)]}' { "log": [ { "commit": "eb3f4b7426cfd2b79d65b7d37155480b32259a11", "tree": "adb9ed5b086c5c501915884cb8a26247b2c4f1c5", "parents": [ "e909cedf6800ef493063f18a089f3632817a8c2d", "0b474240327cebeff08ad429e8ed3cfc6c8ee816" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 13:49:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 13:49:13 2026 -0700" }, "message": "Merge tag \u0027nfsd-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux\n\nPull nfsd fixes from Chuck Lever:\n \"Regressions:\n\n - Tighten bounds checking for sunrpc cache hash tables\n\n - Don\u0027t report key material in the ftrace log\n\n Stable fix:\n\n - Fix lockd\u0027s implementation of the NLM TEST procedure\"\n\n* tag \u0027nfsd-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:\n lockd: fix TEST handling when not all permissions are available.\n NFSD: Report whether fh_key was actually updated\n sunrpc: prevent out-of-bounds read in __cache_seq_start()\n" }, { "commit": "e909cedf6800ef493063f18a089f3632817a8c2d", "tree": "d1ff437b168fefda1e63465ef8e1b4a14074250d", "parents": [ "d60ec36cab338dfe2ae40d73e9c8d6c4af70d2b8", "fb6988b83b4cafe8db63999c1ddff1b7c66d2ff5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 13:37:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 13:37:26 2026 -0700" }, "message": "Merge tag \u0027linux_kselftest-kunit-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kunit fix from Shuah Khan:\n \"Fix a use-after-free in kunit debugfs when using kunit.filter when the\n executor frees dynamically allocated resources after running boot-time\n tests. This resulted in fatal hardware exception due to invalidation\n of capability flags on the reclaimed memory on some architectures such\n as CHERI RISC-V that support the feature, and silent memory corruption\n on others.\n\n The fix for this couples the lifetime of the filtered suite memory\n allocation to the lifetime of the kunit subsystem and its associated\n VFS nodes. Ownership of the boot-time suite_set is now transferred to\n a global tracker (\u0027kunit_boot_suites\u0027), and the memory is cleanly\n released in kunit_exit() during module teardown\"\n\n* tag \u0027linux_kselftest-kunit-fixes-7.1-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n kunit: fix use-after-free in debugfs when using kunit.filter\n" }, { "commit": "d60ec36cab338dfe2ae40d73e9c8d6c4af70d2b8", "tree": "e9a0c763a92a7f4a33c956c4d1ad6a6026e583dc", "parents": [ "e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7", "54cf41c969da6637cce790b7400da1451609db9b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 08:23:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 26 08:23:19 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-05-25-16-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"13 hotfixes. 9 are for MM. 9 are cc:stable and the remaining 4 address\n post-7.1 issues or aren\u0027t considered suitable for backporting.\n\n All patches are singletons - please see the individual changelogs for\n details\"\n\n* tag \u0027mm-hotfixes-stable-2026-05-25-16-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n Revert \"mm: introduce a new page type for page pool in page type\"\n mm/vmalloc: do not trigger BUG() on BH disabled context\n MAINTAINERS, mailmap: change email for Eugen Hristev\n mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page\n kernel/fork: validate exit_signal in kernel_clone()\n mm: memcontrol: propagate NMI slab stats to memcg vmstats\n mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()\n mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one\n zram: fix use-after-free in zram_writeback_endio\n memfd: deny writeable mappings when implying SEAL_WRITE\n ipc: limit next_id allocation to the valid ID range\n Revert \"mm/hugetlbfs: update hugetlbfs to use mmap_prepare\"\n MAINTAINERS: .mailmap: update after GEHC spin-off\n" }, { "commit": "e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7", "tree": "468af00fec2e7579c88b969e38a61f87fb6fab45", "parents": [ "13e4d2579eb34e9731bcc5ca73205708355e5d99", "974820a59efde7c1a7e1260bcfe9bb81f833cc9f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:49:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:49:27 2026 -0700" }, "message": "Merge tag \u0027for-7.1/hpfs-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull hpfs fix from Mikulas Patocka:\n\n - Fix a crash on corrupted filesystem\n\n* tag \u0027for-7.1/hpfs-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n hpfs: fix a crash if hpfs_map_dnode_bitmap fails\n" }, { "commit": "13e4d2579eb34e9731bcc5ca73205708355e5d99", "tree": "9b6d28fbc890c457f361880bec68df7e09749866", "parents": [ "c112662a0e734129985cf3386250cfa59f6b7aa0", "fb7415f2ab0e3c818254cbf5fb0afda71bef4333" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:45:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:45:40 2026 -0700" }, "message": "Merge tag \u0027for-7.1/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fix from Mikulas Patocka:\n\n - fix crashes in dm-vdo if GFP_NOWAIT allocation fails\n\n* tag \u0027for-7.1/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm vdo: use GFP_NOIO for blkdev_issue_zeroout on format path\n" }, { "commit": "c112662a0e734129985cf3386250cfa59f6b7aa0", "tree": "1036360ebaed9a26647e33520c311fcf7c5686f3", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "f42d01aadcedd7bbf4f9a466cabe25c1781dedad" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:22:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon May 25 12:22:50 2026 -0700" }, "message": "Merge tag \u0027bootconfig-fixes-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull bootconfig fix from Masami Hiramatsu:\n\n - Fix buf leak in apply_xbc\n\n* tag \u0027bootconfig-fixes-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tools/bootconfig: Fix buf leaks in apply_xbc\n" }, { "commit": "974820a59efde7c1a7e1260bcfe9bb81f833cc9f", "tree": "1e6d6d137503befefdbefa11d402cefd60f8f37b", "parents": [ "e7ae89a0c97ce2b68b0983cd01eda67cf373517d" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon May 25 14:48:58 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon May 25 14:48:58 2026 +0200" }, "message": "hpfs: fix a crash if hpfs_map_dnode_bitmap fails\n\nIf hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on\nuninitialized quad buffer head, causing a crash.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nReported-by: Farhad Alemi \u003cfarhad.alemi@berkeley.edu\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "e7ae89a0c97ce2b68b0983cd01eda67cf373517d", "tree": "2d7df7d7acab76095da5d5f02fa43bce11231a30", "parents": [ "6a97c4d5262d02f04d1f41113b0d090ea51f08dd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 13:48:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 13:48:06 2026 -0700" }, "message": "Linux 7.1-rc5\n" }, { "commit": "6a97c4d5262d02f04d1f41113b0d090ea51f08dd", "tree": "d8fc003a82eedbba37b878c6eacbe17e12e53c8c", "parents": [ "3526d7462355c4df269d4a87eed53dbd48a1df02", "9a12fa5213cfc391e0eed63902d3be98f0913765" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 12:50:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 12:50:36 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"arm64:\n\n - Fix ITS EventID sanitisation when restoring an interrupt\n translation table.\n\n - Fix PPI memory leak when failing to initialise a vcpu.\n\n - Correctly return an error when the validation of a hypervisor trace\n descriptor fails, and limit this validation to protected mode only.\n\n RISC-V:\n\n - Fix invalid HVA warning in steal-time recording\n\n - Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info() and\n pmu_snapshot_set_shmem()\n\n - Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n\n - Fix sign extension of value for MMIO loads\n\n s390:\n\n - Fix bugs in vSIE (nested virtualization) and UCONTROL, caused by\n the page table rewrite.\n\n x86:\n\n - Apply erratum #1235 workaround (disable AVIC IPI virtualization) on\n Hygon Family 18h, just like on AMD Family 17h.\n\n - When KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM,\n return the VM\u0027s configured APIC bus frequency instead of the\n default. This is less confusing (read: not wrong) and makes it\n easier to fill in CPUID information that communicates the APIC bus\n frequency to the guest.\n\n Selftests:\n\n - Do not include glibc-internal \u003cbits/endian.h\u003e; it worked by chance\n and broke building KVM selftests with musl\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n KVM: selftests: Verify that KVM returns the configured APIC cycle length\n KVM: x86: Return the VM\u0027s configured APIC bus frequency when queried\n KVM: selftests: elf: Include \u003cendian.h\u003e instead of \u003cbits/endian.h\u003e\n KVM: s390: Properly reset zero bit in PGSTE\n KVM: s390: vsie: Fix redundant rmap entries\n KVM: s390: vsie: Fix unshadowing logic\n KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors\n KVM: s390: vsie: Fix memory leak when unshadowing\n KVM: arm64: Fix nVHE/pKVM hyp tracing error on invalid desc\n KVM: arm64: vgic: Free private_irqs when init fails after allocation\n KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits\n RISC-V: KVM: Fix sign extension for MMIO loads\n RISC-V: KVM: Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n riscv: kvm: return SBI_ERR_FAILURE for pmu_event_info() when OOM\n riscv: kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM\n RISC-V: KVM: Fix invalid HVA warning in steal-time recording\n" }, { "commit": "3526d7462355c4df269d4a87eed53dbd48a1df02", "tree": "9eee3b40fda02b288aa3cbcb27bab3fe5e2523a7", "parents": [ "a674bf74b31079782d7d8f333c8d832374f0b65c", "fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 11:00:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 11:00:45 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - On SEV guests, handle set_memory_{encrypted,decrypted}() failures\n more conservatively by assuming that all affected pages are\n unencrypted (Carlos López)\n\n - Disable broadcast TLB flush when PCID is disabled (Tom Lendacky)\n\n - Fix VMX vs. hrtimer_rearm_deferred() regression (Peter Zijlstra)\n\n - Move IRQ/NMI dispatch code from KVM into x86 core, to prepare for a\n KVM x2apic fix (Peter Zijlstra)\n\n - Fix incorrect munmap() size on map_vdso() failure (Guilherme Giacomo\n Simoes)\n\n* tag \u0027x86-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n virt: sev-guest: Explicitly leak pages in unknown state\n x86/mm: Disable broadcast TLB flush when PCID is disabled\n x86/kvm/vmx: Fix VMX vs hrtimer_rearm_deferred()\n x86/kvm/vmx: Move IRQ/NMI dispatch from KVM into x86 core\n x86/vdso: Fix incorrect size in munmap() on map_vdso() failure\n" }, { "commit": "a674bf74b31079782d7d8f333c8d832374f0b65c", "tree": "af47de05fff297bc7e6e58472a2987677c500e8d", "parents": [ "ee651da6d3e1e3c57d22dd6f03850af980b7cd10", "c9b7598eb013c6dbf2526dc050364bd8dc24f0d3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:55:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:55:21 2026 -0700" }, "message": "Merge tag \u0027irq-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irqchip driver fixes from Ingo Molnar:\n\n - Fix the hardware probing error path of the renesas-rzt2h\n irqchip driver\n\n - Fix the exynos-combiner irqchip driver on -rt kernels\n by turning the IRQ controller spinlock into a raw spinlock\n\n* tag \u0027irq-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/renesas-rzt2h: Use pm_runtime_put_sync() in probe error path\n irqchip/exynos-combiner: Switch to raw_spinlock\n" }, { "commit": "ee651da6d3e1e3c57d22dd6f03850af980b7cd10", "tree": "8c2bcd61a715f17f3c68b857440119c6e4603de2", "parents": [ "2be86a8c57773bce1b5c845c49e0bfa3caac838c", "5f41161059fd0f1bbf18c90f3180e38cc45a14eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:48:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:48:55 2026 -0700" }, "message": "Merge tag \u0027core-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull debugobjects fix from Ingo Molnar::\n\n - Fix debugobjects regression on -rt kernels: don\u0027t fill the pool\n (which uses a coarse lock) if -\u003epi_blocked_on, because that messes up\n the priority inheritance of callers\n\n* tag \u0027core-urgent-2026-05-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n debugobjects: Do not fill_pool() if pi_blocked_on\n" }, { "commit": "2be86a8c57773bce1b5c845c49e0bfa3caac838c", "tree": "c66c8e3bb96422cd855d06a22e98dfb72eb08311", "parents": [ "53676e4d44d6b38c8a0d9bff331f170ae2e41bbe", "4e4af55aaca7f6d7673d5f9889ad0529db86a048" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:37:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:37:55 2026 -0700" }, "message": "Merge tag \u0027hwmon-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - adm1266: Various fixes from Abdurrahman Hussain\n\n The fixed issues were reported by Sashiko as part of a code review of\n a functional change in the driver.\n\n - lenovo-ec-sensors: Convert to devm_request_region() to fix\n release_region cleanup, and fix EC \"MCHP\" signature validation logic,\n from Kean Ren\n\n* tag \u0027hwmon-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock\n hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock\n hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock\n hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe()\n hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe()\n hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors\n hwmon: (pmbus/adm1266) don\u0027t clobber GPIO bits before PDIO read in get_multiple\n hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR\n hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer\n hwmon: (pmbus/adm1266) include adapter number in GPIO line label\n hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer\n hwmon: (pmbus/adm1266) reject implausible blackbox record_count\n hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX\n hwmon: (pmbus/adm1266) seed timestamp from the real-time clock\n hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic\n hwmon: (lenovo-ec-sensors): Convert to devm_request_region()\n" }, { "commit": "53676e4d44d6b38c8a0d9bff331f170ae2e41bbe", "tree": "47b6871f3557fa8dfe2c0d508f07fe64078aa004", "parents": [ "f0e77c598ebbb1ae055b156aaa33b7433ae45e51" ], "author": { "name": "Nathan Chancellor", "email": "nathan@kernel.org", "time": "Mon May 18 15:17:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 10:31:24 2026 -0700" }, "message": "drm/msm: Restore second parameter name in purge() and evict()\n\nAfter commit 3392291fc509 (\"drm/msm: Fix shrinker deadlock\"), all\nsupported versions of clang warn (or error with CONFIG_WERROR\u003dy):\n\n drivers/gpu/drm/msm/msm_gem_shrinker.c:105:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]\n 105 | purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n | ^\n drivers/gpu/drm/msm/msm_gem_shrinker.c:117:58: error: omitting the parameter name in a function definition is a C23 extension [-Werror,-Wc23-extensions]\n 117 | evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n | ^\n 2 errors generated.\n\nWith older but supported versions of GCC, this is an unconditional hard error:\n\n drivers/gpu/drm/msm/msm_gem_shrinker.c: In function \u0027purge\u0027:\n drivers/gpu/drm/msm/msm_gem_shrinker.c:105:35: error: parameter name omitted\n purge(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n ^~~~~~~~~~~~~~~~~~~~~~~\n drivers/gpu/drm/msm/msm_gem_shrinker.c: In function \u0027evict\u0027:\n drivers/gpu/drm/msm/msm_gem_shrinker.c:117:35: error: parameter name omitted\n evict(struct drm_gem_object *obj, struct ww_acquire_ctx *)\n ^~~~~~~~~~~~~~~~~~~~~~~\n\nRestore the parameter name to clear up the warnings, renaming it\n\"unused\" to make it clear it is only needed to satisfy the prototype of\ndrm_gem_lru_scan().\n\nCc: stable@vger.kernel.org\nFixes: 3392291fc509 (\"drm/msm: Fix shrinker deadlock\")\nSigned-off-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f0e77c598ebbb1ae055b156aaa33b7433ae45e51", "tree": "101355b4a44c992e2d7d2b7938b0517428a259a4", "parents": [ "4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90", "7dd62566e0d108d29034bcff8503b827f8763320" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 09:53:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 24 09:53:17 2026 -0700" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix bpf_throw() and global subprog combination (Kumar Kartikeya\n Dwivedi)\n\n - Fix out of bounds access in BPF interpreter (Yazhou Tang)\n\n - Fix potential out of bounds access in inner per-cpu array map\n (Guannan Wang)\n\n - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n libbpf: fix off-by-one in emit_signature_match jump offset\n bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature\n selftests/bpf: Cover global subprog exception leaks\n bpf: Check global subprog exception paths\n bpf: make bpf_session_is_return() reference optional\n bpf: Use array_map_meta_equal for percpu array inner map replacement\n selftests/bpf: Add test for large offset bpf-to-bpf call\n bpf: Fix s16 truncation for large bpf-to-bpf call offsets\n bpf: Fix out-of-bounds read in bpf_patch_call_args()\n" }, { "commit": "4cbfe4502e3d4bda48eb4b83dfad8d7da3b22e90", "tree": "f1d70b1952fe86d8b72a765506b7a5663919bf04", "parents": [ "400544639d2a11a9c1e276a912a9dff8fe4107dc", "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:59:02 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - fix for creating tmpfiles\n\n - fix durable reconnect error path\n\n - validate SID in security descriptor when inheriting DACL\n\n* tag \u0027v7.1-rc5-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n ksmbd: validate SID in parent security descriptor during ACL inheritance\n ksmbd: fix durable reconnect error path file lifetime\n" }, { "commit": "400544639d2a11a9c1e276a912a9dff8fe4107dc", "tree": "587237ffcddde9bdde29ec58d8e182d12046fb7e", "parents": [ "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "f13342e15deafb7538a7a8577ed5f4c33c56f64e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:54:48 2026 -0700" }, "message": "Merge tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"A batch of fixes to simple quotas:\n\n - add conditional rescheduling point not dependent on the lock during\n inode iterations to avoid delays with PREEMPT_NONE enabled\n\n - fix subvolume deletion so it does not break the squota invariants\n\n - properly handle enabling squota, tracking extents in the initial\n transaction\n\n - catch and warn about underflows, clamp to zero to avoid further\n problems\n\n And one fix to inode size handling:\n\n - fix handling of preallocated extents beyond i_size when not using\n the no-holes feature\"\n\n* tag \u0027for-7.1-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: swallow btrfs_record_squota_delta() ENOENT\n btrfs: clamp to avoid squota underflow\n btrfs: fix squota accounting during enable generation\n btrfs: check for subvolume before deleting squota qgroup\n btrfs: always drop root-\u003einodes lock before cond_resched()\n btrfs: mark file extent range dirty after converting prealloc extents\n" }, { "commit": "f83ef5bca211a1bdc1ea661c11543712f96a6cea", "tree": "fa9f7b0ff70d88e7ccbed16200f44e8dd5a62e26", "parents": [ "eed108edc1170404bbef9e7d0189d18a3cc354f5", "8339dd0e5090f092c525c5e04b2a75ec5e5305a6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 16:51:22 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fix from Carlos Maiolino:\n \"A single fix for a race in xfs buffer cache which may lead to\n filesystem shutdown due to inconsistent metadata if the buffer\n lookup happens to find an old dead buffer still in the cache\"\n\n* tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n xfs: fix a buffer lookup against removal race\n" }, { "commit": "eed108edc1170404bbef9e7d0189d18a3cc354f5", "tree": "b719bfa55f4f4394d3e017c5b9dc99f074a64311", "parents": [ "95e6d3ba0571330df866911da9dedd83e05417ca", "e90ef85ada857819313000cc50c6edfcddec6850" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:21:08 2026 -0700" }, "message": "Merge tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux\n\nPull nios2 fixes from Dinh Nguyen:\n\n - Implement _THIS_IP_ for inline asm\n\n - Add Simon Schuster as a maintainer and mark the NIOS2 as Supported\n\n* tag \u0027nios2_updates_for_v7.2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:\n nios2: Implement _THIS_IP_ using inline asm\n MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n" }, { "commit": "95e6d3ba0571330df866911da9dedd83e05417ca", "tree": "10f93942d6fb2daa7fc91edc87a41376f06aa822", "parents": [ "c8561c73b4a8669bb13c57a5853318cd02655f9b", "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 09:13:00 2026 -0700" }, "message": "Merge tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Rework KASLR to avoid initrd overlap, remove some unused code to avoid\n a build warning, fix some bugs in kprobes and KVM\"\n\n* tag \u0027loongarch-fixes-7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Move some variable declarations to paravirt.h\n LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n LoongArch: Remove unused code to avoid build warning\n LoongArch: Avoid initrd overlap during kernel relocation\n LoongArch: Skip relocation-time KASLR if already applied\n efi/loongarch: Randomize kernel preferred address for KASLR\n" }, { "commit": "7dd62566e0d108d29034bcff8503b827f8763320", "tree": "38c0df3e5d603d41840f6c66b46e15625c111d7a", "parents": [ "49b18315be4eecfc36b75f4aecb4d40a87d68a20" ], "author": { "name": "KP Singh", "email": "kpsingh@kernel.org", "time": "Fri May 22 23:53:36 2026 +0200" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Sat May 23 07:49:22 2026 -0700" }, "message": "libbpf: fix off-by-one in emit_signature_match jump offset\n\nThe offset for the cleanup-label jump is computed before the MOV R7\ninstruction is emitted, but the JMP lands after it. Account for the\nextra insn in the offset calculation (-2 instead of -1). Drop the\nredundant self-loop in the else branch; gen-\u003eerror \u003d -ERANGE already\nmarks the generation as failed.\n\nFixes: fb2b0e290147 (\"libbpf: Update light skeleton for signing\")\nSigned-off-by: KP Singh \u003ckpsingh@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260522215337.662271-2-kpsingh@kernel.org\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n" }, { "commit": "c8561c73b4a8669bb13c57a5853318cd02655f9b", "tree": "a9ac004283e3930c47a717576756b8d4a44857dd", "parents": [ "3f264650ca7d2a2d6de86234d919f305211632cd", "215c90ee656114f5e8c32408228d97082f8e0eef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:49:05 2026 -0700" }, "message": "Merge tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Remove the software node on platform device release(); without this,\n the software node remains registered after the device is gone and a\n subsequent platform_device_register_full() reusing the same node\n fails with -EBUSY\n\n - In sysfs_update_group(), do not remove a pre-existing directory when\n create_files() fails; the previous code would silently destroy a\n sysfs group that the caller did not create\n\n - Set fwnode-\u003esecondary to NULL in fwnode_init() to avoid dereferencing\n uninitialized memory (e.g. in dev_to_swnode()) when the firmware node\n is allocated on the stack or via a non-zeroing allocator\n\n* tag \u0027driver-core-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n sysfs: don\u0027t remove existing directory on update failure\n driver core: platform: remove software node on release()\n" }, { "commit": "3f264650ca7d2a2d6de86234d919f305211632cd", "tree": "b440c7d62949730c6772d1698dafbba3152da9fe", "parents": [ "ab868c10971c5d2cd27b3709d11225941eabe78e", "023453cb7eb0f53c5dc36babed8e706c1b0b0187" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:32:39 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Core:\n - smbus: fix a potential uninitialization bug\n\n Tegra:\n - drop runtime PM reference when exiting on mutex_lock failure\n - preserve transfer errors when releasing the mutex\"\n\n* tag \u0027i2c-for-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: smbus: fix a potential uninitialization bug\n i2c: tegra: make tegra_i2c_mutex_unlock() return void\n i2c: tegra: fix pm_runtime leak on mutex_lock failure\n" }, { "commit": "ab868c10971c5d2cd27b3709d11225941eabe78e", "tree": "78b438df7cde483d4aa05f28acc6004447e2df17", "parents": [ "f53a244224ec0304209917e3f4d68dc83b1967db", "5b74373390113fba798a76b483837029ab010fef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:17:27 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma\n\nPull rdma fixes from Jason Gunthorpe:\n\n - syzbot triggred crash in rxe due to concurrent plug/unplug\n\n - Possible non-zero\u0027d memory exposed to userspace in bnxt_re\n\n - Malicous \u0027magic packet\u0027 with SIW causes a buffer overflow\n\n - Tighten the new uAPI validation code to not crash in debugging prints\n and have the right module dependencies in drivers\n\n - mana was missing the max_msg_sz report to userspace\n\n - UAF in rtrs on an error path\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:\n RDMA/rtrs: Fix use-after-free in path file creation cleanup\n RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port\n RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()\n RDMA/core: Move the _ib_copy_validate_udata* functions to ib_core_uverbs\n RDMA/siw: Reject MPA FPDU length underflow before signed receive math\n RDMA/bnxt_re: zero shared page before exposing to userspace\n selftests/rdma: explicitly skip tests when required modules are missing\n RDMA/nldev: Add mutual exclusion in nldev_dellink()\n" }, { "commit": "8339dd0e5090f092c525c5e04b2a75ec5e5305a6", "tree": "85f3a7a35a37edd40803494b5789707e6a87ce82", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "c69439a891ccb37ede5d68539636337c6bd92fab" ], "author": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "committer": { "name": "Carlos Maiolino", "email": "cem@kernel.org", "time": "Sat May 23 16:15:18 2026 +0200" }, "message": "Merge tag \u0027xfs-fixes-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux into test_merge\n\nxfs: fixes for v7.1-rc5\n\nSigned-off-by: Carlos Maiolino \u003ccem@kernel.org\u003e\n Lines starting with \u0027#\u0027 will be ignored.\n" }, { "commit": "f53a244224ec0304209917e3f4d68dc83b1967db", "tree": "fe19f266c5edbf2ce37ef1adef2188add9c8d32b", "parents": [ "79bd2dded182b1d458b18e62684b7f82ffc682e5", "e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 23 07:13:06 2026 -0700" }, "message": "Merge tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl\n\nPull fwctl fix from Jason Gunthorpe:\n\n - Buffer overflow due to missing input validation in pds\n\n* tag \u0027for-linus-fwctl\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/fwctl/fwctl:\n fwctl: pds: Validate RPC input size before parsing\n" }, { "commit": "9a12fa5213cfc391e0eed63902d3be98f0913765", "tree": "bef8dcc25a2efd9153e7da972121b8becd710978", "parents": [ "d9c41dc531b0e8feb046ee3d31ce37657101b137" ], "author": { "name": "Tina Zhang", "email": "zhang_wei@open-hieco.net", "time": "Fri May 22 12:00:14 2026 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:09:04 2026 +0200" }, "message": "KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)\n\nHygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and\nshare the same erratum #1235: hardware may read a stale IsRunning\u003d1 bit\nduring ICR write emulation and silently fail to generate an\nAVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.\n\nThe absence of the VM-Exit causes KVM to miss the required wakeup of\nblocking target vCPUs, leading to hung vCPUs and unbounded delays in\nguest execution.\n\nExtend the existing AMD Family 17h erratum #1235 workaround to also cover\nHygon Family 18h. With IPI virtualization disabled, KVM never sets\nIsRunning\u003d1 in the Physical ID table, so every non-self IPI generates a\nVM-Exit and is correctly emulated.\n\nFixes: 8de4a1c8164e (\"KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Tina Zhang \u003czhang_wei@open-hieco.net\u003e\nMessage-ID: \u003c20260522040014.3380201-1-zhang_wei@open-hieco.net\u003e\n" }, { "commit": "d9c41dc531b0e8feb046ee3d31ce37657101b137", "tree": "932e0126afef4181c6d03f316a8deb8c987a4614", "parents": [ "86e2de10eb14446a49019791bd0674faa5fae088" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 22 10:35:26 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:07:40 2026 +0200" }, "message": "KVM: selftests: Verify that KVM returns the configured APIC cycle length\n\nAdd checks in the APIC bus clock test to verify that querying\nKVM_CAP_X86_APIC_BUS_CYCLES_NS on the VM after changing the frequency\nreturns the VM\u0027s actual APIC cycle length, not KVM\u0027s default. For\ngiggles, verify that KVM still returns its default frequency for the\nsystem-scoped check.\n\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260522173526.3539407-3-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "86e2de10eb14446a49019791bd0674faa5fae088", "tree": "9dbaaf7db2147410080b986cd88125ea943dc305", "parents": [ "2d42c7cf1a2dad694db0c518b0e004502859f11c" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri May 22 10:35:25 2026 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:07:29 2026 +0200" }, "message": "KVM: x86: Return the VM\u0027s configured APIC bus frequency when queried\n\nWhen KVM_CAP_X86_APIC_BUS_CYCLES_NS is queried on a specific VM, return the\nVM\u0027s configured APIC bus frequency, not KVM\u0027s default. Aside from the fact\nthat returning the default frequency is blatantly wrong if userspace has\nchanged the frequency, returning the configured frequency means userspace\ncan blindly trust the result, e.g. when filling PV CPUID information that\ncommunicates the APIC bus frequency to the guest.\n\nFixes: 6fef518594bc (\"KVM: x86: Add a capability to configure bus frequency for APIC timer\")\nReported-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nCloses: https://lore.kernel.org/all/ab84153e33fbe7c25667f595c56b310d4d5a93ef.camel@infradead.org\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20260522173526.3539407-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "2d42c7cf1a2dad694db0c518b0e004502859f11c", "tree": "f470008de25117373a234b8e43133c61be891b4e", "parents": [ "06c4f99526784938663a5e82b1ea1b67a4794491" ], "author": { "name": "Hisam Mehboob", "email": "hisamshar@gmail.com", "time": "Thu Apr 09 21:40:22 2026 +0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:05:26 2026 +0200" }, "message": "KVM: selftests: elf: Include \u003cendian.h\u003e instead of \u003cbits/endian.h\u003e\n\n\u003cbits/endian.h\u003e is a glibc-internal header that explicitly states it\nshould never be included directly:\n\n #error \"Never use \u003cbits/endian.h\u003e directly; include \u003cendian.h\u003e instead.\"\n\nReplace it with the correct public header \u003cendian.h\u003e which works on\nall C libraries including musl. Building KVM selftests with musl-gcc\nfails with:\n\n lib/elf.c:10:10: fatal error: bits/endian.h: No such file or directory\n\nFixes: 6089ae0bd5e1 (\"kvm: selftests: add sync_regs_test\")\nSigned-off-by: Hisam Mehboob \u003chisamshar@gmail.com\u003e\nMessage-ID: \u003c20260409164020.1575176-4-hisamshar@gmail.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "06c4f99526784938663a5e82b1ea1b67a4794491", "tree": "d3ed6cdcceb83d01ecdf641585fb814fd0043ab0", "parents": [ "37f32d5ab83968d63cfba6092ecaae3e582db964", "c7832534a8160276cccb9a8cc8cafb5614c579d0" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:04:35 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:04:35 2026 +0200" }, "message": "Merge tag \u0027kvm-riscv-fixes-7.1-1\u0027 of https://github.com/kvm-riscv/linux into HEAD\n\nKVM/riscv fixes for 7.1, take #1\n\n- Fix invalid HVA warning in steal-time recording\n- Return SBI_ERR_FAILURE to guest upon OOM in pmu_event_info()\n and pmu_snapshot_set_shmem()\n- Fix NULL pointer dereference in SBI v0.1 SEND_IPI handler\n- Fix sign extension of value for MMIO loads\n" }, { "commit": "37f32d5ab83968d63cfba6092ecaae3e582db964", "tree": "89302eb3515325d10aa669e592c3d1fe0ca29c95", "parents": [ "e23844b2ddbdd004285f14bdc672b4d854ad4c4e", "9029496abfae3c208336855ae6f3e1f5f881ef76" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:58 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:58 2026 +0200" }, "message": "Merge tag \u0027kvm-s390-master-7.1-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD\n\nKVM: s390: some vSIE and UCONTROL fixes\n\nFix some memory issues and some hangs in vSIE.\n" }, { "commit": "e23844b2ddbdd004285f14bdc672b4d854ad4c4e", "tree": "3456738aee9bc04f692ddcf4ae338bb6ece7229c", "parents": [ "5200f5f493f79f14bbdc349e402a40dfb32f23c8", "1702da76e017ae0fbe1a92b07bc332972c293e89" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:10 2026 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sat May 23 10:03:10 2026 +0200" }, "message": "Merge tag \u0027kvmarm-fixes-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 7.1, take #3\n\n- Fix ITS EventID sanitisation when restoring an interrupt translation\n table.\n\n- Fix PPI memory leak when failing to initialise a vcpu.\n\n- Correctly return an error when the validation of a hypervisor trace\n descriptor fails, and limit this validation to protected mode only.\n" }, { "commit": "79bd2dded182b1d458b18e62684b7f82ffc682e5", "tree": "e11cab84e200dac97bef26a2c880d1fea8caf36d", "parents": [ "de37e502a315677138009d2965f87e2c0721e76f", "0c1a9dce208b4dc265925898e5da98934f7f9266" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:43:33 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Spurious WARN in ops_dequeue() racing with concurrent dispatch\n\n - Self-deadlock between scheduler disable and a concurrent sub-sched\n enable\n\n* tag \u0027sched_ext-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()\n sched_ext: Fix deadlock between scx_root_disable() and concurrent forks\n" }, { "commit": "de37e502a315677138009d2965f87e2c0721e76f", "tree": "0012bea881280a202ccb1a3c6620ed1493a0e202", "parents": [ "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "22572dbcd3486e6c4dced877125bbf50e4e24edf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:28:47 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n \"Two rstat fixes:\n\n - Out-of-bounds access in the css_rstat_updated() BPF kfunc when\n called with an unchecked user-supplied cpu\n\n - Over-strict NMI guard after the recent switch to try_cmpxchg left\n sparc and ppc64 unable to queue rstat updates from NMI\"\n\n* tag \u0027cgroup-for-7.1-rc4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup: rstat: relax NMI guard after switch to try_cmpxchg\n cgroup/rstat: validate cpu before css_rstat_cpu() access\n" }, { "commit": "4a5860ea6098bc6c0a966bb415d5dfe96adb4a86", "tree": "f06a88c6b9511d40464a6cd5ef9f7c2062bed8db", "parents": [ "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "84335a9985867c1a6cd28c693ffbedc4ef1caa39" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:15:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular fixes pull, amdgpu/xe being the usual, with bonus msm content\n to bulk things out, otherwise it has the usual scattered changes, with\n amdxdna dropping a badly thought out userspace api.\n\n gem:\n - clean up LRU locking\n\n msm:\n - Core:\n - Fixed bindings for SM8650, SM8750 and Eliza\n - Don\u0027t use UTS_RELEASE directly\n - Fix typo in clock-names property\n - DPU:\n - Fixed CWB description on Kaanapali\n - Fixed scanline strides for YUV UBWC formats\n - Stopped DSI register dumping to access past the end of region\n - DSI:\n - Fix dumping unaligned regions\n - GPU:\n - Fix GMEM_BASE for a6xx gen3\n - Fix userspace reachable crash on a2xx-a4xx\n - Fix sysprof_active for counter collection with IFPC enabled GPUs\n - Fix shrinker lockdep\n\n amdgpu:\n - Userq fixes\n - VPE fix\n - SMU 15 fix\n - Misc fixes\n - VCE fixes\n - DC bios parsing fixes\n - DC aux fix\n - Mode1 reset fix\n - RAS fixes\n\n amdkfd:\n - Misc fixes\n\n radeon:\n - CS parser fix\n\n xe:\n - SRIOV related fixes\n - Fix leak and double-free\n - Multi-cast register fixes\n - Multi-queue fix\n\n i915:\n - Fix joiner color pipeline selection [display]\n - Fix readback for target_rr in Adaptive Sync SDP [dp]\n - Apply Intel DPCD workaround when SDP on prior line used [psr]\n\n amdxdna:\n - remove mmap and export for ubuf\n\n bridge:\n - chipone-icn6211: managed bridge cleanup\n - lt66121: acquire reset GPIO\n - megachips: fix clean up on failed IRQ requests\n\n v3d:\n - fix UAF in error code paths\n - release GEM-object ref on free\u0027d jobs\n\n virtio:\n - use uninterruptible resv locking in plane updates\n\n mediatek:\n - fix sparse warnings\"\n\n* tag \u0027drm-fixes-2026-05-23\u0027 of https://gitlab.freedesktop.org/drm/kernel: (78 commits)\n drm/xe/oa: Fix exec_queue leak on width check in stream open\n drm/virtio: use uninterruptible resv lock for plane updates\n drm/amdgpu: fix handling in amdgpu_userq_create\n drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check\n drm/amdgpu: userq_va_mapped should remain true once done\n drm/amdgpu: avoid integer overflow in VA range check\n drm/amd/ras: Fix UMC error address allocation leak\n drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset\n drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n drm/amd/display: Validate GPIO pin LUT table size before iterating\n drm/amd/display: Fix integer overflow in bios_get_image()\n drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id\n drm/amdgpu: use atomic operation to achieve lockless serialization\n drm/amdkfd: Check bounds on allocate_doorbell\n drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets\n drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets\n drm/amdgpu/vce1: Stop using amdgpu_vce_resume\n drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n drm/amdgpu/vce1: Don\u0027t repeat GTT MGR node allocation\n drm/amdgpu/vce1: Check if VRAM address is lower than GART.\n ...\n" }, { "commit": "0e6582a51610ee1efb1a3acae96d2960490b6f4b", "tree": "2be0879a817e091f8e6c9cf24e1d0158de4490eb", "parents": [ "59825bc9ce06281224c15c51ec535bf339112d8c", "b71cb088b2e3427924a470fc43e7aedb8a40d2e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 16:08:06 2026 -0700" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Small fixes, two in drivers and the remaining a sign conversion probem\n in sd with no user visible consequences (non-zero is error)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: target: tcm_loop: Fix NULL ptr dereference\n scsi: isci: Fix use-after-free in device removal path\n scsi: sd: Fix return code handling in sd_spinup_disk()\n" }, { "commit": "59825bc9ce06281224c15c51ec535bf339112d8c", "tree": "6098b6c20171c7bff75d2e8d1e543b389e25d681", "parents": [ "cca95436be15d00ddac02d73054b612649485495", "654ddf855bebd8d45a6e707f5dc2344921f5e0cf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 15:45:26 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from\n\n - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to\n handle match overrides gracefully\n\n - asus-armoury:\n - Fix mini-LED mode get/set\n - Add support for FA401EA, FX607VU, G614FR, and GU605CP\n\n - bitland-mifs-wmi:\n - Add CONFIG_LEDS_CLASS dependency\n\n - hp-wmi:\n - Add thermal support for Omen 16-c0xxx (board 8902)\n\n - intel/vsec:\n - Fix enable_cnt imbalance due to PCIe error recovery\n\n - surface/aggregator_registry:\n - Remove battery \u0026 AC nodes on Surface Laptop 7 to avoid duplicated\n devices\n\n - uniwill-laptop:\n - Handle uninitialized and invalid charging threshold values\n - Accept charging threshold of 0 through power supply sysfs ABI and\n clamp it to 1\n - Make \u0027force\u0027 parameter to work also when device descriptor is\n found\n - Do not enable charging limit despite the \u0027force\u0027 parameter to\n avoid permanent damage to battery\n\n* tag \u0027platform-drivers-x86-v7.1-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)\n platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL\n platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL\n platform/x86: system76: Check ACPI_COMPANION() against NULL\n platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL\n platform/x86: intel/rst: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL\n platform/x86: fujitsu: Check ACPI_COMPANION() against NULL\n platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL\n platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL\n platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL\n platform/x86: asus-armoury: add support for GU605CP\n platform/x86: asus-armoury: add support for FA401EA\n platform/x86: asus-armoury: add support for G614FR\n ...\n" }, { "commit": "84335a9985867c1a6cd28c693ffbedc4ef1caa39", "tree": "aef06d4fb220a4eca0c01cbb5087201e640ba8f2", "parents": [ "4378a4116567887066011b8e0cd443241609e467", "4d25342543c01310fc4e0cba7cb17c775e2421e2" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:50:49 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Sat May 23 07:57:08 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- SRIOV related fixes (Wajdeczko, Mohanram)\n- Fix leak and double-free (Lin)\n- Multi-cast register fixes (Gustavo)\n- Multi-queue fix (Niranjana)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com\n" }, { "commit": "cca95436be15d00ddac02d73054b612649485495", "tree": "b99552f9fe51620b5a71e682057e808abc63c1d8", "parents": [ "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "ea17fc4d7dc2ba6459b1a318962960520201baf1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:23:21 2026 -0700" }, "message": "Merge tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy fixes from Vinod Koul:\n\n - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL\n lock failure fix\n\n - Apple typec switch/mux leak fix\n\n - Marvell incoorect register fix for mvebu utmi phy\n\n - Tegra per-pad calibration fix\n\n* tag \u0027phy-fixes-7.1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:\n phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config\n phy: apple: atc: Fix typec switch/mux leak on unbind\n phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()\n phy: eswin: Fix incorrect error check in probe()\n phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix\n phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870\n phy: tegra: xusb: Fix per-pad high-speed termination calibration\n phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access\n phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff\n phy: qcom: edp: Fix AUX_CFG8 programming for DP mode\n phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables\n phy: qcom: edp: Add eDP/DP mode switch support\n phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables\n" }, { "commit": "e216d85eaf4ca525520ca2c0a7d99ee8639a5718", "tree": "b6fbef7d38212c0844bc2be04a2a09cf4d137d2e", "parents": [ "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:19:41 2026 -0700" }, "message": "Merge tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"Another batch of driver fixes from Johan fixing error handling paths,\n plus another from Felix. We also have a new device ID added in the DT\n bindings for SpacemiT K3\"\n\n* tag \u0027spi-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: dt-bindings: fsl-qspi: support SpacemiT K3\n spi: ti-qspi: fix use-after-free after DMA setup failure\n spi: sprd: fix error pointer deref after DMA setup failure\n spi: qup: fix error pointer deref after DMA setup failure\n spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()\n spi: ep93xx: fix error pointer deref after DMA setup failure\n" }, { "commit": "ddae1043d8c46a193b8d5d93ca59f320f03902fe", "tree": "b35aec61f5ad38649275a6967f64fd29323bff2f", "parents": [ "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "f9b2d3b703d13df50c630997dfdc25648e96db0d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 13:17:29 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of fixes here, one very minor Kconfig fix and a fix for a\n nasty issue with error reporting in the tps65219 driver\"\n\n* tag \u0027regulator-fix-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: tps65219: fix irq_data.rdev not being assigned\n regulator: Kconfig: fix a typo in help\n" }, { "commit": "003759d49a407c712f0bbe77cf5cf5b57f03d9e0", "tree": "ef266fd1c05fe6752830fac5a3d0c67ea480972e", "parents": [ "99e08debac1a381d57bd50a26e377e27674d91b7", "3812a9e84265a5cdd90d29fe8d97a023e91fb945" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:33:28 2026 -0700" }, "message": "Merge tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl\n\nPull pin control fixes from Linus Walleij:\n\n - Implement the GPIO .get_direction() callback in the Mediatek driver\n to rid dmesg warnings\n\n - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin\n function, so there is no conflict with orthogonal muxing\n\n - Fix incorrect settings of the \"PUPD\" (pull-up-pull-down) register\n during suspend/resume in the Renesas RZG2L\n\n - Fix the SMT register cache to be per-bank in the Renesas RZG2L\n\n - Fix the QDSS track clock and control pin group names in the Qualcomm\n Eliza driver\n\n - Fix a deadlock in the Amlogic driver, caused by playing around in\n sysfs\n\n - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a\n similar fix for the Qualcomm SM8150\n\n - Allow parsing DTs without explicit function nodes in the Freescale\n i.MX1 driver\n\n - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk\n\n* tag \u0027pinctrl-v7.1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:\n pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11\n pinctrl: imx1: Allow parsing DT without function nodes\n pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150\n pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615\n pinctrl: meson: amlogic-a4: fix deadlock issue\n pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names\n pinctrl: renesas: rzg2l: Fix SMT register cache handling\n pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume\n pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function\n pinctrl: mediatek: moore: implement gpio_chip::get_direction()\n" }, { "commit": "99e08debac1a381d57bd50a26e377e27674d91b7", "tree": "8c8e5bb8a6fdb4693d7bc7881ad1f6f3dd62351c", "parents": [ "c22407252a2421286998323831095e6b8a1d9532", "a4fa45c1d980bc2b9837f469119af24a9304a1fc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:28:47 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - propagate the error code from regulator_enable() in resume path in\n gpio-pca953x\n\n - take the device lock when calling device_is_bound() in virtual GPIO\n drivers\n\n - fix software node leak in remove path in gpio-aggregator\n\n - fix a potential use-after-free in gpio-aggregator\n\n - harden the GPIO character device uAPI: check that line config\n attributes are correctly zeroed\n\n* tag \u0027gpio-fixes-for-v7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: virtuser: lock device when calling device_is_bound()\n gpio: aggregator: lock device when calling device_is_bound()\n gpio: sim: lock device when calling device_is_bound()\n gpio: aggregator: remove the software node when deactivating the aggregator\n gpio: aggregator: fix a potential use-after-free\n gpio: cdev: check if uAPI v2 config attributes are correctly zeroed\n gpio: pca953x: propagate regulator_enable() error from resume\n" }, { "commit": "c22407252a2421286998323831095e6b8a1d9532", "tree": "1874b784b3391147fe004219ce3acee58924741a", "parents": [ "3997e3bb1d30a426c0599918ebaac51698fcc959", "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:22:22 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"As expected, we still continue receiving lots of small fixes.\n\n One major change is about HD-audio pending IRQ handling, but this\n would influence only on odd machines or slow VMs. There are a few\n other fixes for the core part, but most of them are not-too-serious\n UAF fixes, while the rest are mostly device-specific fixes and quirks.\n\n ALSA Core:\n - Fix for PCM silencing with bogus iov_iter\n - Fixes for past-the-end iterators in timer and seq\n - Serialization of UMP output teardown\n - Rate-limit ELD parsing errors\n\n HD-audio:\n - Fixes for IRQ work handling and SSID matching\n - Various Realtek quirks for HP and ASUS laptops, including LED fixes\n\n ASoC:\n - Intel: ACPI match table updates for PTL, NVL, and ARL platforms\n - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs\n - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm\n - DT-binding fix for MediaTek\n\n Others:\n - USB ua101: Reject too-short USB descriptors\n - Scarlett2: Fix for flash writes\n - ASIHPI: Fix for potential OOB access\n - AMD SPI: Fix for bus number in ACPI probe\n\n MAINTAINERS:\n - Updates for SOF and TI maintainers\"\n\n* tag \u0027sound-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits)\n ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional\n ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.\n ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform\n ASoC: cs-amp-lib: Fix typo in error message: write -\u003e read\n ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()\n ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data()\n ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()\n MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer\n ALSA: seq: Serialize UMP output teardown with event_input\n ALSA: scarlett2: Allow flash writes ending at segment boundary\n ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6\n ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream\n ALSA: hda: Move irq pending work into hda-intel stream\n ASoC: soc-utils: Add missing va_end in snd_soc_ret()\n ALSA: ua101: Reject too-short USB descriptors\n ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X\n ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()\n ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register()\n ...\n" }, { "commit": "3997e3bb1d30a426c0599918ebaac51698fcc959", "tree": "3fa748f59fd1af865c612a24367d5ba957887585", "parents": [ "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "f6982769910ecddabdb5b8b9afdab0bb8b6668ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 12:06:23 2026 -0700" }, "message": "Merge tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n - Fix memory leak for peer-to-peer addresses\n - Fix dma map leaks on resource errors\n\n - Another bio integrity fix, fixing a recent regression\n\n - Fix for an issue with the request pre-allocation and caching when IO\n is queued, where if a bio split occurred and ended up blocking, the\n list could be corrupted\n\n* tag \u0027block-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: avoid use-after-free in disk_free_zone_resources()\n blk-mq: pop cached request if it is usable\n nvme-pci: fix dma mapping leak on data setup error\n nvme-pci: fix dma_vecs leak on p2p memory\n bio-integrity-fs: pass data iter to bio_integrity_verify()\n" }, { "commit": "dbae42cfa618abc57f0bc3c28cc140292f4f7410", "tree": "5280f6293c32b1f21d8d4cad148828f7b2a615ab", "parents": [ "558c3eca715ea0110fe6fce38b063a6f9936188c", "e97ff8b62d4690c69297f0f6de874f0564cc01a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 11:53:28 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Fix for an issue with IORING_OP_NOP and using injection results\n\n - Fix for an issue in IORING_OP_WAITID, where the info state was\n assumed cleared by the lower level syscall handler, but for some\n cases it is not. Just clear the data upfront, so that non-initialized\n data isn\u0027t copied back to userspace\n\n - Fix for a lockdep reported issue, where IORING_OP_BIND enters file\n create and hence hits mnt_want_write(), which creates a three part\n lockdep cycle between the super lock, io_uring\u0027s uring_lock, and the\n cred mutex\n\n - Fix a regression introduced in this cycle with how linked timeouts\n are deleted\n\n - Ensure that the -\u003eopcode nospec indexing on the opcode issue side\n covers all the cases\n\n* tag \u0027io_uring-7.1-20260522\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/nop: pass all errors to userspace\n io_uring/timeout: splice timed out link in timeout handler\n io_uring: propagate array_index_nospec opcode into req-\u003eopcode\n io_uring/waitid: clear waitid info before copying it to userspace\n io_uring/net: punt IORING_OP_BIND async if it needs file create\n" }, { "commit": "558c3eca715ea0110fe6fce38b063a6f9936188c", "tree": "c3ef3073c7b18bd51fe30cd95833d4fd3a63a66e", "parents": [ "632360e8f5fce2eee720e952fd84e8cefb5749b6", "dcd4313f0987d69c4134c12bbe3a8cdf795f6c1e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:52:26 2026 -0700" }, "message": "Merge tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - Fix missing lock\n - Fix dentry in use after unmounting\n - cifs.upcall security fix\n - require CAP_NET_ADMIN for swn netlink\n - change allocation in DUP_CTX_STR to GFP_KERNEL\n - minor smbdirect debug fix\n - handle_read_data() folio fix\n\n* tag \u0027v7.1-rc5-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n smb: client: change allocation requirements in DUP_CTX_STR macro\n smb: client: require net admin for CIFS SWN netlink\n smb: smbdirect: divide, not multiply, milliseconds by 1000\n cifs: Fix busy dentry used after unmounting\n smb: client: use data_len for SMB2 READ encrypted folioq copy\n smb: client: reject userspace cifs.spnego descriptions\n smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n" }, { "commit": "632360e8f5fce2eee720e952fd84e8cefb5749b6", "tree": "e97c99601ce85d5e65e2bb2d8ce8733a87b10ba1", "parents": [ "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "3a8389d42bdf4213730f4067f8bfa78bae6564ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 10:44:18 2026 -0700" }, "message": "Merge tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs\n\nPull zonefs fix from Damien Le Moal:\n\n - Avoid potential overflow when converting a zonefs file number string\n to an inode number (from Johannes)\n\n* tag \u0027zonefs-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:\n zonefs: handle integer overflow in zonefs_fname_to_fno\n" }, { "commit": "45255ea1ca096b11b1303c9b54502a28f3a31dd1", "tree": "7f1c03f6a6e9a4f477eda27186717fde6b7c8a1b", "parents": [ "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "a67f3113331d9fb3eb0664602d9b581cb2df7294" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:13:13 2026 -0700" }, "message": "Merge tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix maximum frequency computation in the intel_pstate driver for\n two processor models, update its documentation and fix issues related\n to the dynamic EPP support (added during the current development\n cycle) in the amd-pstate driver:\n\n - Fix maximum frequency computation in the intel_pstate driver for\n Raptor Lake-E and Bartlett Lake that are SMP platforms derived from\n hybrid ones (Rafael Wysocki, Henry Tseng)\n\n - Fix the description of asymmetric packing with SMT in the\n intel_pstate driver documentation (Ricardo Neri)\n\n - Fix multiple amd-pstate driver issues related to dynamic EPP\n support added recently, including making it opt-in only (K Prateek\n Nayak, Mario Limonciello)\"\n\n* tag \u0027pm-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n cpufreq/amd-pstate: Drop Kconfig option for dynamic EPP\n cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake\n cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E\n Documentation: intel_pstate: Fix description of asymmetric packing with SMT\n cpufreq/amd-pstate-ut: Drop policy reference before driver switch\n cpufreq/amd-pstate: Use \"epp_default_dc\" as default when dynamic_epp is disabled\n cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset\n cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn\u0027t modified\n cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name\n cpufreq/amd-pstate: Grab \"amd_pstate_driver_lock\" when toggling dynamic_epp\n" }, { "commit": "28222dcdad2181e3b153b2300ac4cb9cb3304fd7", "tree": "901e80297d94498b21b988894d13e027aab0cfb4", "parents": [ "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "c35cb4fc7231702d1e9952aec1a442f3e27df6f5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 07:06:21 2026 -0700" }, "message": "Merge tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"Unbreak system wakeup on critical battery status in the ACPI battery\n driver inadvertently broken during the 7.0 development cycle\"\n\n* tag \u0027acpi-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: battery: Fix system wakeup on critical battery status\n" }, { "commit": "f6982769910ecddabdb5b8b9afdab0bb8b6668ac", "tree": "da723edd043ab3d628732506f724b795a4931e75", "parents": [ "dc278e9bf2b9513a763353e6b9cc21e0f532954e" ], "author": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Fri May 22 20:56:22 2026 +0900" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri May 22 08:01:52 2026 -0600" }, "message": "block: avoid use-after-free in disk_free_zone_resources()\n\nThe function disk_update_zone_resources() may call\ndisk_free_zone_resources() in case of error, and following this,\nblk_revalidate_disk_zones() will again calls disk_free_zone_resources() if\ndisk_update_zone_resources() failed. If a zone worker thread is being used\n(which is the default for a rotational media zoned device),\ndisk_free_zone_resources() will try to stop the zone worker thread twice\nbecause disk-\u003ezone_wplugs_worker is not reset to NULL when the worker\nthread is stopped the first time.\n\nIn disk_free_zone_resources(), fix this by correctly clearing\ndisk-\u003ezone_wplugs_worker to NULL when the worker thread is stopped.\n\nAnd while at it, since disk_free_zone_resources() is always called after a\nfailed call to disk_update_zone_resources(), remove the unnecessary call\nto disk_free_zone_resources() in disk_update_zone_resources().\n\nFixes: 1365b6904fd0 (\"block: allow submitting all zone writes from a single context\")\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/20260522115622.588535-1-dlemoal@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "ef7f594f5d291a98a4da2cc95e7713d3971bedaa", "tree": "7d2acd2bfc3a23d50420e60426a630d44f3daad1", "parents": [ "cbadb98b7cb017b6b7376940781cb108f7baac71", "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:53:11 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas:\n\n - Handle probe on hinted conditional branch instructions.\n\n BC.cond instructions can be simulated in the same way as B.cond\n instructions, so extend the decode mask for B.cond to cover BC.cond\n\n - Flush the walk cache when unsharing PMD tables. Recent changes to\n huge_pmd_unshare() introduced mmu_gather::unshared_tables but the\n arm64 code was still treating the TLB flushing as only targeting leaf\n entries (TLBI VALE1IS).\n\n Fix it by using non-leaf-only instructions (TLBI VAE1IS) when\n tlb-\u003eunshared_tables is set\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: tlb: Flush walk cache when unsharing PMD tables\n arm64: probes: Handle probes on hinted conditional branch instructions\n" }, { "commit": "cbadb98b7cb017b6b7376940781cb108f7baac71", "tree": "f2e31ea57834aa968cca61f2b657aa92a0ea097c", "parents": [ "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "540f4a4f6ef806a28e794001bb4beac4840a6090" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:40:31 2026 -0700" }, "message": "Merge tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Alexander Gordeev:\n\n - Fix PAI NNPA mismatch between counting and recording, where sampling\n reports twice the value\n\n - Fix loss of PAI counter increments during recording on systems with\n many CPUs under heavy load, while counting is not affected\n\n - On some supported machines, CHSC cannot access memory outside the DMA\n zone, causing CHSC command failures. Restore GFP_DMA flag when\n allocating memory for CHSC control blocks\n\n - Align the numbering scheme for higher-level topology structures like\n socket, book, drawer with other hardware identifiers e.g. in sysfs,\n procfs and tools like lscpu\n\n* tag \u0027s390-7.1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/topology: Use zero-based numbering for containing entities\n s390/cio: Restore GFP_DMA for CHSC allocation\n s390/pai: Fix missing PAI counter increments under heavy load\n s390/pai: Disable duplicate read of kernel PAI counter value\n" }, { "commit": "46de4087d38ece8477ab4b6b7630c13c82c27f1a", "tree": "39b3f3f45fb91213139aba5232909214792905aa", "parents": [ "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "67ea9d353d0ba12bdbc9183ff568dead9e949b80" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:23:56 2026 -0700" }, "message": "Merge tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - Stable fix for a missing cpus_read_lock in one of the cpu sheaves\n flushing paths (Qing Wang)\n\n* tag \u0027slab-for-7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()\n" }, { "commit": "1c04dcd891c011839f57d0501e9bc473cc0aae7d", "tree": "e18468dd6caf762b046a7d1310fa9b704ce85c9d", "parents": [ "23884007afe901352349e709e33eb19373a842d7", "af0c3f05866237f7592219bfe05387bc3bfc99b5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:16:00 2026 -0700" }, "message": "Merge tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux\n\nPull dma-mapping fixes from Marek Szyprowski:\n \"Two minor updates for the DMA-mapping code, mainly fixing some rare\n corner cases (Petr Tesarik, Jianpeng Chang)\"\n\n* tag \u0027dma-mapping-7.1-2026-05-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:\n dma-mapping: move dma_map_resource() sanity check into debug code\n dma-direct: fix use of max_pfn\n" }, { "commit": "23884007afe901352349e709e33eb19373a842d7", "tree": "e698633fffae9e8d69b3f459bc0d07e1896e4d06", "parents": [ "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 22 06:09:58 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Avoid NULL return from hist_field_name()\n\n The function hist_field_name() is directly passed to a strcat() which\n does not handle \"NULL\" characters. Return a zero length string when\n size is greater than the limit.\n\n This is used only to output already created histograms and no field\n currently is greater than the limit. But it should still not return\n NULL.\n\n - Do not call map-\u003eops-\u003eelt_free() on allocation failure\n\n When elt_alloc() fails, it should not call the map-\u003eops-\u003eelt_free()\n function if it exists, as that function may not be able to handle the\n free on allocation failures. The -\u003eelt_free() should only be called\n when elt_alloc() succeeds.\n\n* tag \u0027trace-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails\n tracing: Avoid NULL return from hist_field_name() on truncation\n" }, { "commit": "654ddf855bebd8d45a6e707f5dc2344921f5e0cf", "tree": "f80a3430c0823873130732f8200e6cde7ca5a4b9", "parents": [ "53a8f95cbb407608ef77a864ad4a59f25ddd906c" ], "author": { "name": "Arnd Bergmann", "email": "arnd@arndb.de", "time": "Tue May 19 22:28:01 2026 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Fri May 22 15:48:41 2026 +0300" }, "message": "platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency\n\nThe newly added driver requires the LED classdev support\nand causes a link failure when that is disabled:\n\nx86_64-linux-ld: vmlinux.o: in function `bitland_mifs_wmi_probe\u0027:\nbitland-mifs-wmi.c:(.text+0xede02a): undefined reference to `devm_led_classdev_register_ext\u0027\n\nFixes: dc1ec4fa86b2 (\"platform/x86: bitland-mifs-wmi: Add new Bitland MIFS WMI driver\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://patch.msgid.link/20260519202804.1339581-1-arnd@kernel.org\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "215c90ee656114f5e8c32408228d97082f8e0eef", "tree": "ed95e062785ed5a085f9df266badf9b877dc6f7c", "parents": [ "237557b8a81ab948e8332f7c0058e758f081c0a3" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed May 06 13:57:00 2026 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 22 12:24:08 2026 +0200" }, "message": "device property: set fwnode-\u003esecondary to NULL in fwnode_init()\n\nIf a firmware node is allocated on the stack (for instance: temporary\nsoftware node whose life-time we control) or on the heap - but using a\nnon-zeroing allocation function - and initialized using fwnode_init(),\nits secondary pointer will contain uninitalized memory which likely will\nbe neither NULL nor IS_ERR() and so may end up being dereferenced (for\nexample: in dev_to_swnode()). Set fwnode-\u003esecondary to NULL on\ninitialization.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: 01bb86b380a3 (\"driver core: Add fwnode_init()\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Rafael J. Wysocki (Intel) \u003crafael@kernel.org\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nReviewed-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nLink: https://patch.msgid.link/20260506115701.23035-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "tree": "3d3aa4f6a2ceb7f9fcfbdb54101ed579b6b7243f", "parents": [ "2ccd8ff980b50e842481bae71102fa3883fc4377" ], "author": { "name": "Zeng Heng", "email": "zengheng4@huawei.com", "time": "Thu May 21 15:30:11 2026 +0800" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri May 22 11:13:51 2026 +0100" }, "message": "arm64: tlb: Flush walk cache when unsharing PMD tables\n\nWhen huge_pmd_unshare() is called to unshare a PMD table, the\ntlb_unshare_pmd_ptdesc() function sets tlb-\u003eunshared_tables\u003dtrue\nbut the aarch64 tlb_flush() only checked tlb-\u003efreed_tables to\ndetermine whether to use TLBF_NONE (vae1is, invalidates walk\ncache) or TLBF_NOWALKCACHE (vale1is, leaf-only).\n\nThis caused the stale PMD page table entry to remain in the walk cache\nafter unshare, potentially leading to incorrect page table walks.\n\nFix by including unshared_tables in the check, so that when\nunsharing tables, TLBF_NONE is used and the walk cache is properly\ninvalidated.\n\nHere is the detailed distinction between vae1is and vale1is:\n\n| Instruction Combination | Actual Invalidation Scope |\n| ------------------------ | --------------------------------------------------|\n| `VAE1IS` + TTL\u003d`0` | All entries at all levels (full invalidation) |\n| `VAE1IS` + TTL\u003d`2` (L2) | Non-leaf at Level 0/1 + leaf at Level 2 |\n| `VALE1IS` + TTL\u003d`0` | Leaf entries at all levels (non-leaf not cleared) |\n| `VALE1IS` + TTL\u003d`2` (L2) | Leaf entry at Level 2 only |\n\nSigned-off-by: Zeng Heng \u003czengheng4@huawei.com\u003e\nFixes: 8ce720d5bd91 (\"mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "9029496abfae3c208336855ae6f3e1f5f881ef76", "tree": "024d26f661f5a35801e01a0aac191607964cb43f", "parents": [ "a488e753de5853bec2e2e4d0c5a73f25d464bd2e" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:14 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:11 2026 +0200" }, "message": "KVM: s390: Properly reset zero bit in PGSTE\n\nIn case of memory pressure, it\u0027s possible that a guest page gets freed\nand then almost immediately reused by the guest. If CMMA is enabled,\n_essa_clear_cbrl() will discard all pages that are either unused or\nzero. If a discarded page is reused before _essa_clear_cbrl() is called,\nand the pgste.zero bit is not cleared, the page will be discarded\ndespite not being unused.\n\nWhen calling _gmap_ptep_xchg(), always clear the pgste.zero bit. This\nprevents the page from being accidentally discarded when not unused.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Steffen Eiden \u003cseiden@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "a488e753de5853bec2e2e4d0c5a73f25d464bd2e", "tree": "82a0dcaab52f34e4d9b8cfcc22e91d6577a33264", "parents": [ "2d505c290667eba67352c5db303ec92b7de860ad" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:13 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:11 2026 +0200" }, "message": "KVM: s390: vsie: Fix redundant rmap entries\n\nThe address passed to the gmap rmap was not being masked. As a\nconsequence several different (but functionally equivalent) rmap\nentries were being created for each shadowed table.\n\nFix this by properly masking the address depending on the table level.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "2d505c290667eba67352c5db303ec92b7de860ad", "tree": "dac1ad5d429e552dbd9642fedc01740cd51edba7", "parents": [ "4df4b7cdf54620aa848e7d83d253bb944313f7bd" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:12 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: vsie: Fix unshadowing logic\n\nIn some cases (i.e. under extreme memory pressure on the host),\nattempting to shadow memory will result in the same memory being\nunshadowed, causing a loop.\n\nAdd a PGSTE bit to distinguish between shadowed memory and shadowed DAT\ntables, fix the unshadowing logic in _gmap_ptep_xchg() to prevent\nunnecessary unshadowing and perform better checks.\n\nAlso fix the unshadowing logic in _gmap_crstep_xchg_atomic() which did\nnot unshadow properly when the large page would become unprotected.\n\nOpportunistically add a check in gmap_protect_rmap() to make sure it\nwon\u0027t be called with level \u003d\u003d TABLE_TYPE_PAGE_TABLE.\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "4df4b7cdf54620aa848e7d83d253bb944313f7bd", "tree": "a379ce32e63419b0ce5c3880b45f7fa36313feee", "parents": [ "d0f2eb4493d1c3c8fecb5eadb5c1382074873ef9" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:11 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: Fix leaking kvm_s390_mmu_cache in case of errors\n\nFix a memory leak that can happen if gmap_ucas_map_one() or\nkvm_s390_mmu_cache_topup() return error values.\n\nAlso fix a similar issue in gmap_set_limit().\n\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nReported-by: Jiaxin Fan \u003cjiaxin.fan@ibm.com\u003e\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "d0f2eb4493d1c3c8fecb5eadb5c1382074873ef9", "tree": "3582b08b264de7d287c704dec2625f47c74edf23", "parents": [ "6779b50faa562e6cca1aa6a4649a4d764c6c7e28" ], "author": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Tue May 19 17:01:10 2026 +0200" }, "committer": { "name": "Claudio Imbrenda", "email": "imbrenda@linux.ibm.com", "time": "Fri May 22 11:25:10 2026 +0200" }, "message": "KVM: s390: vsie: Fix memory leak when unshadowing\n\nWhen performing a partial unshadowing, the rmap was being leaked.\n\nAdd the missing kfree().\n\nFixes: a2c17f9270cc (\"KVM: s390: New gmap code\")\nSigned-off-by: Claudio Imbrenda \u003cimbrenda@linux.ibm.com\u003e\nReviewed-by: Christoph Schlameuss \u003cschlameuss@linux.ibm.com\u003e\nReviewed-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\nSigned-off-by: Christian Borntraeger \u003cborntraeger@linux.ibm.com\u003e\n" }, { "commit": "4a09f4a23a3003d31f8545dd0770f2b3b0f54d8b", "tree": "d8af4f1f69384bae692b0dc56158140d27ceaf14", "parents": [ "1c856e158fd34ef2c4475a81c1dc386329989938" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:12 2026 +0800" }, "message": "LoongArch: KVM: Move some variable declarations to paravirt.h\n\nSome variables relative with paravirt feature are declared in the header\nfile asm/qspinlock.h, however this file can be included only when option\nCONFIG_SMP is on. There is compiling warnings if CONFIG_SMP is off since\nvariables are not declared.\n\nMove these variable declarations to header file asm/paravirt.h to avoid\ncompiling warnings.\n\nFixes: c43dce6f13fb (\"LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605061313.O8Hswm2b-lkp@intel.com/\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "1c856e158fd34ef2c4475a81c1dc386329989938", "tree": "13cde94f56edfcfed3b279d0d7b1e7d11486b0c0", "parents": [ "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Fix handling of fatal unrecoverable recursions\n\nKPROBE_HIT_SS and KPROBE_REENTER are two types of fatal recursions that\ncan not be safely recovered in kprobes.\n\nKPROBE_HIT_SS means that a kprobe is hit during single-stepping. At\nthis point, the architecture-specific single-step context is already\nactive. Nested single-stepping would corrupt the state, as the kprobe\ncontrol block (kcb) and hardware registers cannot safely store multiple\nlevels of stepping state.\n\nKPROBE_REENTER means that a third-level recursion occurs when a probe\nis hit while the system is already handling a nested probe (second-\nlevel). The kcb only provides a single slot (prev_kprobe) to backup the\nstate. When a third probe is hit, there is no more space to save the\nstate without corrupting the first-level backup.\n\nKprobes work by replacing instructions with breakpoints. In order to\nexecute the original instruction and continue, it must be moved to a\ntemporary \"single-step\" slot. Since there is no backup space left to\nset up this slot safely, the CPU would be forced to return to the same\noriginal breakpoint address, triggering an endless loop.\n\nCurrently, the code only prints a warning and returns. This leads to\nan infinite re-entry loop as the CPU repeatedly hits the same trap and\na \"stuck\" CPU core because preemption was disabled at the start of the\nhandler and never re-enabled in this early return path.\n\nFix the logic by:\n1. Merging KPROBE_HIT_SS and KPROBE_REENTER cases, as both represent\n fatal recursions that cannot be safely recovered.\n2. Replacing WARN_ON_ONCE() with BUG() to terminate the system. This\n aligns LoongArch with other architectures (x86, arm64, riscv) and\n prevents stack overflow while providing diagnostic information.\n\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "e3ef9a28f558d1cbf0b42d6dcd16c60da557562b", "tree": "07d56e7418b69f9a6ef254f23d267fa6f58feb16", "parents": [ "0ccc9d47cf020994097ff51827cebd04aa2b0bf4" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Fri May 22 15:05:07 2026 +0800" }, "message": "LoongArch: kprobes: Use larch_insn_text_copy() to patch instructions\n\nOn SMP systems, kprobe handlers would occasionally fail to execute on\ncertain CPU cores. The issue is hard to reproduce and typically occurs\nrandomly under high system load.\n\nThe root cause is a software-side instruction hazard. According to the\nLoongArch Reference Manual, while the cache coherency is maintained by\nhardware, software must explicitly use the \"IBAR\" instruction to ensure\nthe instruction fetch unit (IFU) observes the effects of recent stores.\n\nThe current arch_arm_kprobe() and arch_disarm_kprobe() only execute the\n\"IBAR\" barrier (via flush_insn_slot -\u003e local_flush_icache_range) on the\nlocal CPU. This leaves a vulnerable window where remote CPU cores may\ncontinue executing stale instructions from their pipelines or prefetch\nbuffers, as they have not executed an \"IBAR\" since the code modification.\n\nSwitch to larch_insn_text_copy() to fix this:\n1. Synchronization: It uses stop_machine_cpuslocked() to synchronize all\n online CPUs, ensuring no CPU is executing the target code area during\n modification.\n2. Visibility: By passing cpu_online_mask to stop_machine_cpuslocked(),\n the callback text_copy_cb() is executed on all online cores. Each CPU\n core invokes local_flush_icache_range() to execute \"IBAR\", clearing\n instruction hazards system-wide and ensuring the \"break\" instruction\n is visible to the fetch units of all cores.\n3. Robustness: It properly manages memory write permissions (ROX/RW) for\n the kernel text segment during patching, ensuring compatibility with\n CONFIG_STRICT_KERNEL_RWX.\n\nCc: \u003cstable@vger.kernel.org\u003e # 6.18+\nFixes: 6d4cc40fb5f5 (\"LoongArch: Add kprobes support\")\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "2519003dd5fb6f89f10f031e3a97ecb7c9d1b816", "tree": "5c0bfe48f868799e25f70faddc3718e0ef531726", "parents": [ "60a1969fae6209644698fca91c185d153674f631", "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Fri May 22 08:25:18 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc4\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nA bigger batch of fixes than usual due to -next not happeing last week,\nthis is mostly stuff for laptops - a lot of quirks and small fixes,\nmainly for x86 and SoundWire. Nothing too big or exciting individually,\njust two week\u0027s worth.\n" }, { "commit": "54cf41c969da6637cce790b7400da1451609db9b", "tree": "0663638f6db860aeded883cde89feb527d65a771", "parents": [ "04aa71da5f35aacdc9ae9cb5150947daa624f641" ], "author": { "name": "Byungchul Park", "email": "byungchul@sk.com", "time": "Fri May 15 12:47:01 2026 +0900" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:13 2026 -0700" }, "message": "Revert \"mm: introduce a new page type for page pool in page type\"\n\nThis reverts commit db359fccf212 (\"mm: introduce a new page type for page\npool in page type\") and a part of 735a309b4bfb9e (\"net: add net_iov_init()\nand use it to initialize -\u003epage_type\").\n\nNetpp page_type\u0027ed pages might be used in mapping so as to use @_mapcount.\nHowever, since @page_type and @_mapcount are union\u0027ed in struct page,\nthese two can\u0027t be used at the same time. Revert the commit introducing\npage_type for Netpp for now.\n\nThe patch will be retried once @page_type and @_mapcount get allowed to be\nused at the same time.\n\nThe revert also includes removal of @page_type initialization part\nintroduced by commit 735a309b4bfb9e (\"net: add net_iov_init() and use it\nto initialize -\u003epage_type\"), which will be restored on the retry.\n\nLink: https://lore.kernel.org/20260515034701.17027-1-byungchul@sk.com\nFixes: db359fccf212 (\"mm: introduce a new page type for page pool in page type\")\nSigned-off-by: Byungchul Park \u003cbyungchul@sk.com\u003e\nReported-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nCloses: https://lore.kernel.org/all/982b9bc1-0a0a-4fc5-8e3a-3672db2b29a1@nvidia.com\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nAcked-by: Harry Yoo (Oracle) \u003charry@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: Brendan Jackman \u003cjackmanb@google.com\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Ilias Apalodimas \u003cilias.apalodimas@linaro.org\u003e\nCc: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: John Fastabend \u003cjohn.fastabend@gmail.com\u003e\nCc: Leon Romanovsky \u003cleon@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Mark Bloch \u003cmbloch@nvidia.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Paolo Abeni \u003cpabeni@redhat.com\u003e\nCc: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nCc: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\nCc: Simon Horman \u003chorms@kernel.org\u003e\nCc: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nCc: Toke Hoiland-Jorgensen \u003ctoke@redhat.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "04aa71da5f35aacdc9ae9cb5150947daa624f641", "tree": "c90f50c45a98dc9531a596608dd2ee5b135a138d", "parents": [ "f0af98ff6b3077278974a460becbd05bbc710e60" ], "author": { "name": "Uladzislau Rezki (Sony)", "email": "urezki@gmail.com", "time": "Fri May 15 17:30:09 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:13 2026 -0700" }, "message": "mm/vmalloc: do not trigger BUG() on BH disabled context\n\n__get_vm_area_node() currently triggers a BUG() if in_interrupt() returns\ntrue. However, in_interrupt() also reports true when BH are disabled.\n\nThe bridge code can call rhashtable_lookup_insert_fast() with bottom\nhalves disabled:\n\n__vlan_add()\n -\u003e br_fdb_add_local()\n spin_lock_bh(\u0026br-\u003ehash_lock); \u003c-- Disable BH\n -\u003e fdb_add_local()\n -\u003e fdb_create()\n -\u003e rhashtable_lookup_insert_fast()\n -\u003e kvmalloc()\n -\u003e vmalloc()\n -\u003e __get_vm_area_node()\n -\u003e BUG_ON(in_interrupt())\n spin_unlock_bh(\u0026br-\u003ehash_lock)\n\nthis triggers the BUG() despite the caller not being in NMI or\nhard IRQ context.\n\nReplace the in_interrupt() check with in_nmi() || in_hardirq().\n\nLink: https://lore.kernel.org/20260515153009.2296191-1-urezki@gmail.com\nFixes: c6307674ed82 (\"mm: kvmalloc: add non-blocking support for vmalloc\")\nSigned-off-by: Uladzislau Rezki (Sony) \u003curezki@gmail.com\u003e\nCc: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReported-by: syzbot+8b12fc6e0fb139765b58@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/69ff8c7c.050a0220.1036b8.000b.GAE@google.com/\nReviewed-by: Baoquan He \u003cbaoquan.he@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "f0af98ff6b3077278974a460becbd05bbc710e60", "tree": "66449a383f26cfe8b3d4608c814160eb107049bc", "parents": [ "2c6f81d58741349298f51ff697d988cb42881453" ], "author": { "name": "Eugen Hristev", "email": "ehristev@kernel.org", "time": "Sat Apr 25 16:06:48 2026 +0300" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:13 2026 -0700" }, "message": "MAINTAINERS, mailmap: change email for Eugen Hristev\n\nReplace old bouncing emails with ehristev@kernel.org\n\nLink: https://lore.kernel.org/20260425-eh-mailmap-v1-1-58788d401eef@kernel.org\nSigned-off-by: Eugen Hristev \u003cehristev@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "2c6f81d58741349298f51ff697d988cb42881453", "tree": "5bacf14ead5dbf2b892c755800dae1f69fe9fe60", "parents": [ "09e7827e785729f391c8d46dc71becce70d296ab" ], "author": { "name": "Sunny Patel", "email": "nueralspacetech@gmail.com", "time": "Fri May 01 17:21:16 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:13 2026 -0700" }, "message": "mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page\n\nWhen migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due\nto a PMD check failure, the pgtable allocated earlier via\npte_alloc_one() is never freed, causing a memory leak.\n\nAdded free_abort label to release the pgtable in error path.\n\nLink: https://lore.kernel.org/20260501115122.23288-1-nueralspacetech@gmail.com\nFixes: a30b48bf1b24 (\"mm/migrate_device: implement THP migration of zone device pages\")\nSigned-off-by: Sunny Patel \u003cnueralspacetech@gmail.com\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Huang Ying \u003cying.huang@linux.alibaba.com\u003e\nCc: Alistair Popple \u003capopple@nvidia.com\u003e\nCc: Balbir Singh \u003cbalbirs@nvidia.com\u003e\nCc: Byungchul Park \u003cbyungchul@sk.com\u003e\nCc: Gregory Price \u003cgourry@gourry.net\u003e\nCc: Joshua Hahn \u003cjoshua.hahnjy@gmail.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Rakie Kim \u003crakie.kim@sk.com\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "09e7827e785729f391c8d46dc71becce70d296ab", "tree": "da77710b4d990f90a2adee69b068b18e5907ccfb", "parents": [ "e16f17a9c5af50221184d1ef4be4056bf3c4209e" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Mon Mar 16 20:49:56 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:12 2026 -0700" }, "message": "kernel/fork: validate exit_signal in kernel_clone()\n\nWhen a child process exits, it sends exit_signal to its parent via\ndo_notify_parent(). The clone() syscall constructs exit_signal as:\n\n(lower_32_bits(clone_flags) \u0026 CSIGNAL)\n\nCSIGNAL is 0xff, so values in the range 65-255 are possible. However,\nvalid_signal() only accepts signals up to _NSIG (64 on x86_64). A\nnon-zero non-valid exit_signal acts the same as exit_signal \u003d\u003d 0: the\nparent process is not signaled when the child terminates.\n\nThe syzkaller reproducer triggers this by calling clone() with flags\u003d0x80,\nresulting in exit_signal \u003d (0x80 \u0026 CSIGNAL) \u003d 128, which exceeds _NSIG and\nis not a valid signal.\n\nThe v1 of this patch added the check only in the clone() syscall handler,\nwhich is incomplete. kernel_clone() has other callers such as\nsys_ia32_clone() which would remain unprotected. Move the check to\nkernel_clone() to cover all callers.\n\nSince the valid_signal() check is now in kernel_clone() and covers all\ncallers including clone3(), the same check in copy_clone_args_from_user()\nbecomes redundant and is removed. The higher 32bits check for clone3() is\nkept as it is clone3() specific.\n\nNote that this is a user-visible change: previously, passing an invalid\nexit_signal to clone() was silently accepted. The man page for clone()\ndoes not document any defined behavior for invalid exit_signal values, so\nrejecting them with -EINVAL is the correct behavior. It is unlikely that\nany sane application relies on passing an invalid exit_signal.\n\n[oleg@redhat.com: the comment above kernel_clone() should be updated]\n Link: https://lore.kernel.org/abwvgU17W8wuW2-J@redhat.com\nLink: https://lore.kernel.org/20260316151956.563558-1-kartikey406@gmail.com\nFixes: 3f2c788a1314 (\"fork: prevent accidental access to clone3 features\")\nSigned-off-by: Deepanshu Kartikey \u003cKartikey406@gmail.com\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nReported-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dbbe6b99feefc3a0842de\nTested-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com\nLink: https://lore.kernel.org/all/20260307064202.353405-1-kartikey406@gmail.com/T/ [v1]\nLink: https://lore.kernel.org/all/20260316104536.558108-1-kartikey406@gmail.com/T/ [v2]\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Ben Segall \u003cbsegall@google.com\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Dietmar Eggemann \u003cdietmar.eggemann@arm.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nCc: Kees Cook \u003ckees@kernel.org\u003e\nCc: Liam Howlett \u003cliam@infradead.org\u003e\nCc: Lorenzo Stoakes (Oracle) \u003cljs@kernel.org\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Valentin Schneider \u003cvschneid@redhat.com\u003e\nCc: Vincent Guittot \u003cvincent.guittot@linaro.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "e16f17a9c5af50221184d1ef4be4056bf3c4209e", "tree": "a32c9818df92db586a3301605a1509e24b9b9abb", "parents": [ "441f92f7d386b85bad16de49db95a307cba048a2" ], "author": { "name": "Alexandre Ghiti", "email": "alex@ghiti.fr", "time": "Mon May 18 10:28:19 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:12 2026 -0700" }, "message": "mm: memcontrol: propagate NMI slab stats to memcg vmstats\n\nflush_nmi_stats() drains per-node NMI slab atomics into the per-node\nlruvec_stats, but does not propagate them to the memcg-level vmstats.\n\nFor non NMI case, account_slab_nmi_safe() calls mod_memcg_lruvec_state()\nwhich updates both per-node lruvec_stats and memcg-level vmstats, so\nflush_nmi_stats() needs to flush to per-node lruvec_stats as well as\nmemcg-level vmstats.\n\nSo fix this by flushing to the memcg-level vmstats for NMI too.\n\nLink: https://lore.kernel.org/20260518082830.599102-1-alex@ghiti.fr\nFixes: 940b01fc8dc1 (\"memcg: nmi safe memcg stats for specific archs\")\nSigned-off-by: Alexandre Ghiti \u003calex@ghiti.fr\u003e\nAcked-by: Shakeel Butt \u003cshakeel.butt@linux.dev\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReviewed-by: Harry Yoo (Oracle) \u003charry@kernel.org\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Roman Gushchin \u003croman.gushchin@linux.dev\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "441f92f7d386b85bad16de49db95a307cba048a2", "tree": "05f8287448784e8c0d9bcb2faaf8c2d7efe97226", "parents": [ "3f8968e9cbf95d5d87d32218906cab0b9b9eddbe" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Mon May 18 08:25:58 2026 -0700" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:12 2026 -0700" }, "message": "mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()\n\nDAMON sysfs maintains the DAMOS tried region directory objects via a\nlinked list. When the user requests refresh of the directories, DAMON\nsysfs removes all the region directories first, and then generate updated\nregions directory on the empty space. The removal function\n(damon_sysfs_scheme_regions_rm_dirs()) only puts the kobj objects. \nDeletion of the container region object from the linked list is done\ninside the kobj release callback function.\n\nIf somehow the callback invocation is delayed, the list will contain\nregions list that gonna be freed. If the updated region directories\ncreation is started in this situation, the list can be corrupted and\nuse-after-free can happen.\n\nBecause the kobj objects are managed by only DAMON sysfs, the issue cannot\nhappen in normal situation. But, such delays can be made on kernels that\nbuilt with CONFIG_DEBUG_KOBJECT_RELEASE. On the kernel, the issue can\nindeed be reproduced like below.\n\n # damo start --damos_action stat\n # cd /sys/kernel/mm/damon/admin/kdamonds/0/\n # for i in {1..10}; do echo update_schemes_tried_regions \u003e state; done\n # dmesg | grep underflow\n [ 89.296152] refcount_t: underflow; use-after-free.\n\nFix the issue by removing the region object from the list when\ndecrementing the reference count.\n\nAlso update damos_sysfs_populate_region_dir() to add the region object to\nthe list only after the kobject_init_and_add() is success, so that fail of\nkobject_init_and_add() is not leaving the deallocated object on the list.\n\nThe issue was discovered [1] by Sashiko.\n\nLink: https://lore.kernel.org/20260518152559.93038-1-sj@kernel.org\nLink: https://lore.kernel.org/20260513011920.119183-1-sj@kernel.org [1]\nFixes: 9277d0367ba1 (\"mm/damon/sysfs-schemes: implement scheme region directory\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 6.2.x\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "3f8968e9cbf95d5d87d32218906cab0b9b9eddbe", "tree": "8b5778b00b167a88c48f5a8b7c73cf3f7b97cef7", "parents": [ "bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43" ], "author": { "name": "Dev Jain", "email": "dev.jain@arm.com", "time": "Mon May 18 12:06:56 2026 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:12 2026 -0700" }, "message": "mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one\n\nInitialize nr_pages to 1 at the start of each loop iteration, like\nfolio_referenced_one() does.\n\nWithout this, nr_pages computed by a previous folio_unmap_pte_batch() call\ncan be reused on a later iteration that does not run\nfolio_unmap_pte_batch() again.\n\nmmap a 64K large folio with MAP_ANONYMOUS | MAP_DROPPABLE, then call\nmadvise(MADV_FREE), then make the last page device-exclusive via\nHMM_DMIRROR_EXCLUSIVE.\n\nTrigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will\nfirst clear the first 15 out of 16 entries mapping the lazyfree folio. \nThis will set nr_pages to 15. In the next pvmw walk, this nr_pages gets\nreused on a device-exclusive pte, thus potentially corrupting folio\nrefcount/mapcount.\n\nAt the moment, I have a userspace program which can make the kernel spit\nout a trace, but the blow up is in folio_referenced_one(), because there\nare existing bugs in the interaction between device-private and rmap\n(which too I am investigating). I did a one liner kernel change to avoid\ngoing into folio_referenced_one(), and the kernel blows up at\nfolio_remove_rmap_ptes in try_to_unmap_one which is what I wanted.\n\nNote that the bug is there not since file folio batching but lazyfree\nfolio batching, since device-exclusive only works for anonymous folios.\n\nUserspace visible effect is simply kernel crashing somewhere due to\nrefcount/mapcount corruption.\n\nLink: https://lore.kernel.org/20260518063656.3721056-1-dev.jain@arm.com\nFixes: 354dffd29575 (\"mm: support batched unmap for lazyfree large folios during reclamation\")\nSigned-off-by: Dev Jain \u003cdev.jain@arm.com\u003e\nAcked-by: Barry Song \u003cbaohua@kernel.org\u003e\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nCc: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Dev Jain \u003cdev.jain@arm.com\u003e\nCc: Harry Yoo \u003charry@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43", "tree": "598160334ce41b454e0537a6e1a1d10cb5133d23", "parents": [ "3b041514cb6eae45869b020f743c14d983363222" ], "author": { "name": "Richard Chang", "email": "richardycc@google.com", "time": "Tue May 12 07:49:18 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:11 2026 -0700" }, "message": "zram: fix use-after-free in zram_writeback_endio\n\nA crash was observed in zram_writeback_endio due to a NULL pointer\ndereference in wake_up. The root cause is a race condition between the\nbio completion handler (zram_writeback_endio) and the writeback task.\n\nIn zram_writeback_endio, wake_up() is called on \u0026wb_ctl-\u003edone_wait after\nreleasing wb_ctl-\u003edone_lock. This creates a race window where the\nwriteback task can see num_inflight become 0, return, and free wb_ctl\nbefore zram_writeback_endio calls wake_up().\n\nCPU 0 (zram_writeback_endio) CPU 1 (writeback_store)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n zram_writeback_slots\n zram_submit_wb_request\n zram_submit_wb_request\n wait_event(wb_ctl-\u003edone_wait)\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\nwake_up(\u0026wb_ctl-\u003edone_wait);\n zram_complete_done_reqs\nspin_lock(\u0026wb_ctl-\u003edone_lock);\nlist_add(\u0026req-\u003eentry, \u0026wb_ctl-\u003edone_reqs);\nspin_unlock(\u0026wb_ctl-\u003edone_lock);\n while (num_inflight) \u003e 0)\n spin_lock(\u0026wb_ctl-\u003edone_lock);\n list_del(\u0026req-\u003eentry);\n spin_unlock(\u0026wb_ctl-\u003edone_lock);\n // num_inflight becomes 0\n atomic_dec(num_inflight);\n\n // Leave zram_writeback_slots\n // Free wb_ctl\n release_wb_ctl(wb_ctl);\n// UAF crash!\nwake_up(\u0026wb_ctl-\u003edone_wait);\n\nThis patch fixes this race by using RCU. By protecting wb_ctl with\nrcu_read_lock() in zram_writeback_endio and using kfree_rcu() to free it,\nwe ensure that wb_ctl remains valid during the execution of\nzram_writeback_endio.\n\nLink: https://lore.kernel.org/20260512074918.2606208-1-richardycc@google.com\nFixes: f405066a1f0d (\"zram: introduce writeback bio batching\")\nSigned-off-by: Richard Chang \u003crichardycc@google.com\u003e\nSuggested-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nSuggested-by: Minchan Kim \u003cminchan@kernel.org\u003e\nAcked-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nAcked-by: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Brian Geffon \u003cbgeffon@google.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Martin Liu \u003cliumartin@google.com\u003e\nCc: wang wei \u003ca929244872@163.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "3b041514cb6eae45869b020f743c14d983363222", "tree": "217f807f7aaa8089a8d8c168f8ad4c760a2820ff", "parents": [ "fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139" ], "author": { "name": "Pratyush Yadav (Google)", "email": "pratyush@kernel.org", "time": "Tue May 05 15:39:20 2026 +0200" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:11 2026 -0700" }, "message": "memfd: deny writeable mappings when implying SEAL_WRITE\n\nWhen SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the\nimplied seal is set after the check that makes sure the memfd can not have\nany writable mappings. This means one can use SEAL_EXEC to apply\nSEAL_WRITE while having writeable mappings.\n\nThis breaks the contract that SEAL_WRITE provides and can be used by an\nattacker to pass a memfd that appears to be write sealed but can still be\nmodified arbitrarily.\n\nFix this by adding the implied seals before the call for\nmapping_deny_writable() is done.\n\nLink: https://lore.kernel.org/20260505133922.797635-1-pratyush@kernel.org\nFixes: c4f75bc8bd6b (\"mm/memfd: add write seals when apply SEAL_EXEC to executable memfd\")\nSigned-off-by: Pratyush Yadav (Google) \u003cpratyush@kernel.org\u003e\nReviewed-by: Pasha Tatashin \u003cpasha.tatashin@soleen.com\u003e \nAcked-by: Jeff Xu \u003cjeffxu@google.com\u003e\nCc: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: Brendan Jackman \u003cjackmanb@google.com\u003e\nCc: Greg Thelen \u003cgthelen@google.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Kees Cook \u003ckees@kernel.org\u003e\nCc: \"David Hildenbrand (Arm)\" \u003cdavid@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139", "tree": "cdde0ffa442b591dbe7c078cceec92dedd79f8d0", "parents": [ "83f9efcce93f8574be2279090ee2aec58b86cda7" ], "author": { "name": "Linpu Yu", "email": "linpu5433@gmail.com", "time": "Sun May 10 13:43:30 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:11 2026 -0700" }, "message": "ipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid \u003d (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.\n\nLink: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com\nLink: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914.git.linpu5433@gmail.com\nFixes: 03f595668017 (\"ipc: add sysctl to specify desired next object id\")\nSigned-off-by: Linpu Yu \u003clinpu5433@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nCc: Kees Cook \u003ckees@kernel.org\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "83f9efcce93f8574be2279090ee2aec58b86cda7", "tree": "785daedb15ce5bdb1d6e5dd5188f54bef60ba8d4", "parents": [ "83ec6eeb74a592e6568cb0723bac99fb8b3810b4" ], "author": { "name": "Lorenzo Stoakes", "email": "ljs@kernel.org", "time": "Tue May 12 17:06:43 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:11 2026 -0700" }, "message": "Revert \"mm/hugetlbfs: update hugetlbfs to use mmap_prepare\"\n\nThis reverts commit ea52cb24cd3f (\"mm/hugetlbfs: update hugetlbfs to use\nmmap_prepare\") with conflict resolution to account for changes in commit\nea52cb24cd3f (\"mm/hugetlbfs: update hugetlbfs to use mmap_prepare\").\n\nThe patch incorrectly handled hugetlb VMA lock allocation at the\nmmap_prepare stage, where a failed allocation occurring after mmap_prepare\nis called might result in the lock leaking.\n\nThere is no risk of a merge causing a similar issues, as\nVMA_DONTEXPAND_BIT is set for hugetlb mappings.\n\nAs a first step in addressing this issue, simply revert the change so we\ncan rework how we do this having corrected the underlying issues.\n\nWe maintain the VMA flags changes as best we can, accounting for the fact\nthat we were working with a VMA descriptor previously and propagating\nlike-for-like changes for this.\n\nNote that we invoke vma_set_flags() and do not call vma_start_write() as\nvm_flags_set() does. This is OK as it\u0027s being done in an .mmap hook where\nthe VMA is not yet linked into the tree so nobody else can be accessing\nit.\n\nLink: https://lore.kernel.org/20260512160643.266960-1-ljs@kernel.org\nFixes: ea52cb24cd3f (\"mm/hugetlbfs: update hugetlbfs to use mmap_prepare\")\nSigned-off-by: Lorenzo Stoakes \u003cljs@kernel.org\u003e\nReported-by: Mingyu Wang \u003c25181214217@stu.xidian.edu.cn\u003e\nCloses: https://lore.kernel.org/linux-mm/20260425070700.562229-1-25181214217@stu.xidian.edu.cn/\nAcked-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nAcked-by: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "83ec6eeb74a592e6568cb0723bac99fb8b3810b4", "tree": "28f8d1e91e93b23aa258b8f33831de09bced43db", "parents": [ "27fa82620cbaa89a7fc11ac3057701d598813e87" ], "author": { "name": "Ian Ray", "email": "ian.ray@gehealthcare.com", "time": "Wed May 06 09:33:35 2026 +0300" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Thu May 21 19:06:10 2026 -0700" }, "message": "MAINTAINERS: .mailmap: update after GEHC spin-off\n\nUpdate my email address from @ge.com to @gehealthcare.com after GE\nHealthCare was spun-off from GE.\n\nLink: https://lore.kernel.org/20260506063335.3-1-ian.ray@gehealthcare.com\nSigned-off-by: Ian Ray \u003cian.ray@gehealthcare.com\u003e\nReviewed-by: Luca Ceresoli \u003cluca.ceresoli@bootlin.com\u003e\nCc: Neil Armstrong \u003cneil.armstrong@linaro.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "e90ef85ada857819313000cc50c6edfcddec6850", "tree": "dac30ecccddc3779d08024193672c8ab409ec4b0", "parents": [ "7734b168cad167a43e5bda19bc8ccc65669ec964" ], "author": { "name": "Marco Elver", "email": "elver@google.com", "time": "Thu May 21 14:23:55 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:50:46 2026 -0500" }, "message": "nios2: Implement _THIS_IP_ using inline asm\n\nBoth GCC [1] and Clang [2] consider the generic version of _THIS_IP_ to\nbe broken:\n\n #define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; })\n\nIn particular, the address of a label is only expected to be used with a\ncomputed goto.\n\nWhile the generic version more or less works today, it is known to be\nbrittle and may break with current and future optimizations. For\nexample, Clang -O2 always returns 1 when this function is inlined:\n\n static inline unsigned long get_ip(void)\n { return ({ __label__ __here; __here: (unsigned long)\u0026\u0026__here; }); }\n\nFix it by overriding _THIS_IP_ in \u003casm/linkage.h\u003e (which is included by\n\u003clinux/instruction_pointer.h\u003e) using an architecture-specific inline asm\nversion. Additionally, avoiding taking the address of a label prevents\ncompilers from emitting spurious indirect branch targets (e.g. ENDBR or\nBTI) under control-flow integrity schemes.\n\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id\u003d120071 [1]\nLink: https://github.com/llvm/llvm-project/issues/138272 [2]\nSigned-off-by: Marco Elver \u003celver@google.com\u003e\nReviewed-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "7734b168cad167a43e5bda19bc8ccc65669ec964", "tree": "7d628cd58e688e1be667549406cd7c6a678cbc68", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Simon Schuster", "email": "schuster.simon@siemens-energy.com", "time": "Thu May 21 14:46:28 2026 +0200" }, "committer": { "name": "Dinh Nguyen", "email": "dinguyen@kernel.org", "time": "Thu May 21 18:48:24 2026 -0500" }, "message": "MAINTAINERS: arch/nios2: Add Simon Schuster as co-maintainer\n\nAdd Simon Schuster as a co-maintainer for the nios2 architecture and\nmark it as supported.\n\nSigned-off-by: Simon Schuster \u003cschuster.simon@siemens-energy.com\u003e\nAcked-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Dinh Nguyen \u003cdinguyen@kernel.org\u003e\n" }, { "commit": "4ec9c8e023c79f613fe4d5ad8cc737112efb2e44", "tree": "ef3a3d8c16fc4d0473fb3bd5e642fc122d8254a7", "parents": [ "69f030cf95488ae1186c72ac8c66fd279664ea7f" ], "author": { "name": "ChenXiaoSong", "email": "chenxiaosong@kylinos.cn", "time": "Mon May 18 15:23:22 2026 +0000" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:20:24 2026 -0500" }, "message": "smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close\n\nReproducer:\n\n 1. server: systemctl start ksmbd\n 2. client: mount -t cifs //${server_ip}/export /mnt\n 3. client: C program: openat(AT_FDCWD, \"/mnt\", O_RDWR | O_TMPFILE, 0600)\n\nDo not treat `FILE_DELETE_ON_CLOSE_LE` as delete pending while files\nremain open.\n\nThis patch fixes xfstests generic/004.\n\nCc: stable@vger.kernel.org\nLink: https://chenxiaosong.com/en/smb-xfstests-generic-004.html\nCo-developed-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: Huiwen He \u003chehuiwen@kylinos.cn\u003e\nSigned-off-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nTested-by: Steve French \u003cstfrench@microsoft.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "69f030cf95488ae1186c72ac8c66fd279664ea7f", "tree": "d8536854cc7ad089f924001b7a8ddb03dcad6558", "parents": [ "3515503322f4819277091839eed46b695096aca5" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Tue May 19 16:12:04 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: validate SID in parent security descriptor during ACL inheritance\n\nIntroduce smb_validate_ntsd_sid() helper to safely validate Owner SID\nand Group SID inside the NT Security Descriptor (smb_ntsd) retrieved\nfrom the parent directory.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "3515503322f4819277091839eed46b695096aca5", "tree": "3ba1480aea9cefbdbd9b26aaa2389a28c437ba63", "parents": [ "1a2ab0feaa23147e347b4d4cb79cb3fc392118eb" ], "author": { "name": "Junyi Liu", "email": "moss80199@gmail.com", "time": "Mon May 18 23:27:19 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Thu May 21 18:18:49 2026 -0500" }, "message": "ksmbd: fix durable reconnect error path file lifetime\n\nAfter a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes\nthe same ksmbd_file into the session volatile-id table. If smb2_open()\nthen takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)\nand then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).\n\nIn this case fp and dh_info.fp are the same object. The first put drops the\nreconnect lookup reference, but the final durable put can run\n__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,\nit can free the file object without removing the volatile-id entry that was\njust published into the session table.\n\nUse the session-aware put for the final reconnect drop when the reconnect\nhad already succeeded and the error path is cleaning up the republished\nfile. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep\nusing the durable-only put path.\n\nFixes: 1baff47b81f9 (\"ksmbd: fix use-after-free in smb2_open during durable reconnect\")\nSigned-off-by: Junyi Liu \u003cmoss80199@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "4378a4116567887066011b8e0cd443241609e467", "tree": "52fad68b4ca8d4bd0bf265c8a7217f76cb702598", "parents": [ "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "87ed4e845d5a90bba1a56c0a5c580a13982e8648" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:30:46 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 08:31:08 2026 +1000" }, "message": "Merge tag \u0027mediatek-drm-fixes-20260521\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes\n\nMediatek DRM Fixes - 20260521\n\n1. fix sparse warnings\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Chun-Kuang Hu \u003cchunkuang.hu@kernel.org\u003e\nLink: https://patch.msgid.link/20260521135649.4681-1-chunkuang.hu@kernel.org\n" }, { "commit": "6779b50faa562e6cca1aa6a4649a4d764c6c7e28", "tree": "c50f50098c31bb77c5078ac553bb4d531425c1a8", "parents": [ "68993ced0f618e36cf33388f1e50223e5e6e78cc", "ed831e7ea1a860bdbab3eadeb95f7f73e9d212df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 15:02:12 2026 -0700" }, "message": "Merge tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - Remove obsolete PCIe maintainer addresses (Florian Eckert, Hans\n Zhang)\n\n - Restore a brcmstb link speed assignment that was inadvertently\n removed, reducing bcm2712 performance (Florian Fainelli)\n\n* tag \u0027pci-v7.1-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n PCI: brcmstb: Assign pcie-\u003egen from of_pci_get_max_link_speed()\n MAINTAINERS: Remove Jianjun Wang as PCIe mediatek maintainer\n MAINTAINERS: Remove Chuanhua Lei as PCIe intel-gw maintainer\n" }, { "commit": "68993ced0f618e36cf33388f1e50223e5e6e78cc", "tree": "eeecfdda57b25b9e73bd3684ccabee83132edfea", "parents": [ "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "0e3c08f1b7b79b2e9635e70fde3a2f053c99eff1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:39:12 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, wireless and netfilter.\n\n Craziness continues with no end in sight. Even discounting the driver\n revert this is a pretty huge PR for standards of the previous era. I\u0027d\n speculate - we haven\u0027t seen the worst of it, yet. Good news, I guess,\n is that so far we haven\u0027t seen many (any?) cases of \"AI reported a\n bug, we fixed it and a real user regressed\".\n\n Current release - fix to a fix:\n\n - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events\n\n - vsock/virtio: relax the recently added memory limit a little\n\n Current release - regressions:\n\n - IB/IPoIB: make sure IB drivers always use async set_rx_mode since\n some (mlx5) are now required to use it due to locking changes\n\n Previous releases - regressions:\n\n - udp: fix UDP length on last GSO_PARTIAL segment\n\n - af_unix: fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\n - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\n - mlx5e: fix unlocked writing to ICOSQ, breaking AF_XDP\n\n Previous releases - always broken:\n\n - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR\n\n - ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\n - Bluetooth: a lot of locking and concurrency fixes (as always)\n\n - batman-adv (mesh wireless networking): a lot of random fixes for\n issues reported by security researchers and Sashiko\n\n - netfilter: same thing, a lot of small security-ish fixes all over\n the place, nothing really stands out\n\n Misc:\n\n - bring back the old 3c509 driver, Maciej wants to maintain it\"\n\n* tag \u0027net-7.1-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (187 commits)\n net: enetc: avoid VF-\u003ePF mailbox timeout during SR-IOV teardown\n net: enetc: fix init and teardown order to prevent use of unsafe resources\n net: enetc: fix unbounded loop and interrupt handling in VF-to-PF messaging\n net: enetc: fix DMA write to freed memory in enetc_msg_free_mbx()\n net: enetc: fix race condition in VF MAC address configuration\n net: enetc: fix TOCTOU race and validate VF MAC address\n net: enetc: add ratelimiting to VF mailbox error messages\n net: enetc: fix missing error code when pf-\u003evf_state allocation fails\n net: enetc: fix incorrect mailbox message status returned to VFs\n net: bridge: prevent too big nested attributes in br_fill_linkxstats()\n l2tp: use list_del_rcu in l2tp_session_unhash\n net: bcmgenet: keep RBUF EEE/PM disabled\n ethernet: 3c509: Fix most coding style issues\n ethernet: 3c509: Update documentation to match MAINTAINERS\n ethernet: 3c509: Add GPL 2.0 SPDX license identifier\n ethernet: 3c509: Fix AUI transceiver type selection\n Revert \"drivers: net: 3com: 3c509: Remove this driver\"\n tools: ynl: support listening on all nsids\n net: gro: don\u0027t merge zcopy skbs\n pds_core: ensure null-termination for firmware version strings\n ...\n" }, { "commit": "6d3b2673e1fd553395933b6f2bc88c9e9d2a2bc5", "tree": "f5bfe0752de92f43bc01f17f3b9581a90d5a7583", "parents": [ "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:17:28 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph fix from Ilya Dryomov:\n \"A fix for an \u0027rbd unmap\u0027 race condition which popped up on a\n production setup where many RBD devices are frequently mapped and\n unmapped, marked for stable\"\n\n* tag \u0027ceph-for-7.1-rc5\u0027 of https://github.com/ceph/ceph-client:\n rbd: eliminate a race in lock_dwork draining on unmap\n" }, { "commit": "0b474240327cebeff08ad429e8ed3cfc6c8ee816", "tree": "cbe272f8bedb7f2b02bbfd32fd22758e19d8ce80", "parents": [ "fc151100098d2899b7aed99aa1bcfe27bf00d58d" ], "author": { "name": "NeilBrown", "email": "neil@brown.name", "time": "Tue Apr 28 15:47:44 2026 -0400" }, "committer": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Thu May 21 17:08:47 2026 -0400" }, "message": "lockd: fix TEST handling when not all permissions are available.\n\nThe F_GETLK fcntl can work with either read access or write access or\nboth. It can query F_RDLCK and F_WRLCK locks in either case.\n\nHowever lockd currently treats F_GETLK similar to F_SETLK in that read\naccess is required to query an F_RDLCK lock and write access is required\nto query a F_WRLCK lock.\n\nThis is wrong and can cause problems - e.g. when qemu accesses a\nread-only (e.g. iso) filesystem image over NFS (though why it queries\nif it can get a write lock - I don\u0027t know. But it does, and this works\nwith local filesystems).\n\nSo we need TEST requests to be handled differently. To do this:\n\n- change nlm_do_fopen() to accept O_RDWR as a mode and in that case\n succeed if either a O_RDONLY or O_WRONLY file can be opened.\n- change nlm_lookup_file() to accept a mode argument from caller,\n instead of deducing base on lock time, and pass that on to nlm_do_fopen()\n- change nlm4svc_retrieve_args() and nlmsvc_retrieve_args() to detect\n TEST requests and pass O_RDWR as a mode to nlm_lookup_file, passing\n the same mode as before for other requests. Also set\n lock-\u003efl.c.flc_file to whichever file is available for TEST requests.\n- change nlmsvc_testlock() to also not calculate the mode, but to use\n whatever was stored in lock-\u003efl.c.flc_file.\n\nThis behaviour of lockd - requesting O_WRONLY access to TEST for\nexclusive locks - has been present at least since git history began.\nHowever it was hidden until recently because knfsd ignored the access\nrequested by lockd and required only READ access for all locking\nrequests (unless the underlying filesystem provided an f_op-\u003eopen\nfunction which checked access permissions).\n\nThe commit mentioned in Fixes: below changed nfsd_permission() to NOT\noverride the access request for LOCK requests and this exposed the bug\nthat we are now fixing.\n\nNote that there is another issue that this patch does not address.\nThe flock(.., LOCK_EX) call is permitted on a read-only file descriptor.\nLinux NFS maps this to NLM locking as whole-file byte-range locks.\nnfsd will see this as though it were fcntl( F_SETLK (F_WRLCK)) and will\nnow require write access, which it might not be able to get.\nIt is not clear if this is a problem in practice, or what the best\nsolution might be. So no attempt is made to address it.\n\nReported-by: Tj \u003ctj.iam.tj@proton.me\u003e\nLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug\u003d1128861\nFixes: 4cc9b9f2bf4d (\"nfsd: refine and rename NFSD_MAY_LOCK\")\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nSigned-off-by: NeilBrown \u003cneil@brown.name\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\n" }, { "commit": "fc151100098d2899b7aed99aa1bcfe27bf00d58d", "tree": "f096723faa9702578920e9cd21949756b807e6ab", "parents": [ "ea25e3c7915b24e0ef93ee85190f3fada037dfb1" ], "author": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Tue Apr 21 15:20:21 2026 -0400" }, "committer": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Thu May 21 17:08:47 2026 -0400" }, "message": "NFSD: Report whether fh_key was actually updated\n\nThe nfsd_ctl_fh_key_set tracepoint was introduced to capture\noperator activity on the filehandle signing key. Earlier revisions\nlogged the key bytes verbatim; the version that landed hashes the\n16 key bytes through crc32_le and stores the result.\n\nCRC32 is a linear projection of its input rather than a one-way\nfunction, and truncating any hash of fixed-size secret material\nleaves the key recoverable under offline brute force when the\nthreat model includes an attacker with access to the trace ring.\n\nThe operational question the fingerprint was meant to answer is\nwhether a NFSD_CMD_THREADS_SET call that carries an\nNFSD_A_SERVER_FH_KEY attribute actually replaced the active key or\nre-installed the value already in place. Answer that question\ndirectly: compare the incoming key bytes against the current\nnn-\u003efh_key inside nfsd_nl_fh_key_set() and surface a single bit to\nthe tracepoint. The event now prints \"updated\" when the stored\nkey changed and \"unmodified\" otherwise. A first set that fails\nkmalloc reports \"unmodified\" because no key was installed.\n\nReported-by: jaeyeong \u003cfin@spl.team\u003e\nFixes: 62346217fd72 (\"NFSD: Add a key for signing filehandles\")\nCc: Benjamin Coddington \u003cbcodding@hammerspace.com\u003e\nReviewed-by: Benjamin Coddington \u003cbcodding@hammerspace.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\n" }, { "commit": "ea25e3c7915b24e0ef93ee85190f3fada037dfb1", "tree": "4fafb18c6eaee828115e36b9f9c190b1783f644a", "parents": [ "4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1" ], "author": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Tue Apr 21 12:11:25 2026 -0400" }, "committer": { "name": "Chuck Lever", "email": "chuck.lever@oracle.com", "time": "Thu May 21 17:08:47 2026 -0400" }, "message": "sunrpc: prevent out-of-bounds read in __cache_seq_start()\n\nCommit 7b546bd89975 (\"sunrpc/cache: improve RCU safety in\ncache_list walking.\") changed the tail of __cache_seq_start()\nto unconditionally store\n\n\t*pos \u003d ((long long)hash \u003c\u003c 32) + 1\n\nbefore returning, dropping a prior \"hash \u003e\u003d cd-\u003ehash_size\"\nguard. When the while loop exits because every remaining\nbucket was empty, hash equals cd-\u003ehash_size, so the stored\n*pos is one position past the table\u0027s last valid bucket.\nseq_read_iter() caches that index in m-\u003eindex. A subsequent\npread(2) at the same file offset skips traverse() and hands\nthe stored index back to __cache_seq_start(), which decodes\nhash \u003d cd-\u003ehash_size and dereferences\ncd-\u003ehash_table[cd-\u003ehash_size] -- one hlist_head past the end\nof the kzalloc\u0027d table.\n\nKASAN reports an eight-byte slab-out-of-bounds read at the\ntail of the 2048-byte hash_table allocation for the NFSD\nexport cache (EXPORT_HASHMAX * sizeof(struct hlist_head) \u003d\u003d\n256 * 8).\n\nReject an input hash that is out of range before touching the\nhash table. cache_seq_next() already bounds-checks its own\nloop; the start routine needs to be symmetric.\n\nReported-by: syzbot+60cfa08822470bbebe44@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d60cfa08822470bbebe44\nFixes: 7b546bd89975 (\"sunrpc/cache: improve RCU safety in cache_list walking.\")\nReviewed-by: Benjamin Coddington \u003cbcodding@hammerspace.com\u003e\nReviewed-by: NeilBrown \u003cneil@brown.name\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\n" }, { "commit": "7acfa2c5f4366d63653380646ffa7dbd1bfaccc0", "tree": "e91cf187e8c5f748a06c0195b8f97fee74a5a362", "parents": [ "758c807bb943138f887d42d986b645e12446ba9c", "057caace5214da3b457bbd295e1a2ad34d3685ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 21 14:05:09 2026 -0700" }, "message": "Merge tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull ring-buffer fixes from Steven Rostedt:\n\n - Fix reporting MISSED EVENTS in trace iterator\n\n When the \"trace\" file is read with tracing enabled, if the writer\n were to pass the iterator reader, it resets, sets a \"missed_events\"\n flag and continues. The tracing output checks for missed events and\n if there are some, it prints out \"[LOST EVENTS]\" to let the user know\n events were dropped.\n\n But the clearing of the missed_events happened when the tracing\n system queried the ring buffer iterator about missed events. This was\n premature as the ring buffer is per CPU, and the tracing code reads\n all the CPU buffers and checks for missed events when it is read. If\n the CPU iterator that had missed events isn\u0027t printed next, the\n output for the LOST EVENTS is lost.\n\n Clear the missed_events flag when the iterator moves to the next\n event and not when the missed_events flag is queried. Also clear it\n on reset.\n\n - Flush and stop the persistent ring buffer on panic\n\n On panic the persistent ring buffer is used to debug what caused the\n panic. But on some architectures, it requires flushing the memory\n from cache, otherwise, the ring buffer persistent memory may not have\n the last events and this could also cause the ring buffer to be\n corrupted on the next boot.\n\n - Fix nr_subbufs initialization in simple_ring_buffer_init_mm\n\n The remote simple ring buffer meta data nr_subbufs is initialized too\n early and gets cleared later on, making it zero and not reflect the\n actual number of sub-buffers.\n\n - Fix unload_page for simple_ring_buffer init rollback\n\n On error, the pages loaded need to be unloaded. To unload a page it\n is expected that: page \u003d load_page(va); -\u003e unload_page(page). But the\n code was doing: unload_page(va) and not unload_page(page).\n\n - Create output file from cmd_check_undefined\n\n The check for undefined symbols checks if the file *.o.checked exists\n and if so it skips doing the work. But the *.o.checked file never was\n created making every build do the work even when it was already done\n previously.\n\n* tag \u0027trace-ringbuffer-v7.1-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing: Create output file from cmd_check_undefined\n tracing: Fix unload_page for simple_ring_buffer init rollback\n tracing: Fix nr_subbufs initialization in simple_ring_buffer_init_mm()\n ring-buffer: Flush and stop persistent ring buffer on panic\n ring-buffer: Fix reporting of missed events in iterator\n" }, { "commit": "71d9e1561aab0a506f6c783a6c3e16042fd27dff", "tree": "9e06fe4d90a39b436cfca417fc6d0f525a839482", "parents": [ "aee43aaf26c7f162780ab77ce952bae6a1b354bd", "9af1b6e175c82daf4b423da339a722d8e67a735a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:00:45 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri May 22 07:01:04 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-05-21\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nShort summary of fixes pull:\n\namdxdna:\n- remove mmap and export for ubuf\n\nbridge:\n- chipone-icn6211: managed bridge cleanup\n- lt66121: acquire reset GPIO\n- megachips: fix clean up on failed IRQ requests\n\ngem:\n- clean up LRU locking\n\nv3d:\n- fix UAF in error code paths\n- release GEM-object ref on free\u0027d jobs\n\nvirtio:\n- use uninterruptible resv locking in plane updates\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patch.msgid.link/20260521071456.GA14644@localhost.localdomain\n" }, { "commit": "27cd2dde35b2c3b8659fa18f6a935c61fedee5c1", "tree": "411f9e78571a4a30261672c6264cbc6e27f85775", "parents": [ "ea6ec3343e05f7937a53eb6d7617b3abdb4abc19" ], "author": { "name": "Zhengyu He", "email": "hezhy472013@gmail.com", "time": "Thu May 21 22:44:45 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 21:56:07 2026 +0100" }, "message": "spi: dt-bindings: fsl-qspi: support SpacemiT K3\n\nAdd the SpacemiT K3 QSPI compatible to the fsl-qspi binding.\n\nK3 and K1 use the same QSPI controller, so document the K3 compatible\nwith \"spacemit,k1-qspi\" as fallback.\n\nSigned-off-by: Cody Kang \u003ccody.kang.hk@outlook.com\u003e\nSigned-off-by: Zhengyu He \u003chezhy472013@gmail.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260521-k3-pico-itx-qspi-v2-for-next-20260521-v2-1-52bce26e5fd8@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "dc278e9bf2b9513a763353e6b9cc21e0f532954e", "tree": "e43d8e1f3ddbca290546c7759432cb9a6eee3468", "parents": [ "94449463d2ab125067adccc2b0c2d7cd753edfb4" ], "author": { "name": "Keith Busch", "email": "kbusch@kernel.org", "time": "Thu May 21 12:02:53 2026 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu May 21 13:04:11 2026 -0600" }, "message": "blk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it.\n\nFixes: b0077e269f6c1 (\"blk-mq: make sure active queue usage is held for bio_integrity_prep()\")\nFixes: 7b4f36cd22a65 (\"block: ensure we hold a queue reference when using queue limits\")\nSigned-off-by: Keith Busch \u003ckbusch@kernel.org\u003e\nLink: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660", "tree": "ed94992134f52d1f99c7b002ca34f1414f779e7c", "parents": [ "45cf24da0a10203890fae4bd10ca5dbfca430324" ], "author": { "name": "Jeongjun Park", "email": "aha310510@gmail.com", "time": "Thu May 21 20:37:12 2026 +0900" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:28:24 2026 +0100" }, "message": "ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()\n\nIn the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as\na general mixer kcontrol instead of a DAPM kcontrol, so struct\nsnd_soc_dapm_context must not be accessed via\nsnd_soc_dapm_kcontrol_to_dapm().\n\nThis causes a NULL pointer dereference, so it must be modified to use\nsnd_soc_component_to_dapm().\n\nCc: stable@kernel.org\nCloses: https://github.com/raspberrypi/linux/issues/7242\nFixes: 02dbbb7e982a (\"ASoC: codecs: pcm512x: convert to snd_soc_dapm_xxx()\")\nSigned-off-by: Jeongjun Park \u003caha310510@gmail.com\u003e\nLink: https://patch.msgid.link/20260521113712.227438-1-aha310510@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "45cf24da0a10203890fae4bd10ca5dbfca430324", "tree": "2a7ed82c1010f7baea62acad07bddf667ebce0a1", "parents": [ "e0fb794d67f86726817756bcc25c628f4894df29" ], "author": { "name": "Charles Keepax", "email": "ckeepax@opensource.cirrus.com", "time": "Wed May 20 17:36:30 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Thu May 21 19:18:01 2026 +0100" }, "message": "ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match\n\nFor PTL onwards Cirrus are intending to rely on function topologies,\nrather than using a match table for each system type. Remove this\nunnecessary match table entry. Having the match entries can\nmean that systems match when they should use function topologies\ninstead, resulting in incorrect audio configurations. Although,\nadmittedly this is not too likely with this 6x amp configuration\nas those are quite rare, but best to follow best practice.\n\nSigned-off-by: Charles Keepax \u003cckeepax@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260520163631.3300102-3-ckeepax@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" } ], "next": "e0fb794d67f86726817756bcc25c628f4894df29" }