800" }, "message": "procfs: avoid fetching build ID while holding VMA lock\n\nFix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock\nor per-VMA lock, whichever was used to lock VMA under question, to avoid\ndeadlock reported by syzbot:\n\n -\u003e #1 (\u0026mm-\u003emmap_lock){++++}-{4:4}:\n __might_fault+0xed/0x170\n _copy_to_iter+0x118/0x1720\n copy_page_to_iter+0x12d/0x1e0\n filemap_read+0x720/0x10a0\n blkdev_read_iter+0x2b5/0x4e0\n vfs_read+0x7f4/0xae0\n ksys_read+0x12a/0x250\n do_syscall_64+0xcb/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n -\u003e #0 (\u0026sb-\u003es_type-\u003ei_mutex_key#8){++++}-{4:4}:\n __lock_acquire+0x1509/0x26d0\n lock_acquire+0x185/0x340\n down_read+0x98/0x490\n blkdev_read_iter+0x2a7/0x4e0\n __kernel_read+0x39a/0xa90\n freader_fetch+0x1d5/0xa80\n __build_id_parse.isra.0+0xea/0x6a0\n do_procmap_query+0xd75/0x1050\n procfs_procmap_ioctl+0x7a/0xb0\n __x64_sys_ioctl+0x18e/0x210\n do_syscall_64+0xcb/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n other info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n CPU0 CPU1\n ---- ----\n rlock(\u0026mm-\u003emmap_lock);\n lock(\u0026sb-\u003es_type-\u003ei_mutex_key#8);\n lock(\u0026mm-\u003emmap_lock);\n rlock(\u0026sb-\u003es_type-\u003ei_mutex_key#8);\n\n *** DEADLOCK ***\n\nThis seems to be exacerbated (as we haven\u0027t seen these syzbot reports\nbefore that) by the recent:\n\n\t777a8560fd29 (\"lib/buildid: use __kernel_read() for sleepable context\")\n\nTo make this safe, we need to grab file refcount while VMA is still locked, but\nother than that everything is pretty straightforward. Internal build_id_parse()\nAPI assumes VMA is passed, but it only needs the underlying file reference, so\njust add another variant build_id_parse_file() that expects file passed\ndirectly.\n\n[akpm@linux-foundation.org: fix up kerneldoc]\nLink: https://lkml.kernel.org/r/20260129215340.3742283-1-andrii@kernel.org\nFixes: ed5d583a88a9 (\"fs/procfs: implement efficient VMA querying API for /proc/\u003cpid\u003e/maps\")\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nReported-by: \u003csyzbot+4e70c8e0a2017b432f7a@syzkaller.appspotmail.com\u003e\nReviewed-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nTested-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nReviewed-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nCc: Hao Luo \u003chaoluo@google.com\u003e\nCc: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nCc: KP Singh \u003ckpsingh@kernel.org\u003e\nCc: Martin KaFai Lau \u003cmartin.lau@linux.dev\u003e\nCc: Song Liu \u003csong@kernel.org\u003e\nCc: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nCc: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "a0a75b40c919b9f6d3a0b6c978e6ccf344c1be5a", "tree": "735517eba4f1fbb919b692a6c5c832bf618bcdbe", "parents": [ "41d9a6795b95d6ea28439ac1e9ce8c95bbca20fc" ], "author": { "name": "Vishwaroop A", "email": "va@nvidia.com", "time": "Wed Feb 04 14:12:12 2026 +0000" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu Feb 05 19:29:36 2026 +0000" }, "message": "spi: tegra114: Preserve SPI mode bits in def_command1_reg\n\nThe COMMAND1 register bits [29:28] set the SPI mode, which controls\nthe clock idle level. When a transfer ends, tegra_spi_transfer_end()\nwrites def_command1_reg back to restore the default state, but this\nregister value currently lacks the mode bits. This results in the\nclock always being configured as idle low, breaking devices that\nneed it high.\n\nFix this by storing the mode bits in def_command1_reg during setup,\nto prevent this field from always being cleared.\n\nFixes: f333a331adfa (\"spi/tegra114: add spi driver\")\nSigned-off-by: Vishwaroop A \u003cva@nvidia.com\u003e\nLink: https://patch.msgid.link/20260204141212.1540382-1-va@nvidia.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "49233c41cf8546b94d213a5dd877ef07e61b1f3f", "tree": "b844be923d26412a65175c55d3b51fdcf90dfa78", "parents": [ "8fdb05de0e2db89d8f56144c60ab784812e8c3b7", "2005aabe94eaab8608879d98afb901bc99bc3a31" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 11:19:26 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 11:19:26 2026 -0800" }, "message": "Merge tag \u0027pull-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull dcache fixes from Al Viro:\n \"A couple of regression fixes for the tree-in-dcache series this cycle\"\n\n* tag \u0027pull-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:\n functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions\n rust_binderfs: fix a dentry leak\n" }, { "commit": "2005aabe94eaab8608879d98afb901bc99bc3a31", "tree": "25a3c36351581ca100594b0ee14b89977b9f9c0b", "parents": [ "351ea48ae880b1673abcf232947c577183fdf712" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jan 31 18:24:41 2026 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Feb 05 13:53:12 2026 -0500" }, "message": "functionfs: use spinlock for FFS_DEACTIVATED/FFS_CLOSING transitions\n\nWhen all files are closed, functionfs needs ffs_data_reset() to be\ndone before any further opens are allowed.\n\nDuring that time we have ffs-\u003estate set to FFS_CLOSING; that makes\n-\u003eopen() fail with -EBUSY. Once ffs_data_reset() is done, it\nswitches state (to FFS_READ_DESCRIPTORS) indicating that opening\nthat thing is allowed again. There\u0027s a couple of additional twists:\n\t* mounting with -o no_disconnect delays ffs_data_reset()\nfrom doing that at the final -\u003erelease() to the first subsequent\nopen(). That\u0027s indicated by ffs-\u003estate set to FFS_DEACTIVATED;\nif open() sees that, it immediately switches to FFS_CLOSING and\nproceeds with doing ffs_data_reset() before returning to userland.\n\t* a couple of usb callbacks need to force the delayed\ntransition; unfortunately, they are done in locking environment\nthat does not allow blocking and ffs_data_reset() can block.\nAs the result, if these callbacks see FFS_DEACTIVATED, they change\nstate to FFS_CLOSING and use schedule_work() to get ffs_data_reset()\nexecuted asynchronously.\n\nUnfortunately, the locking is rather insufficient. A fix attempted\nin e5bf5ee26663 (\"functionfs: fix the open/removal races\") had closed\na bunch of UAF, but it didn\u0027t do anything to the callbacks, lacked\nbarriers in transition from FFS_CLOSING to FFS_READ_DESCRIPTORS\n_and_ it had been too heavy-handed in open()/open() serialization -\nI\u0027ve used ffs-\u003emutex for that, and it\u0027s being held over actual IO on\nep0, complete with copy_from_user(), etc.\n\nEven more unfortunately, the userland side is apparently racy enough\nto have the resulting timing changes (no failures, just a delayed\nreturn of open(2)) disrupt the things quite badly. Userland bugs\nor not, it\u0027s a clear regression that needs to be dealt with.\n\nSolution is to use a spinlock for serializing these state checks and\ntransitions - unlike ffs-\u003emutex it can be taken in these callbacks\nand it doesn\u0027t disrupt the timings in open().\n\nWe could introduce a new spinlock, but it\u0027s easier to use the one\nthat is already there (ffs-\u003eeps_lock) instead - the locking\nenvironment is safe for it in all affected places.\n\nSince now it is held over all places that alter or check the\nopen count (ffs-\u003eopened), there\u0027s no need to keep that atomic_t -\nint would serve just fine and it\u0027s simpler that way.\n\nFixes: e5bf5ee26663 (\"functionfs: fix the open/removal races\")\nFixes: 18d6b32fca38 (\"usb: gadget: f_fs: add \"no_disconnect\" mode\") # v4.0\nTested-by: Samuel Wu \u003cwusamuel@google.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "351ea48ae880b1673abcf232947c577183fdf712", "tree": "3d37f21d2cff835cfb86d0f65e59d756e5a15a24", "parents": [ "63804fed149a6750ffd28610c5c1c98cce6bd377" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Jan 26 01:05:57 2026 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Thu Feb 05 13:52:16 2026 -0500" }, "message": "rust_binderfs: fix a dentry leak\n\nParallel to binderfs patches - 02da8d2c0965 \"binderfs_binder_ctl_create():\nkill a bogus check\" and the bit of b89aa544821d \"convert binderfs\" that\ngot lost when making 4433d8e25d73 \"convert rust_binderfs\"; the former is\na cleanup, the latter is about marking /binder-control persistent, so that\nit would be taken out on umount.\n\nFixes: 4433d8e25d73 (\"convert rust_binderfs\")\nAcked-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nAcked-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8fdb05de0e2db89d8f56144c60ab784812e8c3b7", "tree": "89d2d6564d3e401fc43217a574e08ba7ed1e7b8d", "parents": [ "b20624608f350c5dadd74577629e90715d351e2c", "bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 09:39:26 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 05 09:39:26 2026 -0800" }, "message": "Merge tag \u0027net-6.19-rc9\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless and Netfilter.\n\n Previous releases - regressions:\n\n - eth: stmmac: fix stm32 (and potentially others) resume regression\n\n - nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\n - usb: r8152: fix resume reset deadlock\n\n - fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for RSS contexts\n\n Previous releases - always broken:\n\n - sched: cls_u32: use skb_header_pointer_careful() to avoid OOB reads\n with malicious u32 rules\n\n - eth: ice: timestamping related fixes\"\n\n* tag \u0027net-6.19-rc9\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (38 commits)\n ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF\n netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n net: cpsw: Execute ndo_set_rx_mode callback in a work queue\n net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue\n gve: Correct ethtool rx_dropped calculation\n gve: Fix stats report corruption on queue count change\n selftest: net: add a test-case for encap segmentation after GRO\n net: gro: fix outer network offset\n net: add proper RCU protection to /proc/net/ptype\n net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()\n wifi: iwlwifi: mvm: pause TCM on fast resume\n wifi: iwlwifi: mld: cancel mlo_scan_start_wk\n net: spacemit: k1-emac: fix jumbo frame support\n net: enetc: Convert 16-bit register reads to 32-bit for ENETC v4\n net: enetc: Convert 16-bit register writes to 32-bit for ENETC v4\n net: enetc: Remove CBDR cacheability AXI settings for ENETC v4\n net: enetc: Remove SI/BDR cacheability AXI settings for ENETC v4\n tipc: use kfree_sensitive() for session key material\n net: stmmac: fix stm32 (and potentially others) resume regression\n net: rss: fix reporting RXH_XFRM_NO_CHANGE as input_xfrm for contexts\n ...\n" }, { "commit": "e34f77b09080c86c929153e2a72da26b4f8947ff", "tree": "f4c190ab2d19e220ce19fbf28d8c59a36a2115a3", "parents": [ "c62e0658d458d8f100445445c3ddb106f3824a45" ], "author": { "name": "Chen Ni", "email": "nichen@iscas.ac.cn", "time": "Thu Feb 05 15:26:49 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Thu Feb 05 18:00:45 2026 +0100" }, "message": "gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()\n\nFix incorrect NULL check in loongson_gpio_init_irqchip().\nThe function checks chip-\u003eparent instead of chip-\u003eirq.parents.\n\nFixes: 03c146cb6cd1 (\"gpio: loongson-64bit: Add support for Loongson-2K0300 SoC\")\nSigned-off-by: Chen Ni \u003cnichen@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260205072649.3271158-1-nichen@iscas.ac.cn\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25", "tree": "1c40e16526838edb0140218d7e7b0c3769cfa0e9", "parents": [ "d9eb317812288700f15965fa20d7db22c54c5e9d" ], "author": { "name": "Shigeru Yoshida", "email": "syoshida@redhat.com", "time": "Wed Feb 04 18:58:37 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 05 08:38:40 2026 -0800" }, "message": "ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF\n\nsyzbot reported a kernel BUG in fib6_add_rt2node() when adding an IPv6\nroute. [0]\n\nCommit f72514b3c569 (\"ipv6: clear RA flags when adding a static\nroute\") introduced logic to clear RTF_ADDRCONF from existing routes\nwhen a static route with the same nexthop is added. However, this\ncauses a problem when the existing route has a gateway.\n\nWhen RTF_ADDRCONF is cleared from a route that has a gateway, that\nroute becomes eligible for ECMP, i.e. rt6_qualify_for_ecmp() returns\ntrue. The issue is that this route was never added to the\nfib6_siblings list.\n\nThis leads to a mismatch between the following counts:\n\n- The sibling count computed by iterating fib6_next chain, which\n includes the newly ECMP-eligible route\n\n- The actual siblings in fib6_siblings list, which does not include\n that route\n\nWhen a subsequent ECMP route is added, fib6_add_rt2node() hits\nBUG_ON(sibling-\u003efib6_nsiblings !\u003d rt-\u003efib6_nsiblings) because the\ncounts don\u0027t match.\n\nFix this by only clearing RTF_ADDRCONF when the existing route does\nnot have a gateway. Routes without a gateway cannot qualify for ECMP\nanyway (rt6_qualify_for_ecmp() requires fib_nh_gw_family), so clearing\nRTF_ADDRCONF on them is safe and matches the original intent of the\ncommit.\n\n[0]:\nkernel BUG at net/ipv6/ip6_fib.c:1217!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6010 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nRIP: 0010:fib6_add_rt2node+0x3433/0x3470 net/ipv6/ip6_fib.c:1217\n[...]\nCall Trace:\n \u003cTASK\u003e\n fib6_add+0x8da/0x18a0 net/ipv6/ip6_fib.c:1532\n __ip6_ins_rt net/ipv6/route.c:1351 [inline]\n ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3946\n ipv6_route_ioctl+0x35c/0x480 net/ipv6/route.c:4571\n inet6_ioctl+0x219/0x280 net/ipv6/af_inet6.c:577\n sock_do_ioctl+0xdc/0x300 net/socket.c:1245\n sock_ioctl+0x576/0x790 net/socket.c:1366\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFixes: f72514b3c569 (\"ipv6: clear RA flags when adding a static route\")\nReported-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dcb809def1baaac68ab92\nTested-by: syzbot+cb809def1baaac68ab92@syzkaller.appspotmail.com\nSigned-off-by: Shigeru Yoshida \u003csyoshida@redhat.com\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260204095837.1285552-1-syoshida@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d9eb317812288700f15965fa20d7db22c54c5e9d", "tree": "f5b143f9cecdf66568aa8cd372b4d9428bb386c9", "parents": [ "7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f", "f41c5d151078c5348271ffaf8e7410d96f2d82f8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 05 08:38:02 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 05 08:38:03 2026 -0800" }, "message": "Merge tag \u0027nf-26-02-05\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: update for net\n\nThis is one last-minute crash fix for nf_tables, from Andrew Fasano:\n\nLogical check is inverted, this makes kernel fail to correctly undo\nthe transaction, leading to a use-after-free.\n\n* tag \u0027nf-26-02-05\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260205074450.3187-1-fw@strlen.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a6abd64e145ca3084b6a567e06517a7c2dbfd38d", "tree": "deefd9e1aca5682357e330f62c56fc64f3fc03a1", "parents": [ "7e210d5e934c8af0f74a1e1b4852a8996a6cb5a5" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Feb 05 09:26:53 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Feb 05 09:26:53 2026 -0700" }, "message": "loop: revert exclusive opener loop status change\n\nThis commit effectively reverts the following two commits:\n\n2704024d83fa (\"loop: add missing bd_abort_claiming in loop_set_status\")\n08e136ebd193 (\"loop: don\u0027t change loop device under exclusive opener in loop_set_status\")\n\nas there are reports of them causing issues with unmounting. As we\u0027re\nclose to the 6.19 kernel release and the original author hasn\u0027t taken a\ncloser look at this yet, revert them for release.\n\nReported-by: nokangaroo \u003cnokangaroo@aon.at\u003e\nLink: https://lore.kernel.org/all/62de4453-17e8-47f6-a10b-39bf5a49fdee@leemhuis.info/\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "f495054bd12e2abe5068e243bdf344b704c303c6", "tree": "aafe260dc3cec4fd6551d6adcf2312ffc55f11bc", "parents": [ "18328546dd59b6adc111cf84a0ee4cdd3a867611" ], "author": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Mon Feb 02 11:00:17 2026 -0800" }, "committer": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Thu Feb 05 08:00:45 2026 -0800" }, "message": "objtool/klp: Fix unexported static call key access for manually built livepatch modules\n\nEnabling CONFIG_MEM_ALLOC_PROFILING_DEBUG with CONFIG_SAMPLE_LIVEPATCH\nresults in the following error:\n\n samples/livepatch/livepatch-shadow-fix1.o: error: objtool: static_call: can\u0027t find static_call_key symbol: __SCK__WARN_trap\n\nThis is caused an extra file-\u003eklp sanity check which was added by commit\n164c9201e1da (\"objtool: Add base objtool support for livepatch\nmodules\"). That check was intended to ensure that livepatch modules\nbuilt with klp-build always have full access to their static call keys.\n\nHowever, it failed to account for the fact that manually built livepatch\nmodules (i.e., not built with klp-build) might need access to unexported\nstatic call keys, for which read-only access is typically allowed for\nmodules.\n\nWhile the livepatch-shadow-fix1 module doesn\u0027t explicitly use any static\ncalls, it does have a memory allocation, which can cause\nCONFIG_MEM_ALLOC_PROFILING_DEBUG to insert a WARN() call. And WARN() is\nnow an unexported static call as of commit 860238af7a33 (\"x86_64/bug:\nInline the UD1\").\n\nFix it by removing the overzealous file-\u003eklp check, restoring the\noriginal behavior for manually built livepatch modules.\n\nFixes: 164c9201e1da (\"objtool: Add base objtool support for livepatch modules\")\nReported-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nAcked-by: Song Liu \u003csong@kernel.org\u003e\nTested-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/0bd3ae9a53c3d743417fe842b740a7720e2bcd1c.1770058775.git.jpoimboe@kernel.org\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\n" }, { "commit": "18328546dd59b6adc111cf84a0ee4cdd3a867611", "tree": "e7f870dc2a104dedf9d9a09a7e026363c29b1796", "parents": [ "b525fcaf0a76507f152d58c6f9e5ef67b3ff552c" ], "author": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Mon Feb 02 10:01:08 2026 -0800" }, "committer": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Thu Feb 05 08:00:45 2026 -0800" }, "message": "objtool/klp: Fix symbol correlation for orphaned local symbols\n\nWhen compiling with CONFIG_LTO_CLANG_THIN, vmlinux.o has\n__irf_[start|end] before the first FILE entry:\n\n $ readelf -sW vmlinux.o\n Symbol table \u0027.symtab\u0027 contains 597706 entries:\n Num: Value Size Type Bind Vis Ndx Name\n 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND\n 1: 0000000000000000 0 NOTYPE LOCAL DEFAULT 18 __irf_start\n 2: 0000000000000200 0 NOTYPE LOCAL DEFAULT 18 __irf_end\n 3: 0000000000000000 0 SECTION LOCAL DEFAULT 17 .text\n 4: 0000000000000000 0 SECTION LOCAL DEFAULT 18 .init.ramfs\n\nThis causes klp-build warnings like:\n\n vmlinux.o: warning: objtool: no correlation: __irf_start\n vmlinux.o: warning: objtool: no correlation: __irf_end\n\nThe problem is that Clang LTO is stripping the initramfs_data.o FILE\nsymbol, causing those two symbols to be orphaned and not noticed by\nklp-diff\u0027s correlation logic. Add a loop to correlate any symbols found\nbefore the first FILE symbol.\n\nFixes: dd590d4d57eb (\"objtool/klp: Introduce klp diff subcommand for diffing object files\")\nReported-by: Song Liu \u003csong@kernel.org\u003e\nAcked-by: Song Liu \u003csong@kernel.org\u003e\nLink: https://patch.msgid.link/e21ec1141fc749b5f538d7329b531c1ab63a6d1a.1770055235.git.jpoimboe@kernel.org\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\n" }, { "commit": "b525fcaf0a76507f152d58c6f9e5ef67b3ff552c", "tree": "f83ffd77f6e53652c52ffb1db86c13d3cd914705", "parents": [ "ab10815472fcbc2c772dc21a979460b7f74f0145" ], "author": { "name": "Petr Pavlu", "email": "petr.pavlu@suse.com", "time": "Fri Jan 23 11:26:57 2026 +0100" }, "committer": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Thu Feb 05 08:00:45 2026 -0800" }, "message": "livepatch: Free klp_{object,func}_ext data after initialization\n\nThe klp_object_ext and klp_func_ext data, which are stored in the\n__klp_objects and __klp_funcs sections, respectively, are not needed\nafter they are used to create the actual klp_object and klp_func\ninstances. This operation is implemented by the init function in\nscripts/livepatch/init.c.\n\nPrefix the two sections with \".init\" so they are freed after the module\nis initializated.\n\nSigned-off-by: Petr Pavlu \u003cpetr.pavlu@suse.com\u003e\nAcked-by: Joe Lawrence \u003cjoe.lawrence@redhat.com\u003e\nAcked-by: Miroslav Benes \u003cmbenes@suse.cz\u003e\nReviewed-by: Aaron Tomlin \u003catomlin@atomlin.com\u003e\nLink: https://patch.msgid.link/20260123102825.3521961-3-petr.pavlu@suse.com\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\n" }, { "commit": "ab10815472fcbc2c772dc21a979460b7f74f0145", "tree": "561fe16d20462ba77aaa6c0cd513071967f445fa", "parents": [ "a8ff29f0ca1d63a215ef445102662850a912d127" ], "author": { "name": "Petr Pavlu", "email": "petr.pavlu@suse.com", "time": "Fri Jan 23 11:26:56 2026 +0100" }, "committer": { "name": "Josh Poimboeuf", "email": "jpoimboe@kernel.org", "time": "Thu Feb 05 08:00:44 2026 -0800" }, "message": "livepatch: Fix having __klp_objects relics in non-livepatch modules\n\nThe linker script scripts/module.lds.S specifies that all input\n__klp_objects sections should be consolidated into an output section of\nthe same name, and start/stop symbols should be created to enable\nscripts/livepatch/init.c to locate this data.\n\nThis start/stop pattern is not ideal for modules because the symbols are\ncreated even if no __klp_objects input sections are present.\nConsequently, a dummy __klp_objects section also appears in the\nresulting module. This unnecessarily pollutes non-livepatch modules.\n\nInstead, since modules are relocatable files, the usual method for\nlocating consolidated data in a module is to read its section table.\nThis approach avoids the aforementioned problem.\n\nThe klp_modinfo already stores a copy of the entire section table with\nthe final addresses. Introduce a helper function that\nscripts/livepatch/init.c can call to obtain the location of the\n__klp_objects section from this data.\n\nFixes: dd590d4d57eb (\"objtool/klp: Introduce klp diff subcommand for diffing object files\")\nSigned-off-by: Petr Pavlu \u003cpetr.pavlu@suse.com\u003e\nAcked-by: Joe Lawrence \u003cjoe.lawrence@redhat.com\u003e\nAcked-by: Miroslav Benes \u003cmbenes@suse.cz\u003e\nReviewed-by: Aaron Tomlin \u003catomlin@atomlin.com\u003e\nLink: https://patch.msgid.link/20260123102825.3521961-2-petr.pavlu@suse.com\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\n" }, { "commit": "7e210d5e934c8af0f74a1e1b4852a8996a6cb5a5", "tree": "09fc8b4daf23a0bce36d3c71a29832d9477f277c", "parents": [ "4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f", "52a0a98549344ca20ad81a4176d68d28e3c05a5c" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Feb 05 08:44:31 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Feb 05 08:44:31 2026 -0700" }, "message": "Merge tag \u0027nvme-6.19-2026-02-05\u0027 of git://git.infradead.org/nvme into block-6.19\n\nPull NVMe fixes from Keith:\n\n\"- Fix NULL pointer access setting up dma mappings (Keith)\n - Fix invalid memory access from malformed TCP PDU (YunJe)\"\n\n* tag \u0027nvme-6.19-2026-02-05\u0027 of git://git.infradead.org/nvme:\n nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n nvme-pci: handle changing device dma map requirements\n" }, { "commit": "52a0a98549344ca20ad81a4176d68d28e3c05a5c", "tree": "09fc8b4daf23a0bce36d3c71a29832d9477f277c", "parents": [ "071be3b0b6575d45be9df9c5b612f5882bfc5e88" ], "author": { "name": "YunJe Shin", "email": "yjshin0438@gmail.com", "time": "Wed Jan 28 09:41:07 2026 +0900" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Feb 05 07:29:10 2026 -0800" }, "message": "nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd-\u003ereq.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg-\u003elength/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg-\u003elength/offset before building the bvec.\n\nFixes: 872d26a391da (\"nvmet-tcp: add NVMe over TCP target driver\")\nSigned-off-by: YunJe Shin \u003cioerts@kookmin.ac.kr\u003e\nReviewed-by: Sagi Grimberg \u003csagi@grimberg.me\u003e\nReviewed-by: Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "071be3b0b6575d45be9df9c5b612f5882bfc5e88", "tree": "736483bafbd38b8887f562b7e6f4e5eba8ff19cc", "parents": [ "4da7c5c3ec34d839bba6e035c3d05c447a2f9d4f" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Wed Feb 04 06:29:11 2026 -0800" }, "committer": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu Feb 05 07:29:10 2026 -0800" }, "message": "nvme-pci: handle changing device dma map requirements\n\nThe initial state of dma_needs_unmap may be false, but change to true\nwhile mapping the data iterator. Enabling swiotlb is one such case that\ncan change the result. The nvme driver needs to save the mapped dma\nvectors to be unmapped later, so allocate as needed during iteration\nrather than assume it was always allocated at the beginning. This fixes\na NULL dereference from accessing an uninitialized dma_vecs when the\ndevice dma unmapping requirements change mid-iteration.\n\nFixes: b8b7570a7ec8 (\"nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping\")\nLink: https://lore.kernel.org/linux-nvme/20260202125738.1194899-1-pradeep.pragallapati@oss.qualcomm.com/\nReported-by: Pradeep P V K \u003cpradeep.pragallapati@oss.qualcomm.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\n" }, { "commit": "033c55fe2e326bea022c3cc5178ecf3e0e459b82", "tree": "61753a80c4094d79d0531e98db2470486d5afd8d", "parents": [ "361eb853c655288f3b5c8020f6cd95d69ffe6479" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Feb 04 11:36:28 2026 -0500" }, "committer": { "name": "Steven Rostedt (Google)", "email": "rostedt@goodmis.org", "time": "Thu Feb 05 09:47:11 2026 -0500" }, "message": "tracing: Fix ftrace event field alignments\n\nThe fields of ftrace specific events (events used to save ftrace internal\nevents like function traces and trace_printk) are generated similarly to\nhow normal trace event fields are generated. That is, the fields are added\nto a trace_events_fields array that saves the name, offset, size,\nalignment and signness of the field. It is used to produce the output in\nthe format file in tracefs so that tooling knows how to parse the binary\ndata of the trace events.\n\nThe issue is that some of the ftrace event structures are packed. The\nfunction graph exit event structures are one of them. The 64 bit calltime\nand rettime fields end up 4 byte aligned, but the algorithm to show to\nuserspace shows them as 8 byte aligned.\n\nThe macros that create the ftrace events has one for embedded structure\nfields. There\u0027s two macros for theses fields:\n\n __field_desc() and __field_packed()\n\nThe difference of the latter macro is that it treats the field as packed.\n\nRename that field to __field_desc_packed() and create replace the\n__field_packed() to be a normal field that is packed and have the calltime\nand rettime use those.\n\nThis showed up on 32bit architectures for function graph time fields. It\nhad:\n\n ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format\n[..]\n field:unsigned long func; offset:8; size:4; signed:0;\n field:unsigned int depth; offset:12; size:4; signed:0;\n field:unsigned int overrun; offset:16; size:4; signed:0;\n field:unsigned long long calltime; offset:24; size:8; signed:0;\n field:unsigned long long rettime; offset:32; size:8; signed:0;\n\nNotice that overrun is at offset 16 with size 4, where in the structure\ncalltime is at offset 20 (16 + 4), but it shows the offset at 24. That\u0027s\nbecause it used the alignment of unsigned long long when used as a\ndeclaration and not as a member of a structure where it would be aligned\nby word size (in this case 4).\n\nBy using the proper structure alignment, the format has it at the correct\noffset:\n\n ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format\n[..]\n field:unsigned long func; offset:8; size:4; signed:0;\n field:unsigned int depth; offset:12; size:4; signed:0;\n field:unsigned int overrun; offset:16; size:4; signed:0;\n field:unsigned long long calltime; offset:20; size:8; signed:0;\n field:unsigned long long rettime; offset:28; size:8; signed:0;\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReported-by: \"jempty.liang\" \u003cimntjempty@163.com\u003e\nLink: https://patch.msgid.link/20260204113628.53faec78@gandalf.local.home\nFixes: 04ae87a52074e (\"ftrace: Rework event_create_dir()\")\nCloses: https://lore.kernel.org/all/20260130015740.212343-1-imntjempty@163.com/\nCloses: https://lore.kernel.org/all/20260202123342.2544795-1-imntjempty@163.com/\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n" }, { "commit": "e2c4c5b2bbd4f688a0f9f6da26cdf6d723c53478", "tree": "dc3b2f47986a0f183af9b6de307180b380b58b68", "parents": [ "e9ab2b83893dd03cf04d98faded81190e635233f" ], "author": { "name": "Xu Yang", "email": "xu.yang_2@nxp.com", "time": "Wed Feb 04 19:11:42 2026 +0800" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Thu Feb 05 11:33:30 2026 +0100" }, "message": "pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup\n\nUSB system wakeup need its PHY on, so add the GENPD_FLAG_ACTIVE_WAKEUP\nflags to USB PHY genpd configuration.\n\nSigned-off-by: Xu Yang \u003cxu.yang_2@nxp.com\u003e\nFixes: 556f5cf9568a (\"soc: imx: add i.MX8MP HSIO blk-ctrl\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "e9ab2b83893dd03cf04d98faded81190e635233f", "tree": "8d13b30e06914174c02a66b57875a66dfc2f19c9", "parents": [ "6bd8b4a92a901fae1a422e6f914801063c345e8d" ], "author": { "name": "Xu Yang", "email": "xu.yang_2@nxp.com", "time": "Wed Feb 04 19:11:41 2026 +0800" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Thu Feb 05 11:31:43 2026 +0100" }, "message": "pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup\n\nCurrent design will power off all dependent GPC power domains in\nimx8mp_blk_ctrl_suspend(), even though the user device has enabled\nwakeup capability. The result is that wakeup function never works\nfor such device.\n\nAn example will be USB wakeup on i.MX8MP. PHY device \u0027382f0040.usb-phy\u0027\nis attached to power domain \u0027hsioblk-usb-phy2\u0027 which is spawned by hsio\nblock control. A virtual power domain device \u0027genpd:3:32f10000.blk-ctrl\u0027\nis created to build connection with \u0027hsioblk-usb-phy2\u0027 and it depends on\nGPC power domain \u0027usb-otg2\u0027. If device \u0027382f0040.usb-phy\u0027 enable wakeup,\nonly power domain \u0027hsioblk-usb-phy2\u0027 keeps on during system suspend,\npower domain \u0027usb-otg2\u0027 is off all the time. So the wakeup event can\u0027t\nhappen.\n\nIn order to further establish a connection between the power domains\nrelated to GPC and block control during system suspend, register a genpd\npower on/off notifier for the power_dev. This allows us to prevent the GPC\npower domain from being powered off, in case the block control power\ndomain is kept on to serve system wakeup.\n\nSuggested-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nFixes: 556f5cf9568a (\"soc: imx: add i.MX8MP HSIO blk-ctrl\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xu Yang \u003cxu.yang_2@nxp.com\u003e\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "4cb1b327135dddf3d0ec2544ea36ed05ba2252bc", "tree": "585a3a7db088c3f014dcfb4034694af541e23768", "parents": [ "bb36170d959fad7f663f91eb9c32a84dd86bef2b" ], "author": { "name": "Daniele Ceraolo Spurio", "email": "daniele.ceraolospurio@intel.com", "time": "Thu Jan 29 10:25:48 2026 -0800" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Feb 05 09:45:22 2026 +0100" }, "message": "drm/xe/guc: Fix CFI violation in debugfs access.\n\nxe_guc_print_info is void-returning, but the function pointer it is\nassigned to expects an int-returning function, leading to the following\nCFI error:\n\n[ 206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe]\n(target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a)\n\nFix this by updating xe_guc_print_info to return an integer.\n\nFixes: e15826bb3c2c (\"drm/xe/guc: Refactor GuC debugfs initialization\")\nSigned-off-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nCc: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nCc: George D Sworo \u003cgeorge.d.sworo@intel.com\u003e\nReviewed-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nLink: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com\n(cherry picked from commit dd8ea2f2ab71b98887fdc426b0651dbb1d1ea760)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "40b24d9cdd4141ef43eeaa7e57c3efc07a567473", "tree": "10141488c0cf43f2fbe4221ab009d2eed4bdbbc4", "parents": [ "0e0c8f4d16de92520623aa1ea485cadbf64e6929" ], "author": { "name": "Shengjiu Wang", "email": "shengjiu.wang@nxp.com", "time": "Fri Jan 30 16:09:10 2026 +0800" }, "committer": { "name": "Liu Ying", "email": "victor.liu@nxp.com", "time": "Thu Feb 05 16:16:45 2026 +0800" }, "message": "drm/bridge: imx8mp-hdmi-pai: enable PM runtime\n\nThere is an audio channel shift issue with multi channel case - the\nchannel order is correct for the first run, but the channel order is\nshifted for the second run. The fix method is to reset the PAI interface\nat the end of playback.\n\nThe reset can be handled by PM runtime, so enable PM runtime.\n\nFixes: 0205fae6327a (\"drm/bridge: imx: add driver for HDMI TX Parallel Audio Interface\")\nSigned-off-by: Shengjiu Wang \u003cshengjiu.wang@nxp.com\u003e\nReviewed-by: Liu Ying \u003cvictor.liu@nxp.com\u003e\nSigned-off-by: Liu Ying \u003cvictor.liu@nxp.com\u003e\nLink: https://lore.kernel.org/r/20260130080910.3532724-1-shengjiu.wang@nxp.com\n" }, { "commit": "51db05283f7c9c95a3e6853a3044cd04226551bf", "tree": "9970c9c9b08a207a2e528df2c3a812e0046df696", "parents": [ "523abd481ccf335727a6ca3840d0fd692328e335" ], "author": { "name": "Breno Baptista", "email": "brenomb07@gmail.com", "time": "Wed Feb 04 23:43:41 2026 -0300" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Feb 05 09:05:10 2026 +0100" }, "message": "ALSA: hda/realtek: Enable headset mic for Acer Nitro 5\n\nAdd quirk to support microphone input through headphone jack on Acer Nitro 5 AN515-57 (ALC295).\n\nSigned-off-by: Breno Baptista \u003cbrenomb07@gmail.com\u003e\nLink: https://patch.msgid.link/20260205024341.26694-1-brenomb07@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "f41c5d151078c5348271ffaf8e7410d96f2d82f8", "tree": "f5b143f9cecdf66568aa8cd372b4d9428bb386c9", "parents": [ "7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f" ], "author": { "name": "Andrew Fasano", "email": "andrew.fasano@nist.gov", "time": "Wed Feb 04 17:46:58 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Feb 05 08:36:59 2026 +0100" }, "message": "netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\n\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don\u0027t need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\n\nCompare the non-catchall activate callback, which is correct:\n\n nft_mapelem_activate():\n if (nft_set_elem_active(ext, iter-\u003egenmask))\n return 0; /* skip active, process inactive */\n\nWith the buggy catchall version:\n\n nft_map_catchall_activate():\n if (!nft_set_elem_active(ext, genmask))\n continue; /* skip inactive, process active */\n\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain-\u003euse reference count. Each abort cycle\npermanently decrements chain-\u003euse. Once chain-\u003euse reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\n\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\n\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones.\n\nFixes: 628bd3e49cba (\"netfilter: nf_tables: drop map element references from preparation phase\")\nSigned-off-by: Andrew Fasano \u003candrew.fasano@nist.gov\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "7d6ba706ae5ef7d3d00b67140d2873ae1da6d41f", "tree": "e55d6928e084a294fde0c4cfa48b873068dd49f1", "parents": [ "7576bd9017e35379db1ab1ef6b0e1d570eb28429", "45a66b75bf10c84060c9948e3be664e03454515d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 04 20:29:53 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 04 20:29:53 2026 -0800" }, "message": "Merge tag \u0027wireless-2026-02-04\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nTwo last-minute iwlwifi fixes:\n - cancel mlo_scan_work on disassoc to avoid\n use-after-free/init-after-queue issues\n - pause TCM work on suspend to avoid crashing\n the FW (and sometimes the host) on resume\n with traffic\n\n* tag \u0027wireless-2026-02-04\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n wifi: iwlwifi: mvm: pause TCM on fast resume\n wifi: iwlwifi: mld: cancel mlo_scan_start_wk\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260204113547.159742-4-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b20624608f350c5dadd74577629e90715d351e2c", "tree": "16d62704de1ec2959ad35dc2f0b3c20248979a46", "parents": [ "f14faaf3a1fb3b9e4cf2e56269711fb85fba9458", "1a47837bfafed7e9ef93f5dfdea6d70869b0c3ab" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 16:04:00 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 16:04:00 2026 -0800" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-02-04-15-55\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"Five hotfixes. Two are cc:stable, two are for MM.\n\n All are singletons - please see the changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-02-04-15-55\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n Documentation: document liveupdate cmdline parameter\n mm, shmem: prevent infinite loop on truncate race\n mailmap: update Alexander Mikhalitsyn\u0027s emails\n liveupdate: luo_file: do not clear serialized_data on unfreeze\n x86/kfence: fix booting on 32bit non-PAE systems\n" }, { "commit": "f14faaf3a1fb3b9e4cf2e56269711fb85fba9458", "tree": "948fa392d177615d84616e2bfa406def5b7ccf8e", "parents": [ "3c7b4d1994f63d6fa3984d7d5ad06dbaad96f167", "c2012263047689e495e81c96d7d5b0586299578d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 15:15:54 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 15:15:54 2026 -0800" }, "message": "Merge tag \u0027tsm-fixes-for-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm\n\nPull TSM (TEE security Manager) fixes from Dan Williams:\n \"The largest change is reverting part of an ABI that never shipped in a\n released kernel (Documentation/ABI/testing/sysfs-class-tsm). The fix /\n replacement for that is too large to squeeze in at this late date.\n\n The rest is a collection of small fixups:\n\n - Fix multiple streams per host bridge for SEV-TIO\n\n - Drop the TSM ABI for reporting IDE streams (to be replaced)\n\n - Fix virtual function enumeration\n\n - Fix reserved stream ID initialization\n\n - Fix unused variable compiler warning\"\n\n* tag \u0027tsm-fixes-for-6.19\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:\n crypto/ccp: Allow multiple streams on the same root bridge\n crypto/ccp: Use PCI bridge defaults for IDE\n coco/tsm: Remove unused variable tsm_rwsem\n PCI/IDE: Fix reading a wrong reg for unused sel stream initialization\n PCI/IDE: Fix off by one error calculating VF RID range\n Revert \"PCI/TSM: Report active IDE streams\"\n" }, { "commit": "3c7b4d1994f63d6fa3984d7d5ad06dbaad96f167", "tree": "37029e996143b6a4b0081e3f53c86ae108e21e7a", "parents": [ "27db1ae6ecdf23f4176276da6037eaafbd23bf94", "0eca95cba2b7bf7b7b4f2fa90734a85fcaa72782" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 15:11:24 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 15:11:24 2026 -0800" }, "message": "Merge tag \u0027sched_ext-for-6.19-rc8-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fix from Tejun Heo:\n\n - Fix race where sched_class operations (sched_setscheduler() and\n friends) could be invoked on dead tasks after sched_ext_dead()\n already ran, causing invalid SCX task state transitions and NULL\n pointer dereferences.\n\n This was a regression from the cgroup exit ordering fix which\n moved sched_ext_free() to finish_task_switch().\n\n* tag \u0027sched_ext-for-6.19-rc8-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Short-circuit sched_class operations on dead tasks\n" }, { "commit": "831a2b27914cc880130ffe8fb8d1e65a5324d07f", "tree": "b35be293b98a2908ffabb7572011e724eba8e1dd", "parents": [ "52fb36a5f9c15285b7d67c0ff87dc17b3206b5df" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Tue Feb 03 17:34:36 2026 +0100" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Feb 04 14:40:36 2026 -0800" }, "message": "hwmon: (occ) Mark occ_init_attribute() as __printf\n\nThis is a printf-style function, which gcc -Werror\u003dsuggest-attribute\u003dformat\ncorrectly points out:\n\ndrivers/hwmon/occ/common.c: In function \u0027occ_init_attribute\u0027:\ndrivers/hwmon/occ/common.c:761:9: error: function \u0027occ_init_attribute\u0027 might be a candidate for \u0027gnu_printf\u0027 format attribute [-Werror\u003dsuggest-attribute\u003dformat]\n\nAdd the attribute to avoid this warning and ensure any incorrect\nformat strings are detected here.\n\nFixes: 744c2fe950e9 (\"hwmon: (occ) Rework attribute registration for stack usage\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://lore.kernel.org/r/20260203163440.2674340-1-arnd@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "0eca95cba2b7bf7b7b4f2fa90734a85fcaa72782", "tree": "737d3de2746ccc49a270fccfb2826bafffb4a153", "parents": [ "c9894e6f0160414b57e895332c580cf5c8da6780" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Feb 04 10:07:55 2026 -1000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Feb 04 12:22:11 2026 -1000" }, "message": "sched_ext: Short-circuit sched_class operations on dead tasks\n\n7900aa699c34 (\"sched_ext: Fix cgroup exit ordering by moving sched_ext_free()\nto finish_task_switch()\") moved sched_ext_free() to finish_task_switch() and\nrenamed it to sched_ext_dead() to fix cgroup exit ordering issues. However,\nthis created a race window where certain sched_class ops may be invoked on\ndead tasks leading to failures - e.g. sched_setscheduler() may try to switch a\ntask which finished sched_ext_dead() back into SCX triggering invalid SCX task\nstate transitions.\n\nAdd task_dead_and_done() which tests whether a task is TASK_DEAD and has\ncompleted its final context switch, and use it to short-circuit sched_class\noperations which may be called on dead tasks.\n\nFixes: 7900aa699c34 (\"sched_ext: Fix cgroup exit ordering by moving sched_ext_free() to finish_task_switch()\")\nReported-by: Andrea Righi \u003carighi@nvidia.com\u003e\nLink: http://lkml.kernel.org/r/20260202151341.796959-1-arighi@nvidia.com\nReviewed-by: Andrea Righi \u003carighi@nvidia.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "7987cce375ac8ce98e170a77aa2399f2cf6eb99f", "tree": "277668e967c2c1d5ad6c1000397967cc0baa4673", "parents": [ "bc8dedae022ce3058659c3addef3ec4b41d15e00" ], "author": { "name": "Viacheslav Dubeyko", "email": "Slava.Dubeyko@ibm.com", "time": "Tue Feb 03 14:54:46 2026 -0800" }, "committer": { "name": "Ilya Dryomov", "email": "idryomov@gmail.com", "time": "Wed Feb 04 22:00:42 2026 +0100" }, "message": "ceph: fix NULL pointer dereference in ceph_mds_auth_match()\n\nThe CephFS kernel client has regression starting from 6.18-rc1.\nWe have issue in ceph_mds_auth_match() if fs_name \u003d\u003d NULL:\n\n const char fs_name \u003d mdsc-\u003efsc-\u003emount_options-\u003emds_namespace;\n ...\n if (auth-\u003ematch.fs_name \u0026\u0026 strcmp(auth-\u003ematch.fs_name, fs_name)) {\n / fsname mismatch, try next one */\n return 0;\n }\n\nPatrick Donnelly suggested that: In summary, we should definitely start\ndecoding `fs_name` from the MDSMap and do strict authorizations checks\nagainst it. Note that the `-o mds_namespace\u003dfoo` should only be used for\nselecting the file system to mount and nothing else. It\u0027s possible\nno mds_namespace is specified but the kernel will mount the only\nfile system that exists which may have name \"foo\".\n\nThis patch reworks ceph_mdsmap_decode() and namespace_equals() with\nthe goal of supporting the suggested concept. Now struct ceph_mdsmap\ncontains m_fs_name field that receives copy of extracted FS name\nby ceph_extract_encoded_string(). For the case of \"old\" CephFS file\nsystems, it is used \"cephfs\" name.\n\n[ idryomov: replace redundant %*pE with %s in ceph_mdsmap_decode(),\n get rid of a series of strlen() calls in ceph_namespace_match(),\n drop changes to namespace_equals() body to avoid treating empty\n mds_namespace as equal, drop changes to ceph_mdsc_handle_fsmap()\n as namespace_equals() isn\u0027t an equivalent substitution there ]\n\nCc: stable@vger.kernel.org\nFixes: 22c73d52a6d0 (\"ceph: fix multifs mds auth caps issue\")\nLink: https://tracker.ceph.com/issues/73886\nSigned-off-by: Viacheslav Dubeyko \u003cSlava.Dubeyko@ibm.com\u003e\nReviewed-by: Patrick Donnelly \u003cpdonnell@ibm.com\u003e\nTested-by: Patrick Donnelly \u003cpdonnell@ibm.com\u003e\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\n" }, { "commit": "27db1ae6ecdf23f4176276da6037eaafbd23bf94", "tree": "440f75bac0051c9217ef78328da0a7d70e3b9978", "parents": [ "a14980444f418de53a7cc315eb4fbd8a89c72991", "0de4a0eec25b9171f2a2abb1a820e125e6797770" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 10:38:56 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 10:38:56 2026 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull KVM fixes from Paolo Bonzini:\n\n - Fix a bug where AVIC is incorrectly inhibited when running with\n x2AVIC disabled via module param (or on a system without x2AVIC)\n\n - Fix a dangling device posted IRQs bug by explicitly checking if the\n irqfd is still active (on the list) when handling an eventfd signal,\n instead of zeroing the irqfd\u0027s routing information when the irqfd is\n deassigned.\n\n Zeroing the irqfd\u0027s routing info causes arm64 and x86\u0027s to not\n disable posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks\n for an MSI), incorrectly leaving the IRQ in posted mode (and leading\n to use-after-free and memory leaks on AMD in particular).\n\n This is both the most pressing and scariest, but it\u0027s been in -next\n for a while.\n\n - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from\n generating calls to the checked versions of memset() and friends,\n which leads to unexpected page faults in guest code due e.g.\n __memset_chk@plt not being resolved.\n\n - Explicitly configure the supported XSS capabilities from within\n {svm,vmx}_set_cpu_caps() to fix a bug where VMX will compute the\n reference VMCS configuration with SHSTK and IBT enabled, but then\n compute each CPUs local config with SHSTK and IBT disabled if not all\n CET xfeatures are enabled, e.g. if the kernel is built with\n X86_KERNEL_IBT\u003dn.\n\n The mismatch in features results in differing nVMX setting, and\n ultimately causes kvm-intel.ko to refuse to load with nested\u003d1.\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: x86: Explicitly configure supported XSS from {svm,vmx}_set_cpu_caps()\n KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures\n KVM: x86: Assert that non-MSI doesn\u0027t have bypass vCPU when deleting producer\n KVM: Don\u0027t clobber irqfd routing type when deassigning irqfd\n KVM: SVM: Check vCPU ID against max x2AVIC ID if and only if x2AVIC is enabled\n" }, { "commit": "0de4a0eec25b9171f2a2abb1a820e125e6797770", "tree": "27ed8be329cdb1ba589feeea3f6906d16375f8b2", "parents": [ "e89f0e9a0a007e8c3afb8ecd739c0b3255422b00", "f8ade833b733ae0b72e87ac6d2202a1afbe3eb4a" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Feb 04 18:30:32 2026 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Wed Feb 04 18:30:32 2026 +0100" }, "message": "Merge tag \u0027kvm-x86-fixes-6.19-rc8\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nFinal KVM fixes for 6.19:\n\n - Fix a bug where AVIC is incorrectly inhibited when running with x2AVIC\n disabled via module param (or on a system without x2AVIC).\n\n - Fix a dangling device posted IRQs bug by explicitly checking if the irqfd is\n still active (on the list) when handling an eventfd signal, instead of\n zeroing the irqfd\u0027s routing information when the irqfd is deassigned.\n Zeroing the irqfd\u0027s routing info causes arm64 and x86\u0027s to not disable\n posting for the IRQ (kvm_arch_irq_bypass_del_producer() looks for an MSI),\n incorrectly leaving the IRQ in posted mode (and leading to use-after-free\n and memory leaks on AMD in particular).\n\n This is both the most pressing and scariest, but it\u0027s been in -next for\n a while.\n\n - Disable FORTIFY_SOURCE for KVM selftests to prevent the compiler from\n generating calls to the checked versions of memset() and friends, which\n leads to unexpected page faults in guest code due e.g. __memset_chk@plt\n not being resolved.\n\n - Explicitly configure the support XSS from within {svm,vmx}_set_cpu_caps() to\n fix a bug where VMX will compute the reference VMCS configuration with SHSTK\n and IBT enabled, but then compute each CPUs local config with SHSTK and IBT\n disabled if not all CET xfeatures are enabled, e.g. if the kernel is built\n with X86_KERNEL_IBT\u003dn. The mismatch in features results in differing nVMX\n setting, and ultimately causes kvm-intel.ko to refuse to load with nested\u003d1.\n" }, { "commit": "a14980444f418de53a7cc315eb4fbd8a89c72991", "tree": "48450181bc0bcdd08166b9cc2ad77f953c4bdbdc", "parents": [ "5fd0a1df5d05ad066e5618ccdd3d0fa6cb686c27", "c3cb2722e28969650c58d6defb09d57339a2a223" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 08:26:22 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 04 08:26:22 2026 -0800" }, "message": "Merge tag \u0027soc-fixes-6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n \"Shawn Guo is moving on from maintaining the NXP i.MX platform and\n hands over to Frank Li. Shawn has maintained the platform for 15 years\n after initially upstreaming support for i.MX6 and i.MX23/28, and his\n work has helped make this the most important industrial embedded Linux\n platform. Roughly one out of five devicetree files in mainline kernels\n are for the wider i.MX platform. Many thanks to Shawn for the taking\n care of the platform all these years!\n\n There are also two additional updates for the MAINTAINERS file, and a\n fix for error handling in the qualcomm smem driver\"\n\n* tag \u0027soc-fixes-6.19-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n MAINTAINERS: Change Sudeep Holla\u0027s email address\n MAINTAINERS: Add myself as maintainer of hisi_soc_hha\n soc: qcom: smem: fix qcom_smem_is_available and check if __smem is valid\n MAINTAINERS: Replace Shawn with Frank as i.MX platform maintainer\n" }, { "commit": "523abd481ccf335727a6ca3840d0fd692328e335", "tree": "13a7d0e063069a79ceda3aa51733f5e992ae01f8", "parents": [ "124bdc6eccc8c5cba68fee00e01c084c116c4360", "f514248727606b9087bc38a284ff686e0093abf1" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Feb 04 17:03:08 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Feb 04 17:03:08 2026 +0100" }, "message": "Merge tag \u0027asoc-fix-v6.19-rc8\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v6.19\n\nA bunch more small fixes here, plus some more of the constant stream of\nquirks. The most notable change here is Richard\u0027s change to the cs_dsp\ncode for the KUnit tests which is relatively large, mostly due to\nboilerplate. The tests were triggering large numbers of error messages\nas part of verifying that problems with input data are appropriately\ndetected which in turn caused runtime issues for the framework due to\nthe performance impact of pushing the logging out, while the logging is\nvaluable in normal operation it\u0027s basically useless while doing tests\ndesigned to trigger it so rate limiting is an appropriate fix.\n" }, { "commit": "bb36170d959fad7f663f91eb9c32a84dd86bef2b", "tree": "f173efb73d4f7f1670a1448d35b9797c145fa6f2", "parents": [ "16264a3b594282a7f25028745158bc59a9cf7f96" ], "author": { "name": "Karthik Poosa", "email": "karthik.poosa@intel.com", "time": "Fri Jan 23 23:02:38 2026 +0530" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Wed Feb 04 16:41:07 2026 +0100" }, "message": "drm/xe/pm: Disable D3Cold for BMG only on specific platforms\n\nRestrict D3Cold disablement for BMG to unsupported NUC platforms,\ninstead of disabling it on all platforms.\n\nSigned-off-by: Karthik Poosa \u003ckarthik.poosa@intel.com\u003e\nFixes: 3e331a6715ee (\"drm/xe/pm: Temporarily disable D3Cold on BMG\")\nLink: https://patch.msgid.link/20260123173238.1642383-1-karthik.poosa@intel.com\nReviewed-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit 39125eaf8863ab09d70c4b493f58639b08d5a897)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "16264a3b594282a7f25028745158bc59a9cf7f96", "tree": "668a4e744b03662d775b706b80395ecd9fd193cc", "parents": [ "51db5eef2ce39311cee2919623cda2ac0fc13c02" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Thu Jan 29 23:38:38 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Wed Feb 04 16:40:54 2026 +0100" }, "message": "drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_dep\n\nCorrect the function name in the kerneldoc.\nIt is for below warning:\n\"Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for\nxe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep()\ninstead\"\n\nFixes: 15366239e2130 (\"drm/xe: Decouple TLB invalidations from GT\")\nReviewed-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nSigned-off-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nLink: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com\n(cherry picked from commit 9f9c117ac566cb567dd56cc5b7564c45653f7a2a)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "51db5eef2ce39311cee2919623cda2ac0fc13c02", "tree": "ae824b1e3714c512272eea4b95149c004f038323", "parents": [ "e022c16965b8345af3c384c9136c7ca541a25f72" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Thu Jan 29 23:38:37 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Wed Feb 04 16:40:49 2026 +0100" }, "message": "drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_early\n\nCorrect the function name in the kerneldoc.\nIt is for below warning:\n\"Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for\nxe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early()\ninstead\"\n\nv2: add () for the function. (Michal)\n\nFixes: db16f9d90c1d9 (\"drm/xe: Split TLB invalidation code in frontend and backend\")\nReviewed-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nSigned-off-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nLink: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com\n(cherry picked from commit 0651dbb9d6a72e99569576fbec4681fd8160d161)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "e022c16965b8345af3c384c9136c7ca541a25f72", "tree": "24dbcdf6fa28b90c1f45ac9f02b49dac707a83eb", "parents": [ "7ee9b3e091c63da71e15c72003f1f07e467f5158" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Thu Jan 29 23:38:36 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Wed Feb 04 16:40:42 2026 +0100" }, "message": "drm/xe: Fix kerneldoc for xe_migrate_exec_queue\n\nCorrect the function name in the kerneldoc.\nIt is for below warning:\n\"Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for\nxe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue()\ninstead\"\n\nFixes: 916ee4704a865 (\"drm/xe/vf: Register CCS read/write contexts with Guc\")\nReviewed-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nSigned-off-by: Michal Wajdeczko \u003cmichal.wajdeczko@intel.com\u003e\nLink: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com\n(cherry picked from commit 9fd8da717934f05125b9ba6782622c459a368dc0)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "7ee9b3e091c63da71e15c72003f1f07e467f5158", "tree": "828154bbf90d7acd8357eac7dbcdaeb4836ef534", "parents": [ "8a44241b0b83a6047c5448da1fff03fcc29496b5" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Fri Jan 30 04:39:08 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Wed Feb 04 16:40:36 2026 +0100" }, "message": "drm/xe/query: Fix topology query pointer advance\n\nThe topology query helper advanced the user pointer by the size\nof the pointer, not the size of the structure. This can misalign\nthe output blob and corrupt the following mask. Fix the increment\nto use sizeof(*topo).\nThere is no issue currently, as sizeof(*topo) happens to be equal\nto sizeof(topo) on 64-bit systems (both evaluate to 8 bytes).\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nReviewed-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\nLink: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit c2a6859138e7f73ad904be17dd7d1da6cc7f06b3)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "45a66b75bf10c84060c9948e3be664e03454515d", "tree": "b1c5d450dbc3ff6ba9846ebe4d0920bfd013e8af", "parents": [ "1cac38910ecb881b09f61f57545a771bbe57ba68", "fb7f54aa2a99b07945911152c5d3d4a6eb39f797" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Feb 04 12:31:42 2026 +0100" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Feb 04 12:31:58 2026 +0100" }, "message": "Merge tag \u0027iwlwifi-fixes-2026-02-03\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next\n\nMiri Korenblit says:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\niwlwifi fixes\n\n- Cancel mlo_scan_work on disassoc\n- Pause TCM work on suspend\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "f514248727606b9087bc38a284ff686e0093abf1", "tree": "73692034c1375cba6cf2f24958f7bf5398a01885", "parents": [ "85352e59de4ce09de8322b2591a26f515fbde9c0" ], "author": { "name": "Ziyi Guo", "email": "n7l8m4@u.northwestern.edu", "time": "Mon Feb 02 17:41:12 2026 +0000" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Feb 04 11:29:58 2026 +0000" }, "message": "ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put()\n\nfsl_xcvr_activate_ctl() has\nlockdep_assert_held(\u0026card-\u003esnd_card-\u003econtrols_rwsem),\nbut fsl_xcvr_mode_put() calls it without acquiring this lock.\n\nOther callers of fsl_xcvr_activate_ctl() in fsl_xcvr_startup() and\nfsl_xcvr_shutdown() properly acquire the lock with down_read()/up_read().\n\nAdd the missing down_read()/up_read() calls around fsl_xcvr_activate_ctl()\nin fsl_xcvr_mode_put() to fix the lockdep assertion and prevent potential\nrace conditions when multiple userspace threads access the control.\n\nSigned-off-by: Ziyi Guo \u003cn7l8m4@u.northwestern.edu\u003e\nLink: https://patch.msgid.link/20260202174112.2018402-1-n7l8m4@u.northwestern.edu\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "85352e59de4ce09de8322b2591a26f515fbde9c0", "tree": "9a9c66eb552befb5723caa0c6dbe4ef102958f86", "parents": [ "7f67ba5413f98d93116a756e7f17cd2c1d6c2bd6" ], "author": { "name": "Frank Li", "email": "Frank.Li@nxp.com", "time": "Mon Feb 02 15:57:57 2026 -0500" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Feb 04 11:29:57 2026 +0000" }, "message": "ASoC: dt-bindings: ti,tlv320aic3x: Add compatible string ti,tlv320aic23\n\nAdd compatible string ti,tlv320aic23 to fix below CHECK_DTB warning:\narch/arm/boot/dts/nxp/imx/imx35-eukrea-mbimxsd35-baseboard.dtb:\n /soc/bus@43f00000/i2c@43f80000/codec@1a: failed to match any schema with compatible: [\u0027ti,tlv320aic23\u0027]\n\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nReviewed-by: Daniel Baluta \u003cdaniel.baluta@nxp.com\u003e\nLink: https://patch.msgid.link/20260202205758.3044617-1-Frank.Li@nxp.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "7f67ba5413f98d93116a756e7f17cd2c1d6c2bd6", "tree": "08c5781b4483daf6bf020e5510bd750d1b3f9d1f", "parents": [ "6e1e735181e0c18e1f4ecb0118be4b1e2ee439d1" ], "author": { "name": "Chris Bainbridge", "email": "chris.bainbridge@gmail.com", "time": "Mon Feb 02 20:50:33 2026 +0000" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Feb 04 11:29:56 2026 +0000" }, "message": "ASoC: amd: fix memory leak in acp3x pdm dma ops\n\nFixes: 4a767b1d039a8 (\"ASoC: amd: add acp3x pdm driver dma ops\")\nSigned-off-by: Chris Bainbridge \u003cchris.bainbridge@gmail.com\u003e\nLink: https://patch.msgid.link/20260202205034.7697-1-chris.bainbridge@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "4463c7aa11a6e67169ae48c6804968960c4bffea", "tree": "ab71341f1e9725425461b1aed59b262ed10ab850", "parents": [ "007d84287c7466ca68a5809b616338214dc5b77b" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Feb 02 10:39:55 2026 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Feb 04 12:21:12 2026 +0100" }, "message": "sched/mmcid: Optimize transitional CIDs when scheduling out\n\nDuring the investigation of the various transition mode issues\ninstrumentation revealed that the amount of bitmap operations can be\nsignificantly reduced when a task with a transitional CID schedules out\nafter the fixup function completed and disabled the transition mode.\n\nAt that point the mode is stable and therefore it is not required to drop\nthe transitional CID back into the pool. As the fixup is complete the\npotential exhaustion of the CID pool is not longer possible, so the CID can\nbe transferred to the scheduling out task or to the CPU depending on the\ncurrent ownership mode.\n\nThe racy snapshot of mm_cid::mode which contains both the ownership state\nand the transition bit is valid because runqueue lock is held and the fixup\nfunction of a concurrent mode switch is serialized.\n\nAssigning the ownership right there not only spares the bitmap access for\ndropping the CID it also avoids it when the task is scheduled back in as it\ndirectly hits the fast path in both modes when the CID is within the\noptimal range. If it\u0027s outside the range the next schedule in will need to\nconverge so dropping it right away is sensible. In the good case this also\nallows to go into the fast path on the next schedule in operation.\n\nWith a thread pool benchmark which is configured to cross the mode switch\nboundaries frequently this reduces the number of bitmap operations by about\n30% and increases the fastpath utilization in the low single digit\npercentage range.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260201192835.100194627@kernel.org\n" }, { "commit": "007d84287c7466ca68a5809b616338214dc5b77b", "tree": "dcabaa066888e11ae0f61793b1e6ee6b9f4e02fd", "parents": [ "47ee94efccf6732e4ef1a815c451aacaf1464757" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Feb 02 10:39:50 2026 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Feb 04 12:21:12 2026 +0100" }, "message": "sched/mmcid: Drop per CPU CID immediately when switching to per task mode\n\nWhen a exiting task initiates the switch from per CPU back to per task\nmode, it has already dropped its CID and marked itself inactive. But a\nleftover from an earlier iteration of the rework then reassigns the per\nCPU CID to the exiting task with the transition bit set.\n\nThat\u0027s wrong as the task is already marked CID inactive, which means it is\ninconsistent state. It\u0027s harmless because the CID is marked in transit and\ntherefore dropped back into the pool when the exiting task schedules out\neither through preemption or the final schedule().\n\nSimply drop the per CPU CID when the exiting task triggered the transition.\n\nFixes: fbd0e71dc370 (\"sched/mmcid: Provide CID ownership mode fixup functions\")\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260201192835.032221009@kernel.org\n" }, { "commit": "47ee94efccf6732e4ef1a815c451aacaf1464757", "tree": "2464aa3faafb2287c302944301cbd2509bf6d811", "parents": [ "4327fb13fa47770183c4850c35382c30ba5f939d" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Feb 02 10:39:45 2026 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Feb 04 12:21:12 2026 +0100" }, "message": "sched/mmcid: Protect transition on weakly ordered systems\n\nShrikanth reported a hard lockup which he observed once. The stack trace\nshows the following CID related participants:\n\n watchdog: CPU 23 self-detected hard LOCKUP @ mm_get_cid+0xe8/0x188\n NIP: mm_get_cid+0xe8/0x188\n LR: mm_get_cid+0x108/0x188\n mm_cid_switch_to+0x3c4/0x52c\n __schedule+0x47c/0x700\n schedule_idle+0x3c/0x64\n do_idle+0x160/0x1b0\n cpu_startup_entry+0x48/0x50\n start_secondary+0x284/0x288\n start_secondary_prolog+0x10/0x14\n\n watchdog: CPU 11 self-detected hard LOCKUP @ plpar_hcall_norets_notrace+0x18/0x2c\n NIP: plpar_hcall_norets_notrace+0x18/0x2c\n LR: queued_spin_lock_slowpath+0xd88/0x15d0\n _raw_spin_lock+0x80/0xa0\n raw_spin_rq_lock_nested+0x3c/0xf8\n mm_cid_fixup_cpus_to_tasks+0xc8/0x28c\n sched_mm_cid_exit+0x108/0x22c\n do_exit+0xf4/0x5d0\n make_task_dead+0x0/0x178\n system_call_exception+0x128/0x390\n system_call_vectored_common+0x15c/0x2ec\n\nThe task on CPU11 is running the CID ownership mode change fixup function\nand is stuck on a runqueue lock. The task on CPU23 is trying to get a CID\nfrom the pool with the same runqueue lock held, but the pool is empty.\n\nAfter decoding a similar issue in the opposite direction switching from per\ntask to per CPU mode the tool which models the possible scenarios failed to\ncome up with a similar loop hole.\n\nThis showed up only once, was not reproducible and according to tooling not\nrelated to a overlooked scheduling scenario permutation. But the fact that\nit was observed on a PowerPC system gave the right hint: PowerPC is a\nweakly ordered architecture.\n\nThe transition mechanism does:\n\n WRITE_ONCE(mm-\u003emm_cid.transit, MM_CID_TRANSIT);\n WRITE_ONCE(mm-\u003emm_cid.percpu, new_mode);\n\n fixup()\n\n WRITE_ONCE(mm-\u003emm_cid.transit, 0);\n\nmm_cid_schedin() does:\n\n if (!READ_ONCE(mm-\u003emm_cid.percpu))\n ...\n cid |\u003d READ_ONCE(mm-\u003emm_cid.transit);\n\nso weakly ordered systems can observe percpu \u003d\u003d false and transit \u003d\u003d 0 even\nif the fixup function has not yet completed. As a consequence the task will\nnot drop the CID when scheduling out before the fixup is completed, which\nmeans the CID space can be exhausted and the next task scheduling in will\nloop in mm_get_cid() and the fixup thread can livelock on the held runqueue\nlock as above.\n\nThis could obviously be solved by using:\n smp_store_release(\u0026mm-\u003emm_cid.percpu, true);\nand\n smp_load_acquire(\u0026mm-\u003emm_cid.percpu);\n\nbut that brings a memory barrier back into the scheduler hotpath, which was\njust designed out by the CID rewrite.\n\nThat can be completely avoided by combining the per CPU mode and the\ntransit storage into a single mm_cid::mode member and ordering the stores\nagainst the fixup functions to prevent the CPU from reordering them.\n\nThat makes the update of both states atomic and a concurrent read observes\nalways consistent state.\n\nThe price is an additional AND operation in mm_cid_schedin() to evaluate\nthe per CPU or the per task path, but that\u0027s in the noise even on strongly\nordered architectures as the actual load can be significantly more\nexpensive and the conditional branch evaluation is there anyway.\n\nFixes: fbd0e71dc370 (\"sched/mmcid: Provide CID ownership mode fixup functions\")\nCloses: https://lore.kernel.org/bdfea828-4585-40e8-8835-247c6a8a76b0@linux.ibm.com\nReported-by: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260201192834.965217106@kernel.org\n" }, { "commit": "4327fb13fa47770183c4850c35382c30ba5f939d", "tree": "9618702aec5ea21650cd886e72d4792ebbda0907", "parents": [ "18f7fcd5e69a04df57b563360b88be72471d6b62" ], "author": { "name": "Thomas Gleixner", "email": "tglx@kernel.org", "time": "Mon Feb 02 10:39:40 2026 +0100" }, "committer": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Wed Feb 04 12:21:11 2026 +0100" }, "message": "sched/mmcid: Prevent live lock on task to CPU mode transition\n\nIhor reported a BPF CI failure which turned out to be a live lock in the\nMM_CID management. The scenario is:\n\nA test program creates the 5th thread, which means the MM_CID users become\nmore than the number of CPUs (four in this example), so it switches to per\nCPU ownership mode.\n\nAt this point each live task of the program has a CID associated. Assume\nthread creation order assignment for simplicity.\n\n T0 CID0 runs fork() and creates T4\n T1 \t CID1\n T2 \t CID2\n T3 \t CID3\n T4 --- not visible yet\n\nT0 sets mm_cid::percpu \u003d true and transfers its own CID to CPU0 where it\nruns on and then starts the fixup which walks through the threads to\ntransfer the per task CIDs either to the CPU the task is running on or drop\nit back into the pool if the task is not on a CPU.\n\nDuring that T1 - T3 are free to schedule in and out before the fixup caught\nup with them. Going through all possible permutations with a python script\nrevealed a few problematic cases. The most trivial one is:\n\n T1 schedules in on CPU1 and observes percpu \u003d\u003d true, so it transfers\n its CID to CPU1\n\n T1 is migrated to CPU2 and schedule in observes percpu \u003d\u003d true, but\n CPU2 does not have a CID associated and T1 transferred its own to\n CPU1\n\n So it has to allocate one with CPU2 runqueue lock held, but the\n pool is empty, so it keeps looping in mm_get_cid().\n\nNow T0 reaches T1 in the thread walk and tries to lock the corresponding\nrunqueue lock, which is held causing a full live lock.\n\nThere is a similar scenario in the reverse direction of switching from per\nCPU to task mode which is way more obvious and got therefore addressed by\nan intermediate mode. In this mode the CIDs are marked with MM_CID_TRANSIT,\nwhich means that they are neither owned by the CPU nor by the task. When a\ntask schedules out with a transit CID it drops the CID back into the pool\nmaking it available for others to use temporarily. Once the task which\ninitiated the mode switch finished the fixup it clears the transit mode and\nthe process goes back into per task ownership mode.\n\nUnfortunately this insight was not mapped back to the task to CPU mode\nswitch as the above described scenario was not considered in the analysis.\n\nApply the same transit mechanism to the task to CPU mode switch to handle\nthese problematic cases correctly.\n\nAs with the CPU to task transition this results in a potential temporary\ncontention on the CID bitmap, but that\u0027s only for the time it takes to\ncomplete the transition. After that it stays in steady mode which does not\ntouch the bitmap at all.\n\nFixes: fbd0e71dc370 (\"sched/mmcid: Provide CID ownership mode fixup functions\")\nCloses: https://lore.kernel.org/2b7463d7-0f58-4e34-9775-6e2115cfb971@linux.dev\nReported-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@kernel.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nReviewed-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260201192834.897115238@kernel.org\n" }, { "commit": "c62e0658d458d8f100445445c3ddb106f3824a45", "tree": "5dbd532f2cb33e7ccc51a680137f4779683c4227", "parents": [ "18f7fcd5e69a04df57b563360b88be72471d6b62" ], "author": { "name": "Alban Bedel", "email": "alban.bedel@lht.dlh.de", "time": "Thu Jan 29 15:59:44 2026 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Feb 04 11:13:02 2026 +0100" }, "message": "gpiolib: acpi: Fix gpio count with string references\n\nSince commit 9880702d123f2 (\"ACPI: property: Support using strings in\nreference properties\") it is possible to use strings instead of local\nreferences. This work fine with single GPIO but not with arrays as\nacpi_gpio_package_count() didn\u0027t handle this case. Update it to handle\nstrings like local references to cover this case as well.\n\nSigned-off-by: Alban Bedel \u003calban.bedel@lht.dlh.de\u003e\nReviewed-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260129145944.3372777-1-alban.bedel@lht.dlh.de\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "0e0c8f4d16de92520623aa1ea485cadbf64e6929", "tree": "824a2fc19691a04991dc7e28e04e372323c5df9a", "parents": [ "8302d0afeaec0bc57d951dd085e0cffe997d4d18" ], "author": { "name": "Jacob Keller", "email": "jacob.e.keller@intel.com", "time": "Mon Feb 02 16:16:39 2026 -0800" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Wed Feb 04 08:52:53 2026 +0100" }, "message": "drm/mgag200: fix mgag200_bmc_stop_scanout()\n\nThe mgag200_bmc_stop_scanout() function is called by the .atomic_disable()\nhandler for the MGA G200 VGA BMC encoder. This function performs a few\nregister writes to inform the BMC of an upcoming mode change, and then\npolls to wait until the BMC actually stops.\n\nThe polling is implemented using a busy loop with udelay() and an iteration\ntimeout of 300, resulting in the function blocking for 300 milliseconds.\n\nThe function gets called ultimately by the output_poll_execute work thread\nfor the DRM output change polling thread of the mgag200 driver:\n\nkworker/0:0-mm_ 3528 [000] 4555.315364:\n ffffffffaa0e25b3 delay_halt.part.0+0x33\n ffffffffc03f6188 mgag200_bmc_stop_scanout+0x178\n ffffffffc087ae7a disable_outputs+0x12a\n ffffffffc087c12a drm_atomic_helper_commit_tail+0x1a\n ffffffffc03fa7b6 mgag200_mode_config_helper_atomic_commit_tail+0x26\n ffffffffc087c9c1 commit_tail+0x91\n ffffffffc087d51b drm_atomic_helper_commit+0x11b\n ffffffffc0509694 drm_atomic_commit+0xa4\n ffffffffc05105e8 drm_client_modeset_commit_atomic+0x1e8\n ffffffffc0510ce6 drm_client_modeset_commit_locked+0x56\n ffffffffc0510e24 drm_client_modeset_commit+0x24\n ffffffffc088a743 __drm_fb_helper_restore_fbdev_mode_unlocked+0x93\n ffffffffc088a683 drm_fb_helper_hotplug_event+0xe3\n ffffffffc050f8aa drm_client_dev_hotplug+0x9a\n ffffffffc088555a output_poll_execute+0x29a\n ffffffffa9b35924 process_one_work+0x194\n ffffffffa9b364ee worker_thread+0x2fe\n ffffffffa9b3ecad kthread+0xdd\n ffffffffa9a08549 ret_from_fork+0x29\n\nOn a server running ptp4l with the mgag200 driver loaded, we found that\nptp4l would sometimes get blocked from execution because of this busy\nwaiting loop.\n\nEvery so often, approximately once every 20 minutes -- though with large\nvariance -- the output_poll_execute() thread would detect some sort of\nchange that required performing a hotplug event which results in attempting\nto stop the BMC scanout, resulting in a 300msec delay on one CPU.\n\nOn this system, ptp4l was pinned to a single CPU. When the\noutput_poll_execute() thread ran on that CPU, it blocked ptp4l from\nexecuting for its 300 millisecond duration.\n\nThis resulted in PTP service disruptions such as failure to send a SYNC\nmessage on time, failure to handle ANNOUNCE messages on time, and clock\ncheck warnings from the application. All of this despite the application\nbeing configured with FIFO_RT and a higher priority than the background\nworkqueue tasks. (However, note that the kernel did not use\nCONFIG_PREEMPT...)\n\nIt is unclear if the event is due to a faulty VGA connection, another bug,\nor actual events causing a change in the connection. At least on the system\nunder test it is not a one-time event and consistently causes disruption to\nthe time sensitive applications.\n\nThe function has some helpful comments explaining what steps it is\nattempting to take. In particular, step 3a and 3b are explained as such:\n\n 3a - The third step is to verify if there is an active scan. We are\n waiting on a 0 on remhsyncsts (\u003cXSPAREREG\u003c0\u003e.\n\n 3b - This step occurs only if the remove is actually scanning. We are\n waiting for the end of the frame which is a 1 on remvsyncsts\n (\u003cXSPAREREG\u003c1\u003e).\n\nThe actual steps 3a and 3b are implemented as while loops with a\nnon-sleeping udelay(). The first step iterates while the tmp value at\nposition 0 is *not* set. That is, it keeps iterating as long as the bit is\nzero. If the bit is already 0 (because there is no active scan), it will\niterate the entire 300 attempts which wastes 300 milliseconds in total.\nThis is opposite of what the description claims.\n\nThe step 3b logic only executes if we do not iterate over the entire 300\nattempts in the first loop. If it does trigger, it is trying to check and\nwait for a 1 on the remvsyncsts. However, again the condition is actually\ninverted and it will loop as long as the bit is 1, stopping once it hits\nzero (rather than the explained attempt to wait until we see a 1).\n\nWorse, both loops are implemented using non-sleeping waits which spin\ninstead of allowing the scheduler to run other processes. If the kernel is\nnot configured to allow arbitrary preemption, it will waste valuable CPU\ntime doing nothing.\n\nThere does not appear to be any documentation for the BMC register\ninterface, beyond what is in the comments here. It seems more probable that\nthe comment here is correct and the implementation accidentally got\ninverted from the intended logic.\n\nReading through other DRM driver implementations, it does not appear that\nthe .atomic_enable or .atomic_disable handlers need to delay instead of\nsleep. For example, the ast_astdp_encoder_helper_atomic_disable() function\ncalls ast_dp_set_phy_sleep() which uses msleep(). The \"atomic\" in the name\nis referring to the atomic modesetting support, which is the support to\nenable atomic configuration from userspace, and not to the \"atomic context\"\nof the kernel. There is no reason to use udelay() here if a sleep would be\nsufficient.\n\nReplace the while loops with a read_poll_timeout() based implementation\nthat will sleep between iterations, and which stops polling once the\ncondition is met (instead of looping as long as the condition is met). This\naligns with the commented behavior and avoids blocking on the CPU while\ndoing nothing.\n\nNote the RREG_DAC is implemented using a statement expression to allow\nworking properly with the read_poll_timeout family of functions. The other\nRREG_\u003cTYPE\u003e macros ought to be cleaned up to have better semantics, and\nseveral places in the mgag200 driver could make use of RREG_DAC or similar\nRREG_* macros should likely be cleaned up for better semantics as well, but\nthat task has been left as a future cleanup for a non-bugfix.\n\nFixes: 414c45310625 (\"mgag200: initial g200se driver (v2)\")\nSuggested-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nReviewed-by: Jocelyn Falempe \u003cjfalempe@redhat.com\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260202-jk-mgag200-fix-bad-udelay-v2-1-ce1e9665987d@intel.com\n" }, { "commit": "7576bd9017e35379db1ab1ef6b0e1d570eb28429", "tree": "5f100557a7f3e0e434c93749e3ee01ba03d3db81", "parents": [ "279fe484dde428d305eeb8e3acdaa7ddfaa62a42", "0b8c878d117319f2be34c8391a77e0f4d5c94d79" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:45:53 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:45:54 2026 -0800" }, "message": "Merge branch \u0027net-cpsw-execute-ndo_set_rx_mode-callback-in-a-work-queue\u0027\n\nKevin Hao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: cpsw: Execute ndo_set_rx_mode callback in a work queue\n\nThese two patches resolve an RTNL assertion call trace issue\nin both the legacy and new cpsw drivers.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260203-bbb-v5-0-ea0ea217a85c@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0b8c878d117319f2be34c8391a77e0f4d5c94d79", "tree": "5f100557a7f3e0e434c93749e3ee01ba03d3db81", "parents": [ "c0b5dc73a38f954e780f93a549b8fe225235c07a" ], "author": { "name": "Kevin Hao", "email": "haokexin@gmail.com", "time": "Tue Feb 03 10:18:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:45:52 2026 -0800" }, "message": "net: cpsw: Execute ndo_set_rx_mode callback in a work queue\n\nCommit 1767bb2d47b7 (\"ipv6: mcast: Don\u0027t hold RTNL for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\") removed the RTNL lock for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this\nchange triggered the following call trace on my BeagleBone Black board:\n WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/481\n RTNL: assertion failed at net/8021q/vlan_core.c (236)\n Modules linked in:\n CPU: 0 UID: 997 PID: 481 Comm: rpcbind Not tainted 6.19.0-rc7-next-20260130-yocto-standard+ #35 PREEMPT\n Hardware name: Generic AM33XX (Flattened Device Tree)\n Call trace:\n unwind_backtrace from show_stack+0x28/0x2c\n show_stack from dump_stack_lvl+0x30/0x38\n dump_stack_lvl from __warn+0xb8/0x11c\n __warn from warn_slowpath_fmt+0x130/0x194\n warn_slowpath_fmt from vlan_for_each+0x120/0x124\n vlan_for_each from cpsw_add_mc_addr+0x54/0x98\n cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec\n __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88\n __dev_mc_add from igmp6_group_added+0x84/0xec\n igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0\n __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4\n __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168\n do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8\n ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c\n do_sock_setsockopt from __sys_setsockopt+0x84/0xac\n __sys_setsockopt from ret_fast_syscall+0x0/0x54\n\nThis trace occurs because vlan_for_each() is called within\ncpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.\nSince modifying vlan_for_each() to operate without the RTNL lock is not\nstraightforward, and because ndo_set_rx_mode() is invoked both with and\nwithout the RTNL lock across different code paths, simply adding\nrtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.\n\nTo resolve this issue, we opt to execute the actual processing within\na work queue, following the approach used by the icssg-prueth driver.\n\nPlease note: To reproduce this issue, I manually reverted the changes to\nam335x-bone-common.dtsi from commit c477358e66a3 (\"ARM: dts: am335x-bone:\nswitch to new cpsw switch drv\") in order to revert to the legacy cpsw\ndriver.\n\nFixes: 1767bb2d47b7 (\"ipv6: mcast: Don\u0027t hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\")\nSigned-off-by: Kevin Hao \u003chaokexin@gmail.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260203-bbb-v5-2-ea0ea217a85c@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c0b5dc73a38f954e780f93a549b8fe225235c07a", "tree": "c7e91ac1c868280a17e6bc54da3bab6d785c7692", "parents": [ "279fe484dde428d305eeb8e3acdaa7ddfaa62a42" ], "author": { "name": "Kevin Hao", "email": "haokexin@gmail.com", "time": "Tue Feb 03 10:18:30 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:45:52 2026 -0800" }, "message": "net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue\n\nCommit 1767bb2d47b7 (\"ipv6: mcast: Don\u0027t hold RTNL for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\") removed the RTNL lock for\nIPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this\nchange triggered the following call trace on my BeagleBone Black board:\n WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496\n RTNL: assertion failed at net/8021q/vlan_core.c (236)\n Modules linked in:\n CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT\n Hardware name: Generic AM33XX (Flattened Device Tree)\n Call trace:\n unwind_backtrace from show_stack+0x28/0x2c\n show_stack from dump_stack_lvl+0x30/0x38\n dump_stack_lvl from __warn+0xb8/0x11c\n __warn from warn_slowpath_fmt+0x130/0x194\n warn_slowpath_fmt from vlan_for_each+0x120/0x124\n vlan_for_each from cpsw_add_mc_addr+0x54/0xd8\n cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec\n __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88\n __dev_mc_add from igmp6_group_added+0x84/0xec\n igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0\n __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4\n __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168\n do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8\n ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c\n do_sock_setsockopt from __sys_setsockopt+0x84/0xac\n __sys_setsockopt from ret_fast_syscall+0x0/0x5\n\nThis trace occurs because vlan_for_each() is called within\ncpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.\nSince modifying vlan_for_each() to operate without the RTNL lock is not\nstraightforward, and because ndo_set_rx_mode() is invoked both with and\nwithout the RTNL lock across different code paths, simply adding\nrtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.\n\nTo resolve this issue, we opt to execute the actual processing within\na work queue, following the approach used by the icssg-prueth driver.\n\nFixes: 1767bb2d47b7 (\"ipv6: mcast: Don\u0027t hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.\")\nSigned-off-by: Kevin Hao \u003chaokexin@gmail.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/20260203-bbb-v5-1-ea0ea217a85c@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "279fe484dde428d305eeb8e3acdaa7ddfaa62a42", "tree": "1941f8afd17e03c01ea82467a654cc80c1f9b7c0", "parents": [ "6788d44b936c7e494b0d179c8843a72188287473", "c7db85d579a1dccb624235534508c75fbf2dfe46" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:28:07 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:28:08 2026 -0800" }, "message": "Merge branch \u0027gve-stats-reporting-fixes\u0027\n\nMax Yuan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngve: Stats reporting fixes\n\nThis series addresses two issues related to statistics in the gve driver.\n\nThe first patch fixes a memory corruption issue that occurs when resizing\nthe stats region during queue count changes. By allocating the maximum\npossible size upfront and aligning offset calculations with the NIC,\nwe ensure stability and accuracy across reconfigurations.\n\nThe second patch fixes the \u0027rx_dropped\u0027 counter by removing allocation\nfailures and incorporating XDP transmit and redirect errors to provide\na more accurate representation of dropped packets.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260202193925.3106272-1-hramamurthy@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c7db85d579a1dccb624235534508c75fbf2dfe46", "tree": "1941f8afd17e03c01ea82467a654cc80c1f9b7c0", "parents": [ "7b9ebcce0296e104a0d82a6b09d68564806158ff" ], "author": { "name": "Max Yuan", "email": "maxyuan@google.com", "time": "Mon Feb 02 19:39:25 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:28:05 2026 -0800" }, "message": "gve: Correct ethtool rx_dropped calculation\n\nThe gve driver\u0027s \"rx_dropped\" statistic, exposed via `ethtool -S`,\nincorrectly includes `rx_buf_alloc_fail` counts. These failures\nrepresent an inability to allocate receive buffers, not true packet\ndrops where a received packet is discarded. This misrepresentation can\nlead to inaccurate diagnostics.\n\nThis patch rectifies the ethtool \"rx_dropped\" calculation. It removes\n`rx_buf_alloc_fail` from the total and adds `xdp_tx_errors` and\n`xdp_redirect_errors`, which represent legitimate packet drops within\nthe XDP path.\n\nCc: stable@vger.kernel.org\nFixes: 433e274b8f7b (\"gve: Add stats for gve.\")\nSigned-off-by: Max Yuan \u003cmaxyuan@google.com\u003e\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nReviewed-by: Joshua Washington \u003cjoshwash@google.com\u003e\nReviewed-by: Matt Olson \u003cmaolson@google.com\u003e\nSigned-off-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260202193925.3106272-3-hramamurthy@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7b9ebcce0296e104a0d82a6b09d68564806158ff", "tree": "27031f5b9ac047922a2496314b2454fb05cc8118", "parents": [ "6788d44b936c7e494b0d179c8843a72188287473" ], "author": { "name": "Debarghya Kundu", "email": "debarghyak@google.com", "time": "Mon Feb 02 19:39:24 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:28:05 2026 -0800" }, "message": "gve: Fix stats report corruption on queue count change\n\nThe driver and the NIC share a region in memory for stats reporting.\nThe NIC calculates its offset into this region based on the total size\nof the stats region and the size of the NIC\u0027s stats.\n\nWhen the number of queues is changed, the driver\u0027s stats region is\nresized. If the queue count is increased, the NIC can write past\nthe end of the allocated stats region, causing memory corruption.\nIf the queue count is decreased, there is a gap between the driver\nand NIC stats, leading to incorrect stats reporting.\n\nThis change fixes the issue by allocating stats region with maximum\nsize, and the offset calculation for NIC stats is changed to match\nwith the calculation of the NIC.\n\nCc: stable@vger.kernel.org\nFixes: 24aeb56f2d38 (\"gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.\")\nSigned-off-by: Debarghya Kundu \u003cdebarghyak@google.com\u003e\nReviewed-by: Joshua Washington \u003cjoshwash@google.com\u003e\nSigned-off-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260202193925.3106272-2-hramamurthy@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6788d44b936c7e494b0d179c8843a72188287473", "tree": "65794d000100456958517a9ea4e579f3eeb10ef0", "parents": [ "f613e8b4afea0cd17c7168e8b00e25bc8d33175d", "bee60ce21b751275b3a7766f614373ef02dde512" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:23:46 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:23:47 2026 -0800" }, "message": "Merge branch \u0027net-gro-fix-outer-network-offset\u0027\n\nPaolo Abeni says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: gro: fix outer network offset\n\nThe GRO stage has still problems in some edge scenarios when dealing\nwith encapsulated traffic: the first patch address an issue there\nleading to bad checksums.\n\nThe second patch introduces a test case covering the relevant scenario:\nS/W segmentation after GRO for encapsulated traffic.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1770032084.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bee60ce21b751275b3a7766f614373ef02dde512", "tree": "65794d000100456958517a9ea4e579f3eeb10ef0", "parents": [ "5c2c3c38be396257a6a2e55bd601a12bb9781507" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Mon Feb 02 12:43:15 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:23:41 2026 -0800" }, "message": "selftest: net: add a test-case for encap segmentation after GRO\n\nWe had a few patches in this area and no explicit coverage so far.\nThe test case covers the scenario addressed by the previous fix;\nreusing the existing udpgro_fwd.sh script to leverage part of the\nof the virtual network setup, even if such script is possibly not\na perfect fit.\n\nNote that the mentioned script already contains several shellcheck\nviolation; this patch does not fix the existing code, just avoids\nadding more issues in the new one.\n\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nLink: https://patch.msgid.link/768ca132af81e83856e34d3105b86c37e566a7ad.1770032084.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5c2c3c38be396257a6a2e55bd601a12bb9781507", "tree": "06f0625e60ec5a3d10c1b0ba39d2848ca25897bc", "parents": [ "f613e8b4afea0cd17c7168e8b00e25bc8d33175d" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Mon Feb 02 12:43:14 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:23:41 2026 -0800" }, "message": "net: gro: fix outer network offset\n\nThe udp GRO complete stage assumes that all the packets inserted the RX\nhave the `encapsulation` flag zeroed. Such assumption is not true, as a\nfew H/W NICs can set such flag when H/W offloading the checksum for\nan UDP encapsulated traffic, the tun driver can inject GSO packets with\nUDP encapsulation and the problematic layout can also be created via\na veth based setup.\n\nDue to the above, in the problematic scenarios, udp4_gro_complete() uses\nthe wrong network offset (inner instead of outer) to compute the outer\nUDP header pseudo checksum, leading to csum validation errors later on\nin packet processing.\n\nAddress the issue always clearing the encapsulation flag at GRO completion\ntime. Such flag will be set again as needed for encapsulated packets by\nudp_gro_complete().\n\nFixes: 5ef31ea5d053 (\"net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb\")\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/562638dbebb3b15424220e26a180274b387e2a88.1770032084.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f613e8b4afea0cd17c7168e8b00e25bc8d33175d", "tree": "9151c2664f02c91ed2d03e9be8c389ec4c1e1aa9", "parents": [ "78211543d2e44f84093049b4ef5f5bfa535f4645" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Feb 02 20:52:17 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:20:30 2026 -0800" }, "message": "net: add proper RCU protection to /proc/net/ptype\n\nYin Fengwei reported an RCU stall in ptype_seq_show() and provided\na patch.\n\nReal issue is that ptype_seq_next() and ptype_seq_show() violate\nRCU rules.\n\nptype_seq_show() runs under rcu_read_lock(), and reads pt-\u003edev\nto get device name without any barrier.\n\nAt the same time, concurrent writers can remove a packet_type structure\n(which is correctly freed after an RCU grace period) and clear pt-\u003edev\nwithout an RCU grace period.\n\nDefine ptype_iter_state to carry a dev pointer along seq_net_private:\n\nstruct ptype_iter_state {\n\tstruct seq_net_private\tp;\n\tstruct net_device\t*dev; // added in this patch\n};\n\nWe need to record the device pointer in ptype_get_idx() and\nptype_seq_next() so that ptype_seq_show() is safe against\nconcurrent pt-\u003edev changes.\n\nWe also need to add full RCU protection in ptype_seq_next().\n(Missing READ_ONCE() when reading list.next values)\n\nMany thanks to Dong Chenchen for providing a repro.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nFixes: 1d10f8a1f40b (\"net-procfs: show net devices bound packet types\")\nFixes: c353e8983e0d (\"net: introduce per netns packet chains\")\nReported-by: Yin Fengwei \u003cfengwei_yin@linux.alibaba.com\u003e\nReported-by: Dong Chenchen \u003cdongchenchen2@huawei.com\u003e\nCloses: https://lore.kernel.org/netdev/CANn89iKRRKPnWjJmb-_3a\u003dsq+9h6DvTQM4DBZHT5ZRGPMzQaiA@mail.gmail.com/T/#m7b80b9fc9b9267f90e0b7aad557595f686f9c50d\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nTested-by: Yin Fengwei \u003cfengwei_yin@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20260202205217.2881198-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "78211543d2e44f84093049b4ef5f5bfa535f4645", "tree": "a707402a2c9de097cb067226d37a8478b1af0f4b", "parents": [ "3125fc17016945b11e9725c6aff30ff3326fd58f" ], "author": { "name": "Chen Ni", "email": "nichen@iscas.ac.cn", "time": "Mon Feb 02 12:02:28 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 03 19:11:58 2026 -0800" }, "message": "net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi()\n\nThe devm_gpiod_get_optional() function may return an ERR_PTR in case of\ngenuine GPIO acquisition errors, not just NULL which indicates the\nlegitimate absence of an optional GPIO.\n\nAdd an IS_ERR() check after the call in adin1110_check_spi(). On error,\nreturn the error code to ensure proper failure handling rather than\nproceeding with invalid pointers.\n\nFixes: 36934cac7aaf (\"net: ethernet: adi: adin1110: add reset GPIO\")\nSigned-off-by: Chen Ni \u003cnichen@iscas.ac.cn\u003e\nReviewed-by: Nuno Sá \u003cnuno.sa@analog.com\u003e\nLink: https://patch.msgid.link/20260202040228.4129097-1-nichen@iscas.ac.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8302d0afeaec0bc57d951dd085e0cffe997d4d18", "tree": "707e6aea39b892185250f32b32565a879a2acafb", "parents": [ "8f8a4dce64013737701d13565cf6107f42b725ea" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Tue Feb 03 15:21:13 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Wed Feb 04 12:17:57 2026 +1000" }, "message": "nouveau/gsp: fix suspend/resume regression on r570 firmware\n\nThe r570 firmware with certain GPUs (at least RTX6000) needs this\nflag to reflect the suspend vs runtime PM state of the driver.\n\nThis uses that info to set the correct flags to the firmware.\n\nThis fixes a regression on RTX6000 and other GPUs since r570 firmware\nwas enabled.\n\nFixes: 53dac0623853 (\"drm/nouveau/gsp: add support for 570.144\")\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nTested-by: Lyude Paul \u003clyude@redhat.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/20260203052431.2219998-4-airlied@gmail.com\n" }, { "commit": "8f8a4dce64013737701d13565cf6107f42b725ea", "tree": "59f26ca96aeadb5875673959c6d09885bdfea41f", "parents": [ "90caca3b7264cc3e92e347b2004fff4e386fc26e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Tue Feb 03 15:21:12 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Wed Feb 04 12:17:43 2026 +1000" }, "message": "nouveau: add a third state to the fini handler.\n\nThis is just refactoring to allow the lower layers to distinguish\nbetween suspend and runtime suspend.\n\nGSP 570 needs to set a flag with the GPU is going into GCOFF,\nthis flag taken from the opengpu driver is set whenever runtime\nsuspend is enterning GCOFF but not for normal suspend paths.\n\nThis just refactors the code, a subsequent patch use the information.\n\nFixes: 53dac0623853 (\"drm/nouveau/gsp: add support for 570.144\")\nCc: \u003cstable@vger.kernel.org\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nTested-by: Lyude Paul \u003clyude@redhat.com\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://patch.msgid.link/20260203052431.2219998-3-airlied@gmail.com\n" }, { "commit": "90caca3b7264cc3e92e347b2004fff4e386fc26e", "tree": "0a5df6d0b21fcf532a80d9c2d47b34e2eadc389c", "parents": [ "78f1421dc3ac2588fb59b55e2b4c2c55a442913e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Tue Feb 03 15:21:11 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Wed Feb 04 12:17:34 2026 +1000" }, "message": "nouveau/gsp: use rpc sequence numbers properly.\n\nThere are two layers of sequence numbers, one at the msg level\nand one at the rpc level.\n\n570 firmware started asserting on the sequence numbers being\nin the right order, and we would see nocat records with asserts\nin them.\n\nAdd the rpc level sequence number support.\n\nFixes: 53dac0623853 (\"drm/nouveau/gsp: add support for 570.144\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nReviewed-by: Lyude Paul \u003clyude@redhat.com\u003e\nTested-by: Lyude Paul \u003clyude@redhat.com\u003e\nLink: https://patch.msgid.link/20260203052431.2219998-2-airlied@gmail.com\n" }, { "commit": "5fd0a1df5d05ad066e5618ccdd3d0fa6cb686c27", "tree": "d7fab3df9e531dd5d4d28a6a8c2f54ac70752158", "parents": [ "de0674d9bc69699c497477d45172493393ae9007", "67b3da8d3051fba7e1523b3afce4f71c658f15f8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 03 16:20:59 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 03 16:20:59 2026 -0800" }, "message": "Merge tag \u0027v6.19rc8-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n \"Two small client memory leak fixes\"\n\n* tag \u0027v6.19rc8-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb/client: fix memory leak in SendReceive()\n smb/client: fix memory leak in smb2_open_file()\n" }, { "commit": "6b61a54e684006ca0d92d684a1d3c3a00f077d8f", "tree": "4127f442c5eda13f15fe4c4297c914ae4f08039e", "parents": [ "84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0" ], "author": { "name": "Harish Kasiviswanathan", "email": "Harish.Kasiviswanathan@amd.com", "time": "Fri Jan 09 15:26:36 2026 -0500" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:24:21 2026 -0500" }, "message": "drm/amdgpu: Fix double deletion of validate_list\n\nIf amdgpu_amdkfd_gpuvm_free_memory_of_gpu() fails after kgd_mem is\nremoved from validate_list, the mem handle still lingers in the KFD idr.\nThis means when process is terminated,\nkfd_process_free_outstanding_kfd_bos() will call\namdgpu_amdkfd_gpuvm_free_memory_of_gpu() again resulting in double\ndeletion.\n\nTo avoid this -\n (a) Check if list is empty before deleting it\n (b) Rearragne amdgpu_amdkfd_gpuvm_free_memory_of_gpu() such that it can\n be safely called again if it returns failure the first time.\n\nSigned-off-by: Harish Kasiviswanathan \u003cHarish.Kasiviswanathan@amd.com\u003e\nReviewed-by: Philip Yang \u003cPhilip.Yang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 6ba60345f45eaf7cb4f89105d26083a4b9fd1cba)\n" }, { "commit": "84962445cd8a83dc5bed4c8ad5bbb2c1cdb249a0", "tree": "6bea7e7fa4fadd44f0df09ac74ed34307314d787", "parents": [ "d25b32aa829a3ed5570138e541a71fb7805faec3" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Fri Jan 16 12:50:49 2026 -0300" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:21:58 2026 -0500" }, "message": "drm/amd/display: remove assert around dpp_base replacement\n\nThere is nothing wrong if in_shaper_func type is DISTRIBUTED POINTS.\nRemove the assert placed for a TODO to avoid misinterpretations.\n\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1714dcc4c2c53e41190896eba263ed6328bcf415)\n" }, { "commit": "d25b32aa829a3ed5570138e541a71fb7805faec3", "tree": "b1dc388f5fbe265f80ef25781f5e8eb709afcc9f", "parents": [ "8f959d37c1f2efec6dac55915ee82302e98101fb" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Mon Dec 08 22:44:15 2025 -0100" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:21:50 2026 -0500" }, "message": "drm/amd/display: extend delta clamping logic to CM3 LUT helper\n\nCommit 27fc10d1095f (\"drm/amd/display: Fix the delta clamping for shaper\nLUT\") fixed banding when using plane shaper LUT in DCN10 CM helper. The\nproblem is also present in DCN30 CM helper, fix banding by extending the\nsame bug delta clamping fix to CM3.\n\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nReviewed-by: Harry Wentland \u003charry.wentland@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 0274a54897f356f9c78767c4a2a5863f7dde90c6)\n" }, { "commit": "8f959d37c1f2efec6dac55915ee82302e98101fb", "tree": "6ad934c07c68c34a2d69ad8d8ad856e288266451", "parents": [ "243b467dea1735fed904c2e54d248a46fa417a2d" ], "author": { "name": "Melissa Wen", "email": "mwen@igalia.com", "time": "Thu Jan 22 12:20:29 2026 -0300" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:21:43 2026 -0500" }, "message": "drm/amd/display: fix wrong color value mapping on MCM shaper LUT\n\nSome shimmer/colorful points appears when using the steamOS color\npipeline for HDR on gaming with DCN32. These points look like black\nvalues being wrongly mapped to red/blue/green values. It was caused\nbecause the number of hw points in regular LUTs and in a shaper LUT was\ntreated as the same.\n\nDCN3+ regular LUTs have 257 bases and implicit deltas (i.e. HW\ncalculates them), but shaper LUT is a special case: it has 256 bases and\n256 deltas, as in DCN1-2 regular LUTs, and outputs 14-bit values.\n\nFix that by setting by decreasing in 1 the number of HW points computed\nin the LUT segmentation so that shaper LUT (i.e. fixpoint \u003d\u003d true) keeps\nthe same DCN10 CM logic and regular LUTs go with `hw_points + 1`.\n\nCC: Krunoslav Kovac \u003cKrunoslav.Kovac@amd.com\u003e\nFixes: 4d5fd3d08ea9 (\"drm/amd/display: PQ tail accuracy\")\nSigned-off-by: Melissa Wen \u003cmwen@igalia.com\u003e\nReviewed-by: Alex Hung \u003calex.hung@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 5006505b19a2119e71c008044d59f6d753c858b9)\n" }, { "commit": "243b467dea1735fed904c2e54d248a46fa417a2d", "tree": "5202298706f1bc9a160ed67ae4eee46589ab5bf5", "parents": [ "1478a34470bf4755465d29b348b24a610bccc180" ], "author": { "name": "Bert Karwatzki", "email": "spasswolf@web.de", "time": "Sun Feb 01 01:24:45 2026 +0100" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:20:59 2026 -0500" }, "message": "Revert \"drm/amd: Check if ASPM is enabled from PCIe subsystem\"\n\nThis reverts commit 7294863a6f01248d72b61d38478978d638641bee.\n\nThis commit was erroneously applied again after commit 0ab5d711ec74\n(\"drm/amd: Refactor `amdgpu_aspm` to be evaluated per device\")\nremoved it, leading to very hard to debug crashes, when used with a system with two\nAMD GPUs of which only one supports ASPM.\n\nLink: https://lore.kernel.org/linux-acpi/20251006120944.7880-1-spasswolf@web.de/\nLink: https://github.com/acpica/acpica/issues/1060\nFixes: 0ab5d711ec74 (\"drm/amd: Refactor `amdgpu_aspm` to be evaluated per device\")\nSigned-off-by: Bert Karwatzki \u003cspasswolf@web.de\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 97a9689300eb2b393ba5efc17c8e5db835917080)\nCc: stable@vger.kernel.org\n" }, { "commit": "1478a34470bf4755465d29b348b24a610bccc180", "tree": "83e6e2669c3881e5767982fcebbef0e9449a8940", "parents": [ "18f7fcd5e69a04df57b563360b88be72471d6b62" ], "author": { "name": "Mario Limonciello", "email": "mario.limonciello@amd.com", "time": "Thu Jan 29 13:47:22 2026 -0600" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Tue Feb 03 17:20:38 2026 -0500" }, "message": "drm/amd: Set minimum version for set_hw_resource_1 on gfx11 to 0x52\n\ncommit f81cd793119e (\"drm/amd/amdgpu: Fix MES init sequence\") caused\na dependency on new enough MES firmware to use amdgpu. This was fixed\non most gfx11 and gfx12 hardware with commit 0180e0a5dd5c\n(\"drm/amdgpu/mes: add compatibility checks for set_hw_resource_1\"), but\nthis left out that GC 11.0.4 had breakage at MES 0x51.\n\nBump the requirement to 0x52 instead.\n\nReported-by: danijel@nausys.com\nCloses: https://gitlab.freedesktop.org/drm/amd/-/issues/4576\nFixes: f81cd793119e (\"drm/amd/amdgpu: Fix MES init sequence\")\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c2d2ccc85faf8cc6934d50c18e43097eb453ade2)\nCc: stable@vger.kernel.org\n" } ], "next": "b126097b0327437048bd045a0e4d273dea2910dd" }