)]}' { "log": [ { "commit": "0257f64bdac7fdca30fa3cae0df8b9ecbec7733a", "tree": "65dae98b02dff81f8882eb5fe287bac66ba94f0c", "parents": [ "61c0b2ae734fc9d33ede9cbf7d3cad67a7b0ce28", "a076cc74744d83fb9f70147a154b99278945a3d2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 13:01:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 13:01:37 2026 -0700" }, "message": "Merge tag \u0027pm-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n\n - Make the idle loop skip the cpuidle governor .reflect() callback\n after it has skipped the .select() one (Rafael Wysocki)\n\n - Fix swapped power/energy unit labels in cpupower (Kaushlendra Kumar)\n\n - Add support for setting EPP via systemd service and intel_pstate\n turbo boost support to cpupower (Jan Kiszka, Zhang Rui)\n\n* tag \u0027pm-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n sched: idle: Make skipping governor callbacks more consistent\n cpupower: Add intel_pstate turbo boost support for Intel platforms\n cpupower: Add support for setting EPP via systemd service\n cpupower: fix swapped power/energy unit labels\n" }, { "commit": "61c0b2ae734fc9d33ede9cbf7d3cad67a7b0ce28", "tree": "4def659b70b24bd00f256769d944d54028a611a6", "parents": [ "8004279c41adf3238ba71931219205cd1f59343b", "97d9960f355cca99960eb44cd1bba1d7ba1073ee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:43:19 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:43:19 2026 -0700" }, "message": "Merge tag \u0027acpi-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fixes from Rafael Wysocki:\n\n - On some platforms, the ACPI companion object of the ACPI video bus\n platform device is shared with multiple other platform devices which\n leads to driver probe issues, so replace that device with an\n auxiliary one (which arguably is a better match for the given use\n case) and update the ACPI video bus driver accordingly (Rafael\n Wysocki)\n\n - Address sparse warnings in acpi_os_initialize() by adding __iomem to\n a local variable declaration (Ben Dooks)\n\n* tag \u0027acpi-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n ACPI: video: Switch over to auxiliary bus type\n" }, { "commit": "8004279c41adf3238ba71931219205cd1f59343b", "tree": "6f4c63a8fe74764c9cd16f3dd179a65b72bfbc05", "parents": [ "e0b38d286eef4633d231859e47679772db07db07", "4529e0015432977af3ecc3b9f940fc2a1ef1b265" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:38:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:38:17 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.0-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull NFS client fixes from Anna Schumaker:\n\n - Fix NFS KConfig typos\n\n - Decrement re_receiving on the early exit paths\n\n - return EISDIR on nfs3_proc_create if d_alias is a dir\n\n* tag \u0027nfs-for-7.0-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs:\n NFS: Fix NFS KConfig typos\n xprtrdma: Decrement re_receiving on the early exit paths\n nfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n" }, { "commit": "e0b38d286eef4633d231859e47679772db07db07", "tree": "8d4dd22b87d624355e6479d24be49893b101eeac", "parents": [ "2c7e63d702f6c4209c5af833308e7fcbc7d4ab17", "0749cab6174dc035b1628fb6db03abf758cfda6f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:15:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 12:15:27 2026 -0700" }, "message": "Merge tag \u0027for-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - detect possible file name hash collision earlier so it does not lead\n to transaction abort\n\n - handle b-tree leaf overflows when snapshotting a subvolume with set\n received UUID, leading to transaction abort\n\n - in zoned mode, reorder relocation block group initialization after\n the transaction kthread start\n\n - fix orphan cleanup state tracking of subvolume, this could lead to\n invalid dentries under some conditions\n\n - add locking around updates of dynamic reclain state update\n\n - in subpage mode, add missing RCU unlock when trying to releae extent\n buffer\n\n - remap tree fixes:\n - add missing description strings for the newly added remap tree\n - properly update search key when iterating backrefs\n\n* tag \u0027for-7.0-rc3-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: remove duplicated definition of btrfs_printk_in_rcu()\n btrfs: remove unnecessary transaction abort in the received subvol ioctl\n btrfs: abort transaction on failure to update root in the received subvol ioctl\n btrfs: fix transaction abort on set received ioctl due to item overflow\n btrfs: fix transaction abort when snapshotting received subvolumes\n btrfs: fix transaction abort on file creation due to name hash collision\n btrfs: read key again after incrementing slot in move_existing_remaps()\n btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()\n btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n btrfs: zoned: move btrfs_zoned_reserve_data_reloc_bg() after kthread start\n btrfs: hold space_info-\u003elock when clearing periodic reclaim ready\n btrfs: print-tree: add remap tree definitions\n" }, { "commit": "2c7e63d702f6c4209c5af833308e7fcbc7d4ab17", "tree": "e46b218ced108b588a1d83364397d57334121efd", "parents": [ "281f36d4a9970c206c2c44042904d4e34c092fbe", "c38b8f5f791ecce13ab77e2257f8fd2444ba80f6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 11:33:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 11:33:35 2026 -0700" }, "message": "Merge tag \u0027net-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from CAN and netfilter.\n\n Current release - regressions:\n\n - eth: mana: Null service_wq on setup error to prevent double destroy\n\n Previous releases - regressions:\n\n - nexthop: fix percpu use-after-free in remove_nh_grp_entry\n\n - sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\n\n - bpf: fix nd_tbl NULL dereference when IPv6 is disabled\n\n - neighbour: restore protocol !\u003d 0 check in pneigh update\n\n - tipc: fix divide-by-zero in tipc_sk_filter_connect()\n\n - eth:\n - mlx5:\n - fix crash when moving to switchdev mode\n - fix DMA FIFO desync on error CQE SQ recovery\n - iavf: fix PTP use-after-free during reset\n - bonding: fix type confusion in bond_setup_by_slave()\n - lan78xx: fix WARN in __netif_napi_del_locked on disconnect\n\n Previous releases - always broken:\n\n - core: add xmit recursion limit to tunnel xmit functions\n\n - net-shapers: don\u0027t free reply skb after genlmsg_reply()\n\n - netfilter:\n - fix stack out-of-bounds read in pipapo_drop()\n - fix OOB read in nfnl_cthelper_dump_table()\n\n - mctp:\n - fix device leak on probe failure\n - i2c: fix skb memory leak in receive path\n\n - can: keep the max bitrate error at 5%\n\n - eth:\n - bonding: fix nd_tbl NULL dereference when IPv6 is disabled\n - bnxt_en: fix RSS table size check when changing ethtool channels\n - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled\n - octeontx2-af: devlink: fix NIX RAS reporter recovery condition\"\n\n* tag \u0027net-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (71 commits)\n net: prevent NULL deref in ip[6]tunnel_xmit()\n octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status\n octeontx2-af: devlink: fix NIX RAS reporter recovery condition\n net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support\n net/mana: Null service_wq on setup error to prevent double destroy\n selftests: rtnetlink: add neighbour update test\n neighbour: restore protocol !\u003d 0 check in pneigh update\n net: dsa: realtek: Fix LED group port bit for non-zero LED group\n tipc: fix divide-by-zero in tipc_sk_filter_connect()\n net: dsa: microchip: Fix error path in PTP IRQ setup\n bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled\n bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled\n net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled\n ipv6: move the disable_ipv6_mod knob to core code\n net: bcmgenet: fix broken EEE by converting to phylib-managed state\n net-shapers: don\u0027t free reply skb after genlmsg_reply()\n net: dsa: mxl862xx: don\u0027t set user_mii_bus\n net: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n page_pool: store detach_time as ktime_t to avoid false-negatives\n net: macb: Shuffle the tx ring before enabling tx\n ...\n" }, { "commit": "a076cc74744d83fb9f70147a154b99278945a3d2", "tree": "9be18f68e87b0121f5b01cd4b1b41cbea7641e3d", "parents": [ "d557640e4ce589a24dca5ca7ce3b9680f471325f", "06c2a67e90c1f04de10ac3091b97665beacb48ce" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 12 19:00:30 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 12 19:00:30 2026 +0100" }, "message": "Merge branch \u0027pm-tools\u0027\n\nMerge cpupower utility updates, including a fix and improvements of the\nexisting functionality, for 7.0-rc4.\n\n* pm-tools:\n cpupower: Add intel_pstate turbo boost support for Intel platforms\n cpupower: Add support for setting EPP via systemd service\n cpupower: fix swapped power/energy unit labels\n" }, { "commit": "281f36d4a9970c206c2c44042904d4e34c092fbe", "tree": "7b2929fbf31fc694f0598b910239a9b8023a2fdf", "parents": [ "80234b5ab240f52fa45d201e899e207b9265ef91", "8e135b8aee5a06c52a4347a5a6d51223c6f36ba3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 10:58:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 12 10:58:02 2026 -0700" }, "message": "Merge tag \u0027apparmor-pr-mainline-2026-03-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor\n\nPull AppArmor fixes from John Johansen:\n - fix race between freeing data and fs accessing it\n - fix race on unreferenced rawdata dereference\n - fix differential encoding verification\n - fix unconfined unprivileged local user can do privileged policy management\n - Fix double free of ns_name in aa_replace_profiles()\n - fix missing bounds check on DEFAULT table in verify_dfa()\n - fix side-effect bug in match_char() macro usage\n - fix: limit the number of levels of policy namespaces\n - replace recursive profile removal with iterative approach\n - fix memory leak in verify_header\n - validate DFA start states are in bounds in unpack_pdb\n\n* tag \u0027apparmor-pr-mainline-2026-03-09\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:\n apparmor: fix race between freeing data and fs accessing it\n apparmor: fix race on rawdata dereference\n apparmor: fix differential encoding verification\n apparmor: fix unprivileged local user can do privileged policy management\n apparmor: Fix double free of ns_name in aa_replace_profiles()\n apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n apparmor: fix side-effect bug in match_char() macro usage\n apparmor: fix: limit the number of levels of policy namespaces\n apparmor: replace recursive profile removal with iterative approach\n apparmor: fix memory leak in verify_header\n apparmor: validate DFA start states are in bounds in unpack_pdb\n" }, { "commit": "97d9960f355cca99960eb44cd1bba1d7ba1073ee", "tree": "71bd7c8c52304d88d43f613b8c8b38bd16bb4b0d", "parents": [ "6ab3532b4c98f4e51969f0e5f3fc919c535f3ce1", "393815f57651101f1590632092986d1d5a3a41bd" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 12 18:42:41 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Thu Mar 12 18:42:41 2026 +0100" }, "message": "Merge branch \u0027acpi-osl\u0027\n\nMerge an ACPI OS services layer (OSL) fix that addresses sparse warnings\nin acpi_os_initialize() (Ben Dooks)\n\n* acpi-osl:\n ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n" }, { "commit": "c38b8f5f791ecce13ab77e2257f8fd2444ba80f6", "tree": "d12f2dd1c32a6d73f1049cca8c3f5cfcb8e6a70e", "parents": [ "87f7dff3ec75b91def0024ebaaf732457f47a63b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Mar 12 04:39:08 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 12 16:03:41 2026 +0100" }, "message": "net: prevent NULL deref in ip[6]tunnel_xmit()\n\nBlamed commit missed that both functions can be called with dev \u003d\u003d NULL.\n\nAlso add unlikely() hints for these conditions that only fuzzers can hit.\n\nFixes: 6f1a9140ecda (\"net: add xmit recursion limit to tunnel xmit functions\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCC: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260312043908.2790803-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "87f7dff3ec75b91def0024ebaaf732457f47a63b", "tree": "3069d101966273960035a54288c9019a4893cd1c", "parents": [ "dc26ca99b835e21e76a58b1463b84adb0ca34f58" ], "author": { "name": "Alok Tiwari", "email": "alok.a.tiwari@oracle.com", "time": "Tue Mar 10 11:48:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 20:39:19 2026 -0700" }, "message": "octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status\n\nThe NIX RAS health report path uses nix_af_rvu_err when handling the\nNIX_AF_RVU_RAS case, so the report prints the ERR interrupt status rather\nthan the RAS interrupt status.\n\nUse nix_af_rvu_ras for the NIX_AF_RVU_RAS report.\n\nFixes: 5ed66306eab6 (\"octeontx2-af: Add devlink health reporters for NIX\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nLink: https://patch.msgid.link/20260310184824.1183651-2-alok.a.tiwari@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc26ca99b835e21e76a58b1463b84adb0ca34f58", "tree": "8c554d0fbe07634c3a1ee3ec432c624cd74e6cde", "parents": [ "840c9d13cb1ca96683a5307ee8e221be163a2c1e" ], "author": { "name": "Alok Tiwari", "email": "alok.a.tiwari@oracle.com", "time": "Tue Mar 10 11:48:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 20:39:19 2026 -0700" }, "message": "octeontx2-af: devlink: fix NIX RAS reporter recovery condition\n\nThe NIX RAS health reporter recovery routine checks nix_af_rvu_int to\ndecide whether to re-enable NIX_AF_RAS interrupts. This is the RVU\ninterrupt status field and is unrelated to RAS events, so the recovery\nflow may incorrectly skip re-enabling NIX_AF_RAS interrupts.\n\nCheck nix_af_rvu_ras instead before writing NIX_AF_RAS_ENA_W1S.\n\nFixes: 5ed66306eab6 (\"octeontx2-af: Add devlink health reporters for NIX\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nLink: https://patch.msgid.link/20260310184824.1183651-1-alok.a.tiwari@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "840c9d13cb1ca96683a5307ee8e221be163a2c1e", "tree": "a438b7e70304bae22660e12776c5d7d0c32f6739", "parents": [ "87c2302813abc55c46485711a678e3c312b00666" ], "author": { "name": "Chintan Vankar", "email": "c-vankar@ti.com", "time": "Tue Mar 10 21:39:40 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 20:28:37 2026 -0700" }, "message": "net: ethernet: ti: am65-cpsw-nuss: Fix rx_filter value for PTP support\n\nThe \"rx_filter\" member of \"hwtstamp_config\" structure is an enum field and\ndoes not support bitwise OR combination of multiple filter values. It\ncauses error while linuxptp application tries to match rx filter version.\nFix this by storing the requested filter type in a new port field.\n\nFixes: 97248adb5a3b (\"net: ti: am65-cpsw: Update hw timestamping filter for PTPv1 RX packets\")\nSigned-off-by: Chintan Vankar \u003cc-vankar@ti.com\u003e\nLink: https://patch.msgid.link/20260310160940.109822-1-c-vankar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "87c2302813abc55c46485711a678e3c312b00666", "tree": "6e053ef56cbbaa147636ff89b722c5bdb97e5052", "parents": [ "ead054054874d7de4c1724e18c1adf90fdb5d7db" ], "author": { "name": "Shiraz Saleem", "email": "shirazsaleem@microsoft.com", "time": "Mon Mar 09 10:24:43 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 20:21:45 2026 -0700" }, "message": "net/mana: Null service_wq on setup error to prevent double destroy\n\nIn mana_gd_setup() error path, set gc-\u003eservice_wq to NULL after\ndestroy_workqueue() to match the cleanup in mana_gd_cleanup().\nThis prevents a use-after-free if the workqueue pointer is checked\nafter a failed setup.\n\nFixes: f975a0955276 (\"net: mana: Fix double destroy_workqueue on service rescan PCI path\")\nSigned-off-by: Shiraz Saleem \u003cshirazsaleem@microsoft.com\u003e\nSigned-off-by: Konstantin Taranov \u003ckotaranov@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260309172443.688392-1-kotaranov@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ead054054874d7de4c1724e18c1adf90fdb5d7db", "tree": "e772db4c1e48add264d80da5c9249f62cf36e176", "parents": [ "14ad51036c57e91e85b83f61df1d27e347912c32", "329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:12:59 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:12:59 2026 -0700" }, "message": "Merge tag \u0027nf-26-03-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nFlorian Westphal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetfilter: updates for net\n\nDue to large volume of backlogged patches its unlikely I will make the\n2nd planned PR this week, so several legit fixes will be pushed back\nto next week. Sorry for the inconvenience but I am out of ideas and\nalternatives.\n\n1) syzbot managed to add/remove devices to a flowtable, due to a bug in\n the flowtable netdevice notifier this gets us a double-add and\n eventually UaF when device is removed again (we only expect one\n entry, duplicate remains past net_device end-of-life).\n From Phil Sutter, bug added in 6.16.\n\n2) Yiming Qian reports another nf_tables transaction handling bug:\n in some cases error unwind misses to undo certain set elements,\n resulting in refcount underflow and use-after-free, bug added in 6.4.\n\n3) Jenny Guanni Qu found out-of-bounds read in pipapo set type.\n While the value is never used, it still rightfully triggers KASAN\n splats. Bug exists since this set type was added in 5.6.\n\n4) a few x_tables modules contain copypastry tcp option parsing code which\n can read 1 byte past the option area. This bug is ancient, fix from\n David Dull.\n\n5) nfnetlink_queue leaks kernel memory if userspace provides bad\n NFQA_VLAN/NFQA_L2HDR attributes. From Hyunwoo Kim, bug stems from\n from 4.7 days.\n\n6) nfnetlink_cthelper has incorrect loop restart logic which may result\n in reading one pointer past end of array. From 3.6 days, fix also from\n Hyunwoo Kim.\n\n7) xt_IDLETIMER v0 extension must reject working with timers added\n by revision v1, else we get list corruption. Bug added in v5.7.\n From Yifan Wu, Juefei Pu and Yuan Tan via Xin Lu.\n\n* tag \u0027nf-26-03-10\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n netfilter: x_tables: guard option walkers against 1-byte tail reads\n netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n netfilter: nf_tables: always walk all pending catchall elements\n netfilter: nf_tables: Fix for duplicate device in netdev hooks\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310132050.630-1-fw@strlen.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14ad51036c57e91e85b83f61df1d27e347912c32", "tree": "f4b7af0cccd83b15c064301451190c8dda7a1cc7", "parents": [ "e62a22f43475624ea466fd9b766f62e8458f4cd9", "e94eaef11142b01f77bf8ba4d0b59720b7858109" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:08:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:08:16 2026 -0700" }, "message": "Merge branch \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-03-10 (ice, iavf, i40e, e1000e, e1000)\n\nNikolay Aleksandrov changes return code of RDMA related ice devlink get\nparameters when irdma is not enabled to -EOPNOTSUPP as current return\nof -ENODEV causes issues with devlink output.\n\nPetr Oros resolves a couple of issues in iavf; freeing PTP resources\nbefore reset and disable. Fixing contention issues with the netdev lock\nbetween reset and some ethtool operations.\n\nAlok Tiwari corrects an incorrect comparison of cloud filter values and\nadjust some passed arguments to sizeof() for consistency on i40e.\n\nMatt Vollrath removes an incorrect decrement for DMA error on e1000 and\ne1000e drivers.\n\n* \u0027100GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n e1000/e1000e: Fix leak in DMA error cleanup\n i40e: fix src IP mask checks and memcpy argument names in cloud filter\n iavf: fix incorrect reset handling in callbacks\n iavf: fix PTP use-after-free during reset\n drivers: net: ice: fix devlink parameters get without irdma\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310205654.4109072-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e62a22f43475624ea466fd9b766f62e8458f4cd9", "tree": "6e111b4fad09f0afa1691679259dd77df0e32fef", "parents": [ "e8f0dc024ce55451ebd54bad975134ba802e4fcc", "68e76fc12df091b04ede5f6244385a35abae0a80" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:04:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:04:58 2026 -0700" }, "message": "Merge branch \u0027neighbour-fix-update-of-proxy-neighbour\u0027\n\nSabrina Dubroca says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nneighbour: fix update of proxy neighbour\n\nWhile re-reading some \"old\" patches I ran into a small change of\nbehavior in commit dc2a27e524ac (\"neighbour: Update pneigh_entry in\npneigh_create().\").\n\nThe old behavior was not consistent between -\u003eprotocol and -\u003eflags,\nand didn\u0027t offer a way to clear protocol, so maybe it\u0027s better to\nchange that (7-years-old [1]) behavior. But then we should change\nnon-proxy neighbours as well to keep neigh/pneigh consistent.\n\n[1] df9b0e30d44c (\"neighbor: Add protocol attribute\")\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "68e76fc12df091b04ede5f6244385a35abae0a80", "tree": "6e111b4fad09f0afa1691679259dd77df0e32fef", "parents": [ "cbada1048847a348797aec63a1d8056621cbe653" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Tue Mar 10 22:59:17 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:04:55 2026 -0700" }, "message": "selftests: rtnetlink: add neighbour update test\n\nCheck that protocol and flags are updated correctly for\nneighbour and pneigh entries.\n\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/d28f72b5b4ff4c9ecbbbde06146a938dcc4c264a.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cbada1048847a348797aec63a1d8056621cbe653", "tree": "96b6a23f094f693d841c73a59d177dbd7e289283", "parents": [ "e8f0dc024ce55451ebd54bad975134ba802e4fcc" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Tue Mar 10 22:59:16 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:04:55 2026 -0700" }, "message": "neighbour: restore protocol !\u003d 0 check in pneigh update\n\nPrior to commit dc2a27e524ac (\"neighbour: Update pneigh_entry in\npneigh_create().\"), a pneigh\u0027s protocol was updated only when the\nvalue of the NDA_PROTOCOL attribute was non-0. While moving the code,\nthat check was removed. This is a small change of user-visible\nbehavior, and inconsistent with the (non-proxy) neighbour behavior.\n\nFixes: dc2a27e524ac (\"neighbour: Update pneigh_entry in pneigh_create().\")\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/38c61de1bb032871a886aff9b9b52fe1cdd4cada.1772894876.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8f0dc024ce55451ebd54bad975134ba802e4fcc", "tree": "6006f774cc4cac984adea67bf1a7aa0decf12519", "parents": [ "6c5a9baa15de240e747263aba435a0951da8d8d2" ], "author": { "name": "Marek Behún", "email": "kabel@kernel.org", "time": "Wed Mar 11 12:12:37 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 19:03:21 2026 -0700" }, "message": "net: dsa: realtek: Fix LED group port bit for non-zero LED group\n\nThe rtl8366rb_led_group_port_mask() function always returns LED port\nbit in LED group 0; the switch statement returns the same thing in all\nnon-default cases.\n\nThis means that the driver does not currently support configuring LEDs\nin non-zero LED groups.\n\nFix this.\n\nFixes: 32d617005475a71e (\"net: dsa: realtek: add LED drivers for rtl8366rb\")\nSigned-off-by: Marek Behún \u003ckabel@kernel.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260311111237.29002-1-kabel@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c5a9baa15de240e747263aba435a0951da8d8d2", "tree": "cc179222c8fed20e8773be04c7380852f74cfb66", "parents": [ "99c8c16a4aad0b37293cae213e15957c573cf79b" ], "author": { "name": "Mehul Rao", "email": "mehulrao@gmail.com", "time": "Tue Mar 10 13:07:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 18:56:28 2026 -0700" }, "message": "tipc: fix divide-by-zero in tipc_sk_filter_connect()\n\nA user can set conn_timeout to any value via\nsetsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a\nSYN is rejected with TIPC_ERR_OVERLOAD and the retry path in\ntipc_sk_filter_connect() executes:\n\n delay %\u003d (tsk-\u003econn_timeout / 4);\n\nIf conn_timeout is in the range [0, 3], the integer division yields 0,\nand the modulo operation triggers a divide-by-zero exception, causing a\nkernel oops/panic.\n\nFix this by clamping conn_timeout to a minimum of 4 at the point of use\nin tipc_sk_filter_connect().\n\nOops: divide error: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 119 Comm: poc-F144 Not tainted 7.0.0-rc2+\nRIP: 0010:tipc_sk_filter_rcv (net/tipc/socket.c:2236 net/tipc/socket.c:2362)\nCall Trace:\n tipc_sk_backlog_rcv (include/linux/instrumented.h:82 include/linux/atomic/atomic-instrumented.h:32 include/net/sock.h:2357 net/tipc/socket.c:2406)\n __release_sock (include/net/sock.h:1185 net/core/sock.c:3213)\n release_sock (net/core/sock.c:3797)\n tipc_connect (net/tipc/socket.c:2570)\n __sys_connect (include/linux/file.h:62 include/linux/file.h:83 net/socket.c:2098)\n\nFixes: 6787927475e5 (\"tipc: buffer overflow handling in listener socket\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mehul Rao \u003cmehulrao@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260310170730.28841-1-mehulrao@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99c8c16a4aad0b37293cae213e15957c573cf79b", "tree": "dd5087d3f5ab616b200d18927b7812dc9c5e556f", "parents": [ "20c1be4cc86fa34bd68496a1b8168f1af0a2ee72" ], "author": { "name": "Bastien Curutchet (Schneider Electric)", "email": "bastien.curutchet@bootlin.com", "time": "Mon Mar 09 14:15:43 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 18:06:22 2026 -0700" }, "message": "net: dsa: microchip: Fix error path in PTP IRQ setup\n\nIf request_threaded_irq() fails during the PTP message IRQ setup, the\nnewly created IRQ mapping is never disposed. Indeed, the\nksz_ptp_irq_setup()\u0027s error path only frees the mappings that were\nsuccessfully set up.\n\nDispose the newly created mapping if the associated\nrequest_threaded_irq() fails at setup.\n\nCc: stable@vger.kernel.org\nFixes: d0b8fec8ae505 (\"net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()\")\nSigned-off-by: Bastien Curutchet (Schneider Electric) \u003cbastien.curutchet@bootlin.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nLink: https://patch.msgid.link/20260309-ksz-ptp-irq-fix-v1-1-757b3b985955@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "20c1be4cc86fa34bd68496a1b8168f1af0a2ee72", "tree": "03864ff6b9d721b605319cb1c19f6aa77154e40b", "parents": [ "908c344d5cfac4160f49715da9efacdf5b6a28bd", "d56b5d163458c45ab8fa1f00bd875af01b3ce28c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:41 2026 -0700" }, "message": "Merge branch \u0027net-bpf-nd_tbl-fixes-for-when-ipv6-disable-1\u0027\n\nRicardo B. Marlière says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n{net,bpf}: nd_tbl fixes for when ipv6.disable\u003d1\n\nPlease consider merging these four patches to fix three crashes that were\nfound after this report:\n\nhttps://lore.kernel.org/all/CAHXs0ORzd62QOG-Fttqa2Cx_A_VFp\u003dutE2H2VTX5nqfgs7LDxQ@mail.gmail.com\n\nThe first patch from Jakub Kicinski is a preparation in order to enable\nthe use ipv6_mod_enabled() even when CONFIG_IPV6\u003dn.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-0-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d56b5d163458c45ab8fa1f00bd875af01b3ce28c", "tree": "03864ff6b9d721b605319cb1c19f6aa77154e40b", "parents": [ "dcb4e2231469523d20cf0a2477d68245795c205d" ], "author": { "name": "Ricardo B. Marlière", "email": "rbm@suse.com", "time": "Sat Mar 07 17:50:56 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:38 2026 -0700" }, "message": "bpf: bpf_out_neigh_v6: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called which\ninitializes it. If bpf_redirect_neigh() is called with explicit AF_INET6\nnexthop parameters, __bpf_redirect_neigh_v6() can skip the IPv6 FIB lookup\nand call bpf_out_neigh_v6() directly. bpf_out_neigh_v6() then calls\nip_neigh_gw6(), which uses ipv6_stub-\u003end_tbl.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000248\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:skb_do_redirect+0x44f/0xf40\n Call Trace:\n \u003cTASK\u003e\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __tcf_classify.constprop.0+0x83/0x160\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? tcf_classify+0x2b/0x50\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? tc_run+0xb8/0x120\n ? srso_alias_return_thunk+0x5/0xfbef5\n __dev_queue_xmit+0x6fa/0x1000\n ? srso_alias_return_thunk+0x5/0xfbef5\n packet_sendmsg+0x10da/0x1700\n ? srso_alias_return_thunk+0x5/0xfbef5\n __sys_sendto+0x1f3/0x220\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x101/0xf80\n ? exc_page_fault+0x6e/0x170\n ? srso_alias_return_thunk+0x5/0xfbef5\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nFix this by adding an early check in bpf_out_neigh_v6(). If IPv6 is\ndisabled, drop the packet before neighbor lookup.\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: ba452c9e996d (\"bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-4-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dcb4e2231469523d20cf0a2477d68245795c205d", "tree": "0e325e88bb88bac5311a29dc195757028adfe9cb", "parents": [ "30021e969d48e5819d5ae56936c2f34c0f7ce997" ], "author": { "name": "Ricardo B. Marlière", "email": "rbm@suse.com", "time": "Sat Mar 07 17:50:55 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:38 2026 -0700" }, "message": "bpf: bpf_out_neigh_v4: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called which\ninitializes it. If bpf_redirect_neigh() is called from tc with an explicit\nnexthop of nh_family \u003d\u003d AF_INET6, bpf_out_neigh_v4() takes the AF_INET6\nbranch and calls ip_neigh_gw6(), which relies on ipv6_stub-\u003end_tbl.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000248\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:skb_do_redirect+0xb93/0xf00\n Call Trace:\n \u003cTASK\u003e\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __tcf_classify.constprop.0+0x83/0x160\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? tcf_classify+0x2b/0x50\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? tc_run+0xb8/0x120\n ? srso_alias_return_thunk+0x5/0xfbef5\n __dev_queue_xmit+0x6fa/0x1000\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? alloc_skb_with_frags+0x58/0x200\n packet_sendmsg+0x10da/0x1700\n ? srso_alias_return_thunk+0x5/0xfbef5\n __sys_sendto+0x1f3/0x220\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x101/0xf80\n ? exc_page_fault+0x6e/0x170\n ? srso_alias_return_thunk+0x5/0xfbef5\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nFix this by adding an early check in the AF_INET6 branch of\nbpf_out_neigh_v4(). If IPv6 is disabled, unlock RCU and drop the packet.\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: ba452c9e996d (\"bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-3-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "30021e969d48e5819d5ae56936c2f34c0f7ce997", "tree": "24a31220d95130049f2bd2f69d27b52186f3b4a9", "parents": [ "94a4b1f959989de9c54d43c3a102fb1ee92e1414" ], "author": { "name": "Ricardo B. Marlière", "email": "rbm@suse.com", "time": "Sat Mar 07 17:50:54 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:37 2026 -0700" }, "message": "net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the nd_tbl is never\ninitialized because inet6_init() exits before ndisc_init() is called\nwhich initializes it. If bonding ARP/NS validation is enabled, an IPv6\nNS/NA packet received on a slave can reach bond_validate_na(), which\ncalls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can\ncrash in __ipv6_chk_addr_and_flags().\n\n BUG: kernel NULL pointer dereference, address: 00000000000005d8\n Oops: Oops: 0000 [#1] SMP NOPTI\n RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170\n Call Trace:\n \u003cIRQ\u003e\n ipv6_chk_addr+0x1f/0x30\n bond_validate_na+0x12e/0x1d0 [bonding]\n ? __pfx_bond_handle_frame+0x10/0x10 [bonding]\n bond_rcv_validate+0x1a0/0x450 [bonding]\n bond_handle_frame+0x5e/0x290 [bonding]\n ? srso_alias_return_thunk+0x5/0xfbef5\n __netif_receive_skb_core.constprop.0+0x3e8/0xe50\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? update_cfs_rq_load_avg+0x1a/0x240\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __enqueue_entity+0x5e/0x240\n __netif_receive_skb_one_core+0x39/0xa0\n process_backlog+0x9c/0x150\n __napi_poll+0x30/0x200\n ? srso_alias_return_thunk+0x5/0xfbef5\n net_rx_action+0x338/0x3b0\n handle_softirqs+0xc9/0x2a0\n do_softirq+0x42/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x62/0x70\n __dev_queue_xmit+0x2d3/0x1000\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? packet_parse_headers+0x10a/0x1a0\n packet_sendmsg+0x10da/0x1700\n ? kick_pool+0x5f/0x140\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __queue_work+0x12d/0x4f0\n __sys_sendto+0x1f3/0x220\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x101/0xf80\n ? exc_page_fault+0x6e/0x170\n ? srso_alias_return_thunk+0x5/0xfbef5\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nFix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to\nbond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate()\nand avoid the path to ipv6_chk_addr().\n\nSuggested-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nFixes: 4e24be018eb9 (\"bonding: add new parameter ns_targets\")\nSigned-off-by: Ricardo B. Marlière \u003crbm@suse.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-2-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "94a4b1f959989de9c54d43c3a102fb1ee92e1414", "tree": "2c9d33898362608986b5b7044df674641f0ca8b5", "parents": [ "908c344d5cfac4160f49715da9efacdf5b6a28bd" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Mar 07 17:50:53 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Mar 11 17:53:37 2026 -0700" }, "message": "ipv6: move the disable_ipv6_mod knob to core code\n\nFrom: Jakub Kicinski \u003ckuba@kernel.org\u003e\n\nMake sure disable_ipv6_mod itself is not part of the IPv6 module,\nin case core code wants to refer to it. We will remove support\nfor IPv6\u003dm soon, this change helps make fixes we commit before\nthat less messy.\n\nLink: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-1-e2677e85628c@suse.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "80234b5ab240f52fa45d201e899e207b9265ef91", "tree": "30befa628b780a2b18a8061e097e4b39eb4dc61d", "parents": [ "2b8e3fac9bac1f2bb67571a00bb58851826fe705", "97e4567d39941248579da34b7fbb568e6659511e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 11 09:30:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 11 09:30:20 2026 -0700" }, "message": "Merge tag \u0027rproc-v7.0-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux\n\nPull remoteproc fixes from Bjorn Andersson:\n\n - Correct the early return from the i.MX remoteproc prepare\n operation, which prevented the platform-specific prepare\n function from being reached\n\n - Ensure that the Mediatek SCP clock is released during system\n suspend after the recent refactoring to avoid issues with the\n clock framework\u0027s prepare lock.\n\n - Correct the type of the subsys_name_len field in the sysmon\n event QMI message, as the recent introduction of big endian\n support in the QMI encoder highlighted the type mismatch and\n resulted in a failure to encode the message\n\n - Roll back the devm_ioremap_resource_wc() to a devm_ioremap_wc()\n in the Qualcomm WCNSS remoteproc driver, after reports that\n requesting this resource fails on some platforms\n\n* tag \u0027rproc-v7.0-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:\n remoteproc: imx_rproc: Fix unreachable platform prepare_ops\n remoteproc: mediatek: Unprepare SCP clock during system suspend\n remoteproc: sysmon: Correct subsys_name_len type in QMI request\n remoteproc: qcom_wcnss: Fix reserved region mapping failure\n" }, { "commit": "2b8e3fac9bac1f2bb67571a00bb58851826fe705", "tree": "d1a9de8355e2efc2e9a94c1c8672cdf65685ca41", "parents": [ "b29fb8829bff243512bb8c8908fd39406f9fd4c3", "35e4f2a17eb40288f9bcdb09549fa04a63a96279" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 11 08:35:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 11 08:35:31 2026 -0700" }, "message": "Merge tag \u0027powerpc-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Madhavan Srinivasan:\n - Correct MSI allocation tracking\n - Always use 64 bits PTE for powerpc/e500\n - Fix inline assembly for clang build on PPC32\n - Fixes for clang build issues in powerpc64/ftrace\n - Fixes for powerpc64/bpf JIT and tailcall support\n - Cleanup MPC83XX devicetrees\n - Fix keymile vendor prefix\n - Fix to use big-endian types for crash variables\n\nThanks to Abhishek Dubey, Christophe Leroy (CS GROUP), Hari Bathini,\nHeiko Schocher, J. Neuschäfer, Mahesh Salgaonkar, Nam Cao, Nilay Shroff,\nRob Herring (Arm), Saket Kumar Bhaskar, Sourabh Jain, Stan Johnson, and\nVenkat Rao Bagalkote.\n\n* tag \u0027powerpc-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (23 commits)\n powerpc/pseries: Correct MSI allocation tracking\n powerpc: dts: mpc83xx: Add unit addresses to /memory\n powerpc: dts: mpc8315erdb: Add missing #cells properties to SPI bus\n powerpc: dts: mpc8315erdb: Rename LED nodes to comply with schema\n powerpc: dts: mpc8315erdb: Use IRQ_TYPE_* macros\n powerpc: dts: mpc8313erdb: Use IRQ_TYPE_* macros\n powerpc: 83xx: km83xx: Fix keymile vendor prefix\n dt-bindings: powerpc: Add Freescale/NXP MPC83xx SoCs\n powerpc64/bpf: fix kfunc call support\n powerpc64/bpf: fix handling of BPF stack in exception callback\n powerpc64/bpf: remove BPF redzone protection in trampoline stack\n powerpc64/bpf: use consistent tailcall offset in trampoline\n powerpc64/bpf: fix the address returned by bpf_get_func_ip\n powerpc64/bpf: do not increment tailcall count when prog is NULL\n powerpc64/ftrace: workaround clang recording GEP in __patchable_function_entries\n powerpc64/ftrace: fix OOL stub count with clang\n powerpc64: make clang cross-build friendly\n powerpc/crash: adjust the elfcorehdr size\n powerpc/kexec/core: use big-endian types for crash variables\n powerpc/prom_init: Fixup missing #size-cells on PowerMac media-bay nodes\n ...\n" }, { "commit": "393815f57651101f1590632092986d1d5a3a41bd", "tree": "2a96b100c4eec619195e86ecb0e1df050f9d6fc4", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681" ], "author": { "name": "Ben Dooks", "email": "ben.dooks@codethink.co.uk", "time": "Wed Mar 11 10:58:35 2026 +0000" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Wed Mar 11 12:30:45 2026 +0100" }, "message": "ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address()\n\nThe pointer returned from acpi_os_map_generic_address() is\ntagged with __iomem, so make the rv it is returned to also\nof void __iomem * type.\n\nFixes the following sparse warning:\n\ndrivers/acpi/osl.c:1686:20: warning: incorrect type in assignment (different address spaces)\ndrivers/acpi/osl.c:1686:20: expected void *rv\ndrivers/acpi/osl.c:1686:20: got void [noderef] __iomem *\n\nFixes: 6915564dc5a8 (\"ACPI: OSL: Change the type of acpi_os_map_generic_address() return value\")\nSigned-off-by: Ben Dooks \u003cben.dooks@codethink.co.uk\u003e\n[ rjw: Subject tweak, added Fixes tag ]\nLink: https://patch.msgid.link/20260311105835.463030-1-ben.dooks@codethink.co.uk\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "b29fb8829bff243512bb8c8908fd39406f9fd4c3", "tree": "b856b54d51c23dc50266b2193fb2ed94337032bd", "parents": [ "b4f0dd314b39ea154f62f3bd3115ed0470f9f71e", "441336115df26b966575de56daf7107ed474faed" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 10 20:30:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 10 20:30:52 2026 -0700" }, "message": "Merge tag \u0027v7.0-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb server fixes from Steve French:\n\n - Fix potential use after free errors\n\n - Fix refcount leak in smb2 open error path\n\n - Prevent allowing logging signing or encryption keys\n\n* tag \u0027v7.0-rc3-ksmbd-server-fixes\u0027 of git://git.samba.org/ksmbd:\n ksmbd: Don\u0027t log keys in SMB3 signing and encryption key generation\n smb: server: fix use-after-free in smb2_open()\n ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()\n ksmbd: fix use-after-free by using call_rcu() for oplock_info\n ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock\n smb/server: Fix another refcount leak in smb2_open()\n" }, { "commit": "908c344d5cfac4160f49715da9efacdf5b6a28bd", "tree": "38930218b8d7a7da234327bb944418ef77cae621", "parents": [ "57885276cc16a2e2b76282c808a4e84cbecb3aae" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Mar 10 06:49:35 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 19:41:13 2026 -0700" }, "message": "net: bcmgenet: fix broken EEE by converting to phylib-managed state\n\nThe bcmgenet EEE implementation is broken in several ways.\nphy_support_eee() is never called, so the PHY never advertises EEE\nand phylib never sets phydev-\u003eenable_tx_lpi. bcmgenet_mac_config()\nchecks priv-\u003eeee.eee_enabled to decide whether to enable the MAC\nLPI logic, but that field is never initialised to true, so the MAC\nnever enters Low Power Idle even when EEE is negotiated - wasting\nthe power savings EEE is designed to provide. The only way to get\nEEE working at all is a manual \u0027ethtool --set-eee eth0 eee on\u0027 after\nevery link-up, and even then bcmgenet_get_eee() immediately clobbers\nthe reported state because phy_ethtool_get_eee() overwrites\neee_enabled and tx_lpi_enabled with the uninitialised PHY eee_cfg\nvalues. Finally, bcmgenet_mac_config() is only called on link-up,\nso EEE is never disabled in hardware on link-down.\n\nFix all of this by removing the MAC-side EEE state tracking\n(priv-\u003eeee) and aligning with the pattern used by other non-phylink\nMAC drivers such as FEC.\n\nCall phy_support_eee() in bcmgenet_mii_probe() so the PHY advertises\nEEE link modes and phylib tracks negotiation state. Move the EEE\nhardware control to bcmgenet_mii_setup(), which is called on every\nlink event, and drive it directly from phydev-\u003eenable_tx_lpi - the\nflag phylib sets when EEE is negotiated and the user has not disabled\nit. This enables EEE automatically once the link partner agrees and\ndisables it cleanly on link-down.\n\nMake bcmgenet_get_eee() and bcmgenet_set_eee() pure passthroughs to\nphy_ethtool_get_eee() and phy_ethtool_set_eee(), with the MAC\nhardware register read/written for tx_lpi_timer. Drop struct\nethtool_keee eee from struct bcmgenet_priv.\n\nFixes: fe0d4fd9285e (\"net: phy: Keep track of EEE configuration\")\nLink: https://lore.kernel.org/netdev/d352039f-4cbb-41e6-9aeb-0b4f3941b54c@lunn.ch/\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nTested-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260310054935.1238594-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57885276cc16a2e2b76282c808a4e84cbecb3aae", "tree": "6873473c9f85e684a4f05b40db89b16d756a130d", "parents": [ "f441b489cc66fbc44d78b6c123e74283b8077431" ], "author": { "name": "Paul Moses", "email": "p@1g4.org", "time": "Mon Mar 09 17:35:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 19:29:09 2026 -0700" }, "message": "net-shapers: don\u0027t free reply skb after genlmsg_reply()\n\ngenlmsg_reply() hands the reply skb to netlink, and\nnetlink_unicast() consumes it on all return paths, whether the\nskb is queued successfully or freed on an error path.\n\nnet_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()\ncurrently jump to free_msg after genlmsg_reply() fails and call\nnlmsg_free(msg), which can hit the same skb twice.\n\nReturn the genlmsg_reply() error directly and keep free_msg\nonly for pre-reply failures.\n\nFixes: 4b623f9f0f59 (\"net-shapers: implement NL get operation\")\nFixes: 553ea9f1efd6 (\"net: shaper: implement introspection support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Moses \u003cp@1g4.org\u003e\nLink: https://patch.msgid.link/20260309173450.538026-2-p@1g4.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f441b489cc66fbc44d78b6c123e74283b8077431", "tree": "da1c4d168cc9d4d9cf642cded692e550aa7b03e7", "parents": [ "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Tue Mar 10 00:41:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 19:18:13 2026 -0700" }, "message": "net: dsa: mxl862xx: don\u0027t set user_mii_bus\n\nThe PHY addresses in the MII bus are not equal to the port addresses,\nso the bus cannot be assigned as user_mii_bus. Falling back on the\nuser_mii_bus in case a PHY isn\u0027t declared in device tree will result in\nusing the wrong (in this case: off-by-+1) PHY.\nRemove the wrong assignment.\n\nFixes: 23794bec1cb60 (\"net: dsa: add basic initial driver for MxL862xx switches\")\nSuggested-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Vladimir Oltean \u003colteanv@gmail.com\u003e\nLink: https://patch.msgid.link/0f0df310fd8cab57e0e5e3d0831dd057fd05bcd5.1773103271.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2503d08f8a2de618e5c3a8183b250ff4a2e2d52c", "tree": "e3c1f3cce6350e85c1aef166888fd5e1cb2bdbfc", "parents": [ "28b225282d44e2ef40e7f46cfdbd5d1b20b8874f" ], "author": { "name": "Fan Wu", "email": "fanwu01@zju.edu.cn", "time": "Mon Mar 09 13:24:09 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 19:05:12 2026 -0700" }, "message": "net: ethernet: arc: emac: quiesce interrupts before requesting IRQ\n\nNormal RX/TX interrupts are enabled later, in arc_emac_open(), so probe\nshould not see interrupt delivery in the usual case. However, hardware may\nstill present stale or latched interrupt status left by firmware or the\nbootloader.\n\nIf probe later unwinds after devm_request_irq() has installed the handler,\nsuch a stale interrupt can still reach arc_emac_intr() during teardown and\nrace with release of the associated net_device.\n\nAvoid that window by putting the device into a known quiescent state before\nrequesting the IRQ: disable all EMAC interrupt sources and clear any\npending EMAC interrupt status bits. This keeps the change hardware-focused\nand minimal, while preventing spurious IRQ delivery from leftover state.\n\nFixes: e4f2379db6c6 (\"ethernet/arc/arc_emac - Add new driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Fan Wu \u003cfanwu01@zju.edu.cn\u003e\nLink: https://patch.msgid.link/20260309132409.584966-1-fanwu01@zju.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "28b225282d44e2ef40e7f46cfdbd5d1b20b8874f", "tree": "b9e2f912c7986b48a2ca7489c17015a5320725db", "parents": [ "881a0263d502e1a93ebc13a78254e9ad19520232" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 17:39:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 19:03:34 2026 -0700" }, "message": "page_pool: store detach_time as ktime_t to avoid false-negatives\n\nWhile testing other changes in vng I noticed that\nnl_netdev.page_pool_check flakes. This never happens in real CI.\n\nTurns out vng may boot and get to that test in less than a second.\npage_pool_detached() records the detach time in seconds, so if\nvng is fast enough detach time is set to 0. Other code treats\n0 as \"not detached\". detach_time is only used to report the state\nto the user, so it\u0027s not a huge deal in practice but let\u0027s fix it.\nStore the raw ktime_t (nanoseconds) instead. A nanosecond value\nof 0 is practically impossible.\n\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nFixes: 69cb4952b6f6 (\"net: page_pool: report when page pool was destroyed\")\nLink: https://patch.msgid.link/20260310003907.3540019-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "881a0263d502e1a93ebc13a78254e9ad19520232", "tree": "c41b36b8fecebea6171efb2e4c07e15def6ffaaa", "parents": [ "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d" ], "author": { "name": "Kevin Hao", "email": "haokexin@gmail.com", "time": "Sat Mar 07 15:08:54 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Mar 10 17:36:44 2026 -0700" }, "message": "net: macb: Shuffle the tx ring before enabling tx\n\nQuanyang observed that when using an NFS rootfs on an AMD ZynqMp board,\nthe rootfs may take an extended time to recover after a suspend.\nUpon investigation, it was determined that the issue originates from a\nproblem in the macb driver.\n\nAccording to the Zynq UltraScale TRM [1], when transmit is disabled,\nthe transmit buffer queue pointer resets to point to the address\nspecified by the transmit buffer queue base address register.\n\nIn the current implementation, the code merely resets `queue-\u003etx_head`\nand `queue-\u003etx_tail` to \u00270\u0027. This approach presents several issues:\n\n- Packets already queued in the tx ring are silently lost,\n leading to memory leaks since the associated skbs cannot be released.\n\n- Concurrent write access to `queue-\u003etx_head` and `queue-\u003etx_tail` may\n occur from `macb_tx_poll()` or `macb_start_xmit()` when these values\n are reset to \u00270\u0027.\n\n- The transmission may become stuck on a packet that has already been sent\n out, with its \u0027TX_USED\u0027 bit set, but has not yet been processed. However,\n due to the manipulation of \u0027queue-\u003etx_head\u0027 and \u0027queue-\u003etx_tail\u0027,\n `macb_tx_poll()` incorrectly assumes there are no packets to handle\n because `queue-\u003etx_head \u003d\u003d queue-\u003etx_tail`. This issue is only resolved\n when a new packet is placed at this position. This is the root cause of\n the prolonged recovery time observed for the NFS root filesystem.\n\nTo resolve this issue, shuffle the tx ring and tx skb array so that\nthe first unsent packet is positioned at the start of the tx ring.\nAdditionally, ensure that updates to `queue-\u003etx_head` and\n`queue-\u003etx_tail` are properly protected with the appropriate lock.\n\n[1] https://docs.amd.com/v/u/en-US/ug1085-zynq-ultrascale-trm\n\nFixes: bf9cf80cab81 (\"net: macb: Fix tx/rx malfunction after phy link down and up\")\nReported-by: Quanyang Wang \u003cquanyang.wang@windriver.com\u003e\nSigned-off-by: Kevin Hao \u003chaokexin@gmail.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260307-zynqmp-v2-1-6ef98a70e1d0@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e94eaef11142b01f77bf8ba4d0b59720b7858109", "tree": "facc2b6a7fd72c512ae0dcfb30444a05ade8ac8e", "parents": [ "e809085f492842ce7a519c9ef72d40f4bca89c13" ], "author": { "name": "Matt Vollrath", "email": "tactii@gmail.com", "time": "Tue Feb 24 18:28:33 2026 -0500" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 10 13:02:54 2026 -0700" }, "message": "e1000/e1000e: Fix leak in DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented after a successful mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping would leak.\n\nIn these commits, a faulty while condition caused an infinite loop in\ndma_error:\nCommit 03b1320dfcee (\"e1000e: remove use of skb_dma_map from e1000e\ndriver\")\nCommit 602c0554d7b0 (\"e1000: remove use of skb_dma_map from e1000 driver\")\n\nCommit c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of\nunsigned in *_tx_map()\") fixed the infinite loop, but introduced the\noff-by-one error.\n\nThis issue may still exist in the igbvf driver, but I did not address it\nin this patch.\n\nFixes: c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of unsigned in *_tx_map()\")\nAssisted-by: Claude:claude-4.6-opus\nSigned-off-by: Matt Vollrath \u003ctactii@gmail.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "e809085f492842ce7a519c9ef72d40f4bca89c13", "tree": "2e1babb630c12f05929cec8875a00987ccb0cc5b", "parents": [ "fdadbf6e84c44df8dbb85cfdd38bc10e4431501d" ], "author": { "name": "Alok Tiwari", "email": "alok.a.tiwari@oracle.com", "time": "Mon Nov 10 11:13:38 2025 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 10 13:02:45 2026 -0700" }, "message": "i40e: fix src IP mask checks and memcpy argument names in cloud filter\n\nFix following issues in the IPv4 and IPv6 cloud filter handling logic in\nboth the add and delete paths:\n\n- The source-IP mask check incorrectly compares mask.src_ip[0] against\n tcf.dst_ip[0]. Update it to compare against tcf.src_ip[0]. This likely\n goes unnoticed because the check is in an \"else if\" path that only\n executes when dst_ip is not set, most cloud filter use cases focus on\n destination-IP matching, and the buggy condition can accidentally\n evaluate true in some cases.\n\n- memcpy() for the IPv4 source address incorrectly uses\n ARRAY_SIZE(tcf.dst_ip) instead of ARRAY_SIZE(tcf.src_ip), although\n both arrays are the same size.\n\n- The IPv4 memcpy operations used ARRAY_SIZE(tcf.dst_ip) and ARRAY_SIZE\n (tcf.src_ip), Update these to use sizeof(cfilter-\u003eip.v4.dst_ip) and\n sizeof(cfilter-\u003eip.v4.src_ip) to ensure correct and explicit copy size.\n\n- In the IPv6 delete path, memcmp() uses sizeof(src_ip6) when comparing\n dst_ip6 fields. Replace this with sizeof(dst_ip6) to make the intent\n explicit, even though both fields are struct in6_addr.\n\nFixes: e284fc280473 (\"i40e: Add and delete cloud filter\")\nSigned-off-by: Alok Tiwari \u003calok.a.tiwari@oracle.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "b4f0dd314b39ea154f62f3bd3115ed0470f9f71e", "tree": "b8eda2f2e4e59a84f9f6f0d220daa3f769e6ad85", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681", "b12bbe35c7c1e431f2fa01fe9291daa52fb7ab43" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 10 12:47:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 10 12:47:56 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-03-09-16-36\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"15 hotfixes. 6 are cc:stable. 14 are for MM.\n\n Singletons, with one doubleton - please see the changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2026-03-09-16-36\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n MAINTAINERS, mailmap: update email address for Lorenzo Stoakes\n mm/mmu_notifier: clean up mmu_notifier.h kernel-doc\n uaccess: correct kernel-doc parameter format\n mm/huge_memory: fix a folio_split() race condition with folio_try_get()\n MAINTAINERS: add co-maintainer and reviewer for SLAB ALLOCATOR\n MAINTAINERS: add RELAY entry\n memcg: fix slab accounting in refill_obj_stock() trylock path\n mm/hugetlb.c: use __pa() instead of virt_to_phys() in early bootmem alloc code\n zram: rename writeback_compressed device attr\n tools/testing: fix testing/vma and testing/radix-tree build\n Revert \"ptdesc: remove references to folios from __pagetable_ctor() and pagetable_dtor()\"\n mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release()\n mm/damon/core: clear walk_control on inactive context in damos_walk()\n mm: memfd_luo: always dirty all folios\n mm: memfd_luo: always make all folios uptodate\n" }, { "commit": "fdadbf6e84c44df8dbb85cfdd38bc10e4431501d", "tree": "012d0fb634a48208e20ebf65bdb4c872b71d9bbc", "parents": [ "efc54fb13d79117a825fef17364315a58682c7ec" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Wed Feb 11 20:18:55 2026 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 10 09:08:31 2026 -0700" }, "message": "iavf: fix incorrect reset handling in callbacks\n\nThree driver callbacks schedule a reset and wait for its completion:\nndo_change_mtu(), ethtool set_ringparam(), and ethtool set_channels().\n\nWaiting for reset in ndo_change_mtu() and set_ringparam() was added by\ncommit c2ed2403f12c (\"iavf: Wait for reset in callbacks which trigger\nit\") to fix a race condition where adding an interface to bonding\nimmediately after MTU or ring parameter change failed because the\ninterface was still in __RESETTING state. The same commit also added\nwaiting in iavf_set_priv_flags(), which was later removed by commit\n53844673d555 (\"iavf: kill \"legacy-rx\" for good\").\n\nWaiting in set_channels() was introduced earlier by commit 4e5e6b5d9d13\n(\"iavf: Fix return of set the new channel count\") to ensure the PF has\nenough time to complete the VF reset when changing channel count, and to\nreturn correct error codes to userspace.\n\nCommit ef490bbb2267 (\"iavf: Add net_shaper_ops support\") added\nnet_shaper_ops to iavf, which required reset_task to use _locked NAPI\nvariants (napi_enable_locked, napi_disable_locked) that need the netdev\ninstance lock.\n\nLater, commit 7e4d784f5810 (\"net: hold netdev instance lock during\nrtnetlink operations\") and commit 2bcf4772e45a (\"net: ethtool: try to\nprotect all callback with netdev instance lock\") started holding the\nnetdev instance lock during ndo and ethtool callbacks for drivers with\nnet_shaper_ops.\n\nFinally, commit 120f28a6f314 (\"iavf: get rid of the crit lock\")\nreplaced the driver\u0027s crit_lock with netdev_lock in reset_task, causing\nincorrect behavior: the callback holds netdev_lock and waits for\nreset_task, but reset_task needs the same lock:\n\n Thread 1 (callback) Thread 2 (reset_task)\n ------------------- ---------------------\n netdev_lock() [blocked on workqueue]\n ndo_change_mtu() or ethtool op\n iavf_schedule_reset()\n iavf_wait_for_reset() iavf_reset_task()\n waiting... netdev_lock() \u003c- blocked\n\nThis does not strictly deadlock because iavf_wait_for_reset() uses\nwait_event_interruptible_timeout() with a 5-second timeout. The wait\neventually times out, the callback returns an error to userspace, and\nafter the lock is released reset_task completes the reset. This leads to\nincorrect behavior: userspace sees an error even though the configuration\nchange silently takes effect after the timeout.\n\nFix this by extracting the reset logic from iavf_reset_task() into a new\niavf_reset_step() function that expects netdev_lock to be already held.\nThe three callbacks now call iavf_reset_step() directly instead of\nscheduling the work and waiting, performing the reset synchronously in\nthe caller\u0027s context which already holds netdev_lock. This eliminates\nboth the incorrect error reporting and the need for\niavf_wait_for_reset(), which is removed along with the now-unused\nreset_waitqueue.\n\nThe workqueue-based iavf_reset_task() becomes a thin wrapper that\nacquires netdev_lock and calls iavf_reset_step(), preserving its use\nfor PF-initiated resets.\n\nThe callbacks may block for several seconds while iavf_reset_step()\npolls hardware registers, but this is acceptable since netdev_lock is a\nper-device mutex and only serializes operations on the same interface.\n\nv3:\n- Remove netif_running() guard from iavf_set_channels(). Unlike\n set_ringparam where descriptor counts are picked up by iavf_open()\n directly, num_req_queues is only consumed during\n iavf_reinit_interrupt_scheme() in the reset path. Skipping the reset\n on a down device would silently discard the channel count change.\n- Remove dead reset_waitqueue code (struct field, init, and all\n wake_up calls) since iavf_wait_for_reset() was the only consumer.\n\nFixes: 120f28a6f314 (\"iavf: get rid of the crit lock\")\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "efc54fb13d79117a825fef17364315a58682c7ec", "tree": "aa0e9a81d3d8f0e35c80498fdcc8eebd5fc1bcea", "parents": [ "bd98c6204d1195973b1760fe45860863deb6200c" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Thu Jan 29 10:57:23 2026 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 10 09:08:31 2026 -0700" }, "message": "iavf: fix PTP use-after-free during reset\n\nCommit 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\") introduced a\nworker to cache PHC time, but failed to stop it during reset or disable.\n\nThis creates a race condition where `iavf_reset_task()` or\n`iavf_disable_vf()` free adapter resources (AQ) while the worker is still\nrunning. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it\naccesses freed memory/locks, leading to a crash.\n\nFix this by calling `iavf_ptp_release()` before tearing down the adapter.\nThis ensures `ptp_clock_unregister()` synchronously cancels the worker and\ncleans up the chardev before the backing resources are destroyed.\n\nFixes: 7c01dbfc8a1c5f (\"iavf: periodically cache PHC time\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nAcked-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "bd98c6204d1195973b1760fe45860863deb6200c", "tree": "b7cd6c596801b94789327c143c18d6ae2539f48c", "parents": [ "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@nvidia.com", "time": "Fri Feb 13 10:48:41 2026 +0200" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Mar 10 09:08:31 2026 -0700" }, "message": "drivers: net: ice: fix devlink parameters get without irdma\n\nIf CONFIG_IRDMA isn\u0027t enabled but there are ice NICs in the system, the\ndriver will prevent full devlink dev param show dump because its rdma get\ncallbacks return ENODEV and stop the dump. For example:\n $ devlink dev param show\n pci/0000:82:00.0:\n name msix_vec_per_pf_max type generic\n values:\n cmode driverinit value 2\n name msix_vec_per_pf_min type generic\n values:\n cmode driverinit value 2\n kernel answers: No such device\n\nReturning EOPNOTSUPP allows the dump to continue so we can see all devices\u0027\ndevlink parameters.\n\nFixes: c24a65b6a27c (\"iidc/ice/irdma: Update IDC to support multiple consumers\")\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@nvidia.com\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "d557640e4ce589a24dca5ca7ce3b9680f471325f", "tree": "8f5f170843815a83aefba3b33b0437946e42bcd6", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Sat Mar 07 17:12:05 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Mar 10 16:03:02 2026 +0100" }, "message": "sched: idle: Make skipping governor callbacks more consistent\n\nIf the cpuidle governor .select() callback is skipped because there\nis only one idle state in the cpuidle driver, the .reflect() callback\nshould be skipped as well, at least for consistency (if not for\ncorrectness), so do it.\n\nFixes: e5c9ffc6ae1b (\"cpuidle: Skip governor when only one idle state is available\")\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReviewed-by: Christian Loehle \u003cchristian.loehle@arm.com\u003e\nReviewed-by: Aboorva Devarajan \u003caboorvad@linux.ibm.com\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nLink: https://patch.msgid.link/12857700.O9o76ZdvQC@rafael.j.wysocki\n" }, { "commit": "73aefba4e2eb713cf7bc4ad83cfc9b5d4f966f6d", "tree": "b717727f76315700db5acabe7910161ff039f147", "parents": [ "6f1a9140ecda3baba3d945b9a6155af4268aafc4", "47bba09b14fa21712398febf36cb14fd4fc3bded" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 15:13:55 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 15:13:55 2026 +0100" }, "message": "Merge tag \u0027linux-can-fixes-for-7.0-20260310\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-03-10\n\nthis is a pull request of 2 patches for net/main.\n\nHaibo Chen\u0027s patch fixes the maximum allowed bit rate error, which was\nbroken in v6.19.\n\nWenyuan Li contributes a patch for the hi311x driver that adds missing\nerror checking in the caller of the hi3110_power_enable() function,\nhi3110_open().\n\nlinux-can-fixes-for-7.0-20260310\n\n* tag \u0027linux-can-fixes-for-7.0-20260310\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value\n can: dev: keep the max bitrate error at 5%\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260310103547.2299403-1-mkl@pengutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6ab3532b4c98f4e51969f0e5f3fc919c535f3ce1", "tree": "a925dd40a1c89be2418755022bc77d9c93208772", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Mar 09 21:54:17 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Mar 10 15:08:21 2026 +0100" }, "message": "ACPI: video: Switch over to auxiliary bus type\n\nCommit 02c057ddefef (\"ACPI: video: Convert the driver to a platform one\")\nswitched over the ACPI video bus driver from an ACPI driver to a platform\ndriver, but that change introduced an unwanted and unexpected side effect.\nNamely, on some systems, the ACPI device object of the ACPI video bus\ndevice is an ACPI companion of multiple platform devices and, after\nadding video_device_ids[] as an acpi_match_table to the acpi_video_bus\nplatform driver, all of those devices started to match that driver and\nits probe callback is invoked for all of them (it fails, but it leaves\na confusing message in the log). Moreover, the MODULE_DEVICE_TABLE()\nof the ACPI video driver module matches all of the devices sharing the\nACPI companion with the ACPI video bus device.\n\nTo address this, make the core ACPI device enumeration code create an\nauxiliary device for the ACPI video bus device object instead of a\nplatform device and switch over the ACPI video bus driver (once more)\nto an auxiliary driver.\n\nAuxiliary driver generally is a better match for ACPI video bus than\nplatform driver, among other things because the ACPI video bus device\ndoes not require any resources to be allocated for it during\nenumeration. It also allows the ACPI video bus driver to stop abusing\ndevice matching based on ACPI device IDs and it allows a special case\nto be dropped from acpi_create_platform_device() because that function\nneed not worry about the ACPI video bus device any more.\n\nFixes: 02c057ddefef (\"ACPI: video: Convert the driver to a platform one\")\nReported-by: Pratap Nirujogi \u003cpratap.nirujogi@amd.com\u003e\nCloses: https://lore.kernel.org/linux-acpi/007e3390-6b2b-457e-83c7-c794c5952018@amd.com/\nTested-by: Pratap Nirujogi \u003cpratap.nirujogi@amd.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReviewed-by: Mario Limonciello (AMD) \u003csuperm1@kernel.org\u003e\n[ rjw: Added AUXILIARY_BUS selection to CONFIG_ACPI to fix build issue ]\n[ rjw: Fixed error path in acpi_create_video_bus_device() ]\nLink: https://patch.msgid.link/5986516.DvuYhMxLoT@rafael.j.wysocki\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n" }, { "commit": "329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf", "tree": "de73cfae04359fba41bbb3f04e17969986b9a781", "parents": [ "6dcee8496d53165b2d8a5909b3050b62ae71fe89" ], "author": { "name": "Yuan Tan", "email": "tanyuan98@outlook.com", "time": "Mon Mar 09 03:41:46 2026 -0700" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:43 2026 +0100" }, "message": "netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels\n\nIDLETIMER revision 0 rules reuse existing timers by label and always call\nmod_timer() on timer-\u003etimer.\n\nIf the label was created first by revision 1 with XT_IDLETIMER_ALARM,\nthe object uses alarm timer semantics and timer-\u003etimer is never initialized.\nReusing that object from revision 0 causes mod_timer() on an uninitialized\ntimer_list, triggering debugobjects warnings and possible panic when\npanic_on_warn\u003d1.\n\nFix this by rejecting revision 0 rule insertion when an existing timer with\nthe same label is of ALARM type.\n\nFixes: 68983a354a65 (\"netfilter: xtables: Add snapshot of hardidletimer target\")\nCo-developed-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nSigned-off-by: Yifan Wu \u003cyifanwucs@gmail.com\u003e\nCo-developed-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Juefei Pu \u003ctomapufckgml@gmail.com\u003e\nSigned-off-by: Yuan Tan \u003ctanyuan98@outlook.com\u003e\nSigned-off-by: Xin Liu \u003cdstsmallbird@foxmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6dcee8496d53165b2d8a5909b3050b62ae71fe89", "tree": "155ce8e2886bc797e5c4d22823e48c4217b5d2ce", "parents": [ "f1ba83755d81c6fc66ac7acd723d238f974091e9" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Sun Mar 08 02:23:34 2026 +0900" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a \u0027goto restart\u0027 that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur !\u003d last)\ncheck, so cb-\u003eargs[1] is never cleared. The for loop finishes with\ncb-\u003eargs[0] \u003d\u003d nf_ct_helper_hsize, and the \u0027goto restart\u0027 jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe \u0027goto restart\u0027 block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0\n\nFixes: 12f7a505331e (\"netfilter: add user-space connection tracking helper infrastructure\")\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "f1ba83755d81c6fc66ac7acd723d238f974091e9", "tree": "002ea99ecd2257cee892d699202da0ddb9b0ac3e", "parents": [ "cfe770220ac2dbd3e104c6b45094037455da81d4" ], "author": { "name": "Hyunwoo Kim", "email": "imv4bel@gmail.com", "time": "Sun Mar 08 02:24:06 2026 +0900" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path\n\nnfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue\nentry from the queue data structures, taking ownership of the entry.\nFor PF_BRIDGE packets, it then calls nfqa_parse_bridge() to parse VLAN\nattributes. If nfqa_parse_bridge() returns an error (e.g. NFQA_VLAN\npresent but NFQA_VLAN_TCI missing), the function returns immediately\nwithout freeing the dequeued entry or its sk_buff.\n\nThis leaks the nf_queue_entry, its associated sk_buff, and all held\nreferences (net_device refcounts, struct net refcount). Repeated\ntriggering exhausts kernel memory.\n\nFix this by dropping the entry via nfqnl_reinject() with NF_DROP verdict\non the error path, consistent with other error handling in this file.\n\nFixes: 8d45ff22f1b4 (\"netfilter: bridge: nf queue verdict to use NFQA_VLAN and NFQA_L2HDR\")\nReviewed-by: David Dull \u003cmonderasdor@gmail.com\u003e\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "cfe770220ac2dbd3e104c6b45094037455da81d4", "tree": "b49b7c5c4f34bea55f5d1fab58914cc71ea086d6", "parents": [ "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5" ], "author": { "name": "David Dull", "email": "monderasdor@gmail.com", "time": "Sat Mar 07 20:26:21 2026 +0200" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i +\u003d op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i \u003d\u003d optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers.\n\nFixes: 2e4e6a17af35 (\"[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables\")\nSigned-off-by: David Dull \u003cmonderasdor@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "d6d8cd2db236a9dd13dbc2d05843b3445cc964b5", "tree": "9cdd996de61081870d9a828d37de6aab282b6f62", "parents": [ "7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9" ], "author": { "name": "Jenny Guanni Qu", "email": "qguanni@gmail.com", "time": "Fri Mar 06 19:12:38 2026 +0000" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()\n\npipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the\nto_offset argument on every iteration, including the last one where\ni \u003d\u003d m-\u003efield_count - 1. This reads one element past the end of the\nstack-allocated rulemap array (declared as rulemap[NFT_PIPAPO_MAX_FIELDS]\nwith NFT_PIPAPO_MAX_FIELDS \u003d\u003d 16).\n\nAlthough pipapo_unmap() returns early when is_last is true without\nusing the to_offset value, the argument is evaluated at the call site\nbefore the function body executes, making this a genuine out-of-bounds\nstack read confirmed by KASAN:\n\n BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]\n Read of size 4 at addr ffff8000810e71a4\n\n This frame has 1 object:\n [32, 160) \u0027rulemap\u0027\n\n The buggy address is at offset 164 -- exactly 4 bytes past the end\n of the rulemap array.\n\nPass 0 instead of rulemap[i + 1].n on the last iteration to avoid\nthe out-of-bounds read.\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nSigned-off-by: Jenny Guanni Qu \u003cqguanni@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9", "tree": "96d632cfd44de719cf721fdee7d9ddd7be641d7c", "parents": [ "b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Thu Mar 05 21:32:00 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]\n\nFixes: 628bd3e49cba (\"netfilter: nf_tables: drop map element references from preparation phase\")\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "b7cdc5a97d02c943f4bdde4d5767ad0c13cad92b", "tree": "75f1ebddf9cedf2ce7b72a213b56252dd6e12d10", "parents": [ "6f1a9140ecda3baba3d945b9a6155af4268aafc4" ], "author": { "name": "Phil Sutter", "email": "phil@nwl.cc", "time": "Thu Mar 05 13:01:44 2026 +0100" }, "committer": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Tue Mar 10 14:10:42 2026 +0100" }, "message": "netfilter: nf_tables: Fix for duplicate device in netdev hooks\n\nWhen handling NETDEV_REGISTER notification, duplicate device\nregistration must be avoided since the device may have been added by\nnft_netdev_hook_alloc() already when creating the hook.\n\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nReported-by: syzbot+bb9127e278fa198e110c@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dbb9127e278fa198e110c\nFixes: a331b78a5525 (\"netfilter: nf_tables: Respect NETDEV_REGISTER events\")\nTested-by: Helen Koike \u003ckoike@igalia.com\u003e\nSigned-off-by: Phil Sutter \u003cphil@nwl.cc\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\n" }, { "commit": "6f1a9140ecda3baba3d945b9a6155af4268aafc4", "tree": "2affe41ab2fcd984dce31458e08eca3dacca0e7c", "parents": [ "3228835877e77200a8c16f26b22017f850f8b0c3" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sat Mar 07 00:01:34 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 13:30:30 2026 +0100" }, "message": "net: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broadcast mode has GRE tap\ninterfaces as slaves, and those GRE tunnels route back through the\nbond, multicast/broadcast traffic triggers infinite recursion between\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\nkernel stack overflow.\n\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\nsufficient because tunnel recursion involves route lookups and full IP\noutput, consuming much more stack per level. Use a lower limit of 4\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\n\nAdd recursion detection using dev_xmit_recursion helpers directly in\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\n\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\ninclude/linux/netdevice.h so they can be used by tunnel code.\n\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\n Workqueue: mld mld_ifc_work\n Call Trace:\n \u003cTASK\u003e\n __build_flow_key.constprop.0 (net/ipv4/route.c:515)\n ip_rt_update_pmtu (net/ipv4/route.c:1073)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n ip_finish_output2 (net/ipv4/ip_output.c:237)\n ip_output (net/ipv4/ip_output.c:438)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n ip_finish_output2 (net/ipv4/ip_output.c:237)\n ip_output (net/ipv4/ip_output.c:438)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n mld_sendpack\n mld_ifc_work\n process_one_work\n worker_thread\n \u003c/TASK\u003e\n\nFixes: 745e20f1b626 (\"net: add a recursion limit in xmit path\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260306160133.3852900-2-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3228835877e77200a8c16f26b22017f850f8b0c3", "tree": "87764fc8618b73e6e0a2c5e537f9349788104a62", "parents": [ "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a", "a8ba129af46856112981c124850ec6a85a1c1ab6" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 12:07:08 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 12:07:09 2026 +0100" }, "message": "Merge branch \u0027amd-xgbe-rx-adaptation-and-phy-handling-fixes\u0027\n\nRaju Rangoju says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\namd-xgbe: RX adaptation and PHY handling fixes\n\nThis series fixes several issues in the amd-xgbe driver related to RX\nadaptation and PHY handling in 10GBASE-KR mode, particularly when\nauto-negotiation is disabled.\n\nPatch 1 fixes link status handling during RX adaptation by correctly\nreading the latched link status bit so transient link drops are\ndetected without losing the current state.\n\nPatch 2 prevents CRC errors that can occur when performing RX\nadaptation with auto-negotiation turned off. The driver now stops\nTX/RX before re-triggering RX adaptation and only re-enables traffic\nonce adaptation completes and the link is confirmed up, ensuring\npackets are not corrupted during the adaptation window.\n\nPatch 3 restores the intended ordering of PHY reset relative to\nphy_start(), making sure PHY settings are reset before the PHY is\nstarted instead of afterwards.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260306111629.1515676-1-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a8ba129af46856112981c124850ec6a85a1c1ab6", "tree": "87764fc8618b73e6e0a2c5e537f9349788104a62", "parents": [ "27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Fri Mar 06 16:46:29 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 12:07:07 2026 +0100" }, "message": "amd-xgbe: reset PHY settings before starting PHY\n\ncommit f93505f35745 (\"amd-xgbe: let the MAC manage PHY PM\") moved\nxgbe_phy_reset() from xgbe_open() to xgbe_start(), placing it after\nphy_start(). As a result, the PHY settings were being reset after the\nPHY had already started.\n\nReorder the calls so that the PHY settings are reset before\nphy_start() is invoked.\n\nFixes: f93505f35745 (\"amd-xgbe: let the MAC manage PHY PM\")\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-4-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "27a4dd0c702b3b2b9cf2c045d100cc2fe8720b81", "tree": "05afcff144a9384d724c570ca37456c2069f006b", "parents": [ "6485cb96be5cd0f4bf39554737ba11322cc9b053" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Fri Mar 06 16:46:28 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 12:07:07 2026 +0100" }, "message": "amd-xgbe: prevent CRC errors during RX adaptation with AN disabled\n\nWhen operating in 10GBASE-KR mode with auto-negotiation disabled and RX\nadaptation enabled, CRC errors can occur during the RX adaptation\nprocess. This happens because the driver continues transmitting and\nreceiving packets while adaptation is in progress.\n\nFix this by stopping TX/RX immediately when the link goes down and RX\nadaptation needs to be re-triggered, and only re-enabling TX/RX after\nadaptation completes and the link is confirmed up. Introduce a flag to\ntrack whether TX/RX was disabled for adaptation so it can be restored\ncorrectly.\n\nThis prevents packets from being transmitted or received during the RX\nadaptation window and avoids CRC errors from corrupted frames.\n\nThe flag tracking the data path state is synchronized with hardware\nstate in xgbe_start() to prevent stale state after device restarts.\nThis ensures that after a restart cycle (where xgbe_stop disables\nTX/RX and xgbe_start re-enables them), the flag correctly reflects\nthat the data path is active.\n\nFixes: 4f3b20bfbb75 (\"amd-xgbe: add support for rx-adaptation\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-3-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6485cb96be5cd0f4bf39554737ba11322cc9b053", "tree": "be0bfca63ffe637b219c6ab2dba6c80f1d6edf03", "parents": [ "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a" ], "author": { "name": "Raju Rangoju", "email": "Raju.Rangoju@amd.com", "time": "Fri Mar 06 16:46:27 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 12:07:06 2026 +0100" }, "message": "amd-xgbe: fix link status handling in xgbe_rx_adaptation\n\nThe link status bit is latched low to allow detection of momentary\nlink drops. If the status indicates that the link is already down,\nread it again to obtain the current state.\n\nFixes: 4f3b20bfbb75 (\"amd-xgbe: add support for rx-adaptation\")\nSigned-off-by: Raju Rangoju \u003cRaju.Rangoju@amd.com\u003e\nLink: https://patch.msgid.link/20260306111629.1515676-2-Raju.Rangoju@amd.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7d86aa41c073c4e7eb75fd2e674f1fd8f289728a", "tree": "3983bc92cfa7decc6cae1414d2c00d62f56e632a", "parents": [ "950803f7254721c1c15858fbbfae3deaaeeecb11" ], "author": { "name": "Chengfeng Ye", "email": "dg573847474@gmail.com", "time": "Fri Mar 06 03:14:02 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 11:38:36 2026 +0100" }, "message": "mctp: route: hold key-\u003elock in mctp_flow_prepare_output()\n\nmctp_flow_prepare_output() checks key-\u003edev and may call\nmctp_dev_set_key(), but it does not hold key-\u003elock while doing so.\n\nmctp_dev_set_key() and mctp_dev_release_key() are annotated with\n__must_hold(\u0026key-\u003elock), so key-\u003edev access is intended to be\nserialized by key-\u003elock. The mctp_sendmsg() transmit path reaches\nmctp_flow_prepare_output() via mctp_local_output() -\u003e mctp_dst_output()\nwithout holding key-\u003elock, so the check-and-set sequence is racy.\n\nExample interleaving:\n\n CPU0 CPU1\n ---- ----\n mctp_flow_prepare_output(key, devA)\n if (!key-\u003edev) // sees NULL\n mctp_flow_prepare_output(\n key, devB)\n if (!key-\u003edev) // still NULL\n mctp_dev_set_key(devB, key)\n mctp_dev_hold(devB)\n key-\u003edev \u003d devB\n mctp_dev_set_key(devA, key)\n mctp_dev_hold(devA)\n key-\u003edev \u003d devA // overwrites devB\n\nNow both devA and devB references were acquired, but only the final\nkey-\u003edev value is tracked for release. One reference can be lost,\ncausing a resource leak as mctp_dev_release_key() would only decrease\nthe reference on one dev.\n\nFix by taking key-\u003elock around the key-\u003edev check and\nmctp_dev_set_key() call.\n\nFixes: 67737c457281 (\"mctp: Pass flow data \u0026 flow release events to drivers\")\nSigned-off-by: Chengfeng Ye \u003cdg573847474@gmail.com\u003e\nLink: https://patch.msgid.link/20260306031402.857224-1-dg573847474@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "950803f7254721c1c15858fbbfae3deaaeeecb11", "tree": "00456bfff5a0c11d0b44876eb3ee5aaa937f3cf9", "parents": [ "e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@shopee.com", "time": "Fri Mar 06 10:15:07 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 11:33:58 2026 +0100" }, "message": "bonding: fix type confusion in bond_setup_by_slave()\n\nkernel BUG at net/core/skbuff.c:2306!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306\nRSP: 0018:ffffc90004aff760 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e\nRDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900\nRBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000\nR10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780\nR13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900\n dev_hard_header include/linux/netdevice.h:3439 [inline]\n packet_snd net/packet/af_packet.c:3028 [inline]\n packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646\n __sys_sendmsg+0x170/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe1a0e6c1a9\n\nWhen a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,\nbond_setup_by_slave() directly copies the slave\u0027s header_ops to the\nbond device:\n\n bond_dev-\u003eheader_ops \u003d slave_dev-\u003eheader_ops;\n\nThis causes a type confusion when dev_hard_header() is later called\non the bond device. Functions like ipgre_header(), ip6gre_header(),all use\nnetdev_priv(dev) to access their device-specific private data. When\ncalled with the bond device, netdev_priv() returns the bond\u0027s private\ndata (struct bonding) instead of the expected type (e.g. struct\nip_tunnel), leading to garbage values being read and kernel crashes.\n\nFix this by introducing bond_header_ops with wrapper functions that\ndelegate to the active slave\u0027s header_ops using the slave\u0027s own\ndevice. This ensures netdev_priv() in the slave\u0027s header functions\nalways receives the correct device.\n\nThe fix is placed in the bonding driver rather than individual device\ndrivers, as the root cause is bond blindly inheriting header_ops from\nthe slave without considering that these callbacks expect a specific\nnetdev_priv() layout.\n\nThe type confusion can be observed by adding a printk in\nipgre_header() and running the following commands:\n\n ip link add dummy0 type dummy\n ip addr add 10.0.0.1/24 dev dummy0\n ip link set dummy0 up\n ip link add gre1 type gre local 10.0.0.1\n ip link add bond1 type bond mode active-backup\n ip link set gre1 master bond1\n ip link set gre1 up\n ip link set bond1 up\n ip addr add fe80::1/64 dev bond1\n\nFixes: 1284cd3a2b74 (\"bonding: two small fixes for IPoIB support\")\nSuggested-by: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@shopee.com\u003e\nLink: https://patch.msgid.link/20260306021508.222062-1-jiayuan.chen@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47bba09b14fa21712398febf36cb14fd4fc3bded", "tree": "5635a9fba66dc7cba582fc81e65cc454cd00da70", "parents": [ "1eea46908c57abb7109b1fce024f366ae6c69c4f" ], "author": { "name": "Wenyuan Li", "email": "2063309626@qq.com", "time": "Tue Mar 10 13:08:44 2026 +0800" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Tue Mar 10 11:12:52 2026 +0100" }, "message": "can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value\n\nIn hi3110_open(), the return value of hi3110_power_enable() is not checked.\nIf power enable fails, the device may not function correctly, while the\ndriver still returns success.\n\nAdd a check for the return value and propagate the error accordingly.\n\nSigned-off-by: Wenyuan Li \u003c2063309626@qq.com\u003e\nLink: https://patch.msgid.link/tencent_B5E2E7528BB28AA8A2A56E16C49BD58B8B07@qq.com\nFixes: 57e83fb9b746 (\"can: hi311x: Add Holt HI-311x CAN driver\")\n[mkl: adjust subject, commit message and jump label]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "1eea46908c57abb7109b1fce024f366ae6c69c4f", "tree": "9e60d568130cd53c23b05cfb10fb465a04fca3a1", "parents": [ "e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69" ], "author": { "name": "Haibo Chen", "email": "haibo.chen@nxp.com", "time": "Fri Mar 06 17:04:48 2026 +0800" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Tue Mar 10 11:12:52 2026 +0100" }, "message": "can: dev: keep the max bitrate error at 5%\n\nCommit b360a13d44db (\"can: dev: print bitrate error with two decimal\ndigits\") changed calculation of the bit rate error from on-tenth of a\npercent to on-hundredth of a percent, but forgot to adjust the scale of the\nCAN_CALC_MAX_ERROR constant.\n\nKeeping the existing logic unchanged: Only when the bitrate error exceeds\n5% should an error be returned. Otherwise, simply output a warning log.\n\nFixes: b360a13d44db (\"can: dev: print bitrate error with two decimal digits\")\nSigned-off-by: Haibo Chen \u003chaibo.chen@nxp.com\u003e\nLink: https://patch.msgid.link/20260306-can-fix-v1-1-ac526cec6777@nxp.com\nCc: stable@kernel.org\n[mkl: improve commit message]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69", "tree": "f9ebde0936b351445252d5ce2f3204892a1f5ff5", "parents": [ "fdfd103aec837fc318fbd381cc65990ad7b62e5b" ], "author": { "name": "Haiyue Wang", "email": "haiyuewa@163.com", "time": "Thu Mar 05 22:32:34 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 11:10:55 2026 +0100" }, "message": "mctp: i2c: fix skb memory leak in receive path\n\nWhen \u0027midev-\u003eallow_rx\u0027 is false, the newly allocated skb isn\u0027t consumed\nby netif_rx(), it needs to free the skb directly.\n\nFixes: f5b8abf9fc3d (\"mctp i2c: MCTP I2C binding driver\")\nSigned-off-by: Haiyue Wang \u003chaiyuewa@163.com\u003e\nLink: https://patch.msgid.link/20260305143240.97592-1-haiyuewa@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fdfd103aec837fc318fbd381cc65990ad7b62e5b", "tree": "065183af13ee08ca2b156b41f0b44a8a85dca0c7", "parents": [ "0d9a60a0618d255530ca56072c5f39eb58e1ed4a", "dbe17e7783cb5d6451ff1217d0464865857e97e1" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 10:36:48 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 10:36:48 2026 +0100" }, "message": "Merge branch \u0027net-enetc-fix-fallback-phy-address-handling-and-do-not-skip-setting-for-addr-0\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: fix fallback PHY address handling and do not skip setting for addr 0\n\nThere are two potential issues when PHY address 0 is used on the board,\nsee the commit messages of the patches for more details.\n\nv1: https://lore.kernel.org/imx/20260303103047.228005-1-wei.fang@nxp.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260305031211.904812-1-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "dbe17e7783cb5d6451ff1217d0464865857e97e1", "tree": "065183af13ee08ca2b156b41f0b44a8a85dca0c7", "parents": [ "246953f33e8cf95621d6c00332e2780ce1594082" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Thu Mar 05 11:12:11 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 10:36:46 2026 +0100" }, "message": "net: enetc: do not skip setting LaBCR[MDIO_PHYAD_PRTAD] for addr 0\n\nGiven that some platforms may use PHY address 0 (I suppose the PHY may\nnot treat address 0 as a broadcast address or default response address).\nIt is possible for some boards to connect multiple PHYs to the same\nENETC MAC, for example:\n\n - a PHY with a non-zero address connects to ENETC MAC through SGMII\n interface (selected via DTS_A)\n - a PHY with address 0 connects to ENETC MAC through RGMII interface\n (selected via DTS_B)\n\nFor the case where the ENETC port MDIO is used to manage the PHY, when\nswitching from DTS_A to DTS_B via soft reboot, LaBCR[MDIO_PHYAD_PRTAD]\nmust be updated to 0 because the NETCMIX block is not reset during soft\nreboot. However, the current driver explicitly skips configuring address\n0, causing LaBCR[MDIO_PHYAD_PRTAD] to retain its old value.\n\nTherefore, remove the special-case skip of PHY address 0 so that valid\nconfigurations using address 0 are properly supported.\n\nFixes: 6633df05f3ad (\"net: enetc: set the external PHY address in IERB for port MDIO usage\")\nFixes: 50bfd9c06f0f (\"net: enetc: set external PHY address in IERB for i.MX94 ENETC\")\nReviewed-by: Clark Wang \u003cxiaoning.wang@nxp.com\u003e\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260305031211.904812-3-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "246953f33e8cf95621d6c00332e2780ce1594082", "tree": "690bd04893cc5509ee0820c4fcb157931b1998b7", "parents": [ "0d9a60a0618d255530ca56072c5f39eb58e1ed4a" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Thu Mar 05 11:12:10 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Mar 10 10:36:46 2026 +0100" }, "message": "net: enetc: fix incorrect fallback PHY address handling\n\nThe current netc_get_phy_addr() implementation falls back to PHY address\n0 when the \"mdio\" node or the PHY child node is missing. On i.MX95, this\ncauses failures when a real PHY is actually assigned address 0 and is\nmanaged through the EMDIO interface. Because the bit 0 of phy_mask will\nbe set, leading imx95_enetc_mdio_phyaddr_config() to return an error, and\nthe netc_blk_ctrl driver probe subsequently fails. Fix this by returning\n-ENODEV when neither an \"mdio\" node nor any PHY node is present, it means\nthat ENETC port MDIO is not used to manage the PHY, so there is no need\nto configure LaBCR[MDIO_PHYAD_PRTAD].\n\nReported-by: Alexander Stein \u003calexander.stein@ew.tq-group.com\u003e\nCloses: https://lore.kernel.org/all/7825188.GXAFRqVoOG@steina-w\nFixes: 6633df05f3ad (\"net: enetc: set the external PHY address in IERB for port MDIO usage\")\nReviewed-by: Clark Wang \u003cxiaoning.wang@nxp.com\u003e\nTested-by: Alexander Stein \u003calexander.stein@ew.tq-group.com\u003e\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260305031211.904812-2-wei.fang@nxp.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0d9a60a0618d255530ca56072c5f39eb58e1ed4a", "tree": "d3615821c97ceeeba12099c9b9610a2bc0ef8aa8", "parents": [ "183f682591a932cf80a85bfc7ad748f5d90c2de7" ], "author": { "name": "Pavan Chebbi", "email": "pavan.chebbi@broadcom.com", "time": "Fri Mar 06 14:58:54 2026 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:49:47 2026 -0700" }, "message": "bnxt_en: Fix RSS table size check when changing ethtool channels\n\nWhen changing channels, the current check in bnxt_set_channels()\nis not checking for non-default RSS contexts when the RSS table size\nchanges. The current check for IFF_RXFH_CONFIGURED is only sufficient\nfor the default RSS context. Expand the check to include the presence\nof any non-default RSS contexts.\n\nAllowing such change will result in incorrect configuration of the\ncontext\u0027s RSS table when the table size changes.\n\nFixes: b3d0083caf9a (\"bnxt_en: Support RSS contexts in ethtool .{get|set}_rxfh()\")\nReported-by: Björn Töpel \u003cbjorn@kernel.org\u003e\nLink: https://lore.kernel.org/netdev/20260303181535.2671734-1-bjorn@kernel.org/\nReviewed-by: Andy Gospodarek \u003candrew.gospodarek@broadcom.com\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20260306225854.3575672-1-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "183f682591a932cf80a85bfc7ad748f5d90c2de7", "tree": "e9d093dbd793348cb68b2429e8aadd57099a7266", "parents": [ "7a85d370bbd0d55791ec57ea8ba13032410e8b9d", "312c816c6bc30342bc30dca0d6db617ab4d3ae4e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:39 2026 -0700" }, "message": "Merge branch \u0027net-usb-lan78xx-accumulated-bug-fixes\u0027\n\nOleksij Rempel says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: usb: lan78xx: accumulated bug fixes\n\nThis series contains a collection of standalone bug fixes for the\nMicrochip LAN78xx driver, addressing packet handling, TX statistics,\ninvalid register accesses, and a kernel warning during disconnect.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260305143429.530909-1-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "312c816c6bc30342bc30dca0d6db617ab4d3ae4e", "tree": "e9d093dbd793348cb68b2429e8aadd57099a7266", "parents": [ "d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Thu Mar 05 15:34:29 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:33 2026 -0700" }, "message": "net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect\n\nRemove redundant netif_napi_del() call from disconnect path.\n\nA WARN may be triggered in __netif_napi_del_locked() during USB device\ndisconnect:\n\n WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350\n\nThis happens because netif_napi_del() is called in the disconnect path while\nNAPI is still enabled. However, it is not necessary to call netif_napi_del()\nexplicitly, since unregister_netdev() will handle NAPI teardown automatically\nand safely. Removing the redundant call avoids triggering the warning.\n\nFull trace:\n lan78xx 1-1:1.0 enu1: Failed to read register index 0x000000c4. ret \u003d -ENODEV\n lan78xx 1-1:1.0 enu1: Failed to set MAC down with error -ENODEV\n lan78xx 1-1:1.0 enu1: Link is Down\n lan78xx 1-1:1.0 enu1: Failed to read register index 0x00000120. ret \u003d -ENODEV\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350\n Modules linked in: flexcan can_dev fuse\n CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.0-rc2-00624-ge926949dab03 #9 PREEMPT\n Hardware name: SKOV IMX8MP CPU revC - bd500 (DT)\n Workqueue: usb_hub_wq hub_event\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n pc : __netif_napi_del_locked+0x2b4/0x350\n lr : __netif_napi_del_locked+0x7c/0x350\n sp : ffffffc085b673c0\n x29: ffffffc085b673c0 x28: ffffff800b7f2000 x27: ffffff800b7f20d8\n x26: ffffff80110bcf58 x25: ffffff80110bd978 x24: 1ffffff0022179eb\n x23: ffffff80110bc000 x22: ffffff800b7f5000 x21: ffffff80110bc000\n x20: ffffff80110bcf38 x19: ffffff80110bcf28 x18: dfffffc000000000\n x17: ffffffc081578940 x16: ffffffc08284cee0 x15: 0000000000000028\n x14: 0000000000000006 x13: 0000000000040000 x12: ffffffb0022179e8\n x11: 1ffffff0022179e7 x10: ffffffb0022179e7 x9 : dfffffc000000000\n x8 : 0000004ffdde8619 x7 : ffffff80110bcf3f x6 : 0000000000000001\n x5 : ffffff80110bcf38 x4 : ffffff80110bcf38 x3 : 0000000000000000\n x2 : 0000000000000000 x1 : 1ffffff0022179e7 x0 : 0000000000000000\n Call trace:\n __netif_napi_del_locked+0x2b4/0x350 (P)\n lan78xx_disconnect+0xf4/0x360\n usb_unbind_interface+0x158/0x718\n device_remove+0x100/0x150\n device_release_driver_internal+0x308/0x478\n device_release_driver+0x1c/0x30\n bus_remove_device+0x1a8/0x368\n device_del+0x2e0/0x7b0\n usb_disable_device+0x244/0x540\n usb_disconnect+0x220/0x758\n hub_event+0x105c/0x35e0\n process_one_work+0x760/0x17b0\n worker_thread+0x768/0xce8\n kthread+0x3bc/0x690\n ret_from_fork+0x10/0x20\n irq event stamp: 211604\n hardirqs last enabled at (211603): [\u003cffffffc0828cc9ec\u003e] _raw_spin_unlock_irqrestore+0x84/0x98\n hardirqs last disabled at (211604): [\u003cffffffc0828a9a84\u003e] el1_dbg+0x24/0x80\n softirqs last enabled at (211296): [\u003cffffffc080095f10\u003e] handle_softirqs+0x820/0xbc8\n softirqs last disabled at (210993): [\u003cffffffc080010288\u003e] __do_softirq+0x18/0x20\n ---[ end trace 0000000000000000 ]---\n lan78xx 1-1:1.0 enu1: failed to kill vid 0081/0\n\nFixes: e110bc825897 (\"net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management\")\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/20260305143429.530909-5-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d9cc0e440f0664f6f3e2c26e39ab9dd5f3badba7", "tree": "6e0d972a143e7437300a5a07b4368f2298ab91e7", "parents": [ "50988747c30df47b73b787f234f746027cb7ec6c" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Thu Mar 05 15:34:28 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:33 2026 -0700" }, "message": "net: usb: lan78xx: skip LTM configuration for LAN7850\n\nDo not configure Latency Tolerance Messaging (LTM) on USB 2.0 hardware.\n\nThe LAN7850 is a High-Speed (USB 2.0) only device and does not support\nSuperSpeed features like LTM. Currently, the driver unconditionally\nattempts to configure LTM registers during initialization. On the\nLAN7850, these registers do not exist, resulting in writes to invalid\nor undocumented memory space.\n\nThis issue was identified during a port to the regmap API with strict\nregister validation enabled. While no functional issues or crashes have\nbeen observed from these invalid writes, bypassing LTM initialization\non the LAN7850 ensures the driver strictly adheres to the hardware\u0027s\nvalid register map.\n\nFixes: 55d7de9de6c3 (\"Microchip\u0027s LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/20260305143429.530909-4-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "50988747c30df47b73b787f234f746027cb7ec6c", "tree": "4293eea39f0f54da9deb9d23396cd7444731c818", "parents": [ "e4f774a0cc955ce762aec91c66915a6e15087ab7" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Thu Mar 05 15:34:27 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:33 2026 -0700" }, "message": "net: usb: lan78xx: fix TX byte statistics for small packets\n\nAccount for hardware auto-padding in TX byte counters to reflect actual\nwire traffic.\n\nThe LAN7850 hardware automatically pads undersized frames to the minimum\nEthernet frame length (ETH_ZLEN, 60 bytes). However, the driver tracks\nthe network statistics based on the unpadded socket buffer length. This\nresults in the tx_bytes counter under-reporting the actual physical\nbytes placed on the Ethernet wire for small packets (like short ARP or\nICMP requests).\n\nUse max_t() to ensure the transmission statistics accurately account for\nthe hardware-generated padding.\n\nFixes: d383216a7efe (\"lan78xx: Introduce Tx URB processing improvements\")\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/20260305143429.530909-3-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e4f774a0cc955ce762aec91c66915a6e15087ab7", "tree": "e56c3b1243f6914a32027661302a57719b55dfcd", "parents": [ "7a85d370bbd0d55791ec57ea8ba13032410e8b9d" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Thu Mar 05 15:34:26 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 19:48:33 2026 -0700" }, "message": "net: usb: lan78xx: fix silent drop of packets with checksum errors\n\nDo not drop packets with checksum errors at the USB driver level;\npass them to the network stack.\n\nPreviously, the driver dropped all packets where the \u0027Receive Error\nDetected\u0027 (RED) bit was set, regardless of the specific error type. This\ncaused packets with only IP or TCP/UDP checksum errors to be dropped\nbefore reaching the kernel, preventing the network stack from accounting\nfor them or performing software fallback.\n\nAdd a mask for hard hardware errors to safely drop genuinely corrupt\nframes, while allowing checksum-errored frames to pass with their\nip_summed field explicitly set to CHECKSUM_NONE.\n\nFixes: 55d7de9de6c3 (\"Microchip\u0027s LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/20260305143429.530909-2-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7a85d370bbd0d55791ec57ea8ba13032410e8b9d", "tree": "d9846b50b03ee1c2257c2edcb9f972caa393c16f", "parents": [ "b2662e7593e94ae09b1cf7ee5f09160a3612bcb2" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Mar 07 12:06:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 18:59:28 2026 -0700" }, "message": "MAINTAINERS: include/net/tc_wrapper.h belongs to TC subsystem\n\ninclude/net/tc_wrapper.h changes should be reviewed by TC maintainers.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260307120607.3504191-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b2662e7593e94ae09b1cf7ee5f09160a3612bcb2", "tree": "a4c619feec1b30171d952e467ef3183e6cec09ab", "parents": [ "288598d80a068a0e9281de35bcb4ce495f189e2a" ], "author": { "name": "Mehul Rao", "email": "mehulrao@gmail.com", "time": "Fri Mar 06 18:38:20 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 18:48:26 2026 -0700" }, "message": "net: nexthop: fix percpu use-after-free in remove_nh_grp_entry\n\nWhen removing a nexthop from a group, remove_nh_grp_entry() publishes\nthe new group via rcu_assign_pointer() then immediately frees the\nremoved entry\u0027s percpu stats with free_percpu(). However, the\nsynchronize_net() grace period in the caller remove_nexthop_from_groups()\nruns after the free. RCU readers that entered before the publish still\nsee the old group and can dereference the freed stats via\nnh_grp_entry_stats_inc() -\u003e get_cpu_ptr(nhge-\u003estats), causing a\nuse-after-free on percpu memory.\n\nFix by deferring the free_percpu() until after synchronize_net() in the\ncaller. Removed entries are chained via nh_list onto a local deferred\nfree list. After the grace period completes and all RCU readers have\nfinished, the percpu stats are safely freed.\n\nFixes: f4676ea74b85 (\"net: nexthop: Add nexthop group entry stats\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mehul Rao \u003cmehulrao@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260306233821.196789-1-mehulrao@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "288598d80a068a0e9281de35bcb4ce495f189e2a", "tree": "352d14c91fa6a3b19c125390932af6cbb20469a0", "parents": [ "87d126852158467ab87d5cbc36ccfd3f15464a6c" ], "author": { "name": "Shuangpeng Bai", "email": "shuangpeng.kernel@gmail.com", "time": "Thu Mar 05 22:40:06 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 18:47:55 2026 -0700" }, "message": "serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release\n\nA reproducer triggers a KASAN slab-use-after-free in pty_write_room()\nwhen caif_serial\u0027s TX path calls tty_write_room(). The faulting access\nis on tty-\u003elink-\u003eport.\n\nHold an extra kref on tty-\u003elink for the lifetime of the caif_serial line\ndiscipline: get it in ldisc_open() and drop it in ser_release(), and\nalso drop it on the ldisc_open() error path.\n\nWith this change applied, the reproducer no longer triggers the UAF in\nmy testing.\n\nLink: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f\nLink: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com\nFixes: e31d5a05948e (\"caif: tty\u0027s are kref objects so take a reference\")\nSigned-off-by: Shuangpeng Bai \u003cshuangpeng.kernel@gmail.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "87d126852158467ab87d5cbc36ccfd3f15464a6c", "tree": "300f55f623e903e529bb6c6e6d96384ea104f653", "parents": [ "c113d5e32678c8de40694b738000a4a2143e2f81" ], "author": { "name": "Álvaro Fernández Rojas", "email": "noltari@gmail.com", "time": "Fri Mar 06 13:29:55 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Mar 09 18:46:46 2026 -0700" }, "message": "net: sfp: improve Huawei MA5671a fixup\n\nWith the current sfp_fixup_ignore_tx_fault() fixup we ignore the TX_FAULT\nsignal, but we also need to apply sfp_fixup_ignore_los() in order to be\nable to communicate with the module even if the fiber isn\u0027t connected for\nconfiguration purposes.\nThis is needed for all the MA5671a firmwares, excluding the FS modded\nfirmware.\n\nFixes: 2069624dac19 (\"net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT\")\nSigned-off-by: Álvaro Fernández Rojas \u003cnoltari@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260306125139.213637-1-noltari@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e135b8aee5a06c52a4347a5a6d51223c6f36ba3", "tree": "71fd2c351918593fe20e7bc5e9739d475ac27488", "parents": [ "a0b7091c4de45a7325c8780e6934a894f92ac86b" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Sun Mar 01 16:10:51 2026 -0800" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:44 2026 -0700" }, "message": "apparmor: fix race between freeing data and fs accessing it\n\nAppArmor was putting the reference to i_private data on its end after\nremoving the original entry from the file system. However the inode\ncan aand does live beyond that point and it is possible that some of\nthe fs call back functions will be invoked after the reference has\nbeen put, which results in a race between freeing the data and\naccessing it through the fs.\n\nWhile the rawdata/loaddata is the most likely candidate to fail the\nrace, as it has the fewest references. If properly crafted it might be\npossible to trigger a race for the other types stored in i_private.\n\nFix this by moving the put of i_private referenced data to the correct\nplace which is during inode eviction.\n\nFixes: c961ee5f21b20 (\"apparmor: convert from securityfs to apparmorfs for policy ns files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "a0b7091c4de45a7325c8780e6934a894f92ac86b", "tree": "ca6aeb988d078924c277f8def6cf2a695c74211a", "parents": [ "39440b137546a3aa383cfdabc605fb73811b6093" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Feb 24 10:20:02 2026 -0800" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:44 2026 -0700" }, "message": "apparmor: fix race on rawdata dereference\n\nThere is a race condition that leads to a use-after-free situation:\nbecause the rawdata inodes are not refcounted, an attacker can start\nopen()ing one of the rawdata files, and at the same time remove the\nlast reference to this rawdata (by removing the corresponding profile,\nfor example), which frees its struct aa_loaddata; as a result, when\nseq_rawdata_open() is reached, i_private is a dangling pointer and\nfreed memory is accessed.\n\nThe rawdata inodes weren\u0027t refcounted to avoid a circular refcount and\nwere supposed to be held by the profile rawdata reference. However\nduring profile removal there is a window where the vfs and profile\ndestruction race, resulting in the use after free.\n\nFix this by moving to a double refcount scheme. Where the profile\nrefcount on rawdata is used to break the circular dependency. Allowing\nfor freeing of the rawdata once all inode references to the rawdata\nare put.\n\nFixes: 5d5182cae401 (\"apparmor: move to per loaddata files, instead of replicating in profiles\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Maxime Bélair \u003cmaxime.belair@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "39440b137546a3aa383cfdabc605fb73811b6093", "tree": "e07d8abd4f5683c116d9157c6d5f90eff9f6dc44", "parents": [ "6601e13e82841879406bf9f369032656f441a425" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Oct 17 01:53:00 2025 -0700" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: fix differential encoding verification\n\nDifferential encoding allows loops to be created if it is abused. To\nprevent this the unpack should verify that a diff-encode chain\nterminates.\n\nUnfortunately the differential encode verification had two bugs.\n\n1. it conflated states that had gone through check and already been\n marked, with states that were currently being checked and marked.\n This means that loops in the current chain being verified are treated\n as a chain that has already been verified.\n\n2. the order bailout on already checked states compared current chain\n check iterators j,k instead of using the outer loop iterator i.\n Meaning a step backwards in states in the current chain verification\n was being mistaken for moving to an already verified state.\n\nMove to a double mark scheme where already verified states get a\ndifferent mark, than the current chain being kept. This enables us\nto also drop the backwards verification check that was the cause of\nthe second error as any already verified state is already marked.\n\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "6601e13e82841879406bf9f369032656f441a425", "tree": "94d7083c7b7e5529326abd70b2826985f975edd7", "parents": [ "5df0c44e8f5f619d3beb871207aded7c78414502" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Fri Nov 07 08:36:04 2025 -0800" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.\n\nFixes: b7fd2c0340eac (\"apparmor: add per policy ns .load, .replace, .remove interface files\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "5df0c44e8f5f619d3beb871207aded7c78414502", "tree": "3429fca709f26abac48e5b96966563de222acc0f", "parents": [ "d352873bbefa7eb39995239d0b44ccdf8aaa79a4" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Wed Sep 10 06:22:17 2025 -0700" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: Fix double free of ns_name in aa_replace_profiles()\n\nif ns_name is NULL after\n1071 error \u003d aa_unpack(udata, \u0026lh, \u0026ns_name);\n\nand if ent-\u003ens_name contains an ns_name in\n1089 } else if (ent-\u003ens_name) {\n\nthen ns_name is assigned the ent-\u003ens_name\n1095 ns_name \u003d ent-\u003ens_name;\n\nhowever ent-\u003ens_name is freed at\n1262 aa_load_ent_free(ent);\n\nand then again when freeing ns_name at\n1270 kfree(ns_name);\n\nFix this by NULLing out ent-\u003ens_name after it is transferred to ns_name\n\nFixes: 145a0ef21c8e9 (\"apparmor: fix blob compression when ns is forced on a policy load\n\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "d352873bbefa7eb39995239d0b44ccdf8aaa79a4", "tree": "f9358705b2fc666ab8f9d6eb75facdb681679df4", "parents": [ "8756b68edae37ff546c02091989a4ceab3f20abd" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 16:51:11 2026 +0100" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k \u003d DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u003e\u003d state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[ 57.179855] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 57.181563] Call Trace:\n[ 57.181572] \u003cTASK\u003e\n[ 57.181577] dump_stack_lvl+0x5e/0x80\n[ 57.181596] print_report+0xc8/0x270\n[ 57.181605] ? verify_dfa+0x59a/0x660\n[ 57.181608] kasan_report+0x118/0x150\n[ 57.181620] ? verify_dfa+0x59a/0x660\n[ 57.181623] verify_dfa+0x59a/0x660\n[ 57.181627] aa_dfa_unpack+0x1610/0x1740\n[ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470\n[ 57.181640] unpack_pdb+0x86d/0x46b0\n[ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181656] ? aa_unpack_nameX+0x1a8/0x300\n[ 57.181659] aa_unpack+0x20b0/0x4c30\n[ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181664] ? stack_depot_save_flags+0x33/0x700\n[ 57.181681] ? kasan_save_track+0x4f/0x80\n[ 57.181683] ? kasan_save_track+0x3e/0x80\n[ 57.181686] ? __kasan_kmalloc+0x93/0xb0\n[ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130\n[ 57.181697] ? policy_update+0x154/0x330\n[ 57.181704] aa_replace_profiles+0x15a/0x1dd0\n[ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780\n[ 57.181712] ? aa_loaddata_alloc+0x77/0x140\n[ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 57.181717] ? _copy_from_user+0x2a/0x70\n[ 57.181730] policy_update+0x17a/0x330\n[ 57.181733] profile_replace+0x153/0x1a0\n[ 57.181735] ? rw_verify_area+0x93/0x2d0\n[ 57.181740] vfs_write+0x235/0xab0\n[ 57.181745] ksys_write+0xb0/0x170\n[ 57.181748] do_syscall_64+0x8e/0x660\n[ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.\n\nFixes: 031dcc8f4e84 (\"apparmor: dfa add support for state differential encoding\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "8756b68edae37ff546c02091989a4ceab3f20abd", "tree": "f76e80d43854ce57adf76a9e373cb5a9d16bbccb", "parents": [ "306039414932c80f8420695a24d4fe10c84ccfb2" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 29 17:08:25 2026 +0100" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[ 94.984676] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[ 94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[ 94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[ 94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 94.986329] Call Trace:\n[ 94.986341] \u003cTASK\u003e\n[ 94.986347] dump_stack_lvl+0x5e/0x80\n[ 94.986374] print_report+0xc8/0x270\n[ 94.986384] ? aa_dfa_match+0x5ae/0x760\n[ 94.986388] kasan_report+0x118/0x150\n[ 94.986401] ? aa_dfa_match+0x5ae/0x760\n[ 94.986405] aa_dfa_match+0x5ae/0x760\n[ 94.986408] __aa_path_perm+0x131/0x400\n[ 94.986418] aa_path_perm+0x219/0x2f0\n[ 94.986424] apparmor_file_open+0x345/0x570\n[ 94.986431] security_file_open+0x5c/0x140\n[ 94.986442] do_dentry_open+0x2f6/0x1120\n[ 94.986450] vfs_open+0x38/0x2b0\n[ 94.986453] ? may_open+0x1e2/0x2b0\n[ 94.986466] path_openat+0x231b/0x2b30\n[ 94.986469] ? __x64_sys_openat+0xf8/0x130\n[ 94.986477] do_file_open+0x19d/0x360\n[ 94.986487] do_sys_openat2+0x98/0x100\n[ 94.986491] __x64_sys_openat+0xf8/0x130\n[ 94.986499] do_syscall_64+0x8e/0x660\n[ 94.986515] ? count_memcg_events+0x15f/0x3c0\n[ 94.986526] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986540] ? handle_mm_fault+0x1639/0x1ef0\n[ 94.986551] ? vma_start_read+0xf0/0x320\n[ 94.986558] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986561] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986563] ? fpregs_assert_state_consistent+0x50/0xe0\n[ 94.986572] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986574] ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[ 94.986587] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 94.986588] ? irqentry_exit+0x3c/0x590\n[ 94.986595] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.\n\nFixes: 074c1cd798cb (\"apparmor: dfa move character match into a macro\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "306039414932c80f8420695a24d4fe10c84ccfb2", "tree": "d2fedc885647c60d67b62a7d66a8cf437bae9657", "parents": [ "ab09264660f9de5d05d1ef4e225aa447c63a8747" ], "author": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Tue Mar 03 11:08:02 2026 -0800" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:43 2026 -0700" }, "message": "apparmor: fix: limit the number of levels of policy namespaces\n\nCurrently the number of policy namespaces is not bounded relying on\nthe user namespace limit. However policy namespaces aren\u0027t strictly\ntied to user namespaces and it is possible to create them and nest\nthem arbitrarily deep which can be used to exhaust system resource.\n\nHard cap policy namespaces to the same depth as user namespaces.\n\nFixes: c88d4c7b049e8 (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nReviewed-by: Ryan Lee \u003cryan.lee@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "ab09264660f9de5d05d1ef4e225aa447c63a8747", "tree": "ba08e540707d5d3fc5a437db8247ecfb357fc646", "parents": [ "e38c55d9f834e5b848bfed0f5c586aaf45acb825" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 13 09:09:43 2026 +0100" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:42 2026 -0700" }, "message": "apparmor: replace recursive profile removal with iterative approach\n\nThe profile removal code uses recursion when removing nested profiles,\nwhich can lead to kernel stack exhaustion and system crashes.\n\nReproducer:\n $ pf\u003d\u0027a\u0027; for ((i\u003d0; i\u003c1024; i++)); do\n echo -e \"profile $pf { \\n }\" | apparmor_parser -K -a;\n pf\u003d\"$pf//x\";\n done\n $ echo -n a \u003e /sys/kernel/security/apparmor/.remove\n\nReplace the recursive __aa_profile_list_release() approach with an\niterative approach in __remove_profile(). The function repeatedly\nfinds and removes leaf profiles until the entire subtree is removed,\nmaintaining the same removal semantic without recursion.\n\nFixes: c88d4c7b049e (\"AppArmor: core policy routines\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "e38c55d9f834e5b848bfed0f5c586aaf45acb825", "tree": "4f91b19ee60361eb7485a517091be0c316c64504", "parents": [ "9063d7e2615f4a7ab321de6b520e23d370e58816" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Tue Jan 20 15:24:04 2026 +0100" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:42 2026 -0700" }, "message": "apparmor: fix memory leak in verify_header\n\nThe function sets `*ns \u003d NULL` on every call, leaking the namespace\nstring allocated in previous iterations when multiple profiles are\nunpacked. This also breaks namespace consistency checking since *ns\nis always NULL when the comparison is made.\n\nRemove the incorrect assignment.\nThe caller (aa_unpack) initializes *ns to NULL once before the loop,\nwhich is sufficient.\n\nFixes: dd51c8485763 (\"apparmor: provide base for multiple profiles to be replaced at once\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "9063d7e2615f4a7ab321de6b520e23d370e58816", "tree": "7f864e220ad12b531ddce35c747a97c5739a2edc", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681" ], "author": { "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com", "time": "Thu Jan 15 15:30:50 2026 +0100" }, "committer": { "name": "John Johansen", "email": "john.johansen@canonical.com", "time": "Mon Mar 09 16:05:42 2026 -0700" }, "message": "apparmor: validate DFA start states are in bounds in unpack_pdb\n\nStart states are read from untrusted data and used as indexes into the\nDFA state tables. The aa_dfa_next() function call in unpack_pdb() will\naccess dfa-\u003etables[YYTD_ID_BASE][start], and if the start state exceeds\nthe number of states in the DFA, this results in an out-of-bound read.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360\n Read of size 4 at addr ffff88811956fb90 by task su/1097\n ...\n\nReject policies with out-of-bounds start states during unpacking\nto prevent the issue.\n\nFixes: ad5ff3db53c6 (\"AppArmor: Add ability to load extended policy\")\nReported-by: Qualys Security Advisory \u003cqsa@qualys.com\u003e\nTested-by: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nReviewed-by: Georgia Garcia \u003cgeorgia.garcia@canonical.com\u003e\nReviewed-by: Cengiz Can \u003ccengiz.can@canonical.com\u003e\nSigned-off-by: Massimiliano Pellizzer \u003cmassimiliano.pellizzer@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\n" }, { "commit": "06c2a67e90c1f04de10ac3091b97665beacb48ce", "tree": "9677d293cbae2a3f8776e9635e36794288ffe280", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681", "3817b1d34432d3d83a61576719570d04c341b7cd" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Mar 09 18:41:20 2026 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Mar 09 18:41:20 2026 +0100" }, "message": "Merge tag \u0027linux-cpupower-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux\n\nPull cpupower utility updates for 7.0-rc4 from Shuah Khan:\n\n\"linux-cpupower-7.0-rc4\n\n - Adds support for setting EPP via systemd service\n - Fixes swapped power/energy unit labels\n - Adds intel_pstate turbo boost support for Intel platforms\"\n\n* tag \u0027linux-cpupower-7.0-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux:\n cpupower: Add intel_pstate turbo boost support for Intel platforms\n cpupower: Add support for setting EPP via systemd service\n cpupower: fix swapped power/energy unit labels\n" }, { "commit": "441336115df26b966575de56daf7107ed474faed", "tree": "2410112532724f06ea395e237bdcfc9c5bd3c215", "parents": [ "1e689a56173827669a35da7cb2a3c78ed5c53680" ], "author": { "name": "Thorsten Blum", "email": "thorsten.blum@linux.dev", "time": "Tue Mar 03 14:25:53 2026 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:39 2026 -0500" }, "message": "ksmbd: Don\u0027t log keys in SMB3 signing and encryption key generation\n\nWhen KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and\ngenerate_smb3encryptionkey() log the session, signing, encryption, and\ndecryption key bytes. Remove the logs to avoid exposing credentials.\n\nFixes: e2f34481b24d (\"cifsd: add server-side procedures for SMB3\")\nCc: stable@vger.kernel.org\nSigned-off-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "1e689a56173827669a35da7cb2a3c78ed5c53680", "tree": "dcc3cd50eba72c0f2ea9ccca1101a49fc113cdb5", "parents": [ "eac3361e3d5dd8067b3258c69615888eb45e9f25" ], "author": { "name": "Marios Makassikis", "email": "mmakassikis@freebox.fr", "time": "Tue Mar 03 11:14:32 2026 +0100" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:39 2026 -0500" }, "message": "smb: server: fix use-after-free in smb2_open()\n\nThe opinfo pointer obtained via rcu_dereference(fp-\u003ef_opinfo) is\ndereferenced after rcu_read_unlock(), creating a use-after-free\nwindow.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Marios Makassikis \u003cmmakassikis@freebox.fr\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "eac3361e3d5dd8067b3258c69615888eb45e9f25", "tree": "6f7dd6cdc9767fe52894d1b53432969f90f8d24c", "parents": [ "1dfd062caa165ec9d7ee0823087930f3ab8a6294" ], "author": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Mon Mar 02 12:55:02 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:39 2026 -0500" }, "message": "ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()\n\nopinfo pointer obtained via rcu_dereference(fp-\u003ef_opinfo) is being\naccessed after rcu_read_unlock() has been called. This creates a\nrace condition where the memory could be freed by a concurrent\nwriter between the unlock and the subsequent pointer dereferences\n(opinfo-\u003eis_lease, etc.), leading to a use-after-free.\n\nFixes: 5fb282ba4fef (\"ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close\")\nCc: stable@vger.kernel.org\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "1dfd062caa165ec9d7ee0823087930f3ab8a6294", "tree": "f2aede1eaf756939273d2245c7397b2df476bc7a", "parents": [ "40955015fae4908157ac6c959ea696d05e6e9b31" ], "author": { "name": "Namjae Jeon", "email": "linkinjeon@kernel.org", "time": "Sat Mar 07 11:32:31 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:39 2026 -0500" }, "message": "ksmbd: fix use-after-free by using call_rcu() for oplock_info\n\nksmbd currently frees oplock_info immediately using kfree(), even\nthough it is accessed under RCU read-side critical sections in places\nlike opinfo_get() and proc_show_files().\n\nSince there is no RCU grace period delay between nullifying the pointer\nand freeing the memory, a reader can still access oplock_info\nstructure after it has been freed. This can leads to a use-after-free\nespecially in opinfo_get() where atomic_inc_not_zero() is called on\nalready freed memory.\n\nFix this by switching to deferred freeing using call_rcu().\n\nFixes: 18b4fac5ef17 (\"ksmbd: fix use-after-free in smb_break_all_levII_oplock()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "40955015fae4908157ac6c959ea696d05e6e9b31", "tree": "fb7cbad1d16f8a63a0d13946e47d1321c77fe7f2", "parents": [ "c15e7c62feb3751cbdd458555819df1d70374890" ], "author": { "name": "Ali Khaledi", "email": "ali.khaledi1989@gmail.com", "time": "Mon Mar 02 10:15:48 2026 +0900" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:39 2026 -0500" }, "message": "ksmbd: fix use-after-free in proc_show_files due to early rcu_read_unlock\n\nThe opinfo pointer obtained via rcu_dereference(fp-\u003ef_opinfo) is\ndereferenced after rcu_read_unlock(), creating a use-after-free\nwindow. A concurrent opinfo_put() can free the opinfo between the\nunlock and the subsequent access to opinfo-\u003eis_lease,\nopinfo-\u003eo_lease-\u003estate, and opinfo-\u003elevel.\n\nFix this by deferring rcu_read_unlock() until after all opinfo\nfield accesses are complete. The values needed (const_names, count,\nlevel) are copied into local variables under the RCU read lock,\nand the potentially-sleeping seq_printf calls happen after the\nlock is released.\n\nFound by AI-assisted code review (Claude Opus 4.6, Anthropic)\nin collaboration with Ali Khaledi.\n\nCc: stable@vger.kernel.org\nFixes: b38f99c1217a (\"ksmbd: add procfs interface for runtime monitoring and statistics\")\nSigned-off-by: Ali Khaledi \u003cali.khaledi1989@gmail.com\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "c15e7c62feb3751cbdd458555819df1d70374890", "tree": "f931a00ab1f7a47bd7b3c9d416d81b7e080a836d", "parents": [ "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681" ], "author": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Thu Feb 26 21:54:21 2026 -0800" }, "committer": { "name": "Steve French", "email": "stfrench@microsoft.com", "time": "Sun Mar 08 21:28:38 2026 -0500" }, "message": "smb/server: Fix another refcount leak in smb2_open()\n\nIf ksmbd_override_fsids() fails, we jump to err_out2. At that point, fp is\nNULL because it hasn\u0027t been assigned dh_info.fp yet, so ksmbd_fd_put(work,\nfp) will not be called. However, dh_info.fp was already inserted into the\nsession file table by ksmbd_reopen_durable_fd(), so it will leak in the\nsession file table until the session is closed.\n\nMove fp \u003d dh_info.fp; ahead of the ksmbd_override_fsids() check to fix the\nproblem.\n\nFound by an experimental AI code review agent at Google.\n\nFixes: c8efcc786146a (\"ksmbd: add support for durable handles v1/v2\")\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\nReviewed-by: ChenXiaoSong \u003cchenxiaosong@kylinos.cn\u003e\nAcked-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n" }, { "commit": "1f318b96cc84d7c2ab792fcc0bfd42a7ca890681", "tree": "0c35deacb844b5fa46909f759acefd30ca58d9da", "parents": [ "fc9f248d8c591454e257edd54ac4085d84f11e6a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 16:56:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 16:56:54 2026 -0700" }, "message": "Linux 7.0-rc3\n" }, { "commit": "fc9f248d8c591454e257edd54ac4085d84f11e6a", "tree": "47ee5797f2cdea3e1d4151a0b3d381aac34d10a0", "parents": [ "014441d1e4b2f5be728433b761df3377dee7a487", "a4b0bf6a40f3c107c67a24fbc614510ef5719980" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 12:13:09 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 12:13:09 2026 -0700" }, "message": "Merge tag \u0027efi-fixes-for-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi\n\nPull EFI fix from Ard Biesheuvel:\n \"Fix for the x86 EFI workaround keeping boot services code and data\n regions reserved until after SetVirtualAddressMap() completes:\n deferred struct page initialization may result in some of this memory\n being lost permanently\"\n\n* tag \u0027efi-fixes-for-v7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:\n x86/efi: defer freeing of boot services memory\n" }, { "commit": "014441d1e4b2f5be728433b761df3377dee7a487", "tree": "7b97a45eee4f95d7fd76f185c05773b5f4199206", "parents": [ "c23719abc3308df7ed3ad35650ad211fb2d2003d", "cfc69c2e6c699c96949f7b0455195b0bfb7dc715" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 10:17:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 08 10:17:05 2026 -0700" }, "message": "Merge tag \u0027i2c-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fix from Wolfram Sang:\n \"A revert for the i801 driver restoring old locking behaviour\"\n\n* tag \u0027i2c-for-7.0-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: i801: Revert \"i2c: i801: replace acpi_lock with I2C bus lock\"\n" }, { "commit": "c23719abc3308df7ed3ad35650ad211fb2d2003d", "tree": "22b3f400be548bd88c368bfe6e5afcf77334fd36", "parents": [ "6ff1020c2f7b5593b916afbc87a835371ab1d51b", "b5ef09a77d0b5213268300eedd8a7d28b4e92d47" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:12:06 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:12:06 2026 -0800" }, "message": "Merge tag \u0027x86-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix SEV guest boot failures in certain circumstances, due to\n very early code relying on a BSS-zeroed variable that isn\u0027t\n actually zeroed yet an may contain non-zero bootup values\n\n Move the variable into the .data section go gain even earlier\n zeroing\n\n - Expose \u0026 allow the IBPB-on-Entry feature on SNP guests, which\n was not properly exposed to guests due to initial implementational\n caution\n\n - Fix O\u003d build failure when CONFIG_EFI_SBAT_FILE is using relative\n file paths\n\n - Fix the various SNC (Sub-NUMA Clustering) topology enumeration\n bugs/artifacts (sched-domain build errors mostly).\n\n SNC enumeration data got more complicated with Granite Rapids X\n (GNR) and Clearwater Forest X (CWF), which exposed these bugs\n and made their effects more serious\n\n - Also use the now sane(r) SNC code to fix resctrl SNC detection bugs\n\n - Work around a historic libgcc unwinder bug in the vdso32 sigreturn\n code (again), which regressed during an overly aggressive recent\n cleanup of DWARF annotations\n\n* tag \u0027x86-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/entry/vdso32: Work around libgcc unwinder bug\n x86/resctrl: Fix SNC detection\n x86/topo: Fix SNC topology mess\n x86/topo: Replace x86_has_numa_in_package\n x86/topo: Add topology_num_nodes_per_package()\n x86/numa: Store extra copy of numa_nodes_parsed\n x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths\n x86/sev: Allow IBPB-on-Entry feature for SNP guests\n x86/boot/sev: Move SEV decompressor variables into the .data section\n" }, { "commit": "6ff1020c2f7b5593b916afbc87a835371ab1d51b", "tree": "f89f7c9c492defc6dc9e8dfaec8bb9d4d2d434a9", "parents": [ "b1b9a9d0b5c875decbc129c16c6e827fb50489a5", "e48a869957a70cc39b4090cd27c36a86f8db9b92" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:09:15 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:09:15 2026 -0800" }, "message": "Merge tag \u0027timers-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Make clock_adjtime() syscall timex validation slightly more permissive\n for auxiliary clocks, to not reject syscalls based on the status field\n that do not try to modify the status field.\n\n This makes the ABI behavior in clock_adjtime() consistent with\n CLOCK_REALTIME\"\n\n* tag \u0027timers-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n timekeeping: Fix timex status validation for auxiliary clocks\n" }, { "commit": "b1b9a9d0b5c875decbc129c16c6e827fb50489a5", "tree": "d45ef819e05900f9e18f6e5a54d5171c1ecd171c", "parents": [ "1954c4f012206147c34acda8da04f827aa7d3ee3", "d658686a1331db3bb108ca079d76deb3208ed949" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:07:13 2026 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 17:07:13 2026 -0800" }, "message": "Merge tag \u0027sched-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull scheduler fix from Ingo Molnar:\n \"Fix a DL scheduler bug that may corrupt internal metrics during PI and\n setscheduler() syscalls, resulting in kernel warnings and misbehavior.\n\n Found during stress-testing\"\n\n* tag \u0027sched-urgent-2026-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting\n" }, { "commit": "1954c4f012206147c34acda8da04f827aa7d3ee3", "tree": "49d682b2b3865d8758fa30926ed55d839e97f75d", "parents": [ "3b5d535c635cbf88dbb63231cbae265b22e6a5f5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Mar 07 20:07:15 2026 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 07 15:03:14 2026 -0800" }, "message": "eventpoll: Convert epoll_put_uevent() to scoped user access\n\nSaves two function calls, and one stac/clac pair.\n\nstac/clac is rather expensive on older cpus like Zen 2.\n\nA synthetic network stress test gives a ~1.5% increase of pps\non AMD Zen 2.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Christophe Leroy \u003cchristophe.leroy@csgroup.eu\u003e\nCc: Dave Hansen \u003cdave.hansen@intel.com\u003e\nCc: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ], "next": "3b5d535c635cbf88dbb63231cbae265b22e6a5f5" }