)]}' { "log": [ { "commit": "d96fcfe1b7f94ac742984ae7986b94a116abff1b", "tree": "0cd70ac5584238e6c65eb544104082ab1fc8a374", "parents": [ "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "a52d6c7160f7e2f8c56adf29146385b8f2868d3d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n\n - Fix crash when using SMT hotplug on ACPI systems in conjunction with\n maxcpus\u003d\n\n - Fix 30% kswapd performance regression introduced by C1-Pro SME\n erratum workaround\n\n - Fix TLB over-invalidation regression during memory hotplug\n\n - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE\n\n - Typo fixes in the arm64 selftests\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftests/arm64: fix spelling errors in comments\n arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1\n arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()\n arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum\n cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()\n arm64: smp: Fix hot-unplug tearing by forcing unregistration\n" }, { "commit": "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "tree": "22161646ade1121b0e8767a41b38e24fb128bc52", "parents": [ "f827c27e573b475863d87bd2bab0b06f75aef5cd", "2726b5758f80a546a4ddeec5019e72035a7fa166" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmc:\n - Use correct IP block table for AMD 1Ah M80H SoC\n - Avoid logging \"(null)\" for missing DMI values\n\n - asus-armoury: update power limits for G614PR\n\n - bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n\n* tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC\n platform/x86: asus-armoury: update power limits for G614PR\n platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values\n" }, { "commit": "f827c27e573b475863d87bd2bab0b06f75aef5cd", "tree": "ea08b002b29739c642f071fda9df5374dd3e1329", "parents": [ "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "b11c513ad943f35cf5e8007d3a56279c79b7ed4b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - provide the missing .get_direction() callback in gpio-palmas\n\n - fix interrupt handling in gpio-dwapb\n\n - add a GPIO self-test program binary to .gitignore\n\n - fix a resource leak in gpio-mvebu\n\n - make the GPIO sharing heuristic more adaptable\n\n* tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mvebu: free generic chips on unbind\n selftests: gpio: add gpio-cdev-uaf to .gitignore\n gpio: dwapb: Mask interrupts at hardware initialization\n gpio: dwapb: Defer clock gating until noirq\n gpio: shared: make the voting mechanism adaptable\n gpios: palmas: add .get_direction() op\n" }, { "commit": "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "tree": "11664c69d7582d9514e3e1eda7dc5457a17f3593", "parents": [ "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "793bf193b18e9bff6c4280268bbffd16a5b533e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "message": "Merge tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Damien Le Moal:\n\n - Fix handling of security locked drive revalidation. This prevents\n such drives from being dropped when locked on resume (Terrence)\n\n* tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-core: Allow capacity transition to zero for locked drives\n ata: libata-core: Skip HPA resize for locked drives\n" }, { "commit": "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "tree": "ba34dc3b1e1074b1a32c44dad26bc32ae812eb42", "parents": [ "a635d6748234582ea287c5ffeae28b9b23f91c7e", "6763a0aea6d658d69b9215ab9151d7bd4c1c314b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull for drm, amdgpu, amdxdna, xe leading the way, some\n small core fixes and a nouveau stability fix along with some minor\n changes in other drivers.\n\n Seems to be a bit quiter than last week at least.\n\n fb-helper:\n - Sync on first active crtc in fb_dirty, rather than first crtc\n\n drm_exec:\n - Use direct label in drm_exec\n\n buddy:\n - Rework try_harder in the buddy allocator\n\n i915:\n - fix underrun on panthor lake\n - LT PHY SSC programming fix\n - fix some NULL derefs and leaks\n\n nouveau:\n - fix a vmm large/small page table update race\n\n xe:\n - Fix PTE index in xe_vm_populate_pgtable for chunked binds\n - Wait on external BO kernel fences in exec IOCTL\n - Remove duplicate include\n - Free madvise VMA array on L2 flush failure\n - Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n\n amdgpu:\n - PSP 15.0.9 update\n - SMU 15.0.9 update\n - VCN 5.3 fix\n - VI ASPM fix\n - Userq fix\n - lifetime fix for amdgpu_vm_get_task_info_pasid()\n - Gfx10 fix\n - SMU 14 fix\n\n amdkfd:\n - CRIU bounds checking fixes\n - secondary context id fix\n - Event bounds checking fix\n\n amdxdna:\n - Fix uaf in mmap failure path\n - A lot of deadlocks, access races and return value fixes\n\n analogix_dp:\n - Fix analogix_dp bitshifts during link training\n\n v3d:\n - Fix absent indirect bo handling\n\n imagination:\n - Make function static to solve compiler warning\n - Fix error checking\"\n\n* tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel: (44 commits)\n nouveau/vmm: fix another SPT/LPT race\n drm/imagination: fix error checking of pvr_vm_context_lookup()\n drm/imagination: make pvr_fw_trace_init_mask_ops static\n gpu/buddy: bail out of try_harder when alignment cannot be honoured\n drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n drm/xe: free madvise VMA array on L2 flush failure\n drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include\n drm/xe: Wait on external BO kernel fences in exec IOCTL\n drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds\n drm/fb-helper: Only consider active CRTCs for vblank sync\n drm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n drm/amd/pm: fix smu14 power limit range calculation\n drm/amdkfd: Check bounds in allocate_event_notification_slot\n amdkfd: properly free secondary context id\n drm/amdkfd: Don\u0027t acquire buffers during CRIU queue restore\n drm/amdkfd: Check bounds on CRIU restore event id\n drm/gfx10: Program DB_RING_CONTROL\n drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue\n drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled\n ...\n" }, { "commit": "6763a0aea6d658d69b9215ab9151d7bd4c1c314b", "tree": "9435a47f28856113e7cba078fb91aec961db5785", "parents": [ "695255c57ff18171190cd374cd5fb7c1539e9842" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Mon Jun 15 14:47:37 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 14:19:23 2026 +1000" }, "message": "nouveau/vmm: fix another SPT/LPT race\n\nWe\u0027ve had an unknown Turing issue for a while with page faults since\nlarge pages and compression.\n\nI\u0027ve got a patch series that syncs all our L2 handling with ogkm and it\nmade this fault happen more.\n\nAfter writing a bunch of debugging patches, I spotted an invalid LPT\nentry where there should have been a valid one.\n\nA 64K MAP succeeds on a range, but a subsequent SPT put drops SPT refs\nacross multiple ranges,\n\nWe shouldn\u0027t assume all ranges where SPTEs go away will have the same\nsparse/invalid/valid state, just iterate over each instead and do the\nright thing.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFixes: d19512f5abb1 (\"nouveau/vmm: start tracking if the LPT PTE is valid. (v6)\")\nLink: https://patch.msgid.link/20260615044737.3419585-1-airlied@gmail.com\n[ Properly format commit message. - Danilo ]\nSigned-off-by: Danilo Krummrich \u003cdakr@kernel.org\u003e\n(cherry picked from commit d008141ed4ce924167a03d46fbce9ad1fe4efa29)\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n" }, { "commit": "695255c57ff18171190cd374cd5fb7c1539e9842", "tree": "4283ed5badd329e2b8daeb7240203d9a277b73ca", "parents": [ "ff17ec871d8741c16a29b8f365ac3f80ad9e5a79", "f5ef65adf81da3dbce4e692e48c1754c0bb95da0" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:38:54 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:39:03 2026 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2026-07-09\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\nDriver Changes:\n- Fix PTE index in xe_vm_populate_pgtable for chunked binds (Matt Brost)\n- Wait on external BO kernel fences in exec IOCTL (Matt Brost)\n- Remove duplicate include (Anas Khan)\n- Free madvise VMA array on L2 flush failure (Guangshuo Li)\n- Stub notifier_lock helpers when DRM_GPUSVM\u003dn (Shuicheng Lin)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Thomas Hellstrom \u003cthomas.hellstrom@linux.intel.com\u003e\nLink: https://patch.msgid.link/alASIbW318Rl-HTv@fedora\n" }, { "commit": "ff17ec871d8741c16a29b8f365ac3f80ad9e5a79", "tree": "1512d867378af9ac93b1aaf38111c26619c13c8e", "parents": [ "7978a34fd6e4eae91db0741b553e7682288d022c", "47ea05f246bebc81c7796f56265cffd812cf0601" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:27:32 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:27:42 2026 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-7.2-2026-07-09\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-7.2-2026-07-09:\n\namdgpu:\n- PSP 15.0.9 update\n- SMU 15.0.9 update\n- VCN 5.3 fix\n- VI ASPM fix\n- Userq fix\n- lifetime fix for amdgpu_vm_get_task_info_pasid()\n- Gfx10 fix\n- SMU 14 fix\n\namdkfd:\n- CRIU bounds checking fixes\n- secondary context id fix\n- Event bounds checking fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260709212303.15913-1-alexander.deucher@amd.com\n" }, { "commit": "7978a34fd6e4eae91db0741b553e7682288d022c", "tree": "7829e50ec6c98620859b0e4e35f28aabd807226b", "parents": [ "58570ef9dc5d0b0465346883f492f12ea1c22369", "cf385cf6e713eba0720651174dac0b2d2f5bb8f8" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:03:14 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 13:03:15 2026 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2026-07-09\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\ndrm-misc-fixes for v7.2-rc3:\n- Fix uaf in amdxdna mmap failure path.\n- A lot of deadlocks, access races and return value fixes in amdxdna.\n- Fix analogix_dp bitshifts during link training.\n- Use direct label in drm_exec.\n- Fix absent indirect bo handling in v3d.\n- Sync on first active crtc in fb_dirty, rather than first crtc.\n- Rework try_harder in the buddy allocator.\n- Make imagination function static to solve compiler warning.\n- Fix imagination error checking.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Maarten Lankhorst \u003cmaarten.lankhorst@linux.intel.com\u003e\nLink: https://patch.msgid.link/71e5b48b-307f-47f5-8fd5-b60ea43e4196@linux.intel.com\n" }, { "commit": "58570ef9dc5d0b0465346883f492f12ea1c22369", "tree": "fce496400afbc422b29d75146974b958000165b8", "parents": [ "8cdeaa50eae8dad34885515f62559ee83e7e8dda", "3d04d9f390eeaab4d9e1ed4e9737e3d83581e18b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 12:27:02 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Jul 10 12:28:05 2026 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2026-07-09\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\nFix underrun regressions on Panther Lake by reverting the recent\nSCL\u003d0 enablement for always-on VRR timing. It also includes a fix\ndisplay LT PHY SSC programming and a small set of i915 fixes\naddressing NULL pointer dereferences, memory leaks and bound checks.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/ak-xZPqluaXVJGtP@intel.com\n" }, { "commit": "a635d6748234582ea287c5ffeae28b9b23f91c7e", "tree": "f350db99de06fb2d32fe2093b07efcef73c6e2ee", "parents": [ "2c7c88a412aa6d09cd04b414211b4ef8553b5309", "f49bca41c12f9f79d39dbf0779d0c672d74b09fe" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 16:30:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 16:30:56 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc2-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n \"This contains a set of SMB server fixes mostly around session setup,\n multichannel/session binding, and protocol-compatible error reporting:\n\n - Fix SID-to-id mapping so only SIDs with a valid local Unix\n representation are translated, while preserving other Windows\n SIDs in NT ACL xattrs\n\n - Fix SMB3 multichannel binding across multi-round authentication,\n keep the derived channel key separate from the established session\n key, and enforce the 32-channel session limit\n\n - Match Windows-compatible close timestamp behavior by coalescing\n automatic write time updates smaller than 15ms\n\n - Return STATUS_DISK_FULL for SET_INFO allocation failures caused\n by ENOSPC or EFBIG\n\n - Fix several signed SESSION_SETUP error paths so clients see the\n intended server status instead of replacing it with\n STATUS_ACCESS_DENIED\n\n - Fix reauthentication on bound channels and reject different-user\n channel binding with STATUS_ACCESS_DENIED\n\n - Use the referenced session dialect/signing algorithm when\n validating and signing rejected cross-dialect binding requests\"\n\n* tag \u0027v7.2-rc2-smb3-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: use the session dialect for rejected binding signatures\n ksmbd: mark rejected cross-dialect bindings as signed\n ksmbd: sign rejected SMB2.1 session binding responses\n ksmbd: handle channel binding with a different user\n ksmbd: find bound sessions during reauthentication\n ksmbd: mark invalid session responses as signed\n smb/server: map SET_INFO ENOSPC to disk full\n ksmbd: coalesce sub-15ms write time updates on close\n ksmbd: fix multichannel binding and enforce channel limit\n ksmbd: validate SID namespace before mapping IDs\n" }, { "commit": "2c7c88a412aa6d09cd04b414211b4ef8553b5309", "tree": "79b8874287ea0f25641f509a0dec4591555a5711", "parents": [ "6bad2e38fe7f2da7dc982b2b80814e632832e568", "f5089008f90c0a7c5520dff3934e0af00adf322d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 08:26:51 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 09 08:26:51 2026 -0700" }, "message": "Merge tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter, Bluetooth and batman-adv.\n\n Current release - regressions:\n\n - bluetooth: fix using chan-\u003econn as indication to no remote netdev\n\n Current release - new code bugs:\n\n - netfilter: cap to maximum number of expectation per master on\n updates\n\n Previous releases - regressions:\n\n - bluetooth:\n - fix UAF of hci_conn_params in add_device_complete\n - fix null ptr deref in hci_abort_conn()\n\n - igmp: remove multicast group from hash table on device destruction\n\n - batman-adv: prevent TVLV OOB check overflow\n\n - eth: mlx5/mlx5e:\n - fix off-by-one in single-FDB error rollback\n - skip peer flow cleanup when LAG seq is unavailable\n - fix crashes in dynamic per-channel stats and HV VHCA agent\n\n - eth: mana: Sync page pool RX frags for CPU\n\n Previous releases - always broken:\n\n - netfilter:\n - mark malformed IPv6 extension headers for hotdrop\n - terminate table name before find_table_lock()\n - ipvs: use parsed transport offset in TCP state lookup\n\n - sched: act_pedit: fix TOCTOU heap OOB write in tc offload\n\n - ethtool: rss: fix hfunc and input_xfrm parsing on big endian\n\n - ipv4/ipv6: fix UAF and memory leak in IGMP/MLD\n\n - tls: consume empty data records in tls_sw_read_sock()\n\n - eth:\n - octeontx2-af: fix VF bringup affecting PF promiscuous state\n - gue: validate REMCSUM private option length\"\n\n* tag \u0027net-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits)\n macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n dibs: loopback: validate offset and size in move_data()\n octeontx2-af: fix VF bringup affecting PF promiscuous state\n ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n net/mlx5: Fix L3 tunnel entropy refcount leak\n net: macb: drop in-flight Tx SKBs on close\n net: mana: Sync page pool RX frags for CPU\n net: mana: Validate the packet length reported by the NIC\n selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n ipvs: ensure inner headers in ICMP errors are in headroom\n ipvs: use parsed transport offset in SCTP state lookup\n ipvs: use parsed transport offset in TCP state lookup\n ipvs: pass parsed transport offset to state handlers\n netfilter: handle unreadable frags\n netfilter: flowtable: support IPIP tunnel with direct xmit\n netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n netfilter: flowtable: use dst in this direction when pushing IPIP header\n netfilter: ipset: allocate the proper memory for the generic hash structure\n netfilter: ipset: cleanup the add/del backlog when resize failed\n netfilter: ipset: exclude gc when resize is in progress\n ...\n" }, { "commit": "cf385cf6e713eba0720651174dac0b2d2f5bb8f8", "tree": "33eb8fe0dd23aa2a3a8f3c3d808e4be17164f62b", "parents": [ "c804aadc4ce3dcb34d6f2ecc9a159c148210805a" ], "author": { "name": "Luigi Santivetti", "email": "luigi.santivetti@imgtec.com", "time": "Tue Jul 07 16:17:16 2026 +0100" }, "committer": { "name": "Alessio Belle", "email": "alessio.belle@imgtec.com", "time": "Thu Jul 09 15:07:32 2026 +0100" }, "message": "drm/imagination: fix error checking of pvr_vm_context_lookup()\n\nSince pvr_vm_context_lookup() returns either NULL or a pointer, then stop\nusing IS_ERR() for checking the return value.\n\nUsing IS_ERR() leads to the kernel oops reported below. It can be\nreproduced by passing an invalid VM context handle from userspace to the\nDRM_IOCTL_PVR_CREATE_CONTEXT ioctl.\n\n[ 92.733119] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000148\n[ 92.742042] Mem abort info:\n[ 92.744890] ESR \u003d 0x0000000096000004\n[ 92.748686] EC \u003d 0x25: DABT (current EL), IL \u003d 32 bits\n[ 92.754020] SET \u003d 0, FnV \u003d 0\n[ 92.757154] EA \u003d 0, S1PTW \u003d 0\n[ 92.760337] FSC \u003d 0x04: level 0 translation fault\n[ 92.765243] Data abort info:\n[ 92.768129] ISV \u003d 0, ISS \u003d 0x00000004, ISS2 \u003d 0x00000000\n[ 92.773626] CM \u003d 0, WnR \u003d 0, TnD \u003d 0, TagAccess \u003d 0\n[ 92.778763] GCS \u003d 0, Overlay \u003d 0, DirtyBit \u003d 0, Xs \u003d 0\n[ 92.784098] user pgtable: 4k pages, 48-bit VAs, pgdp\u003d000000088ed23000\n[ 92.790550] [0000000000000148] pgd\u003d0000000000000000, p4d\u003d0000000000000000\n[ 92.797381] Internal error: Oops: 0000000096000004 [#1] SMP\n[ 92.803027] Modules linked in: powervr\n[ 92.852533] CPU: 0 UID: 0 PID: 409 Comm: triangle Not tainted 7.1.0-rc5-g98b46e693b91 #1 PREEMPT\n[ 92.861385] Hardware name: Texas Instruments AM68 SK (DT)\n[ 92.866766] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n[ 92.873709] pc : pvr_vm_get_fw_mem_context+0x0/0xc [powervr]\n[ 92.879376] lr : pvr_queue_create+0x26c/0x440 [powervr]\n[ 92.884595] sp : ffff8000837fbb00\n[ 92.887895] x29: ffff8000837fbb60 x28: 0000000000000000 x27: ffff8000837fbce8\n[ 92.895015] x26: ffff000807f61a40 x25: ffff000807f61a00 x24: ffff000807f64400\n[ 92.902135] x23: ffff00080a5ab000 x22: ffff800079b24730 x21: ffff000807f61800\n[ 92.909254] x20: ffff00080999e680 x19: 0000000000000000 x18: 0000000000000000\n[ 92.916373] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001\n[ 92.923492] x14: 0000000000000000 x13: 0000000000000002 x12: ffff80008145b298\n[ 92.930611] x11: ffff8000844e5000 x10: ffff80008165a130 x9 : 0000000000000100\n[ 92.937730] x8 : 0000000000000001 x7 : ffff0008076b27e0 x6 : ffff00080ec43b7c\n[ 92.944850] x5 : ffff00080ec43b78 x4 : 0000000000000000 x3 : ffff00080999e680\n[ 92.951968] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000\n[ 92.959088] Call trace:\n[ 92.961521] pvr_vm_get_fw_mem_context+0x0/0xc [powervr] (P)\n[ 92.967173] pvr_context_create+0x190/0x410 [powervr]\n[ 92.972218] pvr_ioctl_create_context+0x44/0x8c [powervr]\n[ 92.977608] drm_ioctl_kernel+0xbc/0x124 [drm]\n[ 92.982127] drm_ioctl+0x1f8/0x4dc [drm]\n[ 92.986098] __arm64_sys_ioctl+0xac/0x104\n[ 92.990102] invoke_syscall+0x54/0x10c\n[ 92.993842] el0_svc_common.constprop.0+0x40/0xe0\n[ 92.998532] do_el0_svc+0x1c/0x28\n[ 93.001835] el0_svc+0x38/0x11c\n[ 93.004969] el0t_64_sync_handler+0xa0/0xe4\n[ 93.009139] el0t_64_sync+0x198/0x19c\n[ 93.012792] Code: aa1703e0 d2800014 95cb0ba4 17ffffe8 (f940a400)\n[ 93.018869] ---[ end trace 0000000000000000 ]---\n\nFixes: d2d79d29bb98 (\"drm/imagination: Implement context creation/destruction ioctls\")\nCc: stable@vger.kernel.org\nSigned-off-by: Luigi Santivetti \u003cluigi.santivetti@imgtec.com\u003e\nReviewed-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\nLink: https://patch.msgid.link/20260707-staging-ddkopsrc-2435-v1-1-24e160d44476@imgtec.com\nSigned-off-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\n" }, { "commit": "c804aadc4ce3dcb34d6f2ecc9a159c148210805a", "tree": "169fec643c49682804d8ad17dc8c4e82d165610c", "parents": [ "56bc6384314fb9ae98975fb2af8b143097ede3dc" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Fri Jul 03 17:23:38 2026 +0100" }, "committer": { "name": "Alessio Belle", "email": "alessio.belle@imgtec.com", "time": "Thu Jul 09 15:07:23 2026 +0100" }, "message": "drm/imagination: make pvr_fw_trace_init_mask_ops static\n\nThe pvr_fw_trace_init_mask_ops is not used outside pvr_fw_trace.c\nso make it static to avoid the following sparse warning:\n\ndrivers/gpu/drm/imagination/pvr_fw_trace.c:74:31: warning: symbol \u0027pvr_fw_trace_init_mask_ops\u0027 was not declared. Should it be static?\n\nFixes: c6978643ea1c (\"drm/imagination: Validate fw trace group_mask\")\nReviewed-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\nLink: https://patch.msgid.link/20260703162338.2848039-1-ben.dooks@codethink.co.uk\nSigned-off-by: Alessio Belle \u003calessio.belle@imgtec.com\u003e\n" }, { "commit": "56bc6384314fb9ae98975fb2af8b143097ede3dc", "tree": "a255205ac49ed748b9a0f697e93701422b0183a6", "parents": [ "06c2b8d7ea2bcb014dd974fc3bc6d128d65d7477" ], "author": { "name": "Arunpravin Paneer Selvam", "email": "Arunpravin.PaneerSelvam@amd.com", "time": "Thu Jul 09 18:40:50 2026 +0530" }, "committer": { "name": "Arunpravin Paneer Selvam", "email": "Arunpravin.PaneerSelvam@amd.com", "time": "Thu Jul 09 18:49:49 2026 +0530" }, "message": "gpu/buddy: bail out of try_harder when alignment cannot be honoured\n\nThe try_harder contiguous fallback could return a range whose start\noffset did not match the caller\u0027s min_block_size. When a candidate\u0027s\nstart is misaligned, realign it: free the misaligned run and reallocate\nexactly @size at the next lower min_block_size boundary. This keeps the\nreturned size unchanged with no surplus to trim, and rejects the request\nonly when no aligned candidate fits.\n\nv2: align misaligned candidates down to min_block_size instead of\n bailing out, for both the RHS and LHS paths (Matthew).\n\nFixes: 0a1844bf0b53 (\"drm/buddy: Improve contiguous memory allocation\")\nSuggested-by: Christian König \u003cchristian.koenig@amd.com\u003e\nCc: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nCc: Christian König \u003cchristian.koenig@amd.com\u003e\nCc: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nTested-by: John Olender \u003cjohn.olender@gmail.com\u003e\nSigned-off-by: Arunpravin Paneer Selvam \u003cArunpravin.PaneerSelvam@amd.com\u003e\nLink: https://patch.msgid.link/20260709131050.1022759-1-Arunpravin.PaneerSelvam@amd.com\n" }, { "commit": "f5089008f90c0a7c5520dff3934e0af00adf322d", "tree": "9aa744bbade5e6d2a7146aa3bcbb0ba8bfaa880e", "parents": [ "78237e3c0720fcc6eb9b87e90fd70f63eeca886f" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Jul 03 17:36:33 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 13:05:04 2026 +0200" }, "message": "macsec: don\u0027t read an unset MAC header in macsec_encrypt()\n\nmacsec_encrypt() reads the Ethernet header via eth_hdr(skb)\n(skb-\u003ehead + skb-\u003emac_header) to memmove() the 12 source/destination MAC\nbytes forward and make room for the SecTAG.\n\nOn the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb\nreaches the macsec ndo_start_xmit() with the MAC header unset, so\neth_hdr(skb) resolves to skb-\u003ehead + (u16)~0 and the read is out of\nbounds: a 12-byte heap over-read that is also emitted on the wire as the\nframe\u0027s outer source/destination MAC. KASAN reports a slab-out-of-bounds\nread in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET\nbuild flags it as an unset mac header in skb_mac_header().\n\nOn the TX path the L2 header is at skb-\u003edata, so use skb_eth_hdr(), added\nby commit 96cc4b69581d (\"macvlan: do not assume mac_header is set in\nmacvlan_broadcast()\") for exactly this purpose.\n\nFixes: c09440f7dcb3 (\"macsec: introduce IEEE 802.1AE driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260703083634.2035145-1-4ncienth@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "78237e3c0720fcc6eb9b87e90fd70f63eeca886f", "tree": "626153581998515ed11af65563ec77f9bbc52837", "parents": [ "fabb881df322da25442f98d23f5fa371e3c78ec4" ], "author": { "name": "Dust Li", "email": "dust.li@linux.alibaba.com", "time": "Tue Jul 07 15:43:18 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 12:44:00 2026 +0200" }, "message": "dibs: loopback: validate offset and size in move_data()\n\nThe loopback move_data() performs a memcpy into the registered DMB\nwithout checking whether offset + size exceeds the DMB length. Unlike\nreal ISM hardware, which enforces memory region bounds natively, the\nsoftware loopback has no such protection.\n\nA peer-supplied out-of-bounds offset or oversized write would result in\nan OOB write past the allocated kernel buffer. Add an explicit bounds\ncheck before the memcpy to reject such requests with -EINVAL.\n\nFixes: f7a22071dbf3 (\"net/smc: implement DMB-related operations of loopback-ism\")\nCc: stable@vger.kernel.org\nReported-by: Federico Kirschbaum \u003cfederico.kirschbaum@xbow.com\u003e\nSigned-off-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nReported-by: Baul Lee \u003cbaul.lee@xbow.com\u003e\nLink: https://patch.msgid.link/20260707074318.1448662-1-dust.li@linux.alibaba.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f5ef65adf81da3dbce4e692e48c1754c0bb95da0", "tree": "0b8a54e932a3017fa1b553b026d71d40af85529f", "parents": [ "14abbed336a2d1bbd726c25d148d2ec0ff928073" ], "author": { "name": "Shuicheng Lin", "email": "shuicheng.lin@intel.com", "time": "Tue Jun 30 19:22:21 2026 +0000" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 09 12:09:42 2026 +0200" }, "message": "drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n\nWhen CONFIG_DRM_GPUSVM\u003dn (e.g. um-allyesconfig), the only caller of\nxe_pt_svm_userptr_notifier_lock() is compiled out, triggering:\n\n drivers/gpu/drm/xe/xe_pt.c:1418:13: warning:\n \u0027xe_pt_svm_userptr_notifier_lock\u0027 defined but not used\n [-Wunused-function]\n\nThe helpers cannot simply be removed in this case: the matching\nxe_pt_svm_userptr_notifier_unlock() is also referenced from\nxe_pt_update_ops_run(), which lives outside any DRM_GPUSVM ifdef and is\ngated only at runtime by pt_update_ops-\u003eneeds_svm_lock. The symbol must\nexist in all builds.\n\nProvide empty static inline stubs for !DRM_GPUSVM, matching the pattern\nused by xe_svm_notifier_lock()/_unlock() in xe_svm.h.\n\nFixes: dca6e08c923a (\"drm/xe/userptr: Hold notifier_lock for write on inject test path\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202606302210.QqcLbOEN-lkp@intel.com/\nReviewed-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nLink: https://patch.msgid.link/20260630192221.2998168-1-shuicheng.lin@intel.com\nSigned-off-by: Shuicheng Lin \u003cshuicheng.lin@intel.com\u003e\n(cherry picked from commit 3359422bf0a1140e96d783a19a397686e580a3ca)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "14abbed336a2d1bbd726c25d148d2ec0ff928073", "tree": "2e0fdb5d70ad3819b94b29f44922d59c79ecbc00", "parents": [ "91426ce50d14a49bde53b3ad1e48393556ba92cd" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Wed Jul 08 15:34:22 2026 +0800" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 09 12:09:37 2026 +0200" }, "message": "drm/xe: free madvise VMA array on L2 flush failure\n\nxe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas().\nAfter get_vmas() succeeds with at least one VMA, error paths must go\nthrough free_vmas so the array is released before the madvise details are\ndestroyed.\n\nThe L2 flush validation path added for PAT madvise rejects some\nSVM/userptr ranges after get_vmas() has succeeded, but jumps directly to\nmadv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on\neach failed ioctl.\n\nJump to free_vmas instead, matching the other validation failure paths\nafter get_vmas() has succeeded.\n\nFixes: 4f39a194d41e (\"drm/xe/xe3p_lpg: Restrict UAPI to enable L2 flush optimization\")\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nReviewed-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/20260708073422.725186-1-lgs201920130244@gmail.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit c3a1c3579b1250060da73507a4acef712974c78a)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "91426ce50d14a49bde53b3ad1e48393556ba92cd", "tree": "ef112d2d633f340e7c265330640fe4b4a94d1c70", "parents": [ "af80e2bfde9312c76b60cf9274248dce0410b30d" ], "author": { "name": "Anas Khan", "email": "anxkhn28@gmail.com", "time": "Thu Jul 02 16:58:20 2026 +0530" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 09 12:09:31 2026 +0200" }, "message": "drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include\n\nxe_pci.c includes \u003ckunit/test-bug.h\u003e twice, separated only by the\n\u003ckunit/test.h\u003e include. Drop the redundant second include; this is a\nnon-functional cleanup flagged by scripts/checkincludes.pl.\n\nFixes: 6cad22853cb8 (\"drm/xe/kunit: Add stub to read_gmdid\")\nSigned-off-by: Anas Khan \u003canxkhn28@gmail.com\u003e\nLink: https://patch.msgid.link/20260702112820.34675-1-anxkhn28@gmail.com\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n(cherry picked from commit 84ed5b0a925721aaf069d36e18a99db966ff4e80)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "af80e2bfde9312c76b60cf9274248dce0410b30d", "tree": "af25434539584e2985cb927b2b47fdc9e3719ee3", "parents": [ "34a4dd45cf210c04fee773b0dbc350aec285f03c" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Thu Jul 02 14:58:05 2026 -0700" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 09 12:09:24 2026 +0200" }, "message": "drm/xe: Wait on external BO kernel fences in exec IOCTL\n\nBefore arming a user job, xe_exec_ioctl() only added the VM\u0027s\ndma-resv KERNEL slot as a dependency. That slot covers rebinds and\nthe kernel operations of the VM\u0027s private BOs, but not external BOs\n(bo-\u003evm \u003d\u003d NULL), which carry their kernel operations (evictions,\nmoves, ...) in their own dma-resv KERNEL slot.\n\nThe DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for\nmemory management operations that must complete before the BO or its\nbacking store may be used: any accessor is required to wait on the\nKERNEL fences before touching the resv. By skipping the external BOs\u0027\nKERNEL slots, the exec path violated that contract and could schedule\na user job while a kernel operation on an external BO mapped by the VM\nwas still in flight, racing against it and potentially reading or\nwriting memory that was being moved.\n\nReplace the VM-only dependency with an iteration over every object\nlocked by the exec, adding each object\u0027s KERNEL slot as a job\ndependency. This covers the VM resv (rebinds and private BOs) as well\nas every external BO, mirroring the drm_gpuvm_resv_add_fence() call\nthat later publishes the job fence to the same set of objects.\nLong-running mode continues to skip this, as before.\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: stable@vger.kernel.org\nAssisted-by: GitHub_Copilot:claude-opus-4.8\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260702215805.4011228-1-matthew.brost@intel.com\n(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "34a4dd45cf210c04fee773b0dbc350aec285f03c", "tree": "4529db2b2db8e4619e73358d000578316da308cc", "parents": [ "959b5016e4646b55fd2fd0438932e4c4e9ce171f" ], "author": { "name": "Matthew Brost", "email": "matthew.brost@intel.com", "time": "Wed Jul 01 18:24:34 2026 -0700" }, "committer": { "name": "Thomas Hellström", "email": "thomas.hellstrom@linux.intel.com", "time": "Thu Jul 09 12:09:18 2026 +0200" }, "message": "drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds\n\nxe_vm_populate_pgtable() indexed the source PTE array (update-\u003ept_entries)\nby the per-call loop counter, assuming each call starts at the first entry\nof the update. That holds for the CPU bind path\n(xe_migrate_update_pgtables_cpu), which populates a whole update in a single\ncall, but not for the GPU bind path: write_pgtable() splits an update into\nMAX_PTE_PER_SDI (510) sized MI_STORE_DATA_IMM chunks, invoking the populate\ncallback once per chunk with an advancing qword_ofs but a fresh command-\nbuffer destination pointer.\n\nAs a result, every chunk after the first re-read pt_entries from index 0\ninstead of from its true offset, so PTEs beyond the first 510 entries of a\nsingle update were programmed with the wrong physical pages, shifting the\nmapping by exactly MAX_PTE_PER_SDI pages.\n\nThis stayed latent because a single update only exceeds 510 qwords when a\nlarge (e.g. 2M) region is bound as individual 4K PTEs rather than a single\nhuge-page entry, which happens when the backing store is sufficiently\nfragmented. It was surfaced by the BO defrag path, which deliberately\nrebinds such fragmented ranges via the GPU bind path, producing\ndeterministic data corruption offset by 510 pages.\n\nIndex pt_entries by the chunk\u0027s absolute offset relative to update-\u003eofs so\nboth the CPU and GPU paths pick the correct entries.\n\nFixes: dd08ebf6c352 (\"drm/xe: Introduce a new DRM driver for Intel GPUs\")\nCc: stable@vger.kernel.org\nAssisted-by: GitHub_Copilot:claude-opus-4.8\nSigned-off-by: Matthew Brost \u003cmatthew.brost@intel.com\u003e\nReviewed-by: Matthew Auld \u003cmatthew.auld@intel.com\u003e\nLink: https://patch.msgid.link/20260702012434.3861171-1-matthew.brost@intel.com\n(cherry picked from commit e6f2d0b757c4fb577a513c577140109d1d292a9a)\nSigned-off-by: Thomas Hellström \u003cthomas.hellstrom@linux.intel.com\u003e\n" }, { "commit": "fabb881df322da25442f98d23f5fa371e3c78ec4", "tree": "4e9eb98796be0e9a3e3cb9f272811f926b4c797e", "parents": [ "24c4c88259464d38b35c3fbaecb68675de64137d" ], "author": { "name": "Harman Kalra", "email": "hkalra@marvell.com", "time": "Thu Jul 02 10:26:16 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 12:00:04 2026 +0200" }, "message": "octeontx2-af: fix VF bringup affecting PF promiscuous state\n\nMbox handling of nix_set_rx_mode for a VF with promiscuous and\nall_multi flags set to false causes deletion of the PF\u0027s promiscuous\nand allmulti MCAM rules. This occurs because the APIs that\nenable/disable these rules operate only on the PF, even when the\nmbox request is made via a VF interface.\n\nGuard both rvu_npc_enable_allmulti_entry() and\nrvu_npc_enable_promisc_entry() disable paths with an is_vf() check so\nthat a VF bringing up or tearing down its interface cannot inadvertently\nclear the PF\u0027s MCAM rules.\n\nFixes: 967db3529eca (\"octeontx2-af: add support for multicast/promisc packet replication feature\")\nSigned-off-by: Harman Kalra \u003chkalra@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nLink: https://patch.msgid.link/20260702045616.3002773-2-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "24c4c88259464d38b35c3fbaecb68675de64137d", "tree": "bd8b446a2d570f99eb0f7f0b6696585c11a01db3", "parents": [ "b62869a81a7ce388d1fbb0fac5fa8300ea614d81", "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:42:56 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:42:57 2026 +0200" }, "message": "Merge tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nThe following patchset contains Netfilter fixes for *net*.\n\nMost of these are LLM fixes for old issues flagged by sashiko/LLMs.\n\nMany of these trigger drive-by-findings in sashiko. In particular:\n\n- many load/store tearing and missing memory barriers, races\n etc. in ipset, esp. with GC and resizing.\n Keeping the proposed patches spinning for yet-another-iteration\n keeps legit fixes back, so I prefer to add these now and follow\n up with other reports later.\n- flowtable work queue still has possible races with teardown,\n but same rationale as with ipset: drive-by findings, not\n problems coming with the flowtable IPIP changeset in this PR.\n- ever since unreadable frag skb support was added in 6.12, we can no\n longer do: BUG_ON(skb_copy_bits( ...): it will fire with such skbs.\n Mina Almasry is looking at similar patterns elsewhere in the stack.\n\n1) Guard skb-\u003emac_header adjustment after IPv6 defragmentation in\nnf_conntrack_reasm. From Xiang Mei.\n\n2) NUL-terminate ebtables table names before calling find_table_lock() to\nprevent stack-out-of-bounds reads. Also from Xiang Mei.\n\n3) Zero the ebtables chainstack array, else error unwind may free bogus\npointer when CPU mask is sparse. All three issues date from 2.6 days.\n\n4) Ensure ebtables module names are c-strings, same bug pattern as 2).\nBug added in 4.6.\n\n5) Fix catchall element handling for inverted lookups in nft_lookup. Fold the\ncatchall lookup into ext before computing the match status. Was like\nthis ever since catchall elements got introduced in 5.13.\nFrom Tamaki Yanagawa.\n\n6-9) ipset updates from Jozsef Kadlecsik:\n- mark rcu protected areas correctly\n- address gc and resize clash in the comment extension\n- add/del backlog cleanup in the error path\n- allocate right size for the generic hash structure\n\n10-12): IPIP flowtable updates from Pablo Neira Ayuso:\n - Use the current direction\u0027s route when pushing IPIP headers\n Fix incorrect headroom and fragmentation offset calculations.\n - Avoid hardware offload for IPIP tunnels due to lack of driver support.\n - Support IPIP tunnels with direct xmit in netfilter flowtable.\n dst_cache and dst_cookie are moved outside the union to share route\n state across flows. This is a followup to work done in 6.19 cycle.\n\n13) Don\u0027t BUG() on skb_copy_bits error. Handle unreadable fragments by\neither returning an error or restricting the copy operations to linear area,\nThis became an issue when unreable frag support was merged in 6.12.\n\n14-16): IPVS updates from Yizhou Zhao:\n - Pass parsed transport offset to IPVS state handlers.\n update callback signatures.\n - use correct transport header offset on state lookp in TCP.\n As-is it was possible for ipv6 extension header data to be\n treated as L4 header.\n - same for SCTP. This was also broken since 2.6 days.\n\n17) Ensure inner IP headers in ICMP errors are in the skb headroom after\nstripping outer headers. Add more checks for the length of inner headers.\nThis was broken since 3.7 days.\nFrom Julian Anastasov.\n\nnetfilter pull request nf-26-07-08\n\n* tag \u0027nf-26-07-08\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n ipvs: ensure inner headers in ICMP errors are in headroom\n ipvs: use parsed transport offset in SCTP state lookup\n ipvs: use parsed transport offset in TCP state lookup\n ipvs: pass parsed transport offset to state handlers\n netfilter: handle unreadable frags\n netfilter: flowtable: support IPIP tunnel with direct xmit\n netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n netfilter: flowtable: use dst in this direction when pushing IPIP header\n netfilter: ipset: allocate the proper memory for the generic hash structure\n netfilter: ipset: cleanup the add/del backlog when resize failed\n netfilter: ipset: exclude gc when resize is in progress\n netfilter: ipset: mark the rcu locked areas properly\n netfilter: nft_lookup: fix catchall element handling with inverted lookups\n netfilter: ebtables: module names must be null-terminated\n netfilter: ebtables: zero chainstack array\n netfilter: ebtables: terminate table name before find_table_lock()\n netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708140309.19633-1-fw@strlen.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b62869a81a7ce388d1fbb0fac5fa8300ea614d81", "tree": "d5c75ce06acb2855385de87132a2d45e3bb873ec", "parents": [ "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Mon Jul 06 08:50:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:38:30 2026 +0200" }, "message": "ethtool: rss: Fix hfunc and input_xfrm parsing on big endian\n\nETHTOOL_A_RSS_HFUNC and ETHTOOL_A_RSS_INPUT_XFRM are NLA_U32 attributes,\nbut ethnl_rss_set() and ethnl_rss_create_doit() parse them with\nethnl_update_u8(), which reads a single byte.\n\nOn little endian this happens to read the least significant byte and\nworks as long as the value fits in a byte. On big endian it reads the\nmost significant byte, so the requested value is parsed incorrectly.\n\nThe destination fields in struct ethtool_rxfh_param are u8, so the\nattribute can\u0027t be read directly with ethnl_update_u32().\nCap the hfunc policy at U8_MAX so an out of range value is rejected\ninstead of being silently truncated into the u8 field, and add\nethnl_update_u8_u32() to read the full u32 and narrow it into the u8\ndestination.\n\nFixes: 82ae67cbc423 (\"ethtool: rss: support setting hfunc via Netlink\")\nFixes: d3e2c7bab124 (\"ethtool: rss: support setting input-xfrm via Netlink\")\nFixes: a166ab7816c5 (\"ethtool: rss: support creating contexts via Netlink\")\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nLink: https://patch.msgid.link/20260706055017.3355806-1-gal@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027", "tree": "66917c2f86085c3b89699b4d67cc3e554dd92b0e", "parents": [ "604e9594449b9907181f4285d0cd6a398bfc9d08" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Fri Jul 03 22:14:23 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:21:12 2026 +0200" }, "message": "net/mlx5: Fix L3 tunnel entropy refcount leak\n\nmlx5_tun_entropy_refcount_inc() counts both VXLAN and L2-to-L3\ntunnel reformat entries as entropy-enabling users. The matching\ndecrement path only handled VXLAN, leaving L2-to-L3 tunnel entries\ncounted after release.\n\nHandle MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL in\nmlx5_tun_entropy_refcount_dec() as well so the enabling entry\nrefcount remains balanced.\n\nFixes: f828ca6a2fb6 (\"net/mlx5e: Add support for hw encapsulation of MPLS over UDP\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260703141423.1723-1-lirongqing@baidu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "604e9594449b9907181f4285d0cd6a398bfc9d08", "tree": "395b56dae56453835477545e0b7f024f5d1aa001", "parents": [ "27f575836cfebbf872dec020428742b10650a955", "98052bdaf6ac1639a63ffc10244eeeab1f62ed2b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:09:06 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 11:09:06 2026 +0200" }, "message": "Merge tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are some batman-adv bugfixes, all by Sven Eckelmann:\n\n - ensure minimal ethernet header on TX\n\n - fix VLAN priority offset\n\n - clean untagged VLAN on netdev registration failure\n\n - tt: avoid request storms during pending request\n\n - tt: prevent TVLV OOB check overflow\n\n - frag: free unfragmentable packet\n\n - frag: fix primary_if leak on failed linearization\n\n - mcast: avoid OOB read of num_dests header\n\n - dat: fix tie-break for candidate selection\n\n* tag \u0027batadv-net-pullrequest-20260708\u0027 of https://git.open-mesh.org/batadv:\n batman-adv: dat: fix tie-break for candidate selection\n batman-adv: mcast: avoid OOB read of num_dests header\n batman-adv: frag: fix primary_if leak on failed linearization\n batman-adv: frag: free unfragmentable packet\n batman-adv: tt: prevent TVLV OOB check overflow\n batman-adv: tt: avoid request storms during pending request\n batman-adv: clean untagged VLAN on netdev registration failure\n batman-adv: fix VLAN priority offset\n batman-adv: ensure minimal ethernet header on TX\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260708091821.314516-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "27f575836cfebbf872dec020428742b10650a955", "tree": "ca480038eecbd50ba8886cc7f2591b7f2bc43d59", "parents": [ "c26c33e632248b334ccf132bc8c4877522c3db95" ], "author": { "name": "Théo Lebrun", "email": "theo.lebrun@bootlin.com", "time": "Thu Jul 02 17:37:02 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:48:15 2026 +0200" }, "message": "net: macb: drop in-flight Tx SKBs on close\n\nThe MACB driver has since forever leaked the outgoing SKBs that\nhave not yet been marked as completed. They live in queue-\u003etx_skb\nwhich gets freed without remorse nor checking.\n\nmacb_free_consistent() gets called in a few codepaths, but only close will\ntrigger the added expressions. In macb_open() and macb_alloc_consistent()\nfailure cases, queues\u0027 tx_skb just got allocated and are empty.\n\nFixes: 89e5785fc8a6 (\"[PATCH] Atmel MACB ethernet driver\")\nCc: stable@vger.kernel.org\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nLink: https://patch.msgid.link/20260702-macb-drop-tx-v4-1-1c833eebdbc8@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c26c33e632248b334ccf132bc8c4877522c3db95", "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc", "parents": [ "f4ef35efbb49527293309f668ea73ec5de9b8e7a", "c72a0f09c57f92113df69f9b902d11c9e4b132f5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:14 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:15 2026 +0200" }, "message": "Merge branch \u0027fix-mana-rx-with-bounce-buffering\u0027\n\nDexuan Cui says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix MANA RX with bounce buffering\n\nWith swiotlb\u003dforce, the MANA NIC fails to work properly due to commit\n730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead\nof full pages to improve memory efficiency.\").\n\nThis happens because, with the standard MTU\u003d1500, the aforementioned\ncommit uses page pool frags with PP_FLAG_DMA_MAP, but fails to call\npage_pool_dma_sync_for_cpu() to sync the received packet for CPU acces\nbefore handing the RX buffer to the stack.\n\nHere patch #2 adds the required page_pool_dma_sync_for_cpu().\n\nPatch #1 validates the packet length reported by the NIC. With patch #2,\npage_pool_dma_sync_for_cpu() uses the packet length, so we don\u0027t want\nto blindly trust the packet length, just in case.\n\nThere is no change between v2 and v3.\nv3 just swaps the order of the 2 patches in v2, as suggested by Simon [3].\n\nReferences:\n[1] v1: https://lore.kernel.org/netdev/20260618035029.249361-1-decui@microsoft.com/\n[2] v2: https://lore.kernel.org/netdev/20260624222605.1794719-1-decui@microsoft.com/\n[3] https://lore.kernel.org/netdev/20260626145048.GB1310988@horms.kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260702041237.617719-1-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c72a0f09c57f92113df69f9b902d11c9e4b132f5", "tree": "c9e8da1ecae2640b4a8e55b82428d239ac99b0cc", "parents": [ "2e2a83b4998af4384e677d3b2ac08565274279bf" ], "author": { "name": "Dexuan Cui", "email": "decui@microsoft.com", "time": "Wed Jul 01 21:12:37 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:36:14 2026 +0200" }, "message": "net: mana: Sync page pool RX frags for CPU\n\nMANA allocates RX buffers from page pool fragments when frag_count is\ngreater than 1. In that case the buffers remain DMA mapped by page pool\nand the RX completion path does not call dma_unmap_single(). As a result,\nthe implicit sync-for-CPU normally performed by dma_unmap_single() is\nmissing before the packet data is passed to the networking stack.\n\nThis breaks RX on configurations which require explicit DMA syncing, for\nexample when booted with swiotlb\u003dforce.\n\nFix this by recording the page pool page and DMA sync offset when the RX\nbuffer is allocated, and syncing the received packet range for CPU access\nbefore handing the RX buffer to the stack.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nLink: https://patch.msgid.link/20260702041237.617719-3-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2e2a83b4998af4384e677d3b2ac08565274279bf", "tree": "98f5e6830f439007b53bdce4ee00bf02b8da7837", "parents": [ "f4ef35efbb49527293309f668ea73ec5de9b8e7a" ], "author": { "name": "Dexuan Cui", "email": "decui@microsoft.com", "time": "Wed Jul 01 21:12:36 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:35:54 2026 +0200" }, "message": "net: mana: Validate the packet length reported by the NIC\n\nValidate the packet length reported in the RX CQE before passing it\nto skb processing. The CQE is supplied by the NIC device and should\nnot be blindly trusted.\n\nCc: stable@vger.kernel.org\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nFixes: ca9c54d2d6a5 (\"net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)\")\nLink: https://patch.msgid.link/20260702041237.617719-2-decui@microsoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f4ef35efbb49527293309f668ea73ec5de9b8e7a", "tree": "8de65ddd4d680d2c3e3d9ff97fe01e22d86dd696", "parents": [ "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc" ], "author": { "name": "Wang Yan", "email": "wangyan01@kylinos.cn", "time": "Thu Jul 02 10:59:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Jul 09 10:32:58 2026 +0200" }, "message": "selftests/net: fix EVP_MD_CTX leak in tcp_mmap\n\nIn tcp_mmap.c, both child_thread() and main() allocate an EVP_MD_CTX\nvia EVP_MD_CTX_new() when integrity checking is enabled, but neither\nfunction releases the context. child_thread() misses the free in its\ncommon cleanup block, and main() returns without freeing the context.\n\nThis results in a SHA256 context leak on every run that uses the\n‑i (integrity) option. Add the missing EVP_MD_CTX_free() calls to\nthe appropriate cleanup paths to fix the leak.\n\nFixes: 5c5945dc695c (\"selftests/net: Add SHA256 computation over data sent in tcp_mmap\")\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260702025949.442523-1-wangyan01@kylinos.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "06c2b8d7ea2bcb014dd974fc3bc6d128d65d7477", "tree": "7b86bfda75b41848890dc90e6b3294e0449f82a4", "parents": [ "c69dbbf0212734e22219dfc31c0922bd7c9ffbb0" ], "author": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Thu Jul 02 16:50:13 2026 +0200" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Thu Jul 09 09:23:31 2026 +0200" }, "message": "drm/fb-helper: Only consider active CRTCs for vblank sync\n\nOnly synchronize fbdev output to the vblank of an active CRTC. Go over\nthe list of CRTCs and pick the first that matches. Fixes warnings as\nthe one shown below\n\n[ 77.201354] WARNING: drivers/gpu/drm/drm_vblank.c:1320 at drm_crtc_wait_one_vblank+0x194/0x1cc [drm], CPU#1: kworker/1:7/1867\n[ 77.201354] omapdrm omapdrm.0: [drm] vblank wait timed out on crtc 0\n\nThis currently happens if the fbdev output is not on CRTC 0.\n\nAtomic and non-atomic drivers require distinct code paths. As for other\nfbdev operations, implement both and select the correct one at runtime.\n\nNot finding an active CRTC is not a bug. Do not wait in this case, but\nflush the display update as before.\n\nv4:\n- avoid possible deadlocks with locking context (Sashiko)\nv3:\n- drop excessive state validation (Jani)\n- acquire plane and CRTC mutices (Sashiko)\nv2:\n- move look-up code into separate helper\n- support drivers with legacy modesetting\nv1:\n- see https://lore.kernel.org/dri-devel/1c9e0e24-9c4a-4259-8700-cf9e5fd60ca3@suse.de/\n\nCo-authored-by: H. Nikolaus Schaller \u003chns@goldelico.com\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nFixes: d8c4bddcd8bcb (\"drm/fb-helper: Synchronize dirty worker with vblank\")\nTested-by: Icenowy Zheng \u003czhengxingda@iscas.ac.cn\u003e\nTested-by: H. Nikolaus Schaller \u003chns@goldelico.com\u003e\nCloses: https://bugs.debian.org/1138033\nAcked-by: Maxime Ripard \u003cmripard@kernel.org\u003e\nLink: https://patch.msgid.link/20260702145021.226932-1-tzimmermann@suse.de\n" }, { "commit": "47ea05f246bebc81c7796f56265cffd812cf0601", "tree": "f7fd90a49007f23e4b35a4eb2dfec50b8765a78f", "parents": [ "e987eabc02646920cd13ab75902693e99735eca0" ], "author": { "name": "David Francis", "email": "David.Francis@amd.com", "time": "Mon Jul 06 10:19:04 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:46:53 2026 -0400" }, "message": "drm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n\nWe weren\u0027t checking whether the values provided in the private\ndata in kfd CRIU restore were within bounds.\n\nFor queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided\ntype is less than it.\n\nFor mqd_size, add new function mqd_size_from_queue_type and confirm\nthat the provided mqd_size matches expectations.\n\nReviewed-by: David Yat Sin \u003cdavid.yatsin@amd.com\u003e\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit f19d8086f6644083c913d70bfdeee20e1b6f46a5)\nCc: stable@vger.kernel.org\n" }, { "commit": "e987eabc02646920cd13ab75902693e99735eca0", "tree": "77887d605ddd0c4735730a4241daa3bd90af3fe1", "parents": [ "bb52249fbbe948875155ccd45cd8d74bf4ae747b" ], "author": { "name": "Yang Wang", "email": "kevinyang.wang@amd.com", "time": "Mon Jul 06 09:29:24 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:46:13 2026 -0400" }, "message": "drm/amd/pm: fix smu14 power limit range calculation\n\nSMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but\nMsgLimits.Power may expose a different firmware limit for the same PPT0\nthrottler. Using those values independently as fixed min/max bases can\nreport an incorrect configurable power range.\n\nKeep the socket power limit as the default value and as the fallback for\ncurrent-limit queries. Calculate the reported range from both firmware\nvalues instead, using the lower value as the minimum base and the higher\nvalue as the maximum base before applying OD percentages.\n\nSigned-off-by: Yang Wang \u003ckevinyang.wang@amd.com\u003e\nReviewed-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit c936b8126b444401318fcbeb1828488cc5312dee)\nCc: stable@vger.kernel.org\n" }, { "commit": "bb52249fbbe948875155ccd45cd8d74bf4ae747b", "tree": "1278344d8b52f3d3531aaea568839ae893bac36f", "parents": [ "a88419af8dbd5abf8b1dfdfd9346376bce5413b4" ], "author": { "name": "David Francis", "email": "David.Francis@amd.com", "time": "Thu May 21 09:18:59 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:45:48 2026 -0400" }, "message": "drm/amdkfd: Check bounds in allocate_event_notification_slot\n\nThe valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT\n\nallocate_event_notification_slot has an option to specify\nan event id to allocate at, used by CRIU. We weren\u0027t checking\nthe bounds on that value.\n\nCheck them.\n\nv2: Lower bounds check is unecessary because of idr_alloc\nalready rejecting negative numbers. Upper bounds check should\nbe KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might\nnot yet exist\n\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nReviewed-by: David Yat Sin \u003cdavid.yatsin@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50)\nCc: stable@vger.kernel.org\n" }, { "commit": "a88419af8dbd5abf8b1dfdfd9346376bce5413b4", "tree": "ca1eec59302e5536d5ccc5137130f112435ab75c", "parents": [ "8a93f77aec65574b8152c88eb73613336f92f86b" ], "author": { "name": "Zhu Lingshan", "email": "lingshan.zhu@amd.com", "time": "Wed Jul 01 16:08:12 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:45:41 2026 -0400" }, "message": "amdkfd: properly free secondary context id\n\nFunction kfd_process_free_id() should skip over\nthe primary kfd process because its context id\nis fixed assigned, not allocated through the ida table.\nThis function should only work on secondary contexts.\n\nFixes: fac682a1d1af (\"amdkfd: identify a secondary kfd process by its id\")\nSigned-off-by: Zhu Lingshan \u003clingshan.zhu@amd.com\u003e\nReviewed-by: Felix Kuehling \u003cfelix.kuehling@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 8799ba6fb6a48438aea20c82e74c2f2a3d2b2e7a)\nCc: stable@vger.kernel.org\n" }, { "commit": "8a93f77aec65574b8152c88eb73613336f92f86b", "tree": "9a4f7ae3be1f3461e8ae7cd47bdbda67111db607", "parents": [ "3888a656e8143e4b40f01143648c768fecbfefc6" ], "author": { "name": "David Francis", "email": "David.Francis@amd.com", "time": "Tue Jun 30 09:58:18 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:44:14 2026 -0400" }, "message": "drm/amdkfd: Don\u0027t acquire buffers during CRIU queue restore.\n\nkfd_criu_restore_queue\u0027s call of kfd_queue_acquire_buffers was\nfailing for multiple reasons\n- The ctl_stack_size set by the CRIU plugin doesn\u0027t match\nwhat is expected by acquire_buffers\n- The svm buffer cannot be acquired at this point because\nCRIU may not have restored it, or may have restored it\nto a different address.\n\nThe only reason acquire_buffers was necessary here was to\navoid a null ptr dereference in init_user_queue.\n\nJust put in a check for that dereference; it doesn\u0027t appear to\ncome up in real use cases right now. That is, there is no\nusage of CRIU with shared MES.\n\nThis is a partial revert of\ncommit 20a5e7ffdfec (\"drm/amdkfd: Properly acquire queue buffers in CRIU restore\")\n\nFixes: 20a5e7ffdfec (\"drm/amdkfd: Properly acquire queue buffers in CRIU restore\")\nReviewed-by: David Yat Sin \u003cdavid.yatsin@amd.com\u003e\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1cafa8b29e029eac3ddf64604f891b35dbf6262b)\nCc: stable@vger.kernel.org\n" }, { "commit": "3888a656e8143e4b40f01143648c768fecbfefc6", "tree": "426f33548eabf645c38dcced35a5e27e2f9f5ceb", "parents": [ "f0262c3a3f14d60140f6b826d40d44edf62c36d6" ], "author": { "name": "David Francis", "email": "David.Francis@amd.com", "time": "Tue May 12 14:49:41 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:37:52 2026 -0400" }, "message": "drm/amdkfd: Check bounds on CRIU restore event id\n\nThe valid amdkfd event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT - 1.\n\nDuring CRIU restore, ensure that the provided event ids are\nin that range.\n\nv2: No need for lower bound check since idr_alloc rejects negative\ninputs\n\nv3: Also change error message to reflect new error condition\n\nReviewed-by: David Yat Sin \u003cdavid.yatsin@amd.com\u003e\nSigned-off-by: David Francis \u003cDavid.Francis@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 5c6c247992d4d9200e073b83f4ec6c703c096845)\n" }, { "commit": "f0262c3a3f14d60140f6b826d40d44edf62c36d6", "tree": "b37384561871a0ca6903ea0504e64ba2ce76849c", "parents": [ "04cc4aa3617b0ed67e859f91f09de5d896a46f3a" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Fri Jun 26 16:29:13 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:37:12 2026 -0400" }, "message": "drm/gfx10: Program DB_RING_CONTROL\n\nThis is needed to allocate occlusion counters across\nboth gfx pipes.\n\nFixes: b7a1a0ef12b8 (\"drm/amd/amdgpu: add pipe1 hardware support\")\nReviewed-by: Timur Kristóf \u003ctimur.kristof@gmail.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 6807352cbabb74b61ba42888769283af72191f66)\nCc: stable@vger.kernel.org\n" }, { "commit": "04cc4aa3617b0ed67e859f91f09de5d896a46f3a", "tree": "e79e9057c17c0c093f8cf13713b67ba159257467", "parents": [ "614e8a989d462876c4f6a659f56e1075e72ad515" ], "author": { "name": "Shahyan Soltani", "email": "shahyan.soltani@amd.com", "time": "Mon Jul 06 08:15:21 2026 -0400" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:30:53 2026 -0400" }, "message": "drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n\nThe vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only\nvalid while the lock is still being held. Once xa_unlock_irqrestore is\ncalled and returned, the pointer is no longer under lock and is subject\nto modification. Since, the caller still dereferences vm-\u003etask_info in\namdgpu_vm_get_task_info_vm() after the lock is removed, this causes a\nuse after unlock problem.\n\nRemove the lifetime issue present in amdgpu_vm_get_task_info_pasid()\nthrough removing the amdgpu_vm_get_vm_from_pasid() function from\namdgpu_vm.c and making the relevant code inline to hold the lock while\nit is still in use.\n\nSigned-off-by: Shahyan Soltani \u003cshahyan.soltani@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)\nCc: stable@vger.kernel.org\n" }, { "commit": "614e8a989d462876c4f6a659f56e1075e72ad515", "tree": "489badaa8de7923be6d47e437c4d48a676848d3c", "parents": [ "18a7826aea6fd09f2d371c02cec70c7234fc4879" ], "author": { "name": "Jesse Zhang", "email": "Jesse.Zhang@amd.com", "time": "Wed Jul 01 18:17:03 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:29:11 2026 -0400" }, "message": "drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue\n\nDestroying a hung user queue issues a MES REMOVE_QUEUE that times out,\nThe destroy path only logged the error and freed the queue, so the\nnext userq submission failed and forced a GPU reset attributed to an innocent workload.\n\nKick the userq reset work when unmap fails so the GPU is recovered at\ndestroy time.\n\nAcked-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Jesse Zhang \u003cJesse.Zhang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 8396b9de4198a54ec4760a94a179347540a9764d)\nCc: stable@vger.kernel.org\n" }, { "commit": "18a7826aea6fd09f2d371c02cec70c7234fc4879", "tree": "f777820bd27a3106153f46ecbb462d0565156fb2", "parents": [ "9c809e489802e40d7845f4daf5a9d828830a8724" ], "author": { "name": "Kenneth Feng", "email": "kenneth.feng@amd.com", "time": "Thu Jun 25 17:48:22 2026 +0800" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:21:49 2026 -0400" }, "message": "drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled\n\nDisable ASPM on VI if PCIE dpm is disabled.\n\nFixes: bb00bf17328d (\"drm/amd/amdgpu: decouple ASPM with pcie dpm\")\nCloses: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370\nSigned-off-by: Kenneth Feng \u003ckenneth.feng@amd.com\u003e\nReviewed-by: Yang Wang \u003ckevinyang.wang@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 873a8d6b3c0a386408c891e4ff1c684fa11783e1)\nCc: stable@vger.kernel.org\n" }, { "commit": "9c809e489802e40d7845f4daf5a9d828830a8724", "tree": "59d236c279ccc8a58d591c5752d9b117c3a2a07c", "parents": [ "e2469bde3fcaa087dcfeccbc6306a9e76a79344e" ], "author": { "name": "Suresh Guttula", "email": "suresh.guttula@amd.com", "time": "Fri Jun 26 11:39:51 2026 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:20:30 2026 -0400" }, "message": "drm/amdgpu: Disable JDPG on VCN5_3\n\nJDPG does not support on VCN5\n\nThis patch will disable JDPG, because DPG is not correctly\ncopying the JRBC Read/Write Pointers (R/WPTR) from the PG\n(Power Gating) block to JRBC.\n\nSigned-off-by: Suresh Guttula \u003csuresh.guttula@amd.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ea3fdd1eda088030d8925f023613728969f55955)\n" }, { "commit": "e2469bde3fcaa087dcfeccbc6306a9e76a79344e", "tree": "72f7a14e781eb64082fa6a8515c1ae2656bede04", "parents": [ "58aad119f4d65a8f91262687db302046a94fa9ac" ], "author": { "name": "Kanala Ramalingeswara Reddy", "email": "Kanala.RamalingeswaraReddy@amd.com", "time": "Wed Jun 17 18:04:53 2026 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:20:02 2026 -0400" }, "message": "drm/amdgpu: add support for SMU version 15.0.9\n\nInitialize SMU Version 15_0_9\n\nSigned-off-by: Kanala Ramalingeswara Reddy \u003cKanala.RamalingeswaraReddy@amd.com\u003e\nSigned-off-by: Granthali Vinodkumar Dhandar \u003cgranthali.vinodkumardhandar@amd.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit 1dfd4e84b5beec353a81d61af9eaf4e5a56e0c57)\n" }, { "commit": "58aad119f4d65a8f91262687db302046a94fa9ac", "tree": "2dfee82f47099d14f934edc68751c3f41c096199", "parents": [ "8cdeaa50eae8dad34885515f62559ee83e7e8dda" ], "author": { "name": "Kanala Ramalingeswara Reddy", "email": "Kanala.RamalingeswaraReddy@amd.com", "time": "Wed Jun 17 18:04:36 2026 +0530" }, "committer": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Wed Jul 08 16:19:30 2026 -0400" }, "message": "drm/amdgpu: add support for PSP version 15.0.9\n\nInitialize PSP Version 15_0_9\n\nSigned-off-by: Kanala Ramalingeswara Reddy \u003cKanala.RamalingeswaraReddy@amd.com\u003e\nSigned-off-by: Granthali Vinodkumar Dhandar \u003cgranthali.vinodkumardhandar@amd.com\u003e\nReviewed-by: Mario Limonciello \u003cmario.limonciello@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n(cherry picked from commit ef71f00173228904763552b7405169023f8034a8)\n" }, { "commit": "6bad2e38fe7f2da7dc982b2b80814e632832e568", "tree": "2bf52fc532555d59cdbbad66cd785628a06a1db4", "parents": [ "0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53", "b6eb022890c78285f55381589c1536bd66b8eaeb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 08 08:43:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jul 08 08:43:44 2026 -0700" }, "message": "Merge tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - OOB, UAF, NULL-deref fixes in core and picolcd, logitech, letsketch,\n appleir and multitouch drivers (Georgiy Osokin, HyeongJun An, Lee\n Jones, Manish Khadka, Maoyi Xie and Trung Nguyen)\n\n - fix for integer wraparound (and corresponding regression selftest) in\n hid-bpf (Yiyang Chen)\n\n* tag \u0027hid-for-linus-2026070801\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n selftests/hid: multitouch: test a large ContactCountMaximum\n HID: multitouch: fix out-of-bounds bit access on mt_io_flags\n selftests/hid: Cover hid_bpf_get_data() size overflow\n selftests/hid: Load only requested struct_ops maps\n HID: bpf: Fix hid_bpf_get_data() range check\n HID: lg-g15: cancel pending work on remove to fix a use-after-free\n HID: logitech-dj: Fix maxfield check in DJ short report validation\n HID: core: Fix OOB read in hid_get_report for numbered reports\n HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n HID: appleir: fix UAF on pending key_up_timer in remove()\n HID: letsketch: fix UAF on inrange_timer at driver unbind\n" }, { "commit": "3f7a535ff0fa627a0132803e4c2f903ceffcbc1c", "tree": "f92b10488f2616de428daa344ee86d11ecfeef01", "parents": [ "2f75c0faa3361b28e36cc0512b3299e163e25789" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Tue Jul 07 21:25:46 2026 +0300" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.\n\nFixes: f2edb9f7706d (\"ipvs: implement passive PMTUD for IPIP packets\")\nLink: https://sashiko.dev/#/patchset/20260702073430.67680-1-zhaoyz24%40mails.tsinghua.edu.cn\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "2f75c0faa3361b28e36cc0512b3299e163e25789", "tree": "1f5638b06f23ecbdfc7ef67fb5d779bb97ddb586", "parents": [ "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:24 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset.\n\nFixes: 2906f66a5682 (\"ipvs: SCTP Trasport Loadbalancing Support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "2500fa3958b1ba51c2b065e39db1b04dfa7e23a2", "tree": "dd12b9e64bf0acf870421762001c827076e4bb5b", "parents": [ "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:23 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: use parsed transport offset in TCP state lookup\n\nTCP state handling reparses the skb to find the TCP header. For IPv6 it\nuses sizeof(struct ipv6hdr), while the surrounding IPVS code already\nparsed the packet with ip_vs_fill_iph_skb() and has the real\ntransport-header offset in iph.len.\n\nThis makes TCP state handling look at the wrong bytes when an IPv6\npacket carries extension headers. Use the parsed transport offset passed\ndown from ip_vs_set_state() when reading the TCP header.\n\nFor IPv4 and for IPv6 packets without extension headers, the passed\noffset matches the previous value.\n\nFixes: 0bbdd42b7efa6 (\"IPVS: Extend protocol DNAT/SNAT and state handlers\")\nLink: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nAssisted-by: Claude Code:GLM-5.2\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866", "tree": "ea27349d925829b2a7ba6cf97a031aaa63aee3cc", "parents": [ "da5b58478a9c1b85608c9e40a3b8432d071b409e" ], "author": { "name": "Yizhou Zhao", "email": "zhaoyz24@mails.tsinghua.edu.cn", "time": "Mon Jul 06 18:16:22 2026 +0800" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "ipvs: pass parsed transport offset to state handlers\n\nIPVS callers already parse the packet into struct ip_vs_iphdr before\nupdating connection state. For IPv6 this records the real\ntransport-header offset after extension headers in iph.len.\n\nPass this parsed transport offset through ip_vs_set_state() and the\nprotocol state_transition() callback so protocol handlers can use the\nsame packet context as scheduling and NAT handling. This patch only\nchanges the common callback plumbing and adapts the protocol callback\nsignatures; TCP and SCTP start using the value in follow-up patches.\n\nSigned-off-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "da5b58478a9c1b85608c9e40a3b8432d071b409e", "tree": "77db84123781dc90946186a49c8fe0e62a25d837", "parents": [ "fa7395c02d95e51bad2952325d2d6503bfbad437" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sun Jul 05 15:29:13 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: handle unreadable frags\n\nsashiko reports:\n When an skb with unreadable fragments (such as from devmem TCP, where\n skb_frags_readable(skb) returns false) is processed by the u32 module,\n skb_copy_bits() will safely return a negative error code [..]\n\nxt_u32: bail out with hotdrop in this case.\ngather_frags: return -1, just as if we had no fragment header.\nnfnetlink_queue: restrict to the linear part.\nnfnetlink_log: restrict to the linear part.\n\nv2:\n - skb_zerocopy helpers don\u0027t copy readable flag, i.e. nfnetlink_queue\n is broken too\n xt_u32 shouldn\u0027t return true if hotdrop was set.\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nCc: stable@vger.kernel.org\nAcked-by: Mina Almasry \u003calmasrymina@google.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "fa7395c02d95e51bad2952325d2d6503bfbad437", "tree": "b9991a1a077ab9620f64275ac7cbc90d01bacc49", "parents": [ "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:56 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: support IPIP tunnel with direct xmit\n\nThe combination of IPIP tunnel with direct xmit, eg. bridge device,\nbreaks because no dst_entry is provided to check the skb headroom and to\nset the iph-\u003efrag_off field. This leads to invalid dst usage and can\ntrigger a crash in the tunnel transmit path.\n\nFix this by moving dst_cache and dst_cookie out of the runtime union so\nthat they can be shared by neighbour, xfrm, and direct tunnel flows.\nFor FLOW_OFFLOAD_XMIT_DIRECT tuples carrying tunnel metadata, preserve\nroute state in these shared fields and release it through the common\ndst release path.\n\nSince dst_entry is now available to the three supported xmit modes and\ndst_release() already deals with NULL dst, remove the xmit type check\nin nft_flow_dst_release(). Moreover, skip the check if the dst entry\nis NULL in nf_flow_dst_check() which is now the case for the direct\nxmit case.\n\nBased on patch from Rein Wei \u003cn05ec@lzu.edu.cn\u003e.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nReported-by: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6c5dcab95f4cd42a1648739ec9300fbb4b1a021f", "tree": "eb029386c666eab831231c882a9fbb7775bd975c", "parents": [ "c328b90c17fc5fa7786503695152880b2afb9326" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:55 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: IPIP tunnel hardware offload is not yet support\n\nNo driver supports for IPIP tunnels yet, give up early on setting up the\nhardware offload for this scenario.\n\nThis patch adds a stub that can be enhanced to add more configuration\nthat are currently not supported. As of now, the offload work is\nenqueued to the worker, then ignored if the hardware offload\nconfiguration is not supported.\n\nCheck the NF_FLOW_HW flag to know if this entry was already tried once\nto be offloaded so this is not retried on refresh when unsupported. Move\nNF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag\nis unset the _del and _stats variants are never called.\n\nThis can be updated later on to skip hardware offload work to be queued\nin case hardware offload does not support it.\n\nFixes: d98103575dcd (\"netfilter: flowtable: Add IP6IP6 rx sw acceleration\")\nFixes: ab427db17885 (\"netfilter: flowtable: Add IPIP rx sw acceleration\")\nCc: stable@vger.kernel.org\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported-by: Zhengyang Chen \u003cchzhengyang2023@lzu.edu.cn\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "c328b90c17fc5fa7786503695152880b2afb9326", "tree": "84b653b7bc72349c5a0347deb37544f30611137c", "parents": [ "724f32699aeabcbd294377904b40b456fd5c67eb" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Jun 30 11:40:54 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: flowtable: use dst in this direction when pushing IPIP header\n\nWhen pushing the IPIP header, the route of the other direction is used\nto calculate the headroom, use the route in this direction. Accessing\nthe other tuple to set the IP source and destination is fine because\nthis tuple does not provide such information to avoid storing redundant\ninformation. However, this tuple already provides the dst for this\ndirection, this went unnoticed because this bug affects headroom and\niph-\u003efrag_off only at this stage.\n\nFixes: d30301ba4b07 (\"netfilter: flowtable: Add IPIP tx sw acceleration\")\nFixes: 93cf357fa797 (\"netfilter: flowtable: Add IP6IP6 tx sw acceleration\")\nCc: stable@vger.kernel.org\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "724f32699aeabcbd294377904b40b456fd5c67eb", "tree": "d6cab8baf89cbe8fa2e43bcfd6051663433c8eb0", "parents": [ "672321302ed682ccb903004f435bbdb353534a9c" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:47:00 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:44 2026 +0200" }, "message": "netfilter: ipset: allocate the proper memory for the generic hash structure\n\nBecause a single create function is emitted for every hash type,\nfrom the IPv4 and IPv6 generic hash structure definitions the last\none, i.e. the IPv6 was in effect for IPv4 too. Use the proper size\nwhen allocating the structure. Comment properly that because create()\nrefers to elements of the generic hash structure, all referred ones\nmust come before the IPv4/IPv6 dependent \u0027next\u0027 member.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "672321302ed682ccb903004f435bbdb353534a9c", "tree": "b457f5dc1d9ef2ad3ba94d3fe27a001b0e172efc", "parents": [ "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:59 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: cleanup the add/del backlog when resize failed\n\nSashiko pointed out that the add/del backlog was not cleaned up\nwhen resize failed. Fix it in the corresponding error path. Also,\nmake sure that the add/del backlog is htable-specific so when\nresize creates a new htable, old/new backlog can\u0027t be mixed up.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "cffcf57bf03cb7f7e83d10f760b5f34e5c51d9b3", "tree": "713bd6ca2ef3c591327e8b7045ee79736142fff0", "parents": [ "5d0c22e73656d050daffad10a2ba8765ce8441c8" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:58 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: exclude gc when resize is in progress\n\nZhengchuan Liang and Eulgyu Kim reported that because resize\ndoes not copy the comment extension into the resized set but\nuses it\u0027s pointer, ongoing gc can free the extension in the\noriginal set which then results stale pointer in the resized\none. The proposed patch was to recreate the extensions for\nevery element in the resized set. It is both expensive and\nwastes memory, so better exclude gc when resizing in progress\ndetected: resizing will destroy the original set anyway,\nso doing gc on it is unnecessary.\n\nIntroduce a new spinlock to exclude parallel gc and resize.\nBecause we just set and check a bool value, there\u0027s no need\nfor the parameter to be atomic_t and rename it for better\nreadability.\n\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nReported-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nReported-by: Xin Liu \u003cbird@lzu.edu.cn\u003e\nReported by: Zhengchuan Liang \u003czcliangcn@gmail.com\u003e\nReported by: Eulgyu Kim \u003ceulgyukim@snu.ac.kr\u003e\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "5d0c22e73656d050daffad10a2ba8765ce8441c8", "tree": "5da16b9fc28bfc0d62198bfcbd500902ea7380a5", "parents": [ "e6107a4c74b54cb33e3bce162a63048ae5a6b198" ], "author": { "name": "Jozsef Kadlecsik", "email": "kadlec@netfilter.org", "time": "Thu Jul 02 15:46:57 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:43 2026 +0200" }, "message": "netfilter: ipset: mark the rcu locked areas properly\n\nWhen we bump the uref counter, there\u0027s no need to keep\nthe rcu lock because the referred hash table can\u0027t\ndisappear. Also, from the same reason in mtype_gc we\nneed the rcu lock and not a spinlock.\n\nSigned-off-by: Jozsef Kadlecsik \u003ckadlec@netfilter.org\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "e6107a4c74b54cb33e3bce162a63048ae5a6b198", "tree": "7eb26e84bfb0137112bcfc8fc943d82d1246c37d", "parents": [ "084d23f818321390509e9738a0b08bbf46df6425" ], "author": { "name": "Tamaki Yanagawa", "email": "ty@000ty.net", "time": "Fri Jul 03 16:22:57 2026 +0000" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:33:37 2026 +0200" }, "message": "netfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!\u003d @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval().\n\nFixes: aaa31047a6d2 (\"netfilter: nftables: add catch-all set element support\")\nSigned-off-by: Tamaki Yanagawa \u003cty@000ty.net\u003e\nAssisted-by: Claude:claude-sonnet-5\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "084d23f818321390509e9738a0b08bbf46df6425", "tree": "c2d58d5ef76495f2e67502c78a7af3c1f21365f3", "parents": [ "cbfe53599eebffd188938ab6774cc41794f6f9d5" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Jul 04 12:05:15 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module().\n\nCc: stable@vger.kernel.org\nFixes: bcf493428840 (\"netfilter: ebtables: Fix extension lookup with identical name\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "cbfe53599eebffd188938ab6774cc41794f6f9d5", "tree": "1f4b8f3420ee8f703a2d8420599a26ad5663624d", "parents": [ "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Jul 04 10:23:31 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place.\n\nCc: stable@vger.kernel.org\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d", "tree": "63725cf9f74fdd7fe611c12dfe6854b2b2b8574a", "parents": [ "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sun Jul 05 14:58:00 2026 -0700" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n Call Trace:\n ...\n string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n vsnprintf (lib/vsprintf.c:2945)\n __request_module (kernel/module/kmod.c:150)\n do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n update_counters (net/bridge/netfilter/ebtables.c:1440)\n do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n raw_setsockopt (net/ipv4/raw.c:847)\n __sys_setsockopt (net/socket.c:2393)\n ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9", "tree": "f206d5080cbce8fa09322d9ab39ee0f3d300a13e", "parents": [ "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc" ], "author": { "name": "Xiang Mei", "email": "xmei5@asu.edu", "time": "Sun Jul 05 16:36:29 2026 -0700" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jul 08 15:22:03 2026 +0200" }, "message": "netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\nnf_ct_frag6_reasm() slides the packet head forward to drop the IPv6\nfragment header and then unconditionally advances skb-\u003emac_header:\n\n\tskb-\u003emac_header +\u003d sizeof(struct frag_hdr);\n\nOn the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header\nyet, so skb-\u003emac_header is still the \"not set\" sentinel (u16)~0U. Adding\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 \u003d\u003d 7),\nafter which skb_mac_header_was_set() wrongly reports a MAC header is\npresent and skb_mac_header() points into the headroom.\n\nThe reassembler has done this unconditional add since it was introduced;\nit was harmless while mac_header was a bare pointer, but wrong once\nmac_header became a u16 offset whose unset state is the ~0U sentinel\ntested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c\ndoes the same relocation and does guard the adjustment; mirror the\nguard here.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nCc: stable@vger.kernel.org\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-8\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6d27e29a90bc6a717b97c6ddcd866db7bd8e4adc", "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d", "parents": [ "235acadd310533ba386ae61ad155b72bee381559", "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:04 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:04 2026 +0200" }, "message": "Merge branch \u0027ipv4-ipv6-fix-uaf-and-memory-leak-in-igmp-mld\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: Fix UAF and memory leak in IGMP/MLD\n\nThis series addresses two potential UAF vulnerabilities\nand memory leaks in the IPv4 IGMP and IPv6 MLD subsystems.\n\nThe first two patches fix a UAF where the packet receive path races with\ndevice teardown. If the device refcount has already hit 0 (but the memory\nis still held by RCU), incoming IGMP/MLD packets trying to schedule delayed\nwork or timers would call refcount_inc() on the 0 refcount, triggering a\nwarning and eventually leading to a UAF when the work runs after the device\nhas been freed. This is fixed by introducing safe hold helpers using\nrefcount_inc_not_zero(). In MLD, we also ensure we only enqueue the skb\nif we successfully acquired the device reference, to avoid leaking skbs\nwhen the device is being destroyed.\n\nThe third patch fixes memory leaks in IPv4 IGMP when timers are deleted or\nstopped. When a timer is deleted (in igmp_mod_timer) or stopped (in\nigmp_stop_timer) and not re-armed, the code dropped the group refcount using\nrefcount_dec(). However, if the group was concurrently removed from the list,\nthis decrement could drop the refcount to 0 without triggering the\ncleanup/free path, leaking the group structure. This is fixed by using\nip_ma_put() instead, and deferring the put until after the lock is released.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260705181756.963063-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36", "tree": "7a4c1b196df327b7a7320515fb7e6afa3f8aeb1d", "parents": [ "9b26518b6896a16b809b1e42986f4ebac7bccc1e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:56 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026im-\u003erefcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u003e for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u003e igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026im-\u003erefcnt),\nand deferring the put until after the spinlock is released.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-4-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9b26518b6896a16b809b1e42986f4ebac7bccc1e", "tree": "fa4c8586487e9d668c7e58bc960a0b0edf063a5d", "parents": [ "7b19c0f81ed1fdaec6bc522569be367199a9edf3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:55 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv6: mcast: Fix potential UAF in MLD delayed work\n\nA race condition exists between device teardown and incoming MLD query\nprocessing, leading to a Use-After-Free in the MLD delayed work.\n\nDuring device destruction, the primary reference to inet6_dev is dropped,\nwhich can drop its refcount to 0. The actual freeing of inet6_dev memory\nis deferred via RCU.\n\nConcurrently, the packet receive path runs under RCU read lock and obtains\nthe inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can\nsafely dereference inet6_dev even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp6_event_query() and schedules delayed work, it\nattempts to acquire a reference using in6_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the inet6_dev memory is still scheduled to be freed after the RCU\ngrace period, the device is freed while the work is still scheduled.\nWhen the work runs, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin6_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not schedule the work.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7b19c0f81ed1fdaec6bc522569be367199a9edf3", "tree": "254a8473aa09bd79729908ed1f527027a6c8c5d2", "parents": [ "235acadd310533ba386ae61ad155b72bee381559" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Jul 05 18:17:54 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 14:41:01 2026 +0200" }, "message": "ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Zero Day Initiative \u003czdi-disclosures@trendmicro.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260705181756.963063-2-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b11c513ad943f35cf5e8007d3a56279c79b7ed4b", "tree": "8bc0aad837bca311d2ee6039ad16e9d40ac3fe7a", "parents": [ "4ad805f0e41acf56ac54855c666d34c59ad66fe7" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Tue Jul 07 16:23:58 2026 -0700" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jul 08 14:05:11 2026 +0200" }, "message": "gpio: mvebu: free generic chips on unbind\n\nirq_alloc_domain_generic_chips() allocates generic chip data that must\nbe freed via irq_domain_remove_generic_chips(). The devres action\nmvebu_gpio_remove_irq_domain() only called irq_domain_remove(), which\nonly frees the generic chips if IRQ_DOMAIN_FLAG_DESTROY_GC is set.\nCall irq_domain_remove_generic_chips() explicitly before\nirq_domain_remove() instead.\n\nFixes: 812d47889a8e (\"gpio/mvebu: Use irq_domain_add_linear\")\nAssisted-by: opencode:big-pickle\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nLink: https://patch.msgid.link/20260707232358.1218077-1-rosenp@gmail.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "235acadd310533ba386ae61ad155b72bee381559", "tree": "ffc3ca11b558ed1630e6f1208309b511a5c8c3c8", "parents": [ "b7f97cae7ec1b6c3c32843c42be218690d310467" ], "author": { "name": "Suman Ghosh", "email": "sumang@marvell.com", "time": "Thu Jul 02 09:04:51 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 12:01:13 2026 +0200" }, "message": "octeontx2-pf: check DMAC extraction support before filtering\n\nCurrently, configuring a VF MAC address via the PF (e.g., \u0027ip link\nset \u003cpf\u003e vf 0 mac \u003cmac\u003e\u0027) blindly attempts to install a DMAC-based\nhardware filter. However, the hardware parser profile might not\nsupport DMAC extraction.\n\nCheck if the hardware parsing profile supports DMAC extraction\nbefore adding the filter. Additionally, emit a warning message\nto inform the operator if the MAC filter installation fails due\nto missing DMAC extraction support. Update config-\u003emac only\nafter hardware programming succeeds in otx2_set_vf_mac().\n\nFixes: f0c2982aaf98 (\"octeontx2-pf: Add support for SR-IOV management functions\")\nSigned-off-by: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260702033451.2969880-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b7f97cae7ec1b6c3c32843c42be218690d310467", "tree": "5350e2160fa6de99543e1bb73f1451635b4665bc", "parents": [ "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e" ], "author": { "name": "Samuel Moelius", "email": "sam.moelius@trailofbits.com", "time": "Thu Jul 02 00:07:59 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:42:21 2026 +0200" }, "message": "net/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic. A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model. A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments.\n\nFixes: a729b7f0bd5b (\"sch_cake: Add overhead compensation support to the rate shaper\")\nAssisted-by: Codex:gpt-5.5-cyber-preview\nSigned-off-by: Samuel Moelius \u003csam.moelius@trailofbits.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5258b4fdae44cf5ac9b7c6fd71c9e0394a9fad5e", "tree": "b2a6859feb61e584a5129638ccbf1348bb5cd0c8", "parents": [ "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb", "6e1930ece855a4c256f1c7e6632d634cfb9888b5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:10:21 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 11:10:21 2026 +0200" }, "message": "Merge tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - hci_conn: Fix null ptr deref in hci_abort_conn()\n - af_bluetooth: fix UAF in bt_accept_dequeue()\n - L2CAP: validate option length before reading conf opt value\n - L2CAP: cancel pending_rx_work before taking conn-\u003elock\n - L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n - L2CAP: fix tx ident leak for commands without a response\n - SCO: Fix a race condition in sco_sock_timeout()\n - ISO: avoid NULL deref of conn in iso_conn_big_sync()\n - ISO: fix malformed ISO_END/CONT handling\n - ISO: exclude RFU bits from ISO_SDU_Length\n - MGMT: Fix adv monitor add failure cleanup\n - MGMT: Fix UAF of hci_conn_params in add_device_complete\n - bnep: pin L2CAP connection during netdev registration\n - 6lowpan: avoid untracked enable work\n - 6lowpan: hold L2CAP conn across debugfs control\n - 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n - btintel_pcie: Refactor FLR to use device_reprobe()\n - btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n - hci_uart: clear HCI_UART_SENDING when write_work is canceled\n - bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\n* tag \u0027for-net-2026-07-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: L2CAP: fix tx ident leak for commands without a response\n Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length\n Bluetooth: ISO: fix malformed ISO_END/CONT handling\n Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()\n Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n Bluetooth: fix UAF in bt_accept_dequeue()\n Bluetooth: bnep: pin L2CAP connection during netdev registration\n Bluetooth: sco: Fix a race condition in sco_sock_timeout()\n Bluetooth: MGMT: Fix adv monitor add failure cleanup\n Bluetooth: 6lowpan: hold L2CAP conn across debugfs control\n Bluetooth: 6lowpan: avoid untracked enable work\n Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()\n Bluetooth: L2CAP: validate option length before reading conf opt value\n Bluetooth: L2CAP: cancel pending_rx_work before taking conn-\u003elock\n Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()\n Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete\n Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev\n Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260706145229.728127-1-luiz.dentz@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a3267a8c9ecabb8e27f5cbda6d19295d5e41beb", "tree": "14819b2f9cd71ae2b30ed93f28172bb87025ecde", "parents": [ "60444706aa17616efc03190d099ac347e28b3d0a" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Wed Jul 01 20:26:52 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Jul 08 10:04:01 2026 +0200" }, "message": "net: mdio: select REGMAP_MMIO instead of depending on it\n\nREGMAP_MMIO is a hidden (non-user-visible) tristate symbol. Using\ndepends on it is incorrect because there is no way for the user to\nenable it directly. Change to select, which is the convention used\nby every other driver in the tree that needs REGMAP_MMIO.\n\nFixes: 8057cbb8335c (\"net: mdio: mscc-miim: Add depend of REGMAP_MMIO on MDIO_MSCC_MIIM\")\nAssisted-by: opencode:big-pickle\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260702032653.1580616-1-rosenp@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4ad805f0e41acf56ac54855c666d34c59ad66fe7", "tree": "7710b51d74a7b4249b70d74f5dd35992477c8a8d", "parents": [ "aaf7766ba3b99a3834319e7cf939838afc705574" ], "author": { "name": "Cihan Karadag", "email": "cihan.cihan@gmail.com", "time": "Tue Jul 07 17:57:05 2026 -0600" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Jul 08 09:45:43 2026 +0200" }, "message": "selftests: gpio: add gpio-cdev-uaf to .gitignore\n\nCommit c7f92042d3f3 (\"selftests: gpio: Add gpio-cdev-uaf tests\") added\nthe gpio-cdev-uaf binary to TEST_GEN_PROGS_EXTENDED but never added it\nto .gitignore. Building it with:\n\n make -C tools/testing/selftests/gpio TARGETS\u003dgpio\n\nleaves gpio-cdev-uaf as an untracked file.\n\nFixes: c7f92042d3f3 (\"selftests: gpio: Add gpio-cdev-uaf tests\")\nSigned-off-by: Cihan Karadag \u003ccihan.cihan@gmail.com\u003e\nReviewed-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260707235707.1349969-1-cihan.cihan@gmail.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "793bf193b18e9bff6c4280268bbffd16a5b533e5", "tree": "a7ccf1aab9f44f9478b3020590fca261959ea055", "parents": [ "917d0a4b95ea7ba01ed6296fb808f752d5d81107" ], "author": { "name": "TJ Adams", "email": "tadamsjr@google.com", "time": "Mon Jul 06 14:00:54 2026 -0700" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Wed Jul 08 13:49:48 2026 +0900" }, "message": "ata: libata-core: Allow capacity transition to zero for locked drives\n\nCommit 91842ed844a0 (\"ata: libata-core: Set capacity to zero for a\nsecurity locked drive\") introduced setting the device capacity (n_sectors)\nto zero in ata_dev_configure() if the drive is security locked.\n\nHowever, during runtime revalidation, ata_dev_revalidate() compares the\nnew capacity (now 0) with the old capacity (\u003e0) and detects a mismatch.\nSince it does not consider the locked status, it returns -ENODEV.\n\nThis revalidation failure can occur when doing a reset of the PHY (e.g.\nhard reset) for a controller that has I/Os in flight. The timed out\nI/Os trigger the SCSI Error Handling (EH) path, which in turn invokes\nlibata device revalidation. If the drive is locked at runtime (e.g.\nit lost power during reset and relocked), revalidation sees the capacity\ntransition to zero and fails, eventually disabling the device.\n\nFix this by allowing the capacity transition to zero in\nata_dev_revalidate() if the drive is reported as security locked by\nata_id_is_locked().\n\nFixes: 91842ed844a0 (\"ata: libata-core: Set capacity to zero for a security locked drive\")\nCc: stable@vger.kernel.org\nAssisted-by: Antigravity:gemini-3.5-flash\nSigned-off-by: Terrence Adams \u003ctadamsjr@google.com\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "917d0a4b95ea7ba01ed6296fb808f752d5d81107", "tree": "b65f229498b840657222cb2c9ae88e51cb5f56a8", "parents": [ "cd64be0ecd399fa2b1ab60b3aaf2b2b744243467" ], "author": { "name": "TJ Adams", "email": "tadamsjr@google.com", "time": "Mon Jul 06 14:00:53 2026 -0700" }, "committer": { "name": "Damien Le Moal", "email": "dlemoal@kernel.org", "time": "Wed Jul 08 13:49:36 2026 +0900" }, "message": "ata: libata-core: Skip HPA resize for locked drives\n\nSkip HPA resize in ata_hpa_resize() if the drive is security locked.\nIf the drive is locked, the command to read the native max address\nfails with -EACCES, which currently causes the sticky quirk\nATA_QUIRK_BROKEN_HPA to be set on the device.\n\nSetting this sticky quirk causes subsequent revalidations (after the\ndrive is unlocked) to bypass HPA checks, preventing the unlocked drive\nfrom exposing its full native capacity without a reboot or device removal.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Terrence Adams \u003ctadamsjr@google.com\u003e\nSigned-off-by: Damien Le Moal \u003cdlemoal@kernel.org\u003e\n" }, { "commit": "c69dbbf0212734e22219dfc31c0922bd7c9ffbb0", "tree": "4bfbbbe6d0260f8f5bf765c963d57825e7cd990c", "parents": [ "44d8fddf1c87d6bb6b65983041a0ce6c2af66bb9" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 13:15:56 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 20:49:28 2026 -0700" }, "message": "accel/amdxdna: Fix potential NULL pointer dereference of abo-\u003eclient\n\nClosing a BO handle clears abo-\u003eclient, while the underlying GEM object\nmay remain alive due to internal kernel references. As a result, code\nexecuted after the BO handle is closed may dereference a NULL abo-\u003eclient\npointer.\n\nRemove accesses to abo-\u003eclient from code paths that may execute after the\nBO handle has been closed.\n\nFixes: d76856beb4a4 (\"accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707201556.562191-1-lizhi.hou@amd.com\n" }, { "commit": "44d8fddf1c87d6bb6b65983041a0ce6c2af66bb9", "tree": "e549de0375fc4c44e2c6b0fb42d863cc800fc773", "parents": [ "0f092793a7b527dfb2cde323d4e5630d43447b84" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:23:23 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 20:49:19 2026 -0700" }, "message": "accel/amdxdna: Check init_srcu_struct() return value\n\nThe return value of init_srcu_struct() is currently ignored. If\ninitialization fails, subsequent use of hwctx_srcu may result in invalid\nmemory accesses.\n\nCheck the return value of init_srcu_struct() and propagate the error to\nthe caller.\n\nFixes: aac243092b70 (\"accel/amdxdna: Add command execution\")\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707172323.539721-1-lizhi.hou@amd.com\n" }, { "commit": "0f092793a7b527dfb2cde323d4e5630d43447b84", "tree": "25b191fa69ccb8fe674c7f478e08bce2439c92c4", "parents": [ "2f8b8593c7832fad655290cef9e99af05b1b52b3" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:23:07 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 20:49:10 2026 -0700" }, "message": "accel/amdxdna: Check drmm_mutex_init() return value\n\ndrmm_mutex_init() may fail and return an error. Check the return value\nand abort initialization if mutex creation fails.\n\nFixes: 8c9ff1b181ba (\"accel/amdxdna: Add a new driver for AMD AI Engine\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707172307.539676-1-lizhi.hou@amd.com\n" }, { "commit": "2f8b8593c7832fad655290cef9e99af05b1b52b3", "tree": "83831362922a91dee00851e60b583bc1886fcf83", "parents": [ "928caf71e566ddc5f303f15fb9c33f16a9915f30" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Jul 03 12:33:35 2026 -0300" }, "committer": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Tue Jul 07 18:52:13 2026 -0300" }, "message": "drm/v3d: Reject invalid indirect BO handle in indirect CSD setup\n\nv3d_get_cpu_indirect_csd_params() looks up the indirect buffer object\nfrom a userspace-supplied handle but never checks the result. A bogus\nor stale handle makes drm_gem_object_lookup() return NULL, which is\nthen stored in info-\u003eindirect and only dereferenced later when the\nindirect CSD job runs, turning a userspace mistake into a NULL pointer\ndereference in the kernel.\n\nBail out with -ENOENT as soon as the lookup fails, so the bad handle is\nrejected at submission time.\n\nFixes: 18b8413b25b7 (\"drm/v3d: Create a CPU job extension for a indirect CSD job\")\nReviewed-by: Iago Toral Quiroga \u003citoral@igalia.com\u003e\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nLink: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com\n" }, { "commit": "2726b5758f80a546a4ddeec5019e72035a7fa166", "tree": "e986d759dfddaf467a07083f2da2181076251391", "parents": [ "cdadb298b182d4615521380a520eb2c7cb762843" ], "author": { "name": "Shyam Sundar S K", "email": "Shyam-sundar.S-k@amd.com", "time": "Tue Jul 07 17:58:52 2026 +0530" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Tue Jul 07 20:10:13 2026 +0300" }, "message": "platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC\n\nPMFW reports the S0i3 subsystem accounting per SoC, and the set of IP\nblocks and their bit ordering differ across SoC generations. Family\n1Ah, Model 80h accounts for a distinct set of 19 IP blocks, which does\nnot match the ordering in soc15_ip_blk[].\n\nCommit 043af31c8d30 (\"platform/x86/amd/pmc: Add PMC driver support for\nAMD 1Ah M80H SoC\") wired amd_1ah_m80_cpu_info to soc15_ip_blk[], so\nM80H has been reporting incorrect S0i3 accounting via debugfs.\n\nAdd soc15_ip_blk_v3[] with the correct ordering and point\namd_1ah_m80_cpu_info at it.\n\nFixes: 043af31c8d30 (\"platform/x86/amd/pmc: Add PMC driver support for AMD 1Ah M80H SoC\")\nSigned-off-by: Shyam Sundar S K \u003cShyam-sundar.S-k@amd.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\nLink: https://patch.msgid.link/20260707122852.2066987-1-Shyam-sundar.S-k@amd.com\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "cdadb298b182d4615521380a520eb2c7cb762843", "tree": "32b5d25429a7c326116b78c4c0c6f006f65503f1", "parents": [ "d3666875c75eb1bc8090343fa0d6fc8fb7924356" ], "author": { "name": "Marco Scardovi", "email": "scardracs@disroot.org", "time": "Tue Jun 30 16:26:35 2026 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Tue Jul 07 20:09:53 2026 +0300" }, "message": "platform/x86: asus-armoury: update power limits for G614PR\n\nThe previously integrated power limits for the ASUS ROG Strix G16 G614PR\nlaptop model were incorrect and too low compared to the windows counterparts.\n\nUpdate the power limits to the correct specifications based on the\nplatform\u0027s hardware capabilities:\n- Increase AC PL1/SPL max limit from 90W to 120W.\n- Increase AC PL2/SPPT default/max from 110W/125W to 140W/145W.\n- Increase AC PL3/FPPT default/max from 110W/125W to 140W/145W.\n\nFixes: 6b3bbe770f4ca0439710b7c42f88b9f6eeebabd0 (platform/x86: asus-armoury: add support for G614PR)\nFixes: https://lore.kernel.org/platform-driver-x86/20260610152130.25892-1-scardracs@disroot.org/\nSigned-off-by: Marco Scardovi \u003cscardracs@disroot.org\u003e\nLink: https://patch.msgid.link/20260630142957.7751-1-scardracs@disroot.org\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "928caf71e566ddc5f303f15fb9c33f16a9915f30", "tree": "e64d01d3c7344f6be344537e19b393da4353794b", "parents": [ "c8d2530791cb53602ac06ec2db6287d99f51cdbc" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:58:18 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:04:51 2026 -0700" }, "message": "accel/amdxdna: Fix hardware context race in amdxdna_update_heap()\n\namdxdna_update_heap() iterates over hardware contexts while holding\nxdna-\u003edev_lock. During the iteration, amdxdna_pm_resume_get_locked() may\ntemporarily release and reacquire the lock, allowing hardware contexts to\nbe modified concurrently.\n\nFix the race by calling amdxdna_pm_resume_get_locked() before\niterating over hardware contexts.\n\nFixes: dbc8fd7a03cb (\"accel/amdxdna: Add expandable device heap support\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707055818.479165-1-lizhi.hou@amd.com\n" }, { "commit": "c8d2530791cb53602ac06ec2db6287d99f51cdbc", "tree": "fd52de3ff58ba9f0e3d6aefb24110ab557af6da8", "parents": [ "66ff5c0eee02c4be67f8ba7fb6c63709ef1c92a3" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:57:32 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:04:43 2026 -0700" }, "message": "accel/amdxdna: Fix deadlock on debug BO command timeout\n\nBoth amdxdna_hwctx_sync_debug_bo() and amdxdna_drm_config_hwctx_ioctl()\nhold xdna-\u003edev_lock while invoking backend operations. If the hardware\nhangs, aie2_cmd_wait() blocks waiting for a firmware response. When the\nDRM scheduler timeout expires, aie2_sched_job_timedout() is invoked to\nreset the hardware. However, the timeout handler also attempts to acquire\ndev_lock, resulting in a deadlock.\n\nAvoid this by releasing dev_lock before waiting for the firmware\nresponse and reacquiring it after the wait completes. This allows the\ntimeout handler to proceed with device recovery when a debug BO command\ntimes out.\n\nFixes: 7ea046838021 (\"accel/amdxdna: Support firmware debug buffer\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707055732.479103-1-lizhi.hou@amd.com\n" }, { "commit": "66ff5c0eee02c4be67f8ba7fb6c63709ef1c92a3", "tree": "bce1a14e15f8b70aa887d223e8def6c3f3f2fa53", "parents": [ "14f172eff9c19f8043a9858845f33cd034f3a41e" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:56:58 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:04:34 2026 -0700" }, "message": "accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure\n\namdxdna_gem_obj_open() increments open_ref before attempting to set up\nthe DMA address mapping. When amdxdna_dma_map_bo() fails, the function\nreturned immediately without rolling back either change made on the first\nopen (open_ref \u003d\u003d 1 path).\n\nFix it by decrementing open_ref and clearing abo-\u003eclient on the error path.\n\nFixes: ece3e8980907 (\"accel/amdxdna: Allow forcing IOVA-based DMA via module parameter\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260707055658.479049-1-lizhi.hou@amd.com\n" }, { "commit": "14f172eff9c19f8043a9858845f33cd034f3a41e", "tree": "7cd1c46d5edd56dc5abdf6031b7bc75b9539734c", "parents": [ "ac7c6b4308c5e757eb278d47b9c0761c31ac9d6b" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 15:12:28 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jul 07 10:00:04 2026 -0700" }, "message": "accel/amdxdna: Fix potential amdxdna_umap lifetime race\n\namdxdna_umap_release() calls the blocking mmu_interval_notifier_remove()\nbefore removing the object from abo-\u003emem.umap_list. If\naie2_populate_range() runs concurrently, it may obtain a reference to an\namdxdna_umap that is being released, leading to a potential use-after-free.\n\nUse kref_get_unless_zero() in aie2_populate_range() when acquiring a\nreference. If the reference count has already dropped to zero, release\nis in progress and the entry is skipped.\n\nFixes: e486147c912f (\"accel/amdxdna: Add BO import and export\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260706221228.434099-1-lizhi.hou@amd.com\n" }, { "commit": "ac7c6b4308c5e757eb278d47b9c0761c31ac9d6b", "tree": "49ce24cd63e573517b3ca4d49da8f09e509b0bb5", "parents": [ "4e28aa8f7ee26d67a4addee6e3980f1cbf861b49" ], "author": { "name": "Robert Mader", "email": "robert.mader@collabora.com", "time": "Fri Jul 03 09:32:30 2026 +0200" }, "committer": { "name": "Maarten Lankhorst", "email": "dev@lankhorst.se", "time": "Tue Jul 07 14:57:10 2026 +0200" }, "message": "drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE\n\nThe client cap is currently advertised unconditionally, even for drivers\nthat do not support plane color pipelines. If clients supporting the latter,\nlike Wayland compositors or tools like drm_info, enable the client cap on\nsuch drivers they will be left without both color pipeline and the legacy\nproperties COLOR_ENCODING and COLOR_RANGE, effectively breaking YUV-\u003eRGB\nconversion support.\n\nPrevent that by only marking the cap supported if there are actually planes\nwith color pipelines.\n\nNote: while the color pipeline replacement for the legacy properties is\nstill under review (1), we can assume that it will work as a drop-in\nreplacement. That means any plane on any hardware currently supporting\nthe legacy properties will be able to offer a functionally equal color\npipeline and there will be no technical reason keep using the legacy\nproperties if both the driver and the client support the new API.\n\n[1] https://lore.kernel.org/dri-devel/20260623164812.81110-1-harry.wentland@amd.com/\n\nSigned-off-by: Robert Mader \u003crobert.mader@collabora.com\u003e\nReviewed-by: Chaitanya Kumar Borah \u003cchaitanya.kumar.borah@intel.com\u003e\nReviewed-by: Melissa Wen \u003cmwen@igalia.com\u003e\nFixes: 179ab8e7d7b3 (\"drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE\")\nLink: https://patch.msgid.link/20260703073230.19982-1-robert.mader@collabora.com\nSuggested-by: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\nSigned-off-by: Maarten Lankhorst \u003cdev@lankhorst.se\u003e\n" }, { "commit": "aaf7766ba3b99a3834319e7cf939838afc705574", "tree": "e71f0574bbc19bdf310e3e3086fead7cc4956f9d", "parents": [ "d775b9451eb8f52021dea6483ad758fef81dbf1e" ], "author": { "name": "Liang Hao", "email": "haohlliang@gmail.com", "time": "Sun Jul 05 15:47:59 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Tue Jul 07 14:32:01 2026 +0200" }, "message": "gpio: dwapb: Mask interrupts at hardware initialization\n\nGPIO interrupts may retain stale state across warm reboots when\nperipherals remain powered. If a GPIO line is not explicitly\nconfigured for interrupts, this can result in interrupt storms\ndue to missing handlers.\n\nFix this by ensuring all interrupts are masked and disabled at\nhardware initialization time via the init_hw() callback. Pending\ninterrupts are also cleared to start from a known-safe state.\n\nInterrupts will be unmasked only when explicitly configured by\nuserspace or kernel drivers.\n\nSigned-off-by: Liang Hao \u003chaohlliang@gmail.com\u003e\nLink: https://patch.msgid.link/20260705074759.47863-1-haohlliang@gmail.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "d775b9451eb8f52021dea6483ad758fef81dbf1e", "tree": "ce42dd292225b5074b898c8faa7a4e9fcff5f507", "parents": [ "b30973e8c3920ddfa9255a959b19057515b4e5e8" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Thu Jul 02 17:22:12 2026 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Tue Jul 07 14:30:50 2026 +0200" }, "message": "gpio: dwapb: Defer clock gating until noirq\n\nGPIO consumers such as gpio-keys can enable IRQ wake and adjust the wake\ntrigger type from their suspend callbacks. If the DWAPB controller suspends\nfirst, masking interrupts and disabling its clocks in the normal suspend\nphase prevents that late wake configuration from reliably reaching the\nhardware. Systems with real DWAPB bus clocks then fail to wake from s2idle\nthrough GPIO keys.\n\nSave the register context in the normal suspend callback, but defer IRQ\nmasking and clock gating until suspend_noirq. At that point all consumers\nhave finished configuring wake IRQs, so keep the clocks enabled when wake\nlines are armed and only gate them when no wake source is active.\nResume_noirq reenables clocks, if they were gated, before the normal resume\npath restores registers.\n\nPropagate wake requests to the parent irqchip while keeping the local wake\nmask in sync with failures.\n\nFixes: 6437c7ba69c3 (\"gpio: dwapb: Add wakeup source support\")\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nLink: https://patch.msgid.link/20260702-gpio-dwapb-wakeup-v2-1-203f2f33429f@ultrarisc.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\n" }, { "commit": "4e28aa8f7ee26d67a4addee6e3980f1cbf861b49", "tree": "0f7d5d6086ef43c759c934127fcd64025b7afd59", "parents": [ "1ba02717e821cf14ece642273958647e79698d3d" ], "author": { "name": "Christian König", "email": "ckoenig.leichtzumerken@gmail.com", "time": "Sat Jul 04 10:41:33 2026 +0200" }, "committer": { "name": "Christian König", "email": "christian.koenig@amd.com", "time": "Tue Jul 07 14:02:53 2026 +0200" }, "message": "drm/drm_exec: avoid indirect goto\n\nThe drm_exec component uses a variable with scope limited to the for() and\nan indirect goto to allow instantiating multiple macros in the same\nfunction.\n\nThis unfortunately doesn\u0027t work well with certain compilers when the\nindirect goto can\u0027t be lowered to a direct jump.\n\nSwitch the indirect goto to a direct goto, the drawback is that we now\ncan\u0027t use the dma_exec_until_all_locked() macro in the same function\nmultiple times.\n\nThe is currently only one user of this and only as a hacky workaround\nwhich is about to be removed.\n\nSo document that the __label__ statement should be used when the macro is\nused multiple times and fix the tests and the only use case where that is\nnecessary.\n\nSuggested-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Christian König \u003cchristian.koenig@amd.com\u003e\nFixes: 9920249a5288 (\"drm/amdgpu: convert amdgpu_vm_lock_by_pasid() to drm_exec\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202606231854.7LeCtlLe-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202606232356.gwHMAJAW-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202606240753.kYjobJVl-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202606241110.iUga5vVw-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202607031446.1PWG18mN-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202607031837.HSmBj8pr-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202607040159.GopyEswS-lkp@intel.com/\nTested-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nReviewed-by: Dave Airlie \u003cairlied@redhat.com\u003e\nLink: https://lore.kernel.org/r/20260704084133.122053-1-christian.koenig@amd.com\n" }, { "commit": "60444706aa17616efc03190d099ac347e28b3d0a", "tree": "9553095845753edff48333bf9060938a70483e1a", "parents": [ "7993211bde166471dffac074dc965489f86531f8" ], "author": { "name": "Enrico Pozzobon", "email": "enrico.pozzobon@dissecto.com", "time": "Wed Jul 01 16:47:23 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 13:07:51 2026 +0200" }, "message": "net: usb: lan78xx: disable VLAN filter in promiscuous mode\n\nThe hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames\nwhose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is\nleft enabled in promiscuous mode, so packet capture (e.g. tcpdump or\nWireshark) does not see tagged frames for unregistered VIDs.\n\nClear the filter while the interface is promiscuous and restore it from\nNETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in\nlan78xx_set_features() so netdev_update_features() cannot re-enable the\nfilter while promiscuous.\n\nFixes: 55d7de9de6c3 (\"Microchip\u0027s LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nSigned-off-by: Enrico Pozzobon \u003cenrico.pozzobon@dissecto.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7993211bde166471dffac074dc965489f86531f8", "tree": "d60cc12a8cdd4366df15560646c9c23be8cb40fb", "parents": [ "5c0e3ba4f500fd4314ceb42f07f16bc445156431" ], "author": { "name": "Yuyang Huang", "email": "yuyanghuang@google.com", "time": "Thu Jul 02 08:50:14 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 12:15:39 2026 +0200" }, "message": "ipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device\u0027s\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev-\u003eip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0\n\nFixes: e9897071350b (\"igmp: hash a hash table to speedup ip_check_mc_rcu()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yuyang Huang \u003cyuyanghuang@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5c0e3ba4f500fd4314ceb42f07f16bc445156431", "tree": "7b1c68c3a31c8980a095f588e588d461be376126", "parents": [ "d9d6d67f4c0877fde783c9d5beee013bcf1b1e85" ], "author": { "name": "Yuho Choi", "email": "dbgh9129@gmail.com", "time": "Wed Jul 01 00:08:47 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 11:03:35 2026 +0200" }, "message": "net/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup.\n\nFixes: ca6139ffc67ee (\"liquidio CN23XX: sysfs VF config support\")\nFixes: 8c978d059224 (\"liquidio CN23XX: Mailbox support\")\nSigned-off-by: Yuho Choi \u003cdbgh9129@gmail.com\u003e\nLink: https://patch.msgid.link/20260701040847.1897845-1-dbgh9129@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d9d6d67f4c0877fde783c9d5beee013bcf1b1e85", "tree": "255607792c371cdaf5e0999c7bee3f1574b072a4", "parents": [ "3be28e2c9cd0230cb51fd4967df095273afd3848" ], "author": { "name": "Dong Yibo", "email": "dong100@mucse.com", "time": "Wed Jul 01 11:22:08 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 10:45:42 2026 +0200" }, "message": "net: rnpgbe: fix mailbox endianness and remove pointer casts\n\nThe rnpgbe mailbox exchanges data through 32-bit MMIO registers in\nlittle-endian wire format. The original code had two problems:\n\n 1. FW structs (with __le16/__le32 fields) were cast to (u32 *)\n before reaching the mailbox transport, hiding the endian\n annotations from sparse.\n\n 2. No cpu_to_le32()/le32_to_cpu() conversion was done between\n CPU-endian MMIO values and the little-endian payload, causing\n data corruption on big-endian systems.\n\nFix by adding the missing byte-order conversions in the transport\nlayer and introducing union wrappers (mbx_fw_cmd_req_u,\nmbx_fw_cmd_reply_u) that overlay each FW struct with a __le32\ndwords[] array. Callers fill named fields using cpu_to_le16/32(),\nthen pass dwords[] to the transport, which now takes explicit\n__le32 * instead of u32 *. This eliminates all pointer casts on\nthe mailbox data path and lets sparse verify the conversions.\n\nFixes: 4543534c3ef5 (\"net: rnpgbe: Add basic mbx ops support\")\nSigned-off-by: Dong Yibo \u003cdong100@mucse.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260701032208.1843156-2-dong100@mucse.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3be28e2c9cd0230cb51fd4967df095273afd3848", "tree": "1817cfb3c25d059cebcd0302e8c18e264f6d8ad0", "parents": [ "9e05e91a9a847ed57926414bd7c2c5e54d6c56c6" ], "author": { "name": "Chuck Lever", "email": "cel@kernel.org", "time": "Tue Jun 30 15:15:51 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 07 10:12:11 2026 +0200" }, "message": "net/tls: Consume empty data records in tls_sw_read_sock()\n\nA peer may send a zero-length TLS application_data record; TLS 1.3\nexplicitly permits these as a traffic-analysis countermeasure (RFC\n8446, Section 5.1). After decryption such a record has full_len \u003d\u003d\n0. tls_sw_read_sock() hands it to the read_actor, which has no\npayload to consume and returns zero. The loop treats a zero return\nas backpressure (used \u003c\u003d 0), requeues the skb at the head of\nrx_list, and stops. rx_list is serviced head-first on the next\ncall, so the empty record is dequeued, fails the same way, and is\nrequeued again; every later record on the connection is blocked\nbehind it.\n\ntls_sw_recvmsg() does not stall on this: a zero-length data record\ncopies nothing and falls through to consume_skb(). Mirror that in\nthe read_sock() path by recognizing an empty data record before\nthe actor runs, consuming it, and continuing.\n\nFixes: 662fbcec32f4 (\"net/tls: implement -\u003eread_sock()\")\nSigned-off-by: Chuck Lever \u003ccel@kernel.org\u003e\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://patch.msgid.link/20260630191551.875664-1-cel@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1ba02717e821cf14ece642273958647e79698d3d", "tree": "8cc1236d0ed26e3746ade587397429ddd22cfa43", "parents": [ "18aaebdf43366954345a6721ed2bff3ac3c9fa61" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jun 08 18:12:42 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:35:30 2026 -0700" }, "message": "accel/amdxdna: Fix VMA access race\n\naie2_populate_range() and amdxdna_umap_release() access a saved VMA\npointer that may have already been freed, leading to a potential\nuse-after-free.\n\nRemove the VMA accesses from these functions to avoid the race.\n\nFixes: e486147c912f (\"accel/amdxdna: Add BO import and export\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260609011242.2833740-1-lizhi.hou@amd.com\n" }, { "commit": "18aaebdf43366954345a6721ed2bff3ac3c9fa61", "tree": "78b92a61aaa53bd09f90d90dfb41f16c731887a7", "parents": [ "e35c9cf5512814fb04f369f2eada64f0a7164609" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jun 15 23:15:32 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:34:56 2026 -0700" }, "message": "accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()\n\nnr_pages is declared as u32 in amdxdna_hmm_register(), which may not be\nlarge enough to represent the number of pages for large mappings.\n\nUse unsigned long for nr_pages to avoid potential overflow.\n\nFixes: ac49797c1815 (\"accel/amdxdna: Add GEM buffer object management\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260616061532.3533469-1-lizhi.hou@amd.com\n" }, { "commit": "e35c9cf5512814fb04f369f2eada64f0a7164609", "tree": "115bdf8bf0be04e712ea778aaee5bc0ddbcb2e07", "parents": [ "6bb8898f702385d363dc2c513a1efa62807f8068" ], "author": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Tue Jun 16 14:24:29 2026 -0700" }, "committer": { "name": "Lizhi Hou", "email": "lizhi.hou@amd.com", "time": "Mon Jul 06 22:32:19 2026 -0700" }, "message": "accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()\n\namdxdna_hwctx_sync_debug_bo() invokes the hardware hwctx_sync_debug_bo()\ncallback while holding xdna-\u003edev_lock.\n\nThe callback may call amdxdna_cmd_submit(), which in turn calls\namdxdna_pm_resume_get(). If the device is suspended,\namdxdna_pm_resume_get() may synchronously execute amdxdna_pm_resume(),\nwhich also acquires xdna-\u003edev_lock, resulting in a deadlock.\n\nAvoid the deadlock by calling amdxdna_pm_resume_get() before holding\nxdna-\u003edev_lock in both amdxdna_hwctx_sync_debug_bo() and\namdxdna_drm_config_hwctx_ioctl()\n\nFixes: 7ea046838021 (\"accel/amdxdna: Support firmware debug buffer\")\nReviewed-by: Max Zhen \u003cmax.zhen@amd.com\u003e\nSigned-off-by: Lizhi Hou \u003clizhi.hou@amd.com\u003e\nLink: https://patch.msgid.link/20260616212429.3620645-1-lizhi.hou@amd.com\n" }, { "commit": "0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53", "tree": "f7bf7ed29f7a271df5365a146b2da083d2ee7708", "parents": [ "cead34ac1ce10046cb745fbc33a4b21cac899753", "039892c35f9d8f5ea00d7c2ed1c25224f28b11d7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 18:51:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 18:51:36 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-07-06-17-49\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"20 hotfixes. 17 are for MM. 12 are cc:stable and the remaining 8\n address post-7.1 issues or aren\u0027t considered suitable for backporting.\n\n Two patches from SJ addresses a couple of quite old DAMON issues. And\n two patches from Yichong Chen fixes tools/virtio build issues. The\n remaining patches are singletons\"\n\n* tag \u0027mm-hotfixes-stable-2026-07-06-17-49\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n tools/include: include stdint.h for SIZE_MAX in overflow.h\n tools/virtio: add missing compat definitions for vhost_net_test\n mm: do file ownership checks with the proper mount idmap\n samples/damon/mtier: fail early if address range parameters are invalid\n mm: a second pagecache maintainer\n mm/damon: add a kernel-doc comment for damon_ctx-\u003ernd_state\n mm/damon: add a kernel-doc comment for damon_ctx-\u003eprobes\n mailmap: add entries for Radu Rendec\n selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE\n selftests/mm: pagemap_ioctl: use the correct page size for transact_test()\n fs/proc: fix KPF_KSM reported for all anonymous pages\n mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access\n mm/damon/ops-common: handle extreme intervals in damon_hot_score()\n MAINTAINERS: add Lance as an rmap reviewer\n mm/compaction: handle free_pages_prepare() properly in compaction_free()\n mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error\n mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()\n mm: shrinker: fix NULL pointer dereference in debugfs\n mm: shrinker: fix shrinker_info teardown race with expansion\n selftests/mm: fix ksft_process_madv.sh test category\n" }, { "commit": "cead34ac1ce10046cb745fbc33a4b21cac899753", "tree": "b0370b911ec176ed14a8d40755a7a7a9b5209ca0", "parents": [ "8cdeaa50eae8dad34885515f62559ee83e7e8dda" ], "author": { "name": "Nick Desaulniers", "email": "ndesaulniers@google.com", "time": "Thu May 28 14:38:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 06 15:49:29 2026 -0700" }, "message": "MAINTAINERS: update ndesaulniers\n\nI\u0027m coming back. I will return. I will possess your body, and I\u0027ll\nmake LKML burn.\n\nSigned-off-by: Nick Desaulniers \u003cndesaulniers@google.com\u003e\nAcked-by: Nathan Chancellor \u003cnathan@kernel.org\u003e\nAcked-by: Will Deacon \u003cwill@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ], "next": "3d04d9f390eeaab4d9e1ed4e9737e3d83581e18b" }