)]}'
{
  "log": [
    {
      "commit": "c369299895a591d96745d6492d4888259b004a9e",
      "tree": "cee98a9ab3b537d18372f54b3b2e6ecbb56387f4",
      "parents": [
        "ec69c9e88315c4be70c283f18c2ff130da6320b5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 14:42:17 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 14:42:17 2026 -0700"
      },
      "message": "Linux 7.0-rc5\n"
    },
    {
      "commit": "ec69c9e88315c4be70c283f18c2ff130da6320b5",
      "tree": "cbb721d4f0b9a5e2dbb9e3ff881e0a912153e538",
      "parents": [
        "d5273fd3ca0bf0b59fff49fb59237440998fbec8"
      ],
      "author": {
        "name": "Mikko Perttunen",
        "email": "mperttunen@nvidia.com",
        "time": "Tue Mar 03 13:32:11 2026 +0900"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:37:58 2026 -0700"
      },
      "message": "i2c: tegra: Don\u0027t mark devices with pins as IRQ safe\n\nI2C devices with associated pinctrl states (DPAUX I2C controllers)\nwill change pinctrl state during runtime PM. This requires taking\na mutex, so these devices cannot be marked as IRQ safe.\n\nAdd PINCTRL as dependency to avoid build errors.\n\nSigned-off-by: Mikko Perttunen \u003cmperttunen@nvidia.com\u003e\nReported-by: Russell King \u003crmk+kernel@armlinux.org.uk\u003e\nLink: https://lore.kernel.org/all/E1vsNBv-00000009nfA-27ZK@rmk-PC.armlinux.org.uk/\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "d5273fd3ca0bf0b59fff49fb59237440998fbec8",
      "tree": "6ddd60c3d384c171a438befcc6058c659797fffa",
      "parents": [
        "ac57fa9faf716c6a0e30128c2c313443cf633019",
        "4a04d13576fd69149b91672b5f1dc62eca272fa5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:16:06 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:16:06 2026 -0700"
      },
      "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Fix how linked registers track zero extension of subregisters (Daniel\n   Borkmann)\n\n - Fix unsound scalar fork for OR instructions (Daniel Wade)\n\n - Fix exception exit lock check for subprogs (Ihor Solodrai)\n\n - Fix undefined behavior in interpreter for SDIV/SMOD instructions\n   (Jenny Guanni Qu)\n\n - Release module\u0027s BTF when module is unloaded (Kumar Kartikeya\n   Dwivedi)\n\n - Fix constant blinding for PROBE_MEM32 instructions (Sachin Kumar)\n\n - Reset register ID for END instructions to prevent incorrect value\n   tracking (Yazhou Tang)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n  selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation\n  bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation\n  selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling\n  bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n  selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend\n  bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n  selftests/bpf: Add tests for bpf_throw lock leak from subprogs\n  bpf: Fix exception exit lock checking for subprogs\n  bpf: Release module BTF IDR before module unload\n  selftests/bpf: Fix pkg-config call on static builds\n  bpf: Fix constant blinding for PROBE_MEM32 stores\n  selftests/bpf: Add test for BPF_END register ID reset\n  bpf: Reset register ID for BPF_END value tracking\n"
    },
    {
      "commit": "ac57fa9faf716c6a0e30128c2c313443cf633019",
      "tree": "df4eb46c83b3b8b776b0268600f82092b4ceedf7",
      "parents": [
        "11ac4ce3f708a073eb9e35fa11f741bb51f45302",
        "50b35c9e50a865600344ab1d8f9a8b3384d7e63d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:10:31 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:10:31 2026 -0700"
      },
      "message": "Merge tag \u0027trace-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Revert \"tracing: Remove pid in task_rename tracing output\"\n\n   A change was made to remove the pid field from the task_rename event\n   because it was thought that it was always done for the current task\n   and recording the pid would be redundant. This turned out to be\n   incorrect and there are a few corner case where this is not true and\n   caused some regressions in tooling.\n\n - Fix the reading from user space for migration\n\n   The reading of user space uses a seq lock type of logic where it uses\n   a per-cpu temporary buffer and disables migration, then enables\n   preemption, does the copy from user space, disables preemption,\n   enables migration and checks if there was any schedule switches while\n   preemption was enabled. If there was a context switch, then it is\n   considered that the per-cpu buffer could be corrupted and it tries\n   again. There\u0027s a protection check that tests if it takes a hundred\n   tries, it issues a warning and exits out to prevent a live lock.\n\n   This was triggered because the task was selected by the load balancer\n   to be migrated to another CPU, every time preemption is enabled the\n   migration task would schedule in try to migrate the task but can\u0027t\n   because migration is disabled and let it run again. This caused the\n   scheduler to schedule out the task every time it enabled preemption\n   and made the loop never exit (until the 100 iteration test\n   triggered).\n\n   Fix this by enabling and disabling preemption and keeping migration\n   enabled if the reading from user space needs to be done again. This\n   will let the migration thread migrate the task and the copy from user\n   space will likely pass on the next iteration.\n\n - Fix trace_marker copy option freeing\n\n   The \"copy_trace_marker\" option allows a tracing instance to get a\n   copy of a write to the trace_marker file of the top level instance.\n   This is managed by a link list protected by RCU. When an instance is\n   removed, a check is made if the option is set, and if so\n   synchronized_rcu() is called.\n\n   The problem is that an iteration is made to reset all the flags to\n   what they were when the instance was created (to perform clean ups)\n   was done before the check of the copy_trace_marker option and that\n   option was cleared, so the synchronize_rcu() was never called.\n\n   Move the clearing of all the flags after the check of\n   copy_trace_marker to do synchronize_rcu() so that the option is still\n   set if it was before and the synchronization is performed.\n\n - Fix entries setting when validating the persistent ring buffer\n\n   When validating the persistent ring buffer on boot up, the number of\n   events per sub-buffer is added to the sub-buffer meta page. The\n   validator was updating cpu_buffer-\u003ehead_page (the first sub-buffer of\n   the per-cpu buffer) and not the \"head_page\" variable that was\n   iterating the sub-buffers. This was causing the first sub-buffer to\n   be assigned the entries for each sub-buffer and not the sub-buffer\n   that was supposed to be updated.\n\n - Use \"hash\" value to update the direct callers\n\n   When updating the ftrace direct callers, it assigned a temporary\n   callback to all the callback functions of the ftrace ops and not just\n   the functions represented by the passed in hash. This causes an\n   unnecessary slow down of the functions of the ftrace_ops that is not\n   being modified. Only update the functions that are going to be\n   modified to call the ftrace loop function so that the update can be\n   made on those functions.\n\n* tag \u0027trace-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n  ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod\n  ring-buffer: Fix to update per-subbuf entries of persistent ring buffer\n  tracing: Fix trace_marker copy link list updates\n  tracing: Fix failure to read user space from system call trace events\n  tracing: Revert \"tracing: Remove pid in task_rename tracing output\"\n"
    },
    {
      "commit": "11ac4ce3f708a073eb9e35fa11f741bb51f45302",
      "tree": "6ef3fd48f3df4022ccfa1153109a3353bb911f37",
      "parents": [
        "8d8bd2a5aa980efaf39b3f46eb1bfd0b5da54453",
        "2f42e85622567a19459679f71e55d41904866aa7"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:05:34 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 11:05:34 2026 -0700"
      },
      "message": "Merge tag \u0027i2c-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n\n - fix broken I2C communication on Armada 3700 with recovery\n\n - fix device_node reference leak in probe (fsi)\n\n - fix NULL-deref when serial string is missing (cp2615)\n\n* tag \u0027i2c-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n  i2c: pxa: defer reset on Armada 3700 when recovery is used\n  i2c: fsi: Fix a potential leak in fsi_i2c_probe()\n  i2c: cp2615: fix serial string NULL-deref at probe\n"
    },
    {
      "commit": "8d8bd2a5aa980efaf39b3f46eb1bfd0b5da54453",
      "tree": "ba52a7967962c3c5b01f9a1a392be089e272f2cb",
      "parents": [
        "ebfd9b7af2fb1e4bbc97a8b33845e7402c3defa9",
        "1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:54:12 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:54:12 2026 -0700"
      },
      "message": "Merge tag \u0027x86-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Improve Qemu MCE-injection behavior by only using AMD SMCA MSRs if\n   the feature bit is set\n\n - Fix the relative path of gettimeofday.c inclusion in vclock_gettime.c\n\n - Fix a boot crash on UV clusters when a socket is marked as\n   \u0027deconfigured\u0027 which are mapped to the SOCK_EMPTY node ID by\n   the UV firmware, while Linux APIs expect NUMA_NO_NODE.\n\n   The difference being (0xffff [unsigned short ~0]) vs [int -1]\n\n* tag \u0027x86-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  x86/platform/uv: Handle deconfigured sockets\n  x86/entry/vdso: Fix path of included gettimeofday.c\n  x86/mce/amd: Check SMCA feature bit before accessing SMCA MSRs\n"
    },
    {
      "commit": "ebfd9b7af2fb1e4bbc97a8b33845e7402c3defa9",
      "tree": "f084f6b3e07b843bf625c60e8da3233b77913c6f",
      "parents": [
        "dea622e183d34e6a4f90acfee9abb605885432bf",
        "e7fcc54524f04e42641de99028edd9c69dc19f8c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:31:51 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:31:51 2026 -0700"
      },
      "message": "Merge tag \u0027perf-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Ingo Molnar:\n\n - Fix a PMU driver crash on AMD EPYC systems, caused by\n   a race condition in x86_pmu_enable()\n\n - Fix a possible counter-initialization bug in x86_pmu_enable()\n\n - Fix a counter inheritance bug in inherit_event() and\n   __perf_event_read()\n\n - Fix an Intel PMU driver branch constraints handling bug\n   found by UBSAN\n\n - Fix the Intel PMU driver\u0027s new Off-Module Response (OMR)\n   support code for Diamond Rapids / Nova lake, to fix a snoop\n   information parsing bug\n\n* tag \u0027perf-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  perf/x86/intel: Fix OMR snoop information parsing issues\n  perf/x86/intel: Add missing branch counters constraint apply\n  perf: Make sure to use pmu_ctx-\u003epmu for groups\n  x86/perf: Make sure to program the counter value for stopped events on migration\n  perf/x86: Move event pointer setup earlier in x86_pmu_enable()\n"
    },
    {
      "commit": "dea622e183d34e6a4f90acfee9abb605885432bf",
      "tree": "1fb0bf0ec87c2460234c5e5ec1a599b2edc8b8a0",
      "parents": [
        "d56d4a110f5a1f340710c12a6a8e3ce915824b8e",
        "4e5019216402ad0b4a84cff457b662d26803f103"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:17:50 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 10:17:50 2026 -0700"
      },
      "message": "Merge tag \u0027objtool-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull objtool fixes from Ingo Molnar:\n \"Fix three more livepatching related build environment bugs, and a\n  false positive warning with Clang jump tables\"\n\n* tag \u0027objtool-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  objtool: Fix Clang jump table detection\n  livepatch/klp-build: Fix inconsistent kernel version\n  objtool/klp: fix mkstemp() failure with long paths\n  objtool/klp: fix data alignment in __clone_symbol()\n"
    },
    {
      "commit": "d56d4a110f5a1f340710c12a6a8e3ce915824b8e",
      "tree": "c0708ee368301eae7a36b23937da16fed41922e7",
      "parents": [
        "b5fddfad34829771c2d06ed43fea35b5e30bd1c9",
        "14de1552a4e3fece78bb20314887e70888c9d448"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 09:57:20 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 09:57:20 2026 -0700"
      },
      "message": "Merge tag \u0027locking-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fix from Ingo Molnar:\n \"Fix a sparse build error regression in \u003clinux/local_lock_internal.h\u003e\n  caused by the locking context-analysis changes\"\n\n* tag \u0027locking-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  include/linux/local_lock_internal.h: Make this header file again compatible with sparse\n"
    },
    {
      "commit": "b5fddfad34829771c2d06ed43fea35b5e30bd1c9",
      "tree": "5f70b25b5b3f85adcaa5fde711dd7c20888eb480",
      "parents": [
        "d723091c8c3e076bb53d52ec3d5a801d49f30caf",
        "76f0930d6e809234904cf9f0f5f42ee6c1dc694e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 09:55:58 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Mar 22 09:55:58 2026 -0700"
      },
      "message": "Merge tag \u0027irq-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fix from Ingo Molnar:\n \"Fix a mailbox channel leak in the riscv-rpmi-sysmsi irqchip driver\"\n\n* tag \u0027irq-urgent-2026-03-22\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe()\n"
    },
    {
      "commit": "d723091c8c3e076bb53d52ec3d5a801d49f30caf",
      "tree": "dce3515d17dca9f1b4bebf661f2d91176de36821",
      "parents": [
        "113ae7b4decc6c2d95bdbbe52e615a0137ef7f9f",
        "2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 16:59:09 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 16:59:09 2026 -0700"
      },
      "message": "Merge tag \u0027driver-core-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core\n\nPull driver core fixes from Danilo Krummrich:\n\n - Generalize driver_override in the driver core, providing a common\n   sysfs implementation and concurrency-safe accessors for bus\n   implementations\n\n - Do not use driver_override as IRQ name in the hwmon axi-fan driver\n\n - Remove an unnecessary driver_override check in sh platform_early\n\n - Migrate the platform bus to use the generic driver_override\n   infrastructure, fixing a UAF condition caused by accessing the\n   driver_override field without proper locking in the platform_match()\n   callback\n\n* tag \u0027driver-core-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:\n  driver core: platform: use generic driver_override infrastructure\n  sh: platform_early: remove pdev-\u003edriver_override check\n  hwmon: axi-fan: don\u0027t use driver_override as IRQ name\n  docs: driver-model: document driver_override\n  driver core: generalize driver_override in struct device\n"
    },
    {
      "commit": "50b35c9e50a865600344ab1d8f9a8b3384d7e63d",
      "tree": "46d99438040707fcd46517ce73e5a35608cd22e9",
      "parents": [
        "f35dbac6942171dc4ce9398d1d216a59224590a9"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@kernel.org",
        "time": "Thu Mar 12 13:37:38 2026 +0100"
      },
      "committer": {
        "name": "Steven Rostedt (Google)",
        "email": "rostedt@goodmis.org",
        "time": "Sat Mar 21 16:51:04 2026 -0400"
      },
      "message": "ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod\n\nThe modify logic registers temporary ftrace_ops object (tmp_ops) to trigger\nthe slow path for all direct callers to be able to safely modify attached\naddresses.\n\nAt the moment we use ops-\u003efunc_hash for tmp_ops filter, which represents all\nthe systems attachments. It\u0027s faster to use just the passed hash filter, which\ncontains only the modified sites and is always a subset of the ops-\u003efunc_hash.\n\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: Andrii Nakryiko \u003candrii@kernel.org\u003e\nCc: Menglong Dong \u003cmenglong8.dong@gmail.com\u003e\nCc: Song Liu \u003csong@kernel.org\u003e\nLink: https://patch.msgid.link/20260312123738.129926-1-jolsa@kernel.org\nFixes: e93672f770d7 (\"ftrace: Add update_ftrace_direct_mod function\")\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n"
    },
    {
      "commit": "f35dbac6942171dc4ce9398d1d216a59224590a9",
      "tree": "8ed9093aa20f8e815b42ae416cc201b94ffebc30",
      "parents": [
        "07183aac4a6828e474f00b37c9d795d0d99e18a7"
      ],
      "author": {
        "name": "Masami Hiramatsu (Google)",
        "email": "mhiramat@kernel.org",
        "time": "Thu Mar 19 18:12:19 2026 +0900"
      },
      "committer": {
        "name": "Steven Rostedt (Google)",
        "email": "rostedt@goodmis.org",
        "time": "Sat Mar 21 16:47:28 2026 -0400"
      },
      "message": "ring-buffer: Fix to update per-subbuf entries of persistent ring buffer\n\nSince the validation loop in rb_meta_validate_events() updates the same\ncpu_buffer-\u003ehead_page-\u003eentries, the other subbuf entries are not updated.\nFix to use head_page to update the entries field, since it is the cursor\nin this loop.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nFixes: 5f3b6e839f3c (\"ring-buffer: Validate boot range memory events\")\nLink: https://patch.msgid.link/177391153882.193994.17158784065013676533.stgit@mhiramat.tok.corp.google.com\nSigned-off-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n"
    },
    {
      "commit": "07183aac4a6828e474f00b37c9d795d0d99e18a7",
      "tree": "89e66e2110f6d54541dbd20f41aa073de4359e60",
      "parents": [
        "edca33a56297d5741ccf867669debec116681987"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "rostedt@goodmis.org",
        "time": "Wed Mar 18 18:55:12 2026 -0400"
      },
      "committer": {
        "name": "Steven Rostedt (Google)",
        "email": "rostedt@goodmis.org",
        "time": "Sat Mar 21 16:43:53 2026 -0400"
      },
      "message": "tracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance\u0027s trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260318185512.1b6c7db4@gandalf.local.home\nFixes: 7b382efd5e8a (\"tracing: Allow the top level trace_marker to write into another instances\")\nReported-by: Sasha Levin \u003csashal@kernel.org\u003e\nCloses: https://lore.kernel.org/all/20260225133122.237275-1-sashal@kernel.org/\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n"
    },
    {
      "commit": "edca33a56297d5741ccf867669debec116681987",
      "tree": "042ba808a4236cd903aa76a6862103a90cea95a1",
      "parents": [
        "a6f22e50c7d51aa225c392c62c33f0fae11f734d"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "rostedt@goodmis.org",
        "time": "Mon Mar 16 13:07:34 2026 -0400"
      },
      "committer": {
        "name": "Steven Rostedt (Google)",
        "email": "rostedt@goodmis.org",
        "time": "Sat Mar 21 16:42:36 2026 -0400"
      },
      "message": "tracing: Fix failure to read user space from system call trace events\n\nThe system call trace events call trace_user_fault_read() to read the user\nspace part of some system calls. This is done by grabbing a per-cpu\nbuffer, disabling migration, enabling preemption, calling\ncopy_from_user(), disabling preemption, enabling migration and checking if\nthe task was preempted while preemption was enabled. If it was, the buffer\nis considered corrupted and it tries again.\n\nThere\u0027s a safety mechanism that will fail out of this loop if it fails 100\ntimes (with a warning). That warning message was triggered in some\npi_futex stress tests. Enabling the sched_switch trace event and\ntraceoff_on_warning, showed the problem:\n\n pi_mutex_hammer-1375    [006] d..21   138.981648: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981651: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981656: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981659: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981664: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981667: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981671: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981675: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981679: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981682: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981687: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981690: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981695: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981698: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981703: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981706: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981711: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981714: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981719: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981722: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981727: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981730: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n pi_mutex_hammer-1375    [006] d..21   138.981735: sched_switch: prev_comm\u003dpi_mutex_hammer prev_pid\u003d1375 prev_prio\u003d95 prev_state\u003dR+ \u003d\u003d\u003e next_comm\u003dmigration/6 next_pid\u003d47 next_prio\u003d0\n     migration/6-47      [006] d..2.   138.981738: sched_switch: prev_comm\u003dmigration/6 prev_pid\u003d47 prev_prio\u003d0 prev_state\u003dS \u003d\u003d\u003e next_comm\u003dpi_mutex_hammer next_pid\u003d1375 next_prio\u003d95\n\nWhat happened was the task 1375 was flagged to be migrated. When\npreemption was enabled, the migration thread woke up to migrate that task,\nbut failed because migration for that task was disabled. This caused the\nloop to fail to exit because the task scheduled out while trying to read\nuser space.\n\nEvery time the task enabled preemption the migration thread would schedule\nin, try to migrate the task, fail and let the task continue. But because\nthe loop would only enable preemption with migration disabled, it would\nalways fail because each time it enabled preemption to read user space,\nthe migration thread would try to migrate it.\n\nTo solve this, when the loop fails to read user space without being\nscheduled out, enabled and disable preemption with migration enabled. This\nwill allow the migration task to successfully migrate the task and the\nnext loop should succeed to read user space without being scheduled out.\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nLink: https://patch.msgid.link/20260316130734.1858a998@gandalf.local.home\nFixes: 64cf7d058a005 (\"tracing: Have trace_marker use per-cpu data to read user space\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n"
    },
    {
      "commit": "a6f22e50c7d51aa225c392c62c33f0fae11f734d",
      "tree": "25960c446a9911d7c25c70326d9fa941eeca3a5c",
      "parents": [
        "f338e77383789c0cae23ca3d48adcc5e9e137e3c"
      ],
      "author": {
        "name": "Xuewen Yan",
        "email": "xuewen.yan@unisoc.com",
        "time": "Fri Mar 06 15:59:54 2026 +0800"
      },
      "committer": {
        "name": "Steven Rostedt (Google)",
        "email": "rostedt@goodmis.org",
        "time": "Sat Mar 21 16:41:18 2026 -0400"
      },
      "message": "tracing: Revert \"tracing: Remove pid in task_rename tracing output\"\n\nThis reverts commit e3f6a42272e028c46695acc83fc7d7c42f2750ad.\n\nThe commit says that the tracepoint only deals with the current task,\nhowever the following case is not current task:\n\ncomm_write() {\n    p \u003d get_proc_task(inode);\n    if (!p)\n        return -ESRCH;\n\n    if (same_thread_group(current, p))\n        set_task_comm(p, buffer);\n}\nwhere set_task_comm() calls __set_task_comm() which records\nthe update of p and not current.\n\nSo revert the patch to show pid.\n\nCc: \u003cmhiramat@kernel.org\u003e\nCc: \u003cmathieu.desnoyers@efficios.com\u003e\nCc: \u003celver@google.com\u003e\nCc: \u003ckees@kernel.org\u003e\nLink: https://patch.msgid.link/20260306075954.4533-1-xuewen.yan@unisoc.com\nFixes: e3f6a42272e0 (\"tracing: Remove pid in task_rename tracing output\")\nReported-by: Guohua Yan \u003cguohua.yan@unisoc.com\u003e\nSigned-off-by: Xuewen Yan \u003cxuewen.yan@unisoc.com\u003e\nReviewed-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\n"
    },
    {
      "commit": "4a04d13576fd69149b91672b5f1dc62eca272fa5",
      "tree": "105f3e958ee72eeafb00b704b88e550e7f8dde1e",
      "parents": [
        "bc308be380c136800e1e94c6ce49cb53141d6506"
      ],
      "author": {
        "name": "Daniel Borkmann",
        "email": "daniel@iogearbox.net",
        "time": "Thu Mar 19 22:15:07 2026 +0100"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:19:40 2026 -0700"
      },
      "message": "selftests/bpf: Add a test cases for sync_linked_regs regarding zext propagation\n\nAdd multiple test cases for linked register tracking with alu32 ops:\n\n  - Add a test that checks sync_linked_regs() regarding reg-\u003eid (the linked\n    target register) for BPF_ADD_CONST32 rather than known_reg-\u003eid (the\n    branch register).\n\n  - Add a test case for linked register tracking that exposes the cross-type\n    sync_linked_regs() bug. One register uses alu32 (w7 +\u003d 1, BPF_ADD_CONST32)\n    and another uses alu64 (r8 +\u003d 2, BPF_ADD_CONST64), both linked to the\n    same base register.\n\n  - Add a test case that exercises regsafe() path pruning when two execution\n    paths reach the same program point with linked registers carrying\n    different ADD_CONST flags (BPF_ADD_CONST32 from alu32 vs BPF_ADD_CONST64\n    from alu64). This particular test passes with and without the fix since\n    the pruning will fail due to different ranges, but it would still be\n    useful to carry this one as a regression test for the unreachable div\n    by zero.\n\nWith the fix applied all the tests pass:\n\n  # LDLIBS\u003d-static PKG_CONFIG\u003d\u0027pkg-config --static\u0027 ./vmtest.sh -- ./test_progs -t verifier_linked_scalars\n  [...]\n  ./test_progs -t verifier_linked_scalars\n  #602/1   verifier_linked_scalars/scalars: find linked scalars:OK\n  #602/2   verifier_linked_scalars/sync_linked_regs_preserves_id:OK\n  #602/3   verifier_linked_scalars/scalars_neg:OK\n  #602/4   verifier_linked_scalars/scalars_neg_sub:OK\n  #602/5   verifier_linked_scalars/scalars_neg_alu32_add:OK\n  #602/6   verifier_linked_scalars/scalars_neg_alu32_sub:OK\n  #602/7   verifier_linked_scalars/scalars_pos:OK\n  #602/8   verifier_linked_scalars/scalars_sub_neg_imm:OK\n  #602/9   verifier_linked_scalars/scalars_double_add:OK\n  #602/10  verifier_linked_scalars/scalars_sync_delta_overflow:OK\n  #602/11  verifier_linked_scalars/scalars_sync_delta_overflow_large_range:OK\n  #602/12  verifier_linked_scalars/scalars_alu32_big_offset:OK\n  #602/13  verifier_linked_scalars/scalars_alu32_basic:OK\n  #602/14  verifier_linked_scalars/scalars_alu32_wrap:OK\n  #602/15  verifier_linked_scalars/scalars_alu32_zext_linked_reg:OK\n  #602/16  verifier_linked_scalars/scalars_alu32_alu64_cross_type:OK\n  #602/17  verifier_linked_scalars/scalars_alu32_alu64_regsafe_pruning:OK\n  #602/18  verifier_linked_scalars/alu32_negative_offset:OK\n  #602/19  verifier_linked_scalars/spurious_precision_marks:OK\n  #602     verifier_linked_scalars:OK\n  Summary: 1/19 PASSED, 0 SKIPPED, 0 FAILED\n\nCo-developed-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260319211507.213816-2-daniel@iogearbox.net\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "bc308be380c136800e1e94c6ce49cb53141d6506",
      "tree": "3e75f2593b21ca468ec586af3cbb595bbf176fdd",
      "parents": [
        "06880982c63012eb392df64c1ca587c294a72226"
      ],
      "author": {
        "name": "Daniel Borkmann",
        "email": "daniel@iogearbox.net",
        "time": "Thu Mar 19 22:15:06 2026 +0100"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:19:40 2026 -0700"
      },
      "message": "bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation\n\nJenny reported that in sync_linked_regs() the BPF_ADD_CONST32 flag is\nchecked on known_reg (the register narrowed by a conditional branch)\ninstead of reg (the linked target register created by an alu32 operation).\n\nExample case with reg:\n\n  1. r6 \u003d bpf_get_prandom_u32()\n  2. r7 \u003d r6 (linked, same id)\n  3. w7 +\u003d 5 (alu32 -- r7 gets BPF_ADD_CONST32, zero-extended by CPU)\n  4. if w6 \u003c 0xFFFFFFFC goto safe (narrows r6 to [0xFFFFFFFC, 0xFFFFFFFF])\n  5. sync_linked_regs() propagates to r7 but does NOT call zext_32_to_64()\n  6. Verifier thinks r7 is [0x100000001, 0x100000004] instead of [1, 4]\n\nSince known_reg above does not have BPF_ADD_CONST32 set above, zext_32_to_64()\nis never called on alu32-derived linked registers. This causes the verifier\nto track incorrect 64-bit bounds, while the CPU correctly zero-extends the\n32-bit result.\n\nThe code checking known_reg-\u003eid was correct however (see scalars_alu32_wrap\nselftest case), but the real fix needs to handle both directions - zext\npropagation should be done when either register has BPF_ADD_CONST32, since\nthe linked relationship involves a 32-bit operation regardless of which\nside has the flag.\n\nExample case with known_reg (exercised also by scalars_alu32_wrap):\n\n  1. r1 \u003d r0; w1 +\u003d 0x100 (alu32 -- r1 gets BPF_ADD_CONST32)\n  2. if r1 \u003e 0x80 - known_reg \u003d r1 (has BPF_ADD_CONST32), reg \u003d r0 (doesn\u0027t)\n\nHence, fix it by checking for (reg-\u003eid | known_reg-\u003eid) \u0026 BPF_ADD_CONST32.\n\nMoreover, sync_linked_regs() also has a soundness issue when two linked\nregisters used different ALU widths: one with BPF_ADD_CONST32 and the\nother with BPF_ADD_CONST64. The delta relationship between linked registers\nassumes the same arithmetic width though. When one register went through\nalu32 (CPU zero-extends the 32-bit result) and the other went through\nalu64 (no zero-extension), the propagation produces incorrect bounds.\n\nExample:\n\n  r6 \u003d bpf_get_prandom_u32()     // fully unknown\n  if r6 \u003e\u003d 0x100000000 goto out  // constrain r6 to [0, U32_MAX]\n  r7 \u003d r6\n  w7 +\u003d 1                        // alu32: r7.id \u003d N | BPF_ADD_CONST32\n  r8 \u003d r6\n  r8 +\u003d 2                        // alu64: r8.id \u003d N | BPF_ADD_CONST64\n  if r7 \u003c 0xFFFFFFFF goto out    // narrows r7 to [0xFFFFFFFF, 0xFFFFFFFF]\n\nAt the branch on r7, sync_linked_regs() runs with known_reg\u003dr7\n(BPF_ADD_CONST32) and reg\u003dr8 (BPF_ADD_CONST64). The delta path\ncomputes:\n\n  r8 \u003d r7 + (delta_r8 - delta_r7) \u003d 0xFFFFFFFF + (2 - 1) \u003d 0x100000000\n\nThen, because known_reg-\u003eid has BPF_ADD_CONST32, zext_32_to_64(r8) is\ncalled, truncating r8 to [0, 0]. But r8 used a 64-bit ALU op -- the\nCPU does NOT zero-extend it. The actual CPU value of r8 is\n0xFFFFFFFE + 2 \u003d 0x100000000, not 0. The verifier now underestimates\nr8\u0027s 64-bit bounds, which is a soundness violation.\n\nFix sync_linked_regs() by skipping propagation when the two registers\nhave mixed ALU widths (one BPF_ADD_CONST32, the other BPF_ADD_CONST64).\n\nLastly, fix regsafe() used for path pruning: the existing checks used\n\"\u0026 BPF_ADD_CONST\" to test for offset linkage, which treated\nBPF_ADD_CONST32 and BPF_ADD_CONST64 as equivalent.\n\nFixes: 7a433e519364 (\"bpf: Support negative offsets, BPF_SUB, and alu32 for linked register tracking\")\nReported-by: Jenny Guanni Qu \u003cqguanni@gmail.com\u003e\nCo-developed-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260319211507.213816-1-daniel@iogearbox.net\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "06880982c63012eb392df64c1ca587c294a72226",
      "tree": "e0d5508ea5e5342b229d8ef740f2d85398cafa5d",
      "parents": [
        "1abd3feb36636b28d7722851fc0c8d392a87e12d",
        "0ad1734cc5598d3ddb6126a8960efe85f0f807d7"
      ],
      "author": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:14:28 2026 -0700"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:14:29 2026 -0700"
      },
      "message": "Merge branch \u0027bpf-fix-unsound-scalar-forking-for-bpf_or\u0027\n\nDaniel Wade says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix unsound scalar forking for BPF_OR\n\nmaybe_fork_scalars() unconditionally sets the pushed path dst register\nto 0 for both BPF_AND and BPF_OR.  For AND this is correct (0 \u0026 K \u003d\u003d 0),\nbut for OR it is wrong (0 | K \u003d\u003d K, not 0).  This causes the verifier to\ntrack an incorrect value on the pushed path, leading to a verifier/runtime\ndivergence that allows out-of-bounds map value access.\n\nv4: Use block comment style for multi-line comments in selftests (Amery Hung)\n    Add Reviewed-by/Acked-by tags\nv3: Use single-line comment style in selftests (Alexei Starovoitov)\nv2: Use push_stack(env, env-\u003einsn_idx, ...) to re-execute the insn\n    on the pushed path (Eduard Zingerman)\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260314021521.128361-1-danjwade95@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n"
    },
    {
      "commit": "0ad1734cc5598d3ddb6126a8960efe85f0f807d7",
      "tree": "e0d5508ea5e5342b229d8ef740f2d85398cafa5d",
      "parents": [
        "c845894ebd6fb43226b3118d6b017942550910c5"
      ],
      "author": {
        "name": "Daniel Wade",
        "email": "danjwade95@gmail.com",
        "time": "Sat Mar 14 13:15:21 2026 +1100"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:14:28 2026 -0700"
      },
      "message": "selftests/bpf: Add tests for maybe_fork_scalars() OR vs AND handling\n\nAdd three test cases to verifier_bounds.c to verify that\nmaybe_fork_scalars() correctly tracks register values for BPF_OR\noperations with constant source operands:\n\n1. or_scalar_fork_rejects_oob: After ARSH 63 + OR 8, the pushed\n   path should have dst \u003d 8. With value_size \u003d 8, accessing\n   map_value + 8 is out of bounds and must be rejected.\n\n2. and_scalar_fork_still_works: Regression test ensuring AND\n   forking continues to work. ARSH 63 + AND 4 produces pushed\n   dst \u003d 0 and current dst \u003d 4, both within value_size \u003d 8.\n\n3. or_scalar_fork_allows_inbounds: After ARSH 63 + OR 4, the\n   pushed path has dst \u003d 4, which is within value_size \u003d 8\n   and should be accepted.\n\nThese tests exercise the fix in the previous patch, which makes the\npushed path re-execute the ALU instruction so it computes the correct\nresult for BPF_OR.\n\nSigned-off-by: Daniel Wade \u003cdanjwade95@gmail.com\u003e\nReviewed-by: Amery Hung \u003cameryhung@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260314021521.128361-3-danjwade95@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "c845894ebd6fb43226b3118d6b017942550910c5",
      "tree": "5ff0c4c66627bb833a2a530c2ee0761274266324",
      "parents": [
        "1abd3feb36636b28d7722851fc0c8d392a87e12d"
      ],
      "author": {
        "name": "Daniel Wade",
        "email": "danjwade95@gmail.com",
        "time": "Sat Mar 14 13:15:20 2026 +1100"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:14:28 2026 -0700"
      },
      "message": "bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR\n\nmaybe_fork_scalars() is called for both BPF_AND and BPF_OR when the\nsource operand is a constant.  When dst has signed range [-1, 0], it\nforks the verifier state: the pushed path gets dst \u003d 0, the current\npath gets dst \u003d -1.\n\nFor BPF_AND this is correct: 0 \u0026 K \u003d\u003d 0.\nFor BPF_OR this is wrong:    0 | K \u003d\u003d K, not 0.\n\nThe pushed path therefore tracks dst as 0 when the runtime value is K,\nproducing an exploitable verifier/runtime divergence that allows\nout-of-bounds map access.\n\nFix this by passing env-\u003einsn_idx (instead of env-\u003einsn_idx + 1) to\npush_stack(), so the pushed path re-executes the ALU instruction with\ndst \u003d 0 and naturally computes the correct result for any opcode.\n\nFixes: bffacdb80b93 (\"bpf: Recognize special arithmetic shift in the verifier\")\nSigned-off-by: Daniel Wade \u003cdanjwade95@gmail.com\u003e\nReviewed-by: Amery Hung \u003cameryhung@gmail.com\u003e\nAcked-by: Eduard Zingerman \u003ceddyz87@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260314021521.128361-2-danjwade95@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "1abd3feb36636b28d7722851fc0c8d392a87e12d",
      "tree": "d084cd92f13b4fe6f846dbf832b889d84e49996d",
      "parents": [
        "a1e5c46eaed3151be93e1aec9af0d8f8db79b8f6",
        "4ac95c65efeaf0c010199b2b2f5f78b06f28dab6"
      ],
      "author": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:12:17 2026 -0700"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:12:17 2026 -0700"
      },
      "message": "Merge branch \u0027bpf-fix-abs-int_min-undefined-behavior-in-interpreter-sdiv-smod\u0027\n\nJenny Guanni Qu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Fix abs(INT_MIN) undefined behavior in interpreter sdiv/smod\n\nThe BPF interpreter\u0027s signed 32-bit division and modulo handlers use\nabs() on s32 operands, which is undefined for S32_MIN. This causes\nthe interpreter to compute wrong results, creating a mismatch with\nthe verifier\u0027s range tracking.\n\nFor example, INT_MIN / 2 returns 0x40000000 instead of the correct\n0xC0000000. The verifier tracks the correct range, so a crafted BPF\nprogram can exploit the mismatch for out-of-bounds map value access\n(confirmed by KASAN).\n\nPatch 1 introduces abs_s32() which handles S32_MIN correctly and\nreplaces all 8 abs((s32)...) call sites. s32 is the only affected\ncase -- the s64 handlers do not use abs().\n\nPatch 2 adds selftests covering sdiv32 and smod32 with INT_MIN\ndividend to prevent regression.\n\nChanges since v4:\n  - Renamed __safe_abs32() to abs_s32() and dropped inline keyword\n    per Alexei Starovoitov\u0027s feedback\n\nChanges since v3:\n  - Fixed stray blank line deletion in the file header\n  - Improved comment per Yonghong Song\u0027s suggestion\n  - Added JIT vs interpreter context to selftest commit message\n\nChanges since v2:\n  - Simplified to use -(u32)x per Mykyta Yatsenko\u0027s suggestion\n\nChanges since v1:\n  - Moved helper above kerneldoc comment block to fix build warnings\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260311011116.2108005-1-qguanni@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n"
    },
    {
      "commit": "4ac95c65efeaf0c010199b2b2f5f78b06f28dab6",
      "tree": "d084cd92f13b4fe6f846dbf832b889d84e49996d",
      "parents": [
        "c77b30bd1dcb61f66c640ff7d2757816210c7cb0"
      ],
      "author": {
        "name": "Jenny Guanni Qu",
        "email": "qguanni@gmail.com",
        "time": "Wed Mar 11 01:11:16 2026 +0000"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:12:17 2026 -0700"
      },
      "message": "selftests/bpf: Add tests for sdiv32/smod32 with INT_MIN dividend\n\nAdd tests to verify that signed 32-bit division and modulo operations\nproduce correct results when the dividend is INT_MIN (0x80000000).\n\nThe bug fixed in the previous commit only affects the BPF interpreter\npath. When JIT is enabled (the default on most architectures), the\nnative CPU division instruction produces the correct result and these\ntests pass regardless. With bpf_jit_enable\u003d0, the interpreter is used\nand without the previous fix, INT_MIN / 2 incorrectly returns\n0x40000000 instead of 0xC0000000 due to abs(S32_MIN) undefined\nbehavior, causing these tests to fail.\n\nTest cases:\n  - SDIV32 INT_MIN / 2 \u003d -1073741824 (imm and reg divisor)\n  - SMOD32 INT_MIN % 2 \u003d 0 (positive and negative divisor)\n\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nAcked-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nSigned-off-by: Jenny Guanni Qu \u003cqguanni@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260311011116.2108005-3-qguanni@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "c77b30bd1dcb61f66c640ff7d2757816210c7cb0",
      "tree": "cce96f5cd0e26852171ff75906d8674532241193",
      "parents": [
        "a1e5c46eaed3151be93e1aec9af0d8f8db79b8f6"
      ],
      "author": {
        "name": "Jenny Guanni Qu",
        "email": "qguanni@gmail.com",
        "time": "Wed Mar 11 01:11:15 2026 +0000"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 13:12:16 2026 -0700"
      },
      "message": "bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter\u0027s signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier\u0027s abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter\u0027s sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs().\n\nFixes: ec0e2da95f72 (\"bpf: Support new signed div/mod instructions.\")\nAcked-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nAcked-by: Mykyta Yatsenko \u003cyatsenko@meta.com\u003e\nSigned-off-by: Jenny Guanni Qu \u003cqguanni@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260311011116.2108005-2-qguanni@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "a1e5c46eaed3151be93e1aec9af0d8f8db79b8f6",
      "tree": "772297acd3f36ad1bb6afb699b838187b0f3ee32",
      "parents": [
        "6c2128505f61b504c79a20b89596feba61388112"
      ],
      "author": {
        "name": "Ihor Solodrai",
        "email": "ihor.solodrai@linux.dev",
        "time": "Thu Mar 19 17:08:09 2026 -0700"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 12:51:44 2026 -0700"
      },
      "message": "selftests/bpf: Add tests for bpf_throw lock leak from subprogs\n\nAdd test cases to ensure the verifier correctly rejects bpf_throw from\nsubprogs when RCU, preempt, or IRQ locks are held:\n\n  * reject_subprog_rcu_lock_throw: subprog acquires bpf_rcu_read_lock and\n    then calls bpf_throw\n  * reject_subprog_throw_preempt_lock: always-throwing subprog called while\n    caller holds bpf_preempt_disable\n  * reject_subprog_throw_irq_lock: always-throwing subprog called while\n    caller holds bpf_local_irq_save\n\nAssisted-by: Claude:claude-opus-4-6\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nAcked-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nAcked-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260320000809.643798-2-ihor.solodrai@linux.dev\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "6c2128505f61b504c79a20b89596feba61388112",
      "tree": "391d16fc7025b7099b7bc7c0a0bf18ddd1712716",
      "parents": [
        "146bd2a87a65aa407bb17fac70d8d583d19aba06"
      ],
      "author": {
        "name": "Ihor Solodrai",
        "email": "ihor.solodrai@linux.dev",
        "time": "Thu Mar 19 17:08:08 2026 -0700"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Sat Mar 21 12:51:44 2026 -0700"
      },
      "message": "bpf: Fix exception exit lock checking for subprogs\n\nprocess_bpf_exit_full() passes check_lock \u003d !curframe to\ncheck_resource_leak(), which is false in cases when bpf_throw() is\ncalled from a static subprog. This makes check_resource_leak() to skip\nvalidation of active_rcu_locks, active_preempt_locks, and\nactive_irq_id on exception exits from subprogs.\n\nAt runtime bpf_throw() unwinds the stack via ORC without releasing any\nuser-acquired locks, which may cause various issues as the result.\n\nFix by setting check_lock \u003d true for exception exits regardless of\ncurframe, since exceptions bypass all intermediate frame\ncleanup. Update the error message prefix to \"bpf_throw\" for exception\nexits to distinguish them from normal BPF_EXIT.\n\nFix reject_subprog_with_rcu_read_lock test which was previously\npassing for the wrong reason. Test program returned directly from the\nsubprog call without closing the RCU section, so the error was\ntriggered by the unclosed RCU lock on normal exit, not by\nbpf_throw. Update __msg annotations for affected tests to match the\nnew \"bpf_throw\" error prefix.\n\nThe spin_lock case is not affected because they are already checked [1]\nat the call site in do_check_insn() before bpf_throw can run.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h\u003dv7.0-rc4#n21098\n\nAssisted-by: Claude:claude-opus-4-6\nFixes: f18b03fabaa9 (\"bpf: Implement BPF exceptions\")\nSigned-off-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nAcked-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nAcked-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260320000809.643798-1-ihor.solodrai@linux.dev\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "2f42e85622567a19459679f71e55d41904866aa7",
      "tree": "4155db6d1151395dfff43968da3fc8e035d18454",
      "parents": [
        "f338e77383789c0cae23ca3d48adcc5e9e137e3c",
        "78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc"
      ],
      "author": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sat Mar 21 19:52:12 2026 +0100"
      },
      "committer": {
        "name": "Wolfram Sang",
        "email": "wsa+renesas@sang-engineering.com",
        "time": "Sat Mar 21 19:52:12 2026 +0100"
      },
      "message": "Merge tag \u0027i2c-host-fixes-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current\n\ni2c-fixes for v7.0-rc5\n\npxa: fix broken I2C communication on Armada 3700 with recovery\nfsi: fix device_node reference leak in probe\ncp2615: fix NULL-deref when serial string is missing\n"
    },
    {
      "commit": "113ae7b4decc6c2d95bdbbe52e615a0137ef7f9f",
      "tree": "3d74bd3024ac440e165b9d48cdc3fca99d6ff4ed",
      "parents": [
        "55d55b97c7fca1f795029c5aea3335a5d885632e",
        "e7bae9a7a5e1251ab414291f4e9304d702bb9221"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 09:09:51 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 09:09:51 2026 -0700"
      },
      "message": "Merge tag \u0027hwmon-for-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - max6639: Fix pulses-per-revolution implementation\n\n - Several PMBus drivers: Add missing error checks\n\n* tag \u0027hwmon-for-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n  hwmon: (max6639) Fix pulses-per-revolution implementation\n  hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()\n  hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value\n  hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value\n  hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value\n  hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value\n"
    },
    {
      "commit": "55d55b97c7fca1f795029c5aea3335a5d885632e",
      "tree": "7c66a7c34aca62d09cfba6f1418b4dbf93be0846",
      "parents": [
        "8991448e56cb2118b561eeda193af53b4ff6b632",
        "3b2c2ab4ceb82af484310c3087541eab00ea288b"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 08:46:13 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 08:46:13 2026 -0700"
      },
      "message": "Merge tag \u0027bootconfig-fixes-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull bootconfig fixes from Masami Hiramatsu:\n\n - Check error code of xbc_init_node() in override value path in\n   xbc_parse_kv()\n\n - Fix fd leak in load_xbc_file() on fstat failure\n\n* tag \u0027bootconfig-fixes-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n  tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure\n  lib/bootconfig: check xbc_init_node() return in override path\n"
    },
    {
      "commit": "8991448e56cb2118b561eeda193af53b4ff6b632",
      "tree": "a7ae3e706dda9f4a4a2a4802ee4a3af3eb6e5b4b",
      "parents": [
        "a0c83177734ab98623795e1ba2cf4b72c23de5e7",
        "b17b79ff896305fd74980a5f72afec370ee88ca4"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 08:42:17 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Mar 21 08:42:17 2026 -0700"
      },
      "message": "Merge tag \u0027for-7.0-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"Another batch of fixes for problems that have been identified by tools\n  analyzing code or by fuzzing. Most of them are short, two patches fix\n  the same thing in many places so the diffs are bigger.\n\n   - handle potential NULL pointer errors after attempting to read\n     extent and checksum trees\n\n   - prevent ENOSPC when creating many qgroups by ioctls in the same\n     transaction\n\n   - encoded write ioctl fixes (with 64K page and 4K block size):\n       - fix unexpected bio length\n       - do not let compressed bios and pages interfere with page cache\n\n   - compression fixes on setups with 64K page and 4K block size: fix\n     folio length assertions (zstd and lzo)\n\n   - remap tree fixes:\n       - make sure to hold block group reference while moving it\n       - handle early exit when moving block group to unused list\n\n   - handle deleted subvolumes with inconsistent state of deletion\n     progress\"\n\n* tag \u0027for-7.0-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n  btrfs: reject root items with drop_progress and zero drop_level\n  btrfs: check block group before marking it unused in balance_remap_chunks()\n  btrfs: hold block group reference during entire move_existing_remap()\n  btrfs: fix an incorrect ASSERT() condition inside lzo_decompress_bio()\n  btrfs: fix an incorrect ASSERT() condition inside zstd_decompress_bio()\n  btrfs: do not touch page cache for encoded writes\n  btrfs: fix a bug that makes encoded write bio larger than expected\n  btrfs: reserve enough transaction items for qgroup ioctls\n  btrfs: check for NULL root after calls to btrfs_csum_root()\n  btrfs: check for NULL root after calls to btrfs_extent_root()\n"
    },
    {
      "commit": "a0c83177734ab98623795e1ba2cf4b72c23de5e7",
      "tree": "4226283eafe1d11029da957c2bd37e410e337bd3",
      "parents": [
        "42bddab0563fe67882b2722620a66dd98c8dbf33",
        "a6e77320badd1444b0429ff8b6f338b750a1dc4f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 18:21:27 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 18:21:27 2026 -0700"
      },
      "message": "Merge tag \u0027drm-fixes-2026-03-21\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Regular weekly pull request, from sunny San Diego. Usual suspects in\n  xe/i915/amdgpu with small fixes all over, then some minor fixes across\n  a few other drivers. It\u0027s probably a bit on the heavy side, but most\n  of the fix seem well contained,\n\n  core:\n   - drm_dev_unplug UAF fix\n\n  pagemap:\n   - lock handling fix\n\n  xe:\n   - A number of teardown fixes\n   - Skip over non-leaf PTE for PRL generation\n   - Fix an uninitialized variable\n   - Fix a missing runtime PM reference\n\n  i915/display:\n   - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display\n   - Fix for PSR entry setup frames count on rejected commit\n   - Fix OOPS if firmware is not loaded and suspend is attempted\n   - Fix unlikely NULL deref due to DC6 on probe\n\n  amdgpu:\n   - Fix gamma 2.2 colorop TFs\n   - BO list fix\n   - LTO fix\n   - DC FP fix\n   - DisplayID handling fix\n   - DCN 2.01 fix\n   - MMHUB boundary fixes\n   - ISP fix\n   - TLB fence fix\n   - Hainan pm fix\n\n  radeon:\n   - Hainan pm fix\n\n  vmwgfx:\n   - memory leak fix\n   - doc warning fix\n\n  imagination:\n   - deadlock fix\n   - interrupt handling fixes\n\n  dw-hdmi-qp:\n   - multi channel audio fix\"\n\n* tag \u0027drm-fixes-2026-03-21\u0027 of https://gitlab.freedesktop.org/drm/kernel: (40 commits)\n  drm/xe: Fix missing runtime PM reference in ccs_mode_store\n  drm/xe: Open-code GGTT MMIO access protection\n  drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp\n  drm/xe/oa: Allow reading after disabling OA stream\n  drm/xe: Skip over non leaf pte for PRL generation\n  drm/xe/guc: Ensure CT state transitions via STOP before DISABLED\n  drm/xe: Trigger queue cleanup if not in wedged mode 2\n  drm/xe: Forcefully tear down exec queues in GuC submit fini\n  drm/xe: Always kill exec queues in xe_guc_submit_pause_abort\n  drm/xe/guc: Fail immediately on GuC load error\n  drm/i915/gt: Check set_default_submission() before deferencing\n  drm/radeon: apply state adjust rules to some additional HAINAN vairants\n  drm/amdgpu: apply state adjust rules to some additional HAINAN vairants\n  drm/amdgpu: rework how we handle TLB fences\n  drm/bridge: dw-hdmi-qp: fix multi-channel audio output\n  drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug\n  drm/amdgpu: Fix ISP segfault issue in kernel v7.0\n  drm/amdgpu/gmc9.0: add bounds checking for cid\n  drm/amdgpu/mmhub4.2.0: add bounds checking for cid\n  drm/amdgpu/mmhub4.1.0: add bounds checking for cid\n  ...\n"
    },
    {
      "commit": "e7bae9a7a5e1251ab414291f4e9304d702bb9221",
      "tree": "70b5dbd77b732e301fc2540252106fc6cb4dfac0",
      "parents": [
        "86259558e422b250aa6aa57163a6d759074573f5"
      ],
      "author": {
        "name": "Guenter Roeck",
        "email": "linux@roeck-us.net",
        "time": "Thu Mar 19 21:31:22 2026 -0700"
      },
      "committer": {
        "name": "Guenter Roeck",
        "email": "linux@roeck-us.net",
        "time": "Fri Mar 20 16:50:58 2026 -0700"
      },
      "message": "hwmon: (max6639) Fix pulses-per-revolution implementation\n\nThe valid range for the pulses-per-revolution devicetree property is\n1..4. The current code checks for a range of 1..5. Fix it.\n\nDeclare the variable used to retrieve pulses per revolution from\ndevicetree as u32 (unsigned) to match the of_property_read_u32() API.\n\nThe current code uses a postfix decrement when writing the pulses per\nresolution into the chip. This has no effect since the value is evaluated\nbefore it is decremented. Fix it by decrementing before evaluating the\nvalue.\n\nFixes: 7506ebcd662b (\"hwmon: (max6639) : Configure based on DT property\")\nCc: Naresh Solanki \u003cnaresh.solanki@9elements.com\u003e\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n"
    },
    {
      "commit": "42bddab0563fe67882b2722620a66dd98c8dbf33",
      "tree": "a2aca082adff962cfa1f327ce59e947f272d3077",
      "parents": [
        "d46d5c8383442ae44c3b782f87719990ac67925b",
        "c4192754e836e0ffed95833509b6ada975b74418"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 11:59:35 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 11:59:35 2026 -0700"
      },
      "message": "Merge tag \u0027execve-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull execve fixes from Kees Cook:\n\n - binfmt_elf_fdpic: fix AUXV size calculation (Andrei Vagin)\n\n - fs/tests: exec: Remove bad test vector\n\n* tag \u0027execve-v7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n  fs/tests: exec: Remove bad test vector\n  binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4\n"
    },
    {
      "commit": "d46d5c8383442ae44c3b782f87719990ac67925b",
      "tree": "99bd362e00aae923e5c148f304d25ab830cd4776",
      "parents": [
        "c612261bedd6bbab7109f798715e449c9d20ff2f",
        "5eb608319bb56464674a71b4a66ea65c6c435d64"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 11:52:32 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 11:52:32 2026 -0700"
      },
      "message": "Merge tag \u0027tty-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial fixes from Greg KH:\n \"Here are some small tty/vt and serial driver fixes for 7.0-rc5.\n  Included in here are:\n\n   - 8250 driver fixes for reported problems\n\n   - serial core lockup fix\n\n   - uartlite driver bugfix\n\n   - vt save/restore bugfix\n\n  All of these have been in linux-next for over a week with no reported\n  problems\"\n\n* tag \u0027tty-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n  vt: save/restore unicode screen buffer for alternate screen\n  serial: 8250_dw: Ensure BUSY is deasserted\n  serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY\n  serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm\n  serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling\n  serial: 8250: Add serial8250_handle_irq_locked()\n  serial: 8250_dw: Avoid unnecessary LCR writes\n  serial: 8250: Protect LCR write in shutdown\n  serial: 8250_pci: add support for the AX99100\n  serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN\n  serial: uartlite: fix PM runtime usage count underflow on probe\n  serial: 8250: always disable IRQ during THRE test\n  serial: 8250: Fix TX deadlock when using DMA\n"
    },
    {
      "commit": "1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3",
      "tree": "591c83756b7fdfb80f186081bedfa17883b1b80b",
      "parents": [
        "63f8b60151dc00895137bfadc987f258060ab264"
      ],
      "author": {
        "name": "Kyle Meyer",
        "email": "kyle.meyer@hpe.com",
        "time": "Fri Mar 20 12:19:20 2026 -0500"
      },
      "committer": {
        "name": "Borislav Petkov (AMD)",
        "email": "bp@alien8.de",
        "time": "Fri Mar 20 19:01:03 2026 +0100"
      },
      "message": "x86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it\u0027s mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes.\n\nFixes: 8a50c5851927 (\"x86/platform/uv: UV support for sub-NUMA clustering\")\nSigned-off-by: Kyle Meyer \u003ckyle.meyer@hpe.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Steve Wahl \u003csteve.wahl@hpe.com\u003e\nCc: stable@vger.kernel.org\nLink: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com\n"
    },
    {
      "commit": "c612261bedd6bbab7109f798715e449c9d20ff2f",
      "tree": "490de81c795658cb41a620eea7e7ff90de73340a",
      "parents": [
        "9f582e39712f950f13dfa1ad49748a90937e48be",
        "418eab7a6f3c002d8e64d6e95ec27118017019af"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:58:56 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:58:56 2026 -0700"
      },
      "message": "Merge tag \u0027io_uring-7.0-20260320\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - A bit of a work-around for AF_UNIX recv multishot, as the in-kernel\n   implementation doesn\u0027t properly signal EOF. We\u0027ll likely rework this\n   one going forward, but the fix is sufficient for now\n\n - Two fixes for incrementally consumed buffers, for non-pollable files\n   and for 0 byte reads\n\n* tag \u0027io_uring-7.0-20260320\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n  io_uring/kbuf: propagate BUF_MORE through early buffer commit path\n  io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF\n  io_uring/poll: fix multishot recv missing EOF on wakeup race\n"
    },
    {
      "commit": "63f8b60151dc00895137bfadc987f258060ab264",
      "tree": "c52f12c8a6a3f347abdb82d782a9c6248f8d7ee8",
      "parents": [
        "201bc182ad6333468013f1af0719ffe125826b6a"
      ],
      "author": {
        "name": "Vladimir Oltean",
        "email": "vladimir.oltean@nxp.com",
        "time": "Fri Mar 20 17:06:53 2026 +0100"
      },
      "committer": {
        "name": "Borislav Petkov (AMD)",
        "email": "bp@alien8.de",
        "time": "Fri Mar 20 17:56:52 2026 +0100"
      },
      "message": "x86/entry/vdso: Fix path of included gettimeofday.c\n\nCommit in Fixes forgot to convert one include path to be relative to the\nkernel source directory after adding latter to flags-y.\n\nFix it.\n\n  [ bp: Rewrite commit message. ]\n\nFixes: 693c819fedcd (\"x86/entry/vdso: Refactor the vdso build\")\nSigned-off-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nLink: https://lore.kernel.org/r/20260307174406.1808981-1-vladimir.oltean@nxp.com\n"
    },
    {
      "commit": "9f582e39712f950f13dfa1ad49748a90937e48be",
      "tree": "f3fdf5ba65511f3ece31c8459d7e0e2ee569095f",
      "parents": [
        "007fe2321509a8287050413655f460d4c5ad8e8c",
        "8c89a077ca796a2fe248c584e9d7e66cff0388c8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:54:40 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:54:40 2026 -0700"
      },
      "message": "Merge tag \u0027spi-fix-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"There\u0027s a couple of core fixes here from Johan, fixing a race\n  condition and an error handling path, plus a bunch of driver specific\n  fixups.\n\n  The Qualcomm issues could be nasty if you ran into them, especially\n  the DMA ordering one\"\n\n* tag \u0027spi-fix-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n  spi: geni-qcom: Check DMA interrupts early in ISR\n  spi: fix statistics allocation\n  spi: fix use-after-free on controller registration failure\n  spi: geni-qcom: Fix CPHA and CPOL mode change detection\n  spi: axiado: Fix double-free in ax_spi_probe()\n  spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()\n  spi: amlogic: spifc-a4: Remove redundant clock cleanup\n"
    },
    {
      "commit": "007fe2321509a8287050413655f460d4c5ad8e8c",
      "tree": "2f971063218dfcb9de7671e317afcedc98ee54f0",
      "parents": [
        "c715f13bb30f9f4d1bd8888667ef32e43b6fedc1",
        "4221f30e3e0a2507641b3397d21aff9e71e749f8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:52:45 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:52:45 2026 -0700"
      },
      "message": "Merge tag \u0027regulator-fix-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fix from Mark Brown:\n \"Just one fix here from Hugo Villeneuve, the documentation for some of\n  the regulator DT properties had been cut\u0027n\u0027pasted so that if anyone\n  actually read it they\u0027d be informed that those properties had\n  completely incorrect meanings\"\n\n* tag \u0027regulator-fix-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n  regulator: dt-bindings: fix typos in regulator-uv-* descriptions\n"
    },
    {
      "commit": "c715f13bb30f9f4d1bd8888667ef32e43b6fedc1",
      "tree": "6e8a5436ca581fd00a603f1b9084ba99e941262d",
      "parents": [
        "d07252736a6e946ca0cf4e7ce456eab5c3fd73e2",
        "b826d2c0b0ecb844c84431ba6b502e744f5d919a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:46:15 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:46:15 2026 -0700"
      },
      "message": "Merge tag \u0027pmdomain-v7.0-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm\n\nPull pmdomain fixes from Ulf Hansson:\n\n - bcm: increase ASB control timeout for bcm2835\n\n - mediatek: fix power domain count\n\n* tag \u0027pmdomain-v7.0-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:\n  pmdomain: bcm: bcm2835-power: Increase ASB control timeout\n  pmdomain: mediatek: Fix power domain count\n"
    },
    {
      "commit": "d07252736a6e946ca0cf4e7ce456eab5c3fd73e2",
      "tree": "d30560375f9cac0da4ea9e084632b391bdb1e122",
      "parents": [
        "f374ff79f4bc4615cb5e13f77f349cb7a45c1c54",
        "5e3486e64094c28a526543f1e8aa0d5964b7f02d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:40:25 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:40:25 2026 -0700"
      },
      "message": "Merge tag \u0027mmc-v7.0-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fixes from Ulf Hansson:\n\n - sdhci: Fix timing selection for 1-bit bus width\n\n - sdhci-pci-gli: Fix DMA write corruption for GL9750\n\n* tag \u0027mmc-v7.0-rc1-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n  mmc: sdhci: fix timing selection for 1-bit bus width\n  mmc: sdhci-pci-gli: fix GL9750 DMA write corruption\n"
    },
    {
      "commit": "f374ff79f4bc4615cb5e13f77f349cb7a45c1c54",
      "tree": "b93971c8396deb67bb0ced991e7f5388a00c9f73",
      "parents": [
        "6ac513185c410f9404ff66b920bec137cbc6e543",
        "e6d7eba23b666d85cacee0643be280d6ce1ebffc"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:38:12 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:38:12 2026 -0700"
      },
      "message": "Merge tag \u0027ata-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Niklas Cassel:\n\n - ADATA SU680 SSDs are causing command timeouts when LPM is enabled.\n   Enable the ATA_QUIRK_NOLPM quirk to prevent LPM from being enabled\n   on these devices (Damien)\n\n - When receiving a REPORT SUPPORTED OPERATION CODES command with an\n   invalid REPORTING OPTIONS format, sense data should have the field\n   pointer set to byte 2 (the location of the REPORTING OPTIONS field)\n   instead of incorrectly pointing to byte 1 (Damien)\n\n* tag \u0027ata-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n  ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()\n  ata: libata-core: disable LPM on ADATA SU680 SSD\n"
    },
    {
      "commit": "6ac513185c410f9404ff66b920bec137cbc6e543",
      "tree": "45e215dca456d9a6f7358d7743b33492ac0bf7c0",
      "parents": [
        "47e231cbd363669eef28dfa97496621e0fc6db88",
        "b9465b04de4b90228de03db9a1e0d56b00814366"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:34:32 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:34:32 2026 -0700"
      },
      "message": "Merge tag \u0027mtd/fixes-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull MTD fixes from Miquel Raynal:\n\n - In SPI NOR, there was an issue with the RDCR capability, leading to\n   several platforms no longer capable of using it for wrong reasons\n   (the follow-up commit renames the helper to avoid future confusion)\n\n - NAND controller drivers needed to be improved to fix some timings, a\n   locking schenario and avoid certain operations during panic writes\n\n - The Spear600 DT binding conversion was done partially, leading to\n   several warnings which have individually been fixed\n\n - Tudor gets replaced by Takahiro for the SPI NOR maintainance\n\n - Plus two more misc fixes\n\n* tag \u0027mtd/fixes-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n  mtd: rawnand: pl353: make sure optimal timings are applied\n  mtd: spi-nor: Rename spi_nor_spimem_check_op()\n  mtd: spi-nor: Fix RDCR controller capability core check\n  mtd: rawnand: brcmnand: skip DMA during panic write\n  mtd: rawnand: serialize lock/unlock against other NAND operations\n  dt-bindings: mtd: st,spear600-smi: Fix example\n  dt-bindings: mtd: st,spear600-smi: #address/size-cells is mandatory\n  dt-bindings: mtd: st,spear600-smi: Fix description\n  mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()\n  mtd: Avoid boot crash in RedBoot partition table parser\n  MAINTAINERS: add Takahiro Kuwano as SPI NOR reviewer\n  MAINTAINERS: remove Tudor Ambarus as SPI NOR maintainer\n"
    },
    {
      "commit": "47e231cbd363669eef28dfa97496621e0fc6db88",
      "tree": "0c5e4479450ad4e1a32abb6726a02d6c993f7fc3",
      "parents": [
        "165160265e4be3a6639dd4ea5ca0953a858e2156",
        "ba17de98545d07285d15ce4fe2afe98283338fb0"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:29:03 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:29:03 2026 -0700"
      },
      "message": "Merge tag \u0027iommu-fixes-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux\n\nPull iommu fixes from Joerg Roedel:\n \"Intel VT-d:\n   - Abort all pending requests on dev_tlb_inv timeout to avoid\n     hardlockup\n   - Limit IOPF handling to PRI-capable device to avoid SVA attach\n     failure\n\n  AMD-Vi:\n   - Make sure identity domain is not used when SNP is active\n\n  Core fixes:\n   - Handle mapping IOVA 0x0 correctly\n   - Fix crash in SVA code\n   - Kernel-doc fix in IO-PGTable code\"\n\n* tag \u0027iommu-fixes-v7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:\n  iommu/amd: Block identity domain when SNP enabled\n  iommu/sva: Fix crash in iommu_sva_unbind_device()\n  iommu/io-pgtable: fix all kernel-doc warnings in io-pgtable.h\n  iommu: Fix mapping check for 0x0 to avoid re-mapping it\n  iommu/vt-d: Only handle IOPF for SVA when PRI is supported\n  iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry\n"
    },
    {
      "commit": "165160265e4be3a6639dd4ea5ca0953a858e2156",
      "tree": "3673abd59108195a1a8c61d970e6c073b8ff5dd0",
      "parents": [
        "c3d13784d5b200fc4b4a1f5d5f5585b8e3a5777e",
        "8c6e9b60f5c7985a9fe41320556a92d7a33451df"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:23:01 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:23:01 2026 -0700"
      },
      "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"There\u0027s a small crop of fixes for the MPAM resctrl driver, a fix for\n  SCS/PAC patching with the AMDGPU driver and a page-table fix for\n  realms running with 52-bit physical addresses:\n\n   - Fix DWARF parsing for SCS/PAC patching to work with very large\n     modules (such as the amdgpu driver)\n\n   - Fixes to the mpam resctrl driver\n\n   - Fix broken handling of 52-bit physical addresses when sharing\n     memory from within a realm\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n  arm64: realm: Fix PTE_NS_SHARED for 52bit PA support\n  arm_mpam: Force __iomem casts\n  arm_mpam: Disable preemption when making accesses to fake MSC in kunit test\n  arm_mpam: Fix null pointer dereference when restoring bandwidth counters\n  arm64/scs: Fix handling of advance_loc4\n"
    },
    {
      "commit": "c3d13784d5b200fc4b4a1f5d5f5585b8e3a5777e",
      "tree": "1ebe806268efc0a8db228a7a68db0912c52be85f",
      "parents": [
        "7006433ca2de80e4aa7d11dceb3124335cff5a43",
        "c0e296f257671ba10249630fe58026f29e4804d9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:18:22 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:18:22 2026 -0700"
      },
      "message": "Merge tag \u0027hyperv-fixes-signed-20260319\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux\n\nPull Hyper-V fixes from Wei Liu:\n\n - Fix ARM64 MSHV support (Anirudh Rayabharam)\n\n - Fix MSHV driver memory handling issues (Stanislav Kinsburskii)\n\n - Update maintainers for Hyper-V DRM driver (Saurabh Sengar)\n\n - Misc clean up in MSHV crashdump code (Ard Biesheuvel, Uros Bizjak)\n\n - Minor improvements to MSHV code (Mukesh R, Wei Liu)\n\n - Revert not yet released MSHV scrub partition hypercall (Wei Liu)\n\n* tag \u0027hyperv-fixes-signed-20260319\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:\n  mshv: Fix error handling in mshv_region_pin\n  MAINTAINERS: Update maintainers for Hyper-V DRM driver\n  mshv: Fix use-after-free in mshv_map_user_memory error path\n  mshv: pass struct mshv_user_mem_region by reference\n  x86/hyperv: Use any general-purpose register when saving %cr2 and %cr8\n  x86/hyperv: Use current_stack_pointer to avoid asm() in hv_hvcrash_ctxt_save()\n  x86/hyperv: Save segment registers directly to memory in hv_hvcrash_ctxt_save()\n  x86/hyperv: Use __naked attribute to fix stackless C function\n  Revert \"mshv: expose the scrub partition hypercall\"\n  mshv: add arm64 support for doorbell \u0026 intercept SINTs\n  mshv: refactor synic init and cleanup\n  x86/hyperv: print out reserved vectors in hexadecimal\n"
    },
    {
      "commit": "a6e77320badd1444b0429ff8b6f338b750a1dc4f",
      "tree": "0d38eb87c8a76fdee42c71650267c57a27aa3992",
      "parents": [
        "a15130d588143a20592d55e2bb2be5489116a88f",
        "65d046b2d8e0d6d855379a981869005fd6b6a41b"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 02:12:41 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 02:17:59 2026 +1000"
      },
      "message": "Merge tag \u0027drm-xe-fixes-2026-03-19\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- A number of teardown fixes (Daniele, Matt Brost, Zhanjun, Ashutosh)\n- Skip over non-leaf PTE for PRL generation  (Brian)\n- Fix an unitialized variable (Umesh)\n- Fix a missing runtime PM reference (Sanjay)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/abxj4_dBHYBiSvDG@fedora\n"
    },
    {
      "commit": "7006433ca2de80e4aa7d11dceb3124335cff5a43",
      "tree": "f4a80332a7381098a87c3dbaf20394d5482e9051",
      "parents": [
        "f268964788a90966f8d18fa00adb94d4ae2ea812",
        "23b5df09c27aec13962b30d32a4167ebdd043f8e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:07:29 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:07:29 2026 -0700"
      },
      "message": "Merge tag \u0027v7.0-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n\n - Fix reporting of i_blocks\n\n - Fix Kerberos mounts with different usernames to same server\n\n - Trivial comment cleanup\n\n* tag \u0027v7.0-rc4-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n  smb: client: fix generic/694 due to wrong -\u003ei_blocks\n  cifs: smb1: fix comment typo\n  smb: client: fix krb5 mount with username option\n"
    },
    {
      "commit": "f268964788a90966f8d18fa00adb94d4ae2ea812",
      "tree": "11f532239678efef876f87679c3ec774132ae844",
      "parents": [
        "0e4f8f1a3d081e834be5fd0a62bdb2554fadd307",
        "b425e4d0eb321a1116ddbf39636333181675d8f4"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:03:37 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Mar 20 09:03:37 2026 -0700"
      },
      "message": "Merge tag \u0027v7.0-rc4-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Three use after free fixes (in close, in compounded ops, and in tree\n   disconnect)\n\n - Multichannel fix\n\n - return proper volume identifier (superblock uuid if available) in\n   FS_OBJECT_ID queries\n\n* tag \u0027v7.0-rc4-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n  ksmbd: fix use-after-free in durable v2 replay of active file handles\n  ksmbd: fix use-after-free of share_conf in compound request\n  ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION\n  ksmbd: unset conn-\u003ebinding on failed binding request\n  ksmbd: fix share_conf UAF in tree_conn disconnect\n"
    },
    {
      "commit": "a15130d588143a20592d55e2bb2be5489116a88f",
      "tree": "a70d77d256ac1aeff4c6c3ef698c18dea3c864c5",
      "parents": [
        "437eccb1a89d7038776d3119e54bfda119c6e92a",
        "86650ee2241ff84207eaa298ab318533f3c21a38"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:57:51 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:58:36 2026 +1000"
      },
      "message": "Merge tag \u0027amd-drm-fixes-7.0-2026-03-19\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.0-2026-03-19:\n\namdgpu:\n- Fix gamma 2.2 colorop TFs\n- BO list fix\n- LTO fix\n- DC FP fix\n- DisplayID handling fix\n- DCN 2.01 fix\n- MMHUB boundary fixes\n- ISP fix\n- TLB fence fix\n- Hainan pm fix\n\nradeon:\n- Hainan pm fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260319131013.36639-1-alexander.deucher@amd.com\n"
    },
    {
      "commit": "437eccb1a89d7038776d3119e54bfda119c6e92a",
      "tree": "c657bf147f0f9ab36363b72d2116bd583361fe63",
      "parents": [
        "d551d2e876bf0e5f41d3cf54d4d63180cd8b8ff0",
        "cffcb42c57686e9a801dfcf37a3d0c62e51c1c3e"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:52:29 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:52:36 2026 +1000"
      },
      "message": "Merge tag \u0027drm-misc-fixes-2026-03-19\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA doc warning fix and a memory leak fix for vmwgfx, a deadlock fix and\ninterrupt handling fixes for imagination, a locking fix for\npagemap_until, a UAF fix for drm_dev_unplug, and a multi-channel audio\nhandling fix for dw-hdmi-qp.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patch.msgid.link/20260319-lush-righteous-malamute-e7bb98@houat\n"
    },
    {
      "commit": "d551d2e876bf0e5f41d3cf54d4d63180cd8b8ff0",
      "tree": "803c8440989d2c155ebd3f6ba30cdef77ad652fd",
      "parents": [
        "f338e77383789c0cae23ca3d48adcc5e9e137e3c",
        "0162ab3220bac870e43e229e6e3024d1a21c3f26"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:43:57 2026 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Sat Mar 21 01:43:59 2026 +1000"
      },
      "message": "Merge tag \u0027drm-intel-fixes-2026-03-19\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- Fix #15771: Screen corruption and stuttering on P14s w/ 3K display\n- Fix for PSR entry setup frames count on rejected commit\n- Fix OOPS if firmware is not loaded and suspend is attempted\n- Fix unlikely NULL deref due to DC6 on probe\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patch.msgid.link/abujAnD-lRDCVSKg@jlahtine-mobl\n"
    },
    {
      "commit": "e6d7eba23b666d85cacee0643be280d6ce1ebffc",
      "tree": "02efc92181cef7de151d8ab8c1fb9eec419854fe",
      "parents": [
        "ce5ae93d1a216680460040c7c0465a6e3b629dec"
      ],
      "author": {
        "name": "Damien Le Moal",
        "email": "dlemoal@kernel.org",
        "time": "Fri Mar 20 12:48:01 2026 +0900"
      },
      "committer": {
        "name": "Niklas Cassel",
        "email": "cassel@kernel.org",
        "time": "Fri Mar 20 09:59:30 2026 +0100"
      },
      "message": "ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()\n\nCommit 4ab7bb976343 (\"ata: libata-scsi: Refactor ata_scsiop_maint_in()\")\nmodified ata_scsiop_maint_in() to directly call\nata_scsi_set_invalid_field() to set the field pointer of the sense data\nof a failed MAINTENANCE IN command. However, in the case of an invalid\ncommand format, the sense data field incorrectly indicates byte 1 of\nthe CDB. Fix this to indicate byte 2 of the command.\n\nReported-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nFixes: 4ab7bb976343 (\"ata: libata-scsi: Refactor ata_scsiop_maint_in()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\n"
    },
    {
      "commit": "0e4f8f1a3d081e834be5fd0a62bdb2554fadd307",
      "tree": "5e385e0e483ff8811a28741f2d2ee2688f75afe9",
      "parents": [
        "9b70771216558bffb329c2e69b2fd5fd71133e55",
        "2c98a8fbd6aa647414c6248dacf254ebe91c79ad"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 16:28:41 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 16:28:41 2026 -0700"
      },
      "message": "Merge tag \u0027parisc-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fix from Helge Deller:\n \"Fix for the cacheflush() syscall which had D/I caches mixed up\"\n\n* tag \u0027parisc-for-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n  parisc: Flush correct cache in cacheflush() syscall\n"
    },
    {
      "commit": "9b70771216558bffb329c2e69b2fd5fd71133e55",
      "tree": "c53dae2ee362f8d94c96efe2a6857829cd49dd63",
      "parents": [
        "a1d9d8e833781c44ab688708804ce35f20f3cbbd",
        "21647677ba9af2cb6bc460e17d9f29a7132c40c3"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 16:13:51 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 16:13:51 2026 -0700"
      },
      "message": "Merge tag \u0027pci-v7.0-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci\n\nPull pci fixes from Bjorn Helgaas:\n\n - Create pwrctrl devices only for DT nodes below a PCI controller that\n   describe PCI devices and are related to a power supply; this prevents\n   waiting indefinitely for pwrctrl drivers that will never probe\n   (Manivannan Sadhasivam)\n\n - Restore endpoint BAR mapping on subrange setup failure to make\n   selftest reliable (Koichiro Den)\n\n* tag \u0027pci-v7.0-fixes-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:\n  PCI: endpoint: pci-epf-test: Roll back BAR mapping when subrange setup fails\n  PCI/pwrctrl: Create pwrctrl devices only for PCI device nodes\n  PCI/pwrctrl: Ensure that remote endpoint node parent has supply requirement\n"
    },
    {
      "commit": "78a6ee14f8b9e1c8f7c77612122444f3be8dc8cc",
      "tree": "4155db6d1151395dfff43968da3fc8e035d18454",
      "parents": [
        "be627abcc0d5dbd5882873bd85fbc18aa3d189ed"
      ],
      "author": {
        "name": "Gabor Juhos",
        "email": "j4g8y7@gmail.com",
        "time": "Thu Feb 26 14:11:27 2026 +0100"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Thu Mar 19 23:54:03 2026 +0100"
      },
      "message": "i2c: pxa: defer reset on Armada 3700 when recovery is used\n\nThe I2C communication is completely broken on the Armada 3700 platform\nsince commit 0b01392c18b9 (\"i2c: pxa: move to generic GPIO recovery\").\n\nFor example, on the Methode uDPU board, probing of the two onboard\ntemperature sensors fails ...\n\n  [    7.271713] i2c i2c-0: using pinctrl states for GPIO recovery\n  [    7.277503] i2c i2c-0:  PXA I2C adapter\n  [    7.282199] i2c i2c-1: using pinctrl states for GPIO recovery\n  [    7.288241] i2c i2c-1:  PXA I2C adapter\n  [    7.292947] sfp sfp-eth1: Host maximum power 3.0W\n  [    7.299614] sfp sfp-eth0: Host maximum power 3.0W\n  [    7.308178] lm75 1-0048: supply vs not found, using dummy regulator\n  [   32.489631] lm75 1-0048: probe with driver lm75 failed with error -121\n  [   32.496833] lm75 1-0049: supply vs not found, using dummy regulator\n  [   82.890614] lm75 1-0049: probe with driver lm75 failed with error -121\n\n... and accessing the plugged-in SFP modules also does not work:\n\n  [  511.298537] sfp sfp-eth1: please wait, module slow to respond\n  [  536.488530] sfp sfp-eth0: please wait, module slow to respond\n  ...\n  [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO\n  [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO\n\nAfter a discussion [1], there was an attempt to fix the problem by\nreverting the offending change by commit 7b211c767121 (\"Revert \"i2c:\npxa: move to generic GPIO recovery\"\"), but that only helped to fix\nthe issue in the 6.1.y stable tree. The reason behind the partial succes\nis that there was another change in commit 20cb3fce4d60 (\"i2c: Set i2c\npinctrl recovery info from it\u0027s device pinctrl\") in the 6.3-rc1 cycle\nwhich broke things further.\n\nThe cause of the problem is the same in case of both offending commits\nmentioned above. Namely, the I2C core code changes the pinctrl state to\nGPIO while running the recovery initialization code. Although the PXA\nspecific initialization also does this, but the key difference is that\nit happens before the controller is getting enabled in i2c_pxa_reset(),\nwhereas in the case of the generic initialization it happens after that.\n\nChange the code to reset the controller only before the first transfer\ninstead of before registering the controller. This ensures that the\ncontroller is not enabled at the time when the generic recovery code\nperforms the pinctrl state changes, thus avoids the problem described\nabove.\n\nAs the result this change restores the original behaviour, which in\nturn makes the I2C communication to work again as it can be seen from\nthe following log:\n\n  [    7.363250] i2c i2c-0: using pinctrl states for GPIO recovery\n  [    7.369041] i2c i2c-0:  PXA I2C adapter\n  [    7.373673] i2c i2c-1: using pinctrl states for GPIO recovery\n  [    7.379742] i2c i2c-1:  PXA I2C adapter\n  [    7.384506] sfp sfp-eth1: Host maximum power 3.0W\n  [    7.393013] sfp sfp-eth0: Host maximum power 3.0W\n  [    7.399266] lm75 1-0048: supply vs not found, using dummy regulator\n  [    7.407257] hwmon hwmon0: temp1_input not attached to any thermal zone\n  [    7.413863] lm75 1-0048: hwmon0: sensor \u0027tmp75c\u0027\n  [    7.418746] lm75 1-0049: supply vs not found, using dummy regulator\n  [    7.426371] hwmon hwmon1: temp1_input not attached to any thermal zone\n  [    7.432972] lm75 1-0049: hwmon1: sensor \u0027tmp75c\u0027\n  [    7.755092] sfp sfp-eth1: module MENTECHOPTO      POS22-LDCC-KR    rev 1.0  sn MNC208U90009     dc 200828\n  [    7.764997] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes\n  [    7.785362] sfp sfp-eth0: module Mikrotik         S-RJ01           rev 1.0  sn 61B103C55C58     dc 201022\n  [    7.803426] hwmon hwmon2: temp1_input not attached to any thermal zone\n\nLink: https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr #1\n\nCc: stable@vger.kernel.org # 6.3+\nFixes: 20cb3fce4d60 (\"i2c: Set i2c pinctrl recovery info from it\u0027s device pinctrl\")\nSigned-off-by: Gabor Juhos \u003cj4g8y7@gmail.com\u003e\nTested-by: Robert Marko \u003crobert.marko@sartura.hr\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260226-i2c-pxa-fix-i2c-communication-v4-1-797a091dae87@gmail.com\n"
    },
    {
      "commit": "be627abcc0d5dbd5882873bd85fbc18aa3d189ed",
      "tree": "2a28e7787a86d1e24b2d45943c42de7380471b50",
      "parents": [
        "aa79f996eb41e95aed85a1bd7f56bcd6a3842008"
      ],
      "author": {
        "name": "Christophe JAILLET",
        "email": "christophe.jaillet@wanadoo.fr",
        "time": "Sun Mar 01 17:21:01 2026 +0100"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Thu Mar 19 23:45:06 2026 +0100"
      },
      "message": "i2c: fsi: Fix a potential leak in fsi_i2c_probe()\n\nIn the commit in Fixes:, when the code has been updated to use an explicit\nfor loop, instead of for_each_available_child_of_node(), the assumption\nthat a reference to a device_node structure would be released at each\niteration has been broken.\n\nNow, an explicit of_node_put() is needed to release the reference.\n\nFixes: 095561f476ab (\"i2c: fsi: Create busses for all ports\")\nSigned-off-by: Christophe JAILLET \u003cchristophe.jaillet@wanadoo.fr\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v5.3+\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/fd805c39f8de51edf303856103d782138a1633c8.1772382022.git.christophe.jaillet@wanadoo.fr\n"
    },
    {
      "commit": "aa79f996eb41e95aed85a1bd7f56bcd6a3842008",
      "tree": "058a0c5e53ce5023e88c139f608479be5e6ee7c1",
      "parents": [
        "f338e77383789c0cae23ca3d48adcc5e9e137e3c"
      ],
      "author": {
        "name": "Johan Hovold",
        "email": "johan@kernel.org",
        "time": "Mon Mar 09 08:50:16 2026 +0100"
      },
      "committer": {
        "name": "Andi Shyti",
        "email": "andi.shyti@kernel.org",
        "time": "Thu Mar 19 23:22:25 2026 +0100"
      },
      "message": "i2c: cp2615: fix serial string NULL-deref at probe\n\nThe cp2615 driver uses the USB device serial string as the i2c adapter\nname but does not make sure that the string exists.\n\nVerify that the device has a serial number before accessing it to avoid\ntriggering a NULL-pointer dereference (e.g. with malicious devices).\n\nFixes: 4a7695429ead (\"i2c: cp2615: add i2c driver for Silicon Labs\u0027 CP2615 Digital Audio Bridge\")\nCc: stable@vger.kernel.org\t# 5.13\nCc: Bence Csókás \u003cbence98@sch.bme.hu\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nReviewed-by: Bence Csókás \u003cbence98@sch.bme.hu\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://lore.kernel.org/r/20260309075016.25612-1-johan@kernel.org\n"
    },
    {
      "commit": "418eab7a6f3c002d8e64d6e95ec27118017019af",
      "tree": "5ba5ecb89fd9b5c09d96b0b4b32ead7c34c138a9",
      "parents": [
        "3ecd3e03144b38a21a3b70254f1b9d2e16629b09"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 19 14:29:20 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 19 15:09:48 2026 -0600"
      },
      "message": "io_uring/kbuf: propagate BUF_MORE through early buffer commit path\n\nWhen io_should_commit() returns true (eg for non-pollable files), buffer\ncommit happens at buffer selection time and sel-\u003ebuf_list is set to\nNULL. When __io_put_kbufs() generates CQE flags at completion time, it\ncalls __io_put_kbuf_ring() which finds a NULL buffer_list and hence\ncannot determine whether the buffer was consumed or not. This means that\nIORING_CQE_F_BUF_MORE is never set for non-pollable input with\nincrementally consumed buffers.\n\nLikewise for io_buffers_select(), which always commits upfront and\ndiscards the return value of io_kbuf_commit().\n\nAdd REQ_F_BUF_MORE to store the result of io_kbuf_commit() during early\ncommit. Then __io_put_kbuf_ring() can check this flag and set\nIORING_F_BUF_MORE accordingy.\n\nReported-by: Martin Michaelis \u003ccode@mgjm.de\u003e\nCc: stable@vger.kernel.org\nFixes: ae98dbf43d75 (\"io_uring/kbuf: add support for incremental buffer consumption\")\nLink: https://github.com/axboe/liburing/issues/1553\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "3ecd3e03144b38a21a3b70254f1b9d2e16629b09",
      "tree": "f22e192299277974691d60645d808aeb4f84d6b6",
      "parents": [
        "a68ed2df72131447d131531a08fe4dfcf4fa4653"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 19 14:29:09 2026 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Thu Mar 19 15:09:40 2026 -0600"
      },
      "message": "io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF\n\nFor a zero length transfer, io_kbuf_inc_commit() is called with !len.\nSince we never enter the while loop to consume the buffers,\nio_kbuf_inc_commit() ends up returning true, consuming the buffer. But\nif no data was consumed, by definition it cannot have consumed the\nbuffer. Return false for that case.\n\nReported-by: Martin Michaelis \u003ccode@mgjm.de\u003e\nCc: stable@vger.kernel.org\nFixes: ae98dbf43d75 (\"io_uring/kbuf: add support for incremental buffer consumption\")\nLink: https://github.com/axboe/liburing/issues/1553\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "23b5df09c27aec13962b30d32a4167ebdd043f8e",
      "tree": "387ef8c29643ed9e9c72a57a74f6bda125a93de4",
      "parents": [
        "50bfd2a22b75a904d5900d64530ae1b69a69907c"
      ],
      "author": {
        "name": "Paulo Alcantara",
        "email": "pc@manguebit.org",
        "time": "Wed Mar 18 21:43:51 2026 -0300"
      },
      "committer": {
        "name": "Steve French",
        "email": "stfrench@microsoft.com",
        "time": "Thu Mar 19 13:56:25 2026 -0500"
      },
      "message": "smb: client: fix generic/694 due to wrong -\u003ei_blocks\n\nWhen updating -\u003ei_size, make sure to always update -\u003ei_blocks as well\nuntil we query new allocation size from the server.\n\ngeneric/694 was failing because smb3_simple_falloc() was missing the\nupdate of -\u003ei_blocks after calling cifs_setsize().  So, fix this by\nupdating -\u003ei_blocks directly in cifs_setsize(), so all places that\ncall it doesn\u0027t need to worry about updating -\u003ei_blocks later.\n\nReported-by: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nCloses: https://lore.kernel.org/r/CANT5p\u003drqgRwaADB\u003db_PhJkqXjtfq3SFv41SSTXSVEHnuh871pA@mail.gmail.com\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.org\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: linux-cifs@vger.kernel.org\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n"
    },
    {
      "commit": "a1d9d8e833781c44ab688708804ce35f20f3cbbd",
      "tree": "2b1ef43c69d3b4e9d978b508a45b1fac4ee2629e",
      "parents": [
        "e9825d1c79570b4c11259e826b3f7c1511544a85",
        "7ab4a7c5d969642782b8a5b608da0dd02aa9f229"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 11:25:40 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 11:25:40 2026 -0700"
      },
      "message": "Merge tag \u0027net-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless, Bluetooth and netfilter.\n\n  Nothing too exciting here, mostly fixes for corner cases.\n\n  Current release - fix to a fix:\n\n   - bonding: prevent potential infinite loop in bond_header_parse()\n\n  Current release - new code bugs:\n\n   - wifi: mac80211: check tdls flag in ieee80211_tdls_oper\n\n  Previous releases - regressions:\n\n   - af_unix: give up GC if MSG_PEEK intervened\n\n   - netfilter: conntrack: add missing netlink policy validations\n\n   - NFC: nxp-nci: allow GPIOs to sleep\"\n\n* tag \u0027net-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (78 commits)\n  MPTCP: fix lock class name family in pm_nl_create_listen_socket\n  icmp: fix NULL pointer dereference in icmp_tag_validation()\n  net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths\n  net: shaper: protect from late creation of hierarchy\n  net: shaper: protect late read accesses to the hierarchy\n  net: mvpp2: guard flow control update with global_tx_fc in buffer switching\n  nfnetlink_osf: validate individual option lengths in fingerprints\n  netfilter: nf_tables: release flowtable after rcu grace period on error\n  netfilter: bpf: defer hook memory release until rcu readers are done\n  net: bonding: fix NULL deref in bond_debug_rlb_hash_show\n  udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6\u003dn\n  net/mlx5e: Fix race condition during IPSec ESN update\n  net/mlx5e: Prevent concurrent access to IPSec ASO context\n  net/mlx5: qos: Restrict RTNL area to avoid a lock cycle\n  ipv6: add NULL checks for idev in SRv6 paths\n  NFC: nxp-nci: allow GPIOs to sleep\n  net: macb: fix uninitialized rx_fs_lock\n  net: macb: fix use-after-free access to PTP clock\n  netdevsim: drop PSP ext ref on forward failure\n  wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n  ...\n"
    },
    {
      "commit": "65d046b2d8e0d6d855379a981869005fd6b6a41b",
      "tree": "82c01f4bc6f3eec419835fc42438a3dc09842d46",
      "parents": [
        "01f2557aa684e514005541e71a3d01f4cd45c170"
      ],
      "author": {
        "name": "Sanjay Yadav",
        "email": "sanjay.kumar.yadav@intel.com",
        "time": "Fri Mar 13 12:46:09 2026 +0530"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 18:05:04 2026 +0100"
      },
      "message": "drm/xe: Fix missing runtime PM reference in ccs_mode_store\n\nccs_mode_store() calls xe_gt_reset() which internally invokes\nxe_pm_runtime_get_noresume(). That function requires the caller\nto already hold an outer runtime PM reference and warns if none\nis held:\n\n  [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection\n  [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at\n  xe_pm_runtime_get_noresume+0x8b/0xc0\n\nFix this by protecting xe_gt_reset() with the scope-based\nguard(xe_pm_runtime)(xe), which is the preferred form when\nthe reference lifetime matches a single scope.\n\nv2:\n- Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng)\n- Update commit message accordingly\n\nCloses: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/7593\nFixes: 480b358e7d8e (\"drm/xe: Do not wake device during a GT reset\")\nCc: \u003cstable@vger.kernel.org\u003e # v6.19+\nCc: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\nCc: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nSuggested-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nSigned-off-by: Sanjay Yadav \u003csanjay.kumar.yadav@intel.com\u003e\nReviewed-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nSigned-off-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260313071608.3459480-2-sanjay.kumar.yadav@intel.com\n(cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "7ab4a7c5d969642782b8a5b608da0dd02aa9f229",
      "tree": "e81b01f34043a820153bd1ed3f0e32e73517c0fe",
      "parents": [
        "614aefe56af8e13331e50220c936fc0689cf5675"
      ],
      "author": {
        "name": "Li Xiasong",
        "email": "lixiasong1@huawei.com",
        "time": "Thu Mar 19 19:21:59 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Mar 19 09:37:48 2026 -0700"
      },
      "message": "MPTCP: fix lock class name family in pm_nl_create_listen_socket\n\nIn mptcp_pm_nl_create_listen_socket(), use entry-\u003eaddr.family\ninstead of sk-\u003esk_family for lock class setup. The \u0027sk\u0027 parameter\nis a netlink socket, not the MPTCP subflow socket being created.\n\nFixes: cee4034a3db1 (\"mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()\")\nSigned-off-by: Li Xiasong \u003clixiasong1@huawei.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260319112159.3118874-1-lixiasong1@huawei.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "614aefe56af8e13331e50220c936fc0689cf5675",
      "tree": "6f241f1eaab46bcd903df6c5f1a040fdf929f260",
      "parents": [
        "b48731849609cbd8c53785a48976850b443153fd"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Wed Mar 18 21:06:01 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Mar 19 09:27:36 2026 -0700"
      },
      "message": "icmp: fix NULL pointer dereference in icmp_tag_validation()\n\nicmp_tag_validation() unconditionally dereferences the result of\nrcu_dereference(inet_protos[proto]) without checking for NULL.\nThe inet_protos[] array is sparse -- only about 15 of 256 protocol\nnumbers have registered handlers. When ip_no_pmtu_disc is set to 3\n(hardened PMTU mode) and the kernel receives an ICMP Fragmentation\nNeeded error with a quoted inner IP header containing an unregistered\nprotocol number, the NULL dereference causes a kernel panic in\nsoftirq context.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)\n Call Trace:\n  \u003cIRQ\u003e\n  icmp_rcv (net/ipv4/icmp.c:1527)\n  ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:242)\n  ip_local_deliver (net/ipv4/ip_input.c:262)\n  ip_rcv (net/ipv4/ip_input.c:573)\n  __netif_receive_skb_one_core (net/core/dev.c:6164)\n  process_backlog (net/core/dev.c:6628)\n  handle_softirqs (kernel/softirq.c:561)\n  \u003c/IRQ\u003e\n\nAdd a NULL check before accessing icmp_strict_tag_validation. If the\nprotocol has no registered handler, return false since it cannot\nperform strict tag validation.\n\nFixes: 8ed1dc44d3e9 (\"ipv4: introduce hardened ip_no_pmtu_disc mode\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260318130558.1050247-4-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b48731849609cbd8c53785a48976850b443153fd",
      "tree": "3e838bdd4df42ef90793ff61e54e741095d3f942",
      "parents": [
        "e7577a06ae28287ca415aec5c12277e3a80ee372"
      ],
      "author": {
        "name": "Anas Iqbal",
        "email": "mohd.abd.6602@gmail.com",
        "time": "Wed Mar 18 08:42:12 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Thu Mar 19 09:26:40 2026 -0700"
      },
      "message": "net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths\n\nSmatch reports:\ndrivers/net/dsa/bcm_sf2.c:997 bcm_sf2_sw_resume() warn:\n\u0027priv-\u003eclk\u0027 from clk_prepare_enable() not released on lines: 983,990.\n\nThe clock enabled by clk_prepare_enable() in bcm_sf2_sw_resume()\nis not released if bcm_sf2_sw_rst() or bcm_sf2_cfp_resume() fails.\n\nAdd the missing clk_disable_unprepare() calls in the error paths\nto properly release the clock resource.\n\nFixes: e9ec5c3bd238 (\"net: dsa: bcm_sf2: request and handle clocks\")\nReviewed-by: Jonas Gorski \u003cjonas.gorski@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nSigned-off-by: Anas Iqbal \u003cmohd.abd.6602@gmail.com\u003e\nLink: https://patch.msgid.link/20260318084212.1287-1-mohd.abd.6602@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "01f2557aa684e514005541e71a3d01f4cd45c170",
      "tree": "eb381e10846f9cd5a40a072726a248418803340b",
      "parents": [
        "e6e3ea52bf07a0b7b9dff189616f189b83ee397a"
      ],
      "author": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Tue Mar 10 18:50:39 2026 -0400"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 17:13:54 2026 +0100"
      },
      "message": "drm/xe: Open-code GGTT MMIO access protection\n\nGGTT MMIO access is currently protected by hotplug (drm_dev_enter),\nwhich works correctly when the driver loads successfully and is later\nunbound or unloaded. However, if driver load fails, this protection is\ninsufficient because drm_dev_unplug() is never called.\n\nAdditionally, devm release functions cannot guarantee that all BOs with\nGGTT mappings are destroyed before the GGTT MMIO region is removed, as\nsome BOs may be freed asynchronously by worker threads.\n\nTo address this, introduce an open-coded flag, protected by the GGTT\nlock, that guards GGTT MMIO access. The flag is cleared during the\ndev_fini_ggtt devm release function to ensure MMIO access is disabled\nonce teardown begins.\n\nCc: stable@vger.kernel.org\nFixes: 919bb54e989c (\"drm/xe: Fix missing runtime outer protection for ggtt_remove_node\")\nReviewed-by: Zhanjun Dong \u003czhanjun.dong@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260310225039.1320161-8-zhanjun.dong@intel.com\n(cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "e9825d1c79570b4c11259e826b3f7c1511544a85",
      "tree": "f66082fd270f4381a0f4412c6b8e6a5991795605",
      "parents": [
        "d107dc8c9c6a9f9e4bb213f5a6398fc5c33a00a9",
        "9633370653151a0d5637634d1887d2f32511e69f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 08:45:34 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 08:45:34 2026 -0700"
      },
      "message": "Merge tag \u0027pm-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix an idle loop issue exposed by recent changes and a race\n  condition related to device removal in the runtime PM core code:\n\n   - Consolidate the handling of two special cases in the idle loop that\n     occur when only one CPU idle state is present (Rafael Wysocki)\n\n   - Fix a race condition related to device removal in the runtime PM\n     core code that may cause a stale device object pointer to be\n     dereferenced (Bart Van Assche)\"\n\n* tag \u0027pm-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  PM: runtime: Fix a race condition related to device removal\n  sched: idle: Consolidate the handling of two special cases\n"
    },
    {
      "commit": "d107dc8c9c6a9f9e4bb213f5a6398fc5c33a00a9",
      "tree": "cc16550ccad2de368154cbf9942f7c10cfa83dc2",
      "parents": [
        "1863b4055b7902de43a1dcc7396805eb631682e5",
        "5cbcd6c0742a2986782a9e2c92aa250d8f5c137d"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 08:42:59 2026 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Mar 19 08:42:59 2026 -0700"
      },
      "message": "Merge tag \u0027acpi-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fixes from Rafael Wysocki:\n \"These fix an MFD child automatic modprobe issue introduced recently,\n  an ACPI processor driver issue introduced by a previous fix and an\n  ACPICA issue causing confusing messages regarding _DSM arguments to be\n  printed:\n\n   - Update the format of the last argument of _DSM to avoid printing\n     confusing error messages in some cases (Saket Dumbre)\n\n   - Fix MFD child automatic modprobe issue by removing a stale check\n     from acpi_companion_match() (Pratap Nirujogi)\n\n   - Prevent possible use-after-free in acpi_processor_errata_piix4()\n     from occurring by rearranging the code to print debug messages\n     while holding references to relevant device objects (Rafael\n     Wysocki)\"\n\n* tag \u0027acpi-7.0-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  ACPI: bus: Fix MFD child automatic modprobe issue\n  ACPI: processor: Fix previous acpi_processor_errata_piix4() fix\n  ACPICA: Update the format of Arg3 of _DSM\n"
    },
    {
      "commit": "e7577a06ae28287ca415aec5c12277e3a80ee372",
      "tree": "7af84ba5d5237a2e248b26c25e83e66de1349bae",
      "parents": [
        "d75ec7e8ba1979a1eb0b9211d94d749cdce849c8",
        "dbdfaae9609629a9569362e3b8f33d0a20fd783c"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 19 15:39:33 2026 +0100"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 19 15:39:33 2026 +0100"
      },
      "message": "Merge tag \u0027nf-26-03-19\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*:\n\n1) Fix UaF when netfilter bpf link goes away while nfnetlink dumps\n   current hook list, we have to wait until rcu readers are gone.\n\n2) Fix UaF when flowtable fails to register all devices, similar\n   bug as 1). From Pablo Neira Ayuso.\n\n3) nfnetlink_osf fails to properly validate option length fields.\n   From Weiming Shi.\n\nnetfilter pull request nf-26-03-19\n\n* tag \u0027nf-26-03-19\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n  nfnetlink_osf: validate individual option lengths in fingerprints\n  netfilter: nf_tables: release flowtable after rcu grace period on error\n  netfilter: bpf: defer hook memory release until rcu readers are done\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260319093834.19933-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "5cbcd6c0742a2986782a9e2c92aa250d8f5c137d",
      "tree": "efb7e1f964fc19317ce802b3348e5c6cd5e2dc74",
      "parents": [
        "bf504b229cb8d534eccbaeaa23eba34c05131e25",
        "ab93d7eee94205430fc3b0532557cb0494bf2faf",
        "e7648ffecb7fcb7400e123bb6ea989633a104fc3"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 19 14:57:06 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 19 14:57:06 2026 +0100"
      },
      "message": "Merge branches \u0027acpica\u0027 and \u0027acpi-bus\u0027\n\nMerge an ACPICA fix and a core ACPI support code fix for 7.0-rc5:\n\n - Update the format of the last argument of _DSM to avoid printing\n   confusing error messages in some cases (Saket Dumbre)\n\n - Fix MFD child automatic modprobe issue by removing a stale check\n   from acpi_companion_match() (Pratap Nirujogi)\n\n* acpica:\n  ACPICA: Update the format of Arg3 of _DSM\n\n* acpi-bus:\n  ACPI: bus: Fix MFD child automatic modprobe issue\n"
    },
    {
      "commit": "9633370653151a0d5637634d1887d2f32511e69f",
      "tree": "5d080218dadd228de99d089e5902015e02b37fbf",
      "parents": [
        "f4c31b07b136839e0fb3026f8a5b6543e3b14d2f",
        "29ab768277617452d88c0607c9299cdc63b6e9ff"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 19 14:49:44 2026 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Mar 19 14:49:44 2026 +0100"
      },
      "message": "Merge branch \u0027pm-runtime\u0027\n\nMerge a fix for a race condition related to device removal (Bart Van\nAssche) for 7.0-rc5.\n\n* pm-runtime:\n  PM: runtime: Fix a race condition related to device removal\n"
    },
    {
      "commit": "e6e3ea52bf07a0b7b9dff189616f189b83ee397a",
      "tree": "c6ef992365565f7fe88cdc05ba16499b460164ff",
      "parents": [
        "9be6fd9fbd2032b683e51374497768af9aaa228a"
      ],
      "author": {
        "name": "Umesh Nerlige Ramappa",
        "email": "umesh.nerlige.ramappa@intel.com",
        "time": "Thu Mar 12 05:53:09 2026 -0700"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:23:04 2026 +0100"
      },
      "message": "drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp\n\nGetting engine specific CTX TIMESTAMP register can fail. In that case,\nif the context is active, new_ts is uninitialized. Fix that case by\ninitializing new_ts to the last value that was sampled in SW -\nlrc-\u003ectx_timestamp.\n\nFlagged by static analysis.\n\nv2: Fix new_ts initialization (Ashutosh)\n\nFixes: bb63e7257e63 (\"drm/xe: Avoid toggling schedule state to check LRC timestamp in TDR\")\nSigned-off-by: Umesh Nerlige Ramappa \u003cumesh.nerlige.ramappa@intel.com\u003e\nReviewed-by: Ashutosh Dixit \u003cashutosh.dixit@intel.com\u003e\nLink: https://patch.msgid.link/20260312125308.3126607-2-umesh.nerlige.ramappa@intel.com\n(cherry picked from commit 466e75d48038af252187855058a7a9312db9d2f8)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "9be6fd9fbd2032b683e51374497768af9aaa228a",
      "tree": "62749338efccf73e67351e20db62eeae2e5dfa84",
      "parents": [
        "38b8dcde231641f00eee977d245dbfe5f6b06e11"
      ],
      "author": {
        "name": "Ashutosh Dixit",
        "email": "ashutosh.dixit@intel.com",
        "time": "Thu Mar 12 22:36:30 2026 -0700"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:58 2026 +0100"
      },
      "message": "drm/xe/oa: Allow reading after disabling OA stream\n\nSome OA data might be present in the OA buffer when OA stream is\ndisabled. Allow UMD\u0027s to retrieve this data, so that all data till the\npoint when OA stream is disabled can be retrieved.\n\nv2: Update tail pointer after disable (Umesh)\n\nFixes: efb315d0a013 (\"drm/xe/oa/uapi: Read file_operation\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ashutosh Dixit \u003cashutosh.dixit@intel.com\u003e\nReviewed-by: Umesh Nerlige Ramappa\u003cumesh.nerlige.ramappa@intel.com\u003e\nLink: https://patch.msgid.link/20260313053630.3176100-1-ashutosh.dixit@intel.com\n(cherry picked from commit 4ff57c5e8dbba23b5457be12f9709d5c016da16e)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "38b8dcde231641f00eee977d245dbfe5f6b06e11",
      "tree": "8624a34834852318ed600dc4a31d7b8bd17fb61b",
      "parents": [
        "7838dd8367419e9fc43b79c038321cb3c04de2a2"
      ],
      "author": {
        "name": "Brian Nguyen",
        "email": "brian3.nguyen@intel.com",
        "time": "Thu Mar 05 17:15:48 2026 +0000"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:53 2026 +0100"
      },
      "message": "drm/xe: Skip over non leaf pte for PRL generation\n\nThe check using xe_child-\u003ebase.children was insufficient in determining\nif a pte was a leaf node. So explicitly skip over every non-leaf pt and\nconditionally abort if there is a scenario where a non-leaf pt is\ninterleaved between leaf pt, which results in the page walker skipping\nover some leaf pt.\n\nNote that the behavior being targeted for abort is\nPD[0] \u003d 2M PTE\nPD[1] \u003d PT -\u003e 512 4K PTEs\nPD[2] \u003d 2M PTE\n\nresults in abort, page walker won\u0027t descend PD[1].\n\nWith new abort, ensuring valid PRL before handling a second abort.\n\nv2:\n - Revert to previous assert.\n - Revised non-leaf handling for interleaf child pt and leaf pte.\n - Update comments to specifications. (Stuart)\n - Remove unnecessary XE_PTE_PS64. (Matthew B)\n\nv3:\n - Modify secondary abort to only check non-leaf PTEs. (Matthew B)\n\nFixes: b912138df299 (\"drm/xe: Create page reclaim list on unbind\")\nSigned-off-by: Brian Nguyen \u003cbrian3.nguyen@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nCc: Stuart Summers \u003cstuart.summers@intel.com\u003e\nLink: https://patch.msgid.link/20260305171546.67691-6-brian3.nguyen@intel.com\nSigned-off-by: Matt Roper \u003cmatthew.d.roper@intel.com\u003e\n(cherry picked from commit 1d123587525db86cc8f0d2beb35d9e33ca3ade83)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "7838dd8367419e9fc43b79c038321cb3c04de2a2",
      "tree": "9a386c866d5254757e4604549257d069a383c3ea",
      "parents": [
        "e0f82655df6fbb15b318e9d56724cd54b1cfb04d"
      ],
      "author": {
        "name": "Zhanjun Dong",
        "email": "zhanjun.dong@intel.com",
        "time": "Tue Mar 10 18:50:37 2026 -0400"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:39 2026 +0100"
      },
      "message": "drm/xe/guc: Ensure CT state transitions via STOP before DISABLED\n\nThe GuC CT state transition requires moving to the STOP state before\nentering the DISABLED state. Update the driver teardown sequence to make\nthe proper state machine transitions.\n\nFixes: ee4b32220a6b (\"drm/xe/guc: Add devm release action to safely tear down CT\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zhanjun Dong \u003czhanjun.dong@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260310225039.1320161-6-zhanjun.dong@intel.com\n(cherry picked from commit dace8cb0032f57ea67c87b3b92ad73c89dd2db44)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "e0f82655df6fbb15b318e9d56724cd54b1cfb04d",
      "tree": "a1b4093e789edaa04e31baf155ddfd12af434f3a",
      "parents": [
        "fb3738693cbdce104bf12615e980a6a37ff9087d"
      ],
      "author": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Tue Mar 10 18:50:35 2026 -0400"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:33 2026 +0100"
      },
      "message": "drm/xe: Trigger queue cleanup if not in wedged mode 2\n\nThe intent of wedging a device is to allow queues to continue running\nonly in wedged mode 2. In other modes, queues should initiate cleanup\nand signal all remaining fences. Fix xe_guc_submit_wedge to correctly\nclean up queues when wedge mode !\u003d 2.\n\nFixes: 7dbe8af13c18 (\"drm/xe: Wedge the entire device\")\nCc: stable@vger.kernel.org\nReviewed-by: Zhanjun Dong \u003czhanjun.dong@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260310225039.1320161-4-zhanjun.dong@intel.com\n(cherry picked from commit e25ba41c8227c5393c16e4aab398076014bd345f)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "fb3738693cbdce104bf12615e980a6a37ff9087d",
      "tree": "5f6b6dc9d9b3459c9cab8a4c1ab5c34eddf4d019",
      "parents": [
        "26c638d5602e329e0b26281a74c6ec69dee12f23"
      ],
      "author": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Tue Mar 10 18:50:34 2026 -0400"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:28 2026 +0100"
      },
      "message": "drm/xe: Forcefully tear down exec queues in GuC submit fini\n\nIn GuC submit fini, forcefully tear down any exec queues by disabling\nCTs, stopping the scheduler (which cleans up lost G2H), killing all\nremaining queues, and resuming scheduling to allow any remaining cleanup\nactions to complete and signal any remaining fences.\n\nSplit guc_submit_fini into device related and software only part. Using\ndevice-managed and drm-managed action guarantees the correct ordering of\ncleanup.\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: stable@vger.kernel.org\nReviewed-by: Zhanjun Dong \u003czhanjun.dong@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260310225039.1320161-3-zhanjun.dong@intel.com\n(cherry picked from commit a6ab444a111a59924bd9d0c1e0613a75a0a40b89)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "26c638d5602e329e0b26281a74c6ec69dee12f23",
      "tree": "df455f9a8b902613b8fadaa7c02f5047025883cf",
      "parents": [
        "9b72283ec9b8685acdb3467de8fbc3352fdb70bb"
      ],
      "author": {
        "name": "Matthew Brost",
        "email": "matthew.brost@intel.com",
        "time": "Tue Mar 10 18:50:33 2026 -0400"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:22 2026 +0100"
      },
      "message": "drm/xe: Always kill exec queues in xe_guc_submit_pause_abort\n\nxe_guc_submit_pause_abort is intended to be called after something\ndisastrous occurs (e.g., VF migration fails, device wedging, or driver\nunload) and should immediately trigger the teardown of remaining\nsubmission state. With that, kill any remaining queues in this function.\n\nFixes: 7c4b7e34c83b (\"drm/xe/vf: Abort VF post migration recovery on failure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zhanjun Dong \u003czhanjun.dong@intel.com\u003e\nReviewed-by: Stuart Summers \u003cstuart.summers@intel.com\u003e\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260310225039.1320161-2-zhanjun.dong@intel.com\n(cherry picked from commit 78f3bf00be4f15daead02ba32d4737129419c902)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "9b72283ec9b8685acdb3467de8fbc3352fdb70bb",
      "tree": "d77508926d2b0f0dcf3acfe0678c7a651e54aeb3",
      "parents": [
        "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681"
      ],
      "author": {
        "name": "Daniele Ceraolo Spurio",
        "email": "daniele.ceraolospurio@intel.com",
        "time": "Mon Mar 02 16:17:33 2026 -0800"
      },
      "committer": {
        "name": "Thomas Hellström",
        "email": "thomas.hellstrom@linux.intel.com",
        "time": "Thu Mar 19 14:22:17 2026 +0100"
      },
      "message": "drm/xe/guc: Fail immediately on GuC load error\n\nBy using the same variable for both the return of poll_timeout_us and\nthe return of the polled function guc_wait_ucode, the return value of\nthe latter is overwritten and lost after exiting the polling loop. Since\nguc_wait_ucode returns -1 on GuC load failure, we lose that information\nand always continue as if the GuC had been loaded correctly.\n\nThis is fixed by simply using 2 separate variables.\n\nFixes: a4916b4da448 (\"drm/xe/guc: Refactor GuC load to use poll_timeout_us()\")\nSigned-off-by: Daniele Ceraolo Spurio \u003cdaniele.ceraolospurio@intel.com\u003e\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nSigned-off-by: Vinay Belgaumkar \u003cvinay.belgaumkar@intel.com\u003e\nLink: https://patch.msgid.link/20260303001732.2540493-2-daniele.ceraolospurio@intel.com\n(cherry picked from commit c85ec5c5753a46b5c2aea1292536487be9470ffe)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n"
    },
    {
      "commit": "d75ec7e8ba1979a1eb0b9211d94d749cdce849c8",
      "tree": "60b2a6484b46408356c34ed15d8f9a15085df9bd",
      "parents": [
        "0f9ea7141f365b4f27226898e62220fb98ef8dc6"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 17 09:10:14 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 19 13:47:15 2026 +0100"
      },
      "message": "net: shaper: protect from late creation of hierarchy\n\nWe look up a netdev during prep of Netlink ops (pre- callbacks)\nand take a ref to it. Then later in the body of the callback\nwe take its lock or RCU which are the actual protections.\n\nThe netdev may get unregistered in between the time we take\nthe ref and the time we lock it. We may allocate the hierarchy\nafter flush has already run, which would lead to a leak.\n\nTake the instance lock in pre- already, this saves us from the race\nand removes the need for dedicated lock/unlock callbacks completely.\nAfter all, if there\u0027s any chance of write happening concurrently\nwith the flush - we\u0027re back to leaking the hierarchy.\n\nWe may take the lock for devices which don\u0027t support shapers but\nwe\u0027re only dealing with SET operations here, not taking the lock\nwould be optimizing for an error case.\n\nFixes: 93954b40f6a4 (\"net-shapers: implement NL set and delete operations\")\nLink: https://lore.kernel.org/20260309173450.538026-1-p@1g4.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20260317161014.779569-2-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0f9ea7141f365b4f27226898e62220fb98ef8dc6",
      "tree": "937487a70af1af2d07e1a2ff1cac8af7501139e1",
      "parents": [
        "8a63baadf08453f66eb582fdb6dd234f72024723"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Tue Mar 17 09:10:13 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 19 13:47:15 2026 +0100"
      },
      "message": "net: shaper: protect late read accesses to the hierarchy\n\nWe look up a netdev during prep of Netlink ops (pre- callbacks)\nand take a ref to it. Then later in the body of the callback\nwe take its lock or RCU which are the actual protections.\n\nThis is not proper, a conversion from a ref to a locked netdev\nmust include a liveness check (a check if the netdev hasn\u0027t been\nunregistered already). Fix the read cases (those under RCU).\nWrites needs a separate change to protect from creating the\nhierarchy after flush has already run.\n\nFixes: 4b623f9f0f59 (\"net-shapers: implement NL get operation\")\nReported-by: Paul Moses \u003cp@1g4.org\u003e\nLink: https://lore.kernel.org/20260309173450.538026-1-p@1g4.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20260317161014.779569-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "8c6e9b60f5c7985a9fe41320556a92d7a33451df",
      "tree": "29f43484902f70f2c54163a01ff74b24b8fb72a0",
      "parents": [
        "fb75437b447875ae97ea3a173e734dbd553a3881"
      ],
      "author": {
        "name": "Suzuki K Poulose",
        "email": "suzuki.poulose@arm.com",
        "time": "Mon Mar 16 16:19:01 2026 +0000"
      },
      "committer": {
        "name": "Will Deacon",
        "email": "will@kernel.org",
        "time": "Thu Mar 19 12:46:05 2026 +0000"
      },
      "message": "arm64: realm: Fix PTE_NS_SHARED for 52bit PA support\n\nWith LPA/LPA2, the top bits of the PFN (Bits[51:48]) end up in the lower bits\nof the PTE. So, simply creating a mask of the \"top IPA bit\" doesn\u0027t work well\nfor these configurations to set the \"top\" bit at the output of Stage1\ntranslation.\n\nFix this by using the __phys_to_pte_val() to do the right thing for all\nconfigurations.\n\nTested using, kvmtool, placing the memory at a higher address (-m \u003csize\u003e@\u003cAddr\u003e).\n\n e.g:\n # lkvm run --realm -c 4 -m 512M@@128T -k Image --console serial\n\n sh-5.0# dmesg | grep \"LPA2\\|RSI\"\n[    0.000000] RME: Using RSI version 1.0\n[    0.000000] CPU features: detected: 52-bit Virtual Addressing (LPA2)\n[    0.777354] CPU features: detected: 52-bit Virtual Addressing for KVM (LPA2)\n\nFixes: 399306954996 (\"arm64: realm: Query IPA size from the RMM\")\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Steven Price \u003csteven.price@arm.com\u003e\nCc: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Suzuki K Poulose \u003csuzuki.poulose@arm.com\u003e\nReviewed-by: Steven Price \u003csteven.price@arm.com\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nSigned-off-by: Will Deacon \u003cwill@kernel.org\u003e\n"
    },
    {
      "commit": "8a63baadf08453f66eb582fdb6dd234f72024723",
      "tree": "a19152d06caadb46501c503b86fc6e99a15bdcfe",
      "parents": [
        "7c46bd845d89ad4772573cfe0f2a56b93db75cc7"
      ],
      "author": {
        "name": "Muhammad Hammad Ijaz",
        "email": "mhijaz@amazon.com",
        "time": "Mon Mar 16 12:31:01 2026 -0700"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Thu Mar 19 10:31:19 2026 +0100"
      },
      "message": "net: mvpp2: guard flow control update with global_tx_fc in buffer switching\n\nmvpp2_bm_switch_buffers() unconditionally calls\nmvpp2_bm_pool_update_priv_fc() when switching between per-cpu and\nshared buffer pool modes. This function programs CM3 flow control\nregisters via mvpp2_cm3_read()/mvpp2_cm3_write(), which dereference\npriv-\u003ecm3_base without any NULL check.\n\nWhen the CM3 SRAM resource is not present in the device tree (the\nthird reg entry added by commit 60523583b07c (\"dts: marvell: add CM3\nSRAM memory to cp11x ethernet device tree\")), priv-\u003ecm3_base remains\nNULL and priv-\u003eglobal_tx_fc is false. Any operation that triggers\nmvpp2_bm_switch_buffers(), for example an MTU change that crosses\nthe jumbo frame threshold, will crash:\n\n  Unable to handle kernel NULL pointer dereference at\n  virtual address 0000000000000000\n  Mem abort info:\n    ESR \u003d 0x0000000096000006\n    EC \u003d 0x25: DABT (current EL), IL \u003d 32 bits\n  pc : readl+0x0/0x18\n  lr : mvpp2_cm3_read.isra.0+0x14/0x20\n  Call trace:\n   readl+0x0/0x18\n   mvpp2_bm_pool_update_fc+0x40/0x12c\n   mvpp2_bm_pool_update_priv_fc+0x94/0xd8\n   mvpp2_bm_switch_buffers.isra.0+0x80/0x1c0\n   mvpp2_change_mtu+0x140/0x380\n   __dev_set_mtu+0x1c/0x38\n   dev_set_mtu_ext+0x78/0x118\n   dev_set_mtu+0x48/0xa8\n   dev_ifsioc+0x21c/0x43c\n   dev_ioctl+0x2d8/0x42c\n   sock_ioctl+0x314/0x378\n\nEvery other flow control call site in the driver already guards\nhardware access with either priv-\u003eglobal_tx_fc or port-\u003etx_fc.\nmvpp2_bm_switch_buffers() is the only place that omits this check.\n\nAdd the missing priv-\u003eglobal_tx_fc guard to both the disable and\nre-enable calls in mvpp2_bm_switch_buffers(), consistent with the\nrest of the driver.\n\nFixes: 3a616b92a9d1 (\"net: mvpp2: Add TX flow control support for jumbo frames\")\nSigned-off-by: Muhammad Hammad Ijaz \u003cmhijaz@amazon.com\u003e\nReviewed-by: Gunnar Kudrjavets \u003cgunnarku@amazon.com\u003e\nLink: https://patch.msgid.link/20260316193157.65748-1-mhijaz@amazon.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "dbdfaae9609629a9569362e3b8f33d0a20fd783c",
      "tree": "45a230030cbe436d526569a14406d0884c5ae052",
      "parents": [
        "d73f4b53aaaea4c95f245e491aa5eeb8a21874ce"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Thu Mar 19 15:32:44 2026 +0800"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Thu Mar 19 10:27:07 2026 +0100"
      },
      "message": "nfnetlink_osf: validate individual option lengths in fingerprints\n\nnfnl_osf_add_callback() validates opt_num bounds and string\nNUL-termination but does not check individual option length fields.\nA zero-length option causes nf_osf_match_one() to enter the option\nmatching loop even when foptsize sums to zero, which matches packets\nwith no TCP options where ctx-\u003eoptp is NULL:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n  nf_osf_match (net/netfilter/nfnetlink_osf.c:227)\n  xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n  ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)\n  nf_hook_slow (net/netfilter/core.c:623)\n  ip_local_deliver (net/ipv4/ip_input.c:262)\n  ip_rcv (net/ipv4/ip_input.c:573)\n\nAdditionally, an MSS option (kind\u003d2) with length \u003c 4 causes\nout-of-bounds reads when nf_osf_match_one() unconditionally accesses\noptp[2] and optp[3] for MSS value extraction.  While RFC 9293\nsection 3.2 specifies that the MSS option is always exactly 4\nbytes (Kind\u003d2, Length\u003d4), the check uses \"\u003c 4\" rather than\n\"!\u003d 4\" because lengths greater than 4 do not cause memory\nsafety issues -- the buffer is guaranteed to be at least\nfoptsize bytes by the ctx-\u003eoptsize \u003d\u003d foptsize check.\n\nReject fingerprints where any option has zero length, or where an MSS\noption has length less than 4, at add time rather than trusting these\nvalues in the packet matching hot path.\n\nFixes: 11eeef41d5f6 (\"netfilter: passive OS fingerprint xtables match\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "d73f4b53aaaea4c95f245e491aa5eeb8a21874ce",
      "tree": "46515e290da0dde27a142b7bec6e4958c5a807f9",
      "parents": [
        "24f90fa3994b992d1a09003a3db2599330a5232a"
      ],
      "author": {
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org",
        "time": "Tue Mar 17 20:00:26 2026 +0100"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Thu Mar 19 10:26:31 2026 +0100"
      },
      "message": "netfilter: nf_tables: release flowtable after rcu grace period on error\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks.\n\nFixes: 3b49e2e94e6e (\"netfilter: nf_tables: add flow table netlink frontend\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "24f90fa3994b992d1a09003a3db2599330a5232a",
      "tree": "e5e94aa247da295d063a5618aaa33cd945a7d5d3",
      "parents": [
        "7c46bd845d89ad4772573cfe0f2a56b93db75cc7"
      ],
      "author": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Tue Mar 17 12:23:08 2026 +0100"
      },
      "committer": {
        "name": "Florian Westphal",
        "email": "fw@strlen.de",
        "time": "Thu Mar 19 10:26:31 2026 +0100"
      },
      "message": "netfilter: bpf: defer hook memory release until rcu readers are done\n\nYiming Qian reports UaF when concurrent process is dumping hooks via\nnfnetlink_hooks:\n\nBUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0\nRead of size 8 at addr ffff888003edbf88 by task poc/79\nCall Trace:\n \u003cTASK\u003e\n nfnl_hook_dump_one.isra.0+0xe71/0x10f0\n netlink_dump+0x554/0x12b0\n nfnl_hook_get+0x176/0x230\n [..]\n\nDefer release until after concurrent readers have completed.\n\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nFixes: 84601d6ee68a (\"bpf: add bpf_link support for BPF_NETFILTER programs\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n"
    },
    {
      "commit": "7c46bd845d89ad4772573cfe0f2a56b93db75cc7",
      "tree": "2c25c3e6c5e00038829a91b7385c640cfd98f19d",
      "parents": [
        "605b52497bf89b3b154674deb135da98f916e390",
        "d5ad6ab61cbd89afdb60881f6274f74328af3ee9"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 19:25:40 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 19:25:41 2026 -0700"
      },
      "message": "Merge tag \u0027wireless-2026-03-18\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nJust a few updates:\n - cfg80211:\n   - guarantee pmsr work is cancelled\n - mac80211:\n   - reject TDLS operations on non-TDLS stations\n   - fix crash in AP_VLAN bandwidth change\n   - fix leak or double-free on some TX preparation\n     failures\n   - remove keys needed for beacons _after_ stopping\n     those\n   - fix debugfs static branch race\n   - avoid underflow in inactive time\n   - fix another NULL dereference in mesh on invalid\n     frames\n - ti/wlcore: avoid infinite realloc loop\n\n* tag \u0027wireless-2026-03-18\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:\n  wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n  wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n  wifi: mac80211: fix NULL deref in mesh_matches_local()\n  wifi: mac80211: check tdls flag in ieee80211_tdls_oper\n  wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down\n  wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n  mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations\n  wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times\n  wifi: mac80211: remove keys after disabling beaconing\n  wifi: mac80211_hwsim: fully initialise PMSR capabilities\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260318172515.381148-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "605b52497bf89b3b154674deb135da98f916e390",
      "tree": "dd9f0393dc72c362c0e12f72f9a8aceb4a664f02",
      "parents": [
        "b3a6df291fecf5f8a308953b65ca72b7fc9e015d"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Mon Mar 16 17:50:34 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 18:05:40 2026 -0700"
      },
      "message": "net: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info-\u003eslave without checking if it\u0027s NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info-\u003eslave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[    1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[    1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[    1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[    1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[    1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[    1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[    1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[    1.294864] FS:  0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[    1.295239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[    1.295897] Call Trace:\n[    1.296134]  seq_read_iter (fs/seq_file.c:231)\n[    1.296341]  seq_read (fs/seq_file.c:164)\n[    1.296493]  full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[    1.296658]  vfs_read (fs/read_write.c:572)\n[    1.296981]  ksys_read (fs/read_write.c:717)\n[    1.297132]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[    1.297325]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \"(none)\" for entries with no assigned slave.\n\nFixes: caafa84251b88 (\"bonding: add the debugfs interface to see RLB hash table\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nLink: https://patch.msgid.link/20260317005034.1888794-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b3a6df291fecf5f8a308953b65ca72b7fc9e015d",
      "tree": "e6a692664a235dccf9b5c9958d4390876f907d90",
      "parents": [
        "6d43a9f6a1727f45fbc5b518a20250ebfec707f3"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Mon Mar 16 18:02:41 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 18:00:07 2026 -0700"
      },
      "message": "udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6\u003dn\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n  [...]\n  Call Trace:\n    \u003cTASK\u003e\n    genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n    genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n    [...]\n    netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n    genl_rcv (net/netlink/genetlink.c:1219)\n    netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n    netlink_sendmsg (net/netlink/af_netlink.c:1894)\n    __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n    __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n    __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n    do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n    entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it.\n\nFixes: fd384412e199b (\"udp_tunnel: Seperate ipv6 functions into its own file.\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nLink: https://patch.msgid.link/20260317010241.1893893-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "6d43a9f6a1727f45fbc5b518a20250ebfec707f3",
      "tree": "b84b86f9ba5839b9ad0c739c4c57443bcdb56aa1",
      "parents": [
        "d0f9eca219e6e46f1cf76fc28ae3f753b2b3ecd4",
        "beb6e2e5976a128b0cccf10d158124422210c5ef"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:54:58 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:54:59 2026 -0700"
      },
      "message": "Merge branch \u0027mlx5-misc-fixes-2026-03-16\u0027\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlx5 misc fixes 2026-03-16\n\nThis patchset provides misc bug fixes from the team to the mlx5\ncore and Eth drivers.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260316094603.6999-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "beb6e2e5976a128b0cccf10d158124422210c5ef",
      "tree": "b84b86f9ba5839b9ad0c739c4c57443bcdb56aa1",
      "parents": [
        "99b36850d881e2d65912b2520a1c80d0fcc9429a"
      ],
      "author": {
        "name": "Jianbo Liu",
        "email": "jianbol@nvidia.com",
        "time": "Mon Mar 16 11:46:03 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:54:53 2026 -0700"
      },
      "message": "net/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel\u0027s xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there\u0027s no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow.\n\nFixes: fef06678931f (\"net/mlx5e: Fix ESN update kernel panic\")\nSigned-off-by: Jianbo Liu \u003cjianbol@nvidia.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260316094603.6999-4-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "99b36850d881e2d65912b2520a1c80d0fcc9429a",
      "tree": "e6e42f29042078d6567bcb11e7f52e53dde6e6d0",
      "parents": [
        "b7e3a5d9c0d66b7fb44f63aef3bd734821afa0c8"
      ],
      "author": {
        "name": "Jianbo Liu",
        "email": "jianbol@nvidia.com",
        "time": "Mon Mar 16 11:46:02 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:54:53 2026 -0700"
      },
      "message": "net/mlx5e: Prevent concurrent access to IPSec ASO context\n\nThe query or updating IPSec offload object is through Access ASO WQE.\nThe driver uses a single mlx5e_ipsec_aso struct for each PF, which\ncontains a shared DMA-mapped context for all ASO operations.\n\nA race condition exists because the ASO spinlock is released before\nthe hardware has finished processing WQE. If a second operation is\ninitiated immediately after, it overwrites the shared context in the\nDMA area.\n\nWhen the first operation\u0027s completion is processed later, it reads\nthis corrupted context, leading to unexpected behavior and incorrect\nresults.\n\nThis commit fixes the race by introducing a private context within\neach IPSec offload object. The shared ASO context is now copied to\nthis private context while the ASO spinlock is held. Subsequent\nprocessing uses this saved, per-object context, ensuring its integrity\nis maintained.\n\nFixes: 1ed78fc03307 (\"net/mlx5e: Update IPsec soft and hard limits\")\nSigned-off-by: Jianbo Liu \u003cjianbol@nvidia.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260316094603.6999-3-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b7e3a5d9c0d66b7fb44f63aef3bd734821afa0c8",
      "tree": "692f22f8bbbca54fa9576d7fa0acfe86c20da24c",
      "parents": [
        "d0f9eca219e6e46f1cf76fc28ae3f753b2b3ecd4"
      ],
      "author": {
        "name": "Cosmin Ratiu",
        "email": "cratiu@nvidia.com",
        "time": "Mon Mar 16 11:46:01 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:54:53 2026 -0700"
      },
      "message": "net/mlx5: qos: Restrict RTNL area to avoid a lock cycle\n\nA lock dependency cycle exists where:\n1. mlx5_ib_roce_init -\u003e mlx5_core_uplink_netdev_event_replay -\u003e\nmlx5_blocking_notifier_call_chain (takes notifier_rwsem) -\u003e\nmlx5e_mdev_notifier_event -\u003e mlx5_netdev_notifier_register -\u003e\nregister_netdevice_notifier_dev_net (takes rtnl)\n\u003d\u003e notifier_rwsem -\u003e rtnl\n\n2. mlx5e_probe -\u003e _mlx5e_probe -\u003e\nmlx5_core_uplink_netdev_set (takes uplink_netdev_lock) -\u003e\nmlx5_blocking_notifier_call_chain (takes notifier_rwsem)\n\u003d\u003e uplink_netdev_lock -\u003e notifier_rwsem\n\n3: devlink_nl_rate_set_doit -\u003e devlink_nl_rate_set -\u003e\nmlx5_esw_devlink_rate_leaf_tx_max_set -\u003e esw_qos_devlink_rate_to_mbps -\u003e\nmlx5_esw_qos_max_link_speed_get (takes rtnl) -\u003e\nmlx5_esw_qos_lag_link_speed_get_locked -\u003e\nmlx5_uplink_netdev_get (takes uplink_netdev_lock)\n\u003d\u003e rtnl -\u003e uplink_netdev_lock\n\u003d\u003e BOOM! (lock cycle)\n\nFix that by restricting the rtnl-protected section to just the necessary\npart, the call to netdev_master_upper_dev_get and speed querying, so\nthat the last lock dependency is avoided and the cycle doesn\u0027t close.\nThis is safe because mlx5_uplink_netdev_get uses netdev_hold to keep the\nuplink netdev alive while its master device is queried.\n\nUse this opportunity to rename the ambiguously-named \"hold_rtnl_lock\"\nargument to \"take_rtnl\" and remove the \"_locked\" suffix from\nmlx5_esw_qos_lag_link_speed_get_locked.\n\nFixes: 6b4be64fd9fe (\"net/mlx5e: Harden uplink netdev access against device unbind\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260316094603.6999-2-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d0f9eca219e6e46f1cf76fc28ae3f753b2b3ecd4",
      "tree": "bbefb346b7ba075d98715440dd452bff15022662",
      "parents": [
        "cf2ce96c7150f9997fc87281600c3de7f20311bd",
        "0d4aef630be9d5f9c1227d07669c26c4383b5ad0"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:41:00 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:41:00 2026 -0700"
      },
      "message": "Merge tag \u0027batadv-net-pullrequest-20260317\u0027 of https://git.open-mesh.org/linux-merge\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere is a batman-adv bugfix:\n\n- avoid OGM aggregation when skb tailroom is insufficient, by Yang Yang\n\n* tag \u0027batadv-net-pullrequest-20260317\u0027 of https://git.open-mesh.org/linux-merge:\n  batman-adv: avoid OGM aggregation when skb tailroom is insufficient\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260317160002.1869478-1-sw@simonwunderlich.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "cf2ce96c7150f9997fc87281600c3de7f20311bd",
      "tree": "e03acc484df925ba3934f5aa36135196bcd3617b",
      "parents": [
        "06413793526251870e20402c39930804f14d59c0",
        "6850deb61118345996f03b87817b4ae0f2f25c38"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:38:15 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:38:15 2026 -0700"
      },
      "message": "Merge branch \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-03-17 (igc, iavf, libie)\n\nKohei Enju adds use of helper function to add missing update of\nskb-\u003etail when padding is needed for igc.\n\nZdenek Bouska clears stale XSK timestamps when taking down Tx rings on\nigc.\n\nPetr Oros changes handling of iavf VLAN filter handling when an added\nVLAN is also on the delete list to which can race and cause the VLAN\nfilter to not be added.\n\nMichal frees cmd_buf for libie firmware logging to stop memory leaks.\n\n* \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n  libie: prevent memleak in fwlog code\n  iavf: fix VLAN filter lost on add/delete race\n  igc: fix page fault in XDP TX timestamps handling\n  igc: fix missing update of skb-\u003etail in igc_xmit_frame()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260317211906.115505-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "146bd2a87a65aa407bb17fac70d8d583d19aba06",
      "tree": "1d595352039d384f61bfa00486b9e28099888a37",
      "parents": [
        "e06e6b8001233241eb5b2e2791162f0585f50f4b"
      ],
      "author": {
        "name": "Kumar Kartikeya Dwivedi",
        "email": "memxor@gmail.com",
        "time": "Thu Mar 12 13:53:07 2026 -0700"
      },
      "committer": {
        "name": "Alexei Starovoitov",
        "email": "ast@kernel.org",
        "time": "Wed Mar 18 17:26:40 2026 -0700"
      },
      "message": "bpf: Release module BTF IDR before module unload\n\nGregory reported in [0] that the global_map_resize test when run in\nrepeatedly ends up failing during program load. This stems from the fact\nthat BTF reference has not dropped to zero after the previous run\u0027s\nmodule is unloaded, and the older module\u0027s BTF is still discoverable and\nvisible. Later, in libbpf, load_module_btfs() will find the ID for this\nstale BTF, open its fd, and then it will be used during program load\nwhere later steps taking module reference using btf_try_get_module()\nfail since the underlying module for the BTF is gone.\n\nLogically, once a module is unloaded, it\u0027s associated BTF artifacts\nshould become hidden. The BTF object inside the kernel may still remain\nalive as long its reference counts are alive, but it should no longer be\ndiscoverable.\n\nTo fix this, let us call btf_free_id() from the MODULE_STATE_GOING case\nfor the module unload to free the BTF associated IDR entry, and disable\nits discovery once module unload returns to user space. If a race\nhappens during unload, the outcome is non-deterministic anyway. However,\nuser space should be able to rely on the guarantee that once it has\nsynchronously established a successful module unload, no more stale\nartifacts associated with this module can be obtained subsequently.\n\nNote that we must be careful to not invoke btf_free_id() in btf_put()\nwhen btf_is_module() is true now. There could be a window where the\nmodule unload drops a non-terminal reference, frees the IDR, but the\nsame ID gets reused and the second unconditional btf_free_id() ends up\nreleasing an unrelated entry.\n\nTo avoid a special case for btf_is_module() case, set btf-\u003eid to zero to\nmake btf_free_id() idempotent, such that we can unconditionally invoke it\nfrom btf_put(), and also from the MODULE_STATE_GOING case. Since zero is\nan invalid IDR, the idr_remove() should be a noop.\n\nNote that we can be sure that by the time we reach final btf_put() for\nbtf_is_module() case, the btf_free_id() is already done, since the\nmodule itself holds the BTF reference, and it will call this function\nfor the BTF before dropping its own reference.\n\n  [0]: https://lore.kernel.org/bpf/cover.1773170190.git.grbell@redhat.com\n\nFixes: 36e68442d1af (\"bpf: Load and verify kernel module BTFs\")\nAcked-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nSuggested-by: Martin KaFai Lau \u003cmartin.lau@kernel.org\u003e\nReported-by: Gregory Bell \u003cgrbell@redhat.com\u003e\nReviewed-by: Emil Tsalapatis \u003cemil@etsalapatis.com\u003e\nSigned-off-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nLink: https://lore.kernel.org/r/20260312205307.1346991-1-memxor@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\n"
    },
    {
      "commit": "06413793526251870e20402c39930804f14d59c0",
      "tree": "04e1c1801e36c52fb304929f3321f879f0b8d7d1",
      "parents": [
        "55dc632ab2ac2889b15995a9eef56c753d48ebc7"
      ],
      "author": {
        "name": "Minhong He",
        "email": "heminhong@kylinos.cn",
        "time": "Mon Mar 16 15:33:01 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:23:43 2026 -0700"
      },
      "message": "ipv6: add NULL checks for idev in SRv6 paths\n\n__in6_dev_get() can return NULL when the device has no IPv6 configuration\n(e.g. MTU \u003c IPV6_MIN_MTU or after NETDEV_UNREGISTER).\n\nAdd NULL checks for idev returned by __in6_dev_get() in both\nseg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL\npointer dereferences.\n\nFixes: 1ababeba4a21 (\"ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)\")\nFixes: bf355b8d2c30 (\"ipv6: sr: add core files for SR HMAC support\")\nSigned-off-by: Minhong He \u003cheminhong@kylinos.cn\u003e\nReviewed-by: Andrea Mayer \u003candrea.mayer@uniroma2.it\u003e\nLink: https://patch.msgid.link/20260316073301.106643-1-heminhong@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "55dc632ab2ac2889b15995a9eef56c753d48ebc7",
      "tree": "4fe42211a8d08e8cf7d1e9f27eecf2196215d057",
      "parents": [
        "34b11cc56e4369bc08b1f4c4a04222d75ed596ce"
      ],
      "author": {
        "name": "Ian Ray",
        "email": "ian.ray@gehealthcare.com",
        "time": "Tue Mar 17 10:53:36 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:20:51 2026 -0700"
      },
      "message": "NFC: nxp-nci: allow GPIOs to sleep\n\nAllow the firmware and enable GPIOs to sleep.\n\nThis fixes a `WARN_ON\u0027 and allows the driver to operate GPIOs which are\nconnected to I2C GPIO expanders.\n\n-- \u003e8 --\nkernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98\n-- \u003e8 --\n\nFixes: 43201767b44c (\"NFC: nxp-nci: Convert to use GPIO descriptor\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ian Ray \u003cian.ray@gehealthcare.com\u003e\nLink: https://patch.msgid.link/20260317085337.146545-1-ian.ray@gehealthcare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "34b11cc56e4369bc08b1f4c4a04222d75ed596ce",
      "tree": "96674e5e337723f435d611696d904d41aa091678",
      "parents": [
        "8da13e6d63c1a97f7302d342c89c4a56a55c7015"
      ],
      "author": {
        "name": "Fedor Pchelkin",
        "email": "pchelkin@ispras.ru",
        "time": "Mon Mar 16 13:38:25 2026 +0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Wed Mar 18 17:18:53 2026 -0700"
      },
      "message": "net: macb: fix uninitialized rx_fs_lock\n\nIf hardware doesn\u0027t support RX Flow Filters, rx_fs_lock spinlock is not\ninitialized leading to the following assertion splat triggerable via\nset_rxnfc callback.\n\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn\u0027t initialize this object before use?\nturning off the locking correctness validator.\nCPU: 1 PID: 949 Comm: syz.0.6 Not tainted 6.1.164+ #113\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106\n assign_lock_key kernel/locking/lockdep.c:974 [inline]\n register_lock_class+0x141b/0x17f0 kernel/locking/lockdep.c:1287\n __lock_acquire+0x74f/0x6c40 kernel/locking/lockdep.c:4928\n lock_acquire kernel/locking/lockdep.c:5662 [inline]\n lock_acquire+0x190/0x4b0 kernel/locking/lockdep.c:5627\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0x33/0x50 kernel/locking/spinlock.c:162\n gem_del_flow_filter drivers/net/ethernet/cadence/macb_main.c:3562 [inline]\n gem_set_rxnfc+0x533/0xac0 drivers/net/ethernet/cadence/macb_main.c:3667\n ethtool_set_rxnfc+0x18c/0x280 net/ethtool/ioctl.c:961\n __dev_ethtool net/ethtool/ioctl.c:2956 [inline]\n dev_ethtool+0x229c/0x6290 net/ethtool/ioctl.c:3095\n dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510\n sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215\n sock_ioctl+0x577/0x6d0 net/socket.c:1320\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:46 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nA more straightforward solution would be to always initialize rx_fs_lock,\njust like rx_fs_list.  However, in this case the driver set_rxnfc callback\nwould return with a rather confusing error code, e.g. -EINVAL.  So deny\nset_rxnfc attempts directly if the RX filtering feature is not supported\nby hardware.\n\nFixes: ae8223de3df5 (\"net: macb: Added support for RX filtering\")\nSigned-off-by: Fedor Pchelkin \u003cpchelkin@ispras.ru\u003e\nLink: https://patch.msgid.link/20260316103826.74506-2-pchelkin@ispras.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    }
  ],
  "next": "8da13e6d63c1a97f7302d342c89c4a56a55c7015"
}